8 ms·

The contract with MITRE has been extended. https://www.forbes.com/sites/kateoflahertyuk/2025/04/16/cve-program-funding-cut-what-it-means-and-what-to-do-next/ h

The contract with MITRE has been extended. https://www.forbes.com/sites/kateoflahertyuk/2025/04/16/cve-program-funding-cut-what-it-means-and-what-to-do-next/ https://www.forbes.com/sites/kateoflahertyuk/2025/04/16/cve-... My guess indefinitely. DOGE might be a bunch of idiots, but in the entire DOD, there are non-idiots.

metalliqaz 1y ago
[flagged]
- lenerdenator 1y ago
  [flagged]
  - fennecfoxy 1y ago
    Hasn't that always been the case for society at large? From Wernher Von Braun to Oppenheimer.
  - xpe 1y ago
    > Malicious idiots surrounded by sheepish intelligent people. Prefixing people with "sheepish intelligent" is bound to oversimplify this. Many of the non-DOGE employees who directly see wrongdoing are likely making calculated decisions on what to do. It depends on many factors, including the law and whistleblower protections. Many of them are responding in various ways that they hope will have an impact. Some resign in protest. Others file lawsuits. Others leak to the press. Could they do more? Yes. So let's help them. What can we do? Just to give two relatively middle-of-the-ground recommendations: First, donate to legal-protection funds for whistleblowers. Second, call your representatives and demand reinstatement of the inspectors general.
    - lenerdenator 1y ago
      The current administration is shipping people out of American territory to a hellhole in El Salvador without trial. It'd like to do that more often. Whistleblower protections don't mean much if the brute squad snatches you off the street and throws you on a plane regardless of what the law says.
      - xpe 1y ago
        > Whistleblower protections don't mean much if the brute squad snatches you off the street and throws you on a plane regardless of what the law says. Activism isn't either/or; do what you think is best!
- tomrod 1y ago
  [flagged]
tlogan 1y ago
My guess is that they’ll be phased out next year. The long-term goal seems to be transitioning the CVE program into something more like an industry-led consortium. (If you did not notice they operate zero budgeting approach: cut everything and if something is very important reverse it. But you cut first and then ask questions.) It’s worth noting that MITRE is a DoD contractor (with minor contracts from other agencies like this one). Having the CVE program operated by a company funded by the U.S. military raises valid concerns about conflicts of interest—especially in an ecosystem that depends on neutrality and global trust.
- nxobject 1y ago
  I’m a little hesitant to trust a CVE database operated by private industry on the grounds of conflict of interest for that reason, too.
  - ThinkBeat 1y ago
    I am quite hesitant to trust the DOD to keep track of software vulnerabilities. Some parts are developing and exploiting vulnerabilities. And given a fresh feed of what people find, and usually a delay from notification until publication, which may sometimes just be a bit longer of a delay, would allow the DOD to weaponize the vulnerability for their own use as well.
    - j16sdiz 1y ago
      CVE Numbering Authorities (CNA) have lots of control over those.
    - derektank 1y ago
      This contract is funded by CISA, which is an agency within the Department of Homeland Security, not DoD. As far as I'm aware, there are no components of DHS with Title 10 or Title 50 authorities to conduct cyber operations, unless you count the Coast Guard but they normally operate under Title 14. So there really should be no conflicts of interest as no one in the DHS is authorized to exploit vulnerabilities as part of cyber operations.
lynndotpy 1y ago
[flagged]
- EgregiousCube 1y ago
  A bit disingenuous; he also had a career as a soldier.
  - lynndotpy 1y ago
    Ok, and he is not someone you should rely on to make exclusively good decisions.
  - bclemens 1y ago
    Of course! It's easy to forget he was a guard at one of America's most notorious concentration camps, Guantanamo Bay. It's foolish to think of him only as a Fox News personality.
    - typesarecool 1y ago
      Not defending him as a person, but he earned a bronze star serving in Iraq.
      - boston_clone 1y ago
        [flagged]
        gonzoflip 1y ago
        "automatically" Do you have any evidence for this at all? That they are automatically awarded? We can discuss the low bar that O's seemingly have for earning some awards, but there is no reason to misrepresent the process. And I know at least one person that was awarded a Bronze Star without the V, even thought the award was for a specific valiant action they took, it's tough to say without reading the award or being there.
stronglikedan 1y ago
[flagged]
- deleted 1y ago
  [deleted]
- PaulDavisThe1st 1y ago
  Opinions vary widely on whether that is the case.
- i80and 1y ago
  I don't know if this is a Poe's Law situation or not, so apologies if this is a satirical bit, but I'm horrified by the idea that you may be serious.
  - knowaveragejoe 1y ago
    No, see, they're doing things and doing things is Good. Therefore progress is being made, and the country is being made incrementally better.
    - RankingMember 1y ago
      Poe's Law overflow detected
