6 ms·
If there are any Europeans here, I'd love to make my vulnerability database that's accumulated from all linux security trackers and the CVE/NVD open source if I
by cookiengineer 2y ago
If there are any Europeans here, I'd love to make my vulnerability database that's accumulated from all linux security trackers and the CVE/NVD open source if I can manage to find some folks who'd help with maintenance.
Currently hosting costs are unclear, but it should be doable if we offer API access for like 5 bucks / month for private and 100 / month for corporate or similar.
Already did a backup of the NVD in the last couple hours, currently backing up the security trackers and OVAL feeds.
Gonna need some sleep now, it's morning again.
My project criteria:
- hosting within the EU
- must have a copyleft license (AGPL)
- must have open source backend and frontend
- dataset size is around 90-148 GB (compressed vs uncompressed)
- ideally an e.V. for managing funds and costs, so it can survive me
- already built my vulnerability scraper in Go, would contribute it under AGPL
- already built all schema parsers, would contribute them also under AGPL
- backend and frontend needs to be built
- would make it prerendered, so that cves can be static HTML files that can be hosted on a CDN
- needs submission/PoC/advisory web forms and database/workflow for it
- data is accumulated into a JSON format (sources are mixed non standard formats for each security tracker. Enterprise distros use odata or oval for the most parts)
If you are interested, write me on linkedin.com/in/cookiengineer or here.
- weinzierl 2y agoTry to talk to the people from the Sovereign Tech Fund, they have a history of sponsoring security relevant projects in the EU.
- jauco 2y agoAnd maybe the sidn fund?
- decide1000 2y agoNlnet for opensource
- Sander_Marechal 2y agoYes, maybe reach out to Michiel Leenaars from the NLNet foundation. But IIRC NLNet mostly funds shorter development tracks, not ongoing upkeep/maintenance.
- NekkoDroid 2y ago> Sovereign Tech Fund It's actually been upgraded to the Sovereign Tech Agency now
- deleted 2y ago[deleted]
- f_devd 2y agoMaybe something to bring up to one of these e.V.'s if it ends up being difficult to get started: Codeberg.org, nlnet.nl, ccc.de
- tagyro 2y ago+1 for ccc.de
- cookiengineer 2y agoCodeberg might be a nice cooperation partner for hosting the git repositories. Gonna write them! I'm also visiting the local CCC chapters here this week, maybe it makes sense to have a separate e.V. where the CCC chapters are beneficiaries?
- greenRust 2y agoGreat idea. I'm interested in helping. I'll dm you.
- Ucalegon 2y agoThe EU should just buy MITRE. Move it to the EU and make it a EU based project.
- panny 2y agoThis would be hilarious. That would be a good thumb in the eye to the current administration who complained long and loud about how Obama let ICANN leave US possession. Just imagine the campaign commercials in 2026, >The POTUS transferred our cyber defenses to the EU Ouch
- rob74 2y agoWell, that's kind of the point? The current administration doesn't care about cyber defense, any less than it cares about protecting the environment, protecting consumers, having top-notch universities and research, foreign aid etc. etc. Actually, it takes pride in not caring about all of these things.
- Ucalegon 2y agoNot to mention the administration aren't going to be held accountable for, or actually be impacted by, the harms that come for their actions.
- rocqua 2y agoMy guess is that they feel they are supplying something the whole world is benefiting from, and they believe that unfair. That ignores the fact that the US benefits immensely from this, and that they benefit domestically from providing that benefit more widely by getting a lot of free contributions from the outside. But the US foots the bill of those who do get payed, so its unfair...
- fragmede 2y agoIt's so unfair that I have an great job so I can treat my friends to dinner all the time! I hate being rich.
- JimBlackwood 2y agoI’m interested to help! I added you on LinkedIn, so will message there after you accept. :)
- juicyyy 2y agoIm also interested in helping
- anontrot 2y agoTry if you can find some help here https://openssf.org/ https://openssf.org/
- wustus 2y agoDepending on deployment strategy I could help with Kubernetes stuff.
- sneak 2y agoThe AGPL is a nonfree (and nonsensical) license. There’s nothing wrong with normal GPL.
- deleted 2y ago[deleted]
- lifthrasiir 2y agoIs there a non-free license approved by FSF and OSI and compatible with DFSG?
- deleted 2y ago[deleted]
- goodpoint 2y agoThere are already many security trackers, why writing a new one? The issue is paying people to handle the advisories.
- cookiengineer 2y agoI agree with you there. Before CISA got sacked / taken down, they were working together with the BSI and other CERT agencies on a vulnerability exchange format. This might be the optimum time to implement CSAF and to lead by example when it comes to vulnerability disclosures.