- WD-42 1y ago
  Better for who exactly? Malware authors?
- nashashmi 1y ago
  Actually idiots could still end up make improvements. Won’t stop them from being idiots. But what the commenter is saying is the ones who recklessly cut programs trashing away all the effort that went into the program are idiots. They are trying to make a thriving government have a reputation for failure and unreliability.
- benregenspan 1y ago
plasma_beam 1y ago
It doesn't appear to have posted to FPDS yet: https://www.fpds.gov/ezsearch/fpdsportal?q=PIID%3A%2270RCSJ24FR0000018%22&templateName=1.5.3&indexName=awardfull&x=0&y=0&sortBy=SIGNED_DATE&desc=Y https://www.fpds.gov/ezsearch/fpdsportal?q=PIID%3A%2270RCSJ2... The contract expired today, but had an option period through March of 2026. DHS just needed to exercise the option. Edit: Note the contract ended today April 16 - so performance would stop midnight tonight if the option wasn't exercised. Government contracts routinely go down to the wire like this, and often are late getting exercised. Why the uproar over this one? Did CISA signal to MITRE that they weren't going to exercise the option?
- marcusb 1y ago
  > Did CISA signal to MITRE that they weren't going to exercise the option? An internal letter sent to CVE board members was making the rounds yesterday warning the current contract ("contracting pathway") would expire. The letter was authenticated by Brian Krebs[0]. Once Krebs authenticated the letter, people more or less assumed CISA was pulling funding, at least based on the infosec social media posts I saw. CISA officials responded to multiple media inquiries (including the OP) with a statement that more directly said the contract would expire: Although CISA’s contract with the MITRE Corporation will lapse after April 16, we are urgently working to mitigate impact and to maintain CVE services on which global stakeholders rely.[1] 0 - https://krebsonsecurity.com/2025/04/funding-expires-for-key-cyber-vulnerability-database/ https://krebsonsecurity.com/2025/04/funding-expires-for-key-... 1 - https://www.csoonline.com/article/3963190/cve-program-faces-swift-end-after-dhs-fails-to-renew-contract-leaving-security-flaw-tracking-in-limbo.html https://www.csoonline.com/article/3963190/cve-program-faces-...
andreygrehov 1y ago
But the article says, quote: > It’s unclear what led to DHS’s decision to end the contract after 25 years and then suddenly it gets extended. What does it have to do with DOGE?
- KingLancelot 1y ago
  [dead]
- marcusb 1y ago
  MITRE has been hit with DOGE-branded cuts[0] earlier this month. CISA has been impacted[1]. It seems reasonable to assume they were involved in this. 0 - https://virginiabusiness.com/nova-govcon-firm-mitre-to-lay-off-442-employees-after-doge-cuts-contracts/ https://virginiabusiness.com/nova-govcon-firm-mitre-to-lay-o... 1 - https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-staffers-amid-ongoing-federal-cuts/?guccounter=1 https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st...
  - andreygrehov 1y ago
    That’s a pretty big leap. Ending a 25-year contract and laying off ~600 employees are two very different scales of impact. While DOGE-related cuts might have influenced some decisions, assuming they directly caused DHS to initially let the CVE contract lapse seems like a stretch. Just because two things happen near each other doesn’t mean one caused the other - this feels more like another chance to take a swing at DOGE, since that’s the bandwagon everyone’s riding right now.
    - marcusb 1y ago
      Yes, imagining that the quasi-government organization that is solely tasked with cutting spending might have cut spending at an agency where they are currently cutting spending is a “huge leap.” What was I thinking?
      - andreygrehov 1y ago
deleted 1y ago
[deleted]
dang 1y ago
Thanks. It's always a puzzle what to do with threads based on articles that have since been superseded by later developments. Do we start a new thread based on a new article? The new article / thread usually fails to do very well, partly because there just was a big discussion, and partly because hearing about something getting fixed is less interesting and exciting than the original stimulus. I've been playing recently with putting [fixed] at the end of the original title to indicate this sort of state change to the reader. Not sure if that's the best way, nor if the situation has genuinely been fixed or not, but I guess it's better than nothing. Swapping out the article and title would probably be too much of a rug pull on the existing thread.
- dang 1y ago
  Previous examples of this for anyone curious: NIH.gov DNS servers down, making PubMed, BLAST, etc. unreachable [fixed] - https://news.ycombinator.com/item?id=43229201 https://news.ycombinator.com/item?id=43229201 - March 2025 (385 comments) Mozilla site down due to "overdue hosting payments" [fixed] - https://news.ycombinator.com/item?id=43226089 https://news.ycombinator.com/item?id=43226089 - March 2025 (102 comments) Ask HN: Stripe Atlas messed up my 83B election what do I do? [fixed] - https://news.ycombinator.com/item?id=40825802 https://news.ycombinator.com/item?id=40825802 - June 2024 (3 comments)
- ethbr1 1y ago
  Maybe [updated] as a more neutral term to indicate post-submission change?
  - dang 1y ago
    Ok! Updated above.