- harrisi 2y agoI'm not European but I'd love to help.
- mwe-dfn 2y agoThe European, GDPR compliant subnet of the Internet Computer could suit your needs. The app would be decentralized out of the box and it can't be shut down by a single entity like a traditional cloud provider or nation state. Hosting 100GB costs about 500$ per year [0]. This is not a traditional hosting provider, it's a decentralized cloud. Reach out on the forum [1] or to me if this sounds like a good fit to you (I think it does, from your list of requirements). [0] https://internetcomputer.org/docs/building-apps/essentials/cost-estimations-and-examples#icp-pricing-calculator https://internetcomputer.org/docs/building-apps/essentials/c... [1] https://forum.dfinity.org/ https://forum.dfinity.org/
- immibis 2y agoOr just use a normal host where hosting 100GB costs about $60.00 per year.
- vachina 2y agoMy 4TiB seedbox at home costs $5 in electricity.
- mwe-dfn 2y agoAs mentioned in the response to the sibling, I am not just talking about hosting the data, but also running the app. Ofc, with a lot of traffic the running costs would increase. The reason for the higher price is that both data and running software is redundant and decentralized by design - no need to configure anything.
- f_devd 2y agoSeems way overkill & unnecessary. Wouldn't the e.V. (foundation) especially with FOSS backend/frontend already ensure continued operation? Also if it's about redudancy/resilience it seems like good ol' torrent/ipfs or even a dedicated dht (if you really want to have fast updated content) would be much more efficient.
- mwe-dfn 2y ago>FOSS backend/frontend That phrase does not address where and how to host data and run software, and while I think an e.V. would be a great idea, it also does doesn't address it. So these concerns seem orthogonal to my input. The IC Protocol is indeed about redundancy and resilience, but also about sovereignty and security, and it does not just host data (like torrents) but also runs software in a verifiable way (in particular, for every message you get from a dapp on the ICP, you get a certificate that proves that the majority of nodes in the subnet agree on the result). In a nutshell, it's a platform that gives you many guarantees (security, redundancy, sovereignty) out of the box - as opposed to classical solutions which have to be composed of many different building blocks that need to be orchestrated to work together.
- tecleandor 2y ago(Spain, doing storage and web hosting) What usually worries me the most is the administrative or management part, which I don't know how big would be for this project...
- senda 2y agomessaged on linkedin fyi
- lars_francke 2y agoHonest question: Does this not already exist? - https://vulnerability.circl.lu/ https://vulnerability.circl.lu/ - https://osv.dev/ https://osv.dev/ - https://vuldb.com/ https://vuldb.com/ And a few others?
- cookiengineer 2y agoOSV is made by Google/Alphabet and therefore also prone to Trump intervention (see Gulf of Mexico executive order). The circl.lu might be actually a potential cooperation partner. (Vuldb is down right now)
- SSLy 2y agoyou've slept just 3 hours? Go back to bed..
- kiru_io 2y agoMaybe just a toilet break (see the bio): > Fun fact: All my comments have been written on the toilet. I don't use social media anywhere else.
- biorach 2y agohttps://xkcd.com/1369/ https://xkcd.com/1369/
- cookiengineer 2y agoYep, toilet and now back to bed :D
- ljm 2y agoTaking TDD to a level it’s never been before
- JCharante 2y agohmm? it's already daytime in Europe where he's located
- mitjam 2y agoThe main costs definitely not hosting and can be quite significant. MITRE had $2.37B revenue in 2023, most if it contributions. I don't know how much of it can be attributed to the CVE, but I assume it's not an insignificant part of it: https://projects.propublica.org/nonprofits/organizations/42239742 https://projects.propublica.org/nonprofits/organizations/422...
- hypercube33 2y agoI would email someone like Patch My PC they seem good stewards of stuff open source from my vague looking and they are good people. They may just host a clone of it that's open.
- newsclues 2y agoWhy EU? Canada may be another friendly option
- deleted 2y ago[deleted]
- com 2y agoCanada’s been described as the Ukraine of North America. Let’s not site global critical infrastructure within 150km of US land borders for a generation, please.
- jetster735180 2y agoI don't believe I've heard that before. As a Canadian, I can confirm it's nothing like what's happening in Ukraine.
- stereu 2y ago[dead]
- sberder 2y agoLooks like some people are already getting things moving: https://www.thecvefoundation.org/ https://www.thecvefoundation.org/
- worthless-trash 2y agoSome cnas may also submit. Is this something you are open to?
- dev_l1x_be 2y agoWe should host it and collect membership fee from people who need this data. This way we can make it resilient against lack of government support. I would love to pay 5-10EUR/month to use such a service.
- deleted 2y ago[deleted]