metalliqaz 1y ago

[flagged]

lenerdenator 1y ago
[flagged]
- fennecfoxy 1y ago
  Hasn't that always been the case for society at large? From Wernher Von Braun to Oppenheimer.
- xpe 1y ago
  > Malicious idiots surrounded by sheepish intelligent people. Prefixing people with "sheepish intelligent" is bound to oversimplify this. Many of the non-DOGE employees who directly see wrongdoing are likely making calculated decisions on what to do. It depends on many factors, including the law and whistleblower protections. Many of them are responding in various ways that they hope will have an impact. Some resign in protest. Others file lawsuits. Others leak to the press. Could they do more? Yes. So let's help them. What can we do? Just to give two relatively middle-of-the-ground recommendations: First, donate to legal-protection funds for whistleblowers. Second, call your representatives and demand reinstatement of the inspectors general.
  - lenerdenator 1y ago
    The current administration is shipping people out of American territory to a hellhole in El Salvador without trial. It'd like to do that more often. Whistleblower protections don't mean much if the brute squad snatches you off the street and throws you on a plane regardless of what the law says.
    - xpe 1y ago
      > Whistleblower protections don't mean much if the brute squad snatches you off the street and throws you on a plane regardless of what the law says. Activism isn't either/or; do what you think is best!
tomrod 1y ago
[flagged]

tlogan 1y ago

My guess is that they’ll be phased out next year. The long-term goal seems to be transitioning the CVE program into something more like an industry-led consortium. (If you did not notice they operate zero budgeting approach: cut everything and if something is very important reverse it. But you cut first and then ask questions.) It’s worth noting that MITRE is a DoD contractor (with minor contracts from other agencies like this one). Having the CVE program operated by a company funded by the U.S. military raises valid concerns about conflicts of interest—especially in an ecosystem that depends on neutrality and global trust.

nxobject 1y ago
I’m a little hesitant to trust a CVE database operated by private industry on the grounds of conflict of interest for that reason, too.
- ThinkBeat 1y ago
  I am quite hesitant to trust the DOD to keep track of software vulnerabilities. Some parts are developing and exploiting vulnerabilities. And given a fresh feed of what people find, and usually a delay from notification until publication, which may sometimes just be a bit longer of a delay, would allow the DOD to weaponize the vulnerability for their own use as well.
  - j16sdiz 1y ago
    CVE Numbering Authorities (CNA) have lots of control over those.
  - derektank 1y ago
    This contract is funded by CISA, which is an agency within the Department of Homeland Security, not DoD. As far as I'm aware, there are no components of DHS with Title 10 or Title 50 authorities to conduct cyber operations, unless you count the Coast Guard but they normally operate under Title 14. So there really should be no conflicts of interest as no one in the DHS is authorized to exploit vulnerabilities as part of cyber operations.

lynndotpy 1y ago

[flagged]

EgregiousCube 1y ago
A bit disingenuous; he also had a career as a soldier.
- lynndotpy 1y ago
  Ok, and he is not someone you should rely on to make exclusively good decisions.
- bclemens 1y ago
  Of course! It's easy to forget he was a guard at one of America's most notorious concentration camps, Guantanamo Bay. It's foolish to think of him only as a Fox News personality.
  - typesarecool 1y ago
    Not defending him as a person, but he earned a bronze star serving in Iraq.
    - boston_clone 1y ago
      [flagged]
      - gonzoflip 1y ago
        "automatically" Do you have any evidence for this at all? That they are automatically awarded? We can discuss the low bar that O's seemingly have for earning some awards, but there is no reason to misrepresent the process. And I know at least one person that was awarded a Bronze Star without the V, even thought the award was for a specific valiant action they took, it's tough to say without reading the award or being there.

stronglikedan 1y ago

[flagged]

deleted 1y ago
[deleted]
PaulDavisThe1st 1y ago
Opinions vary widely on whether that is the case.
i80and 1y ago
I don't know if this is a Poe's Law situation or not, so apologies if this is a satirical bit, but I'm horrified by the idea that you may be serious.
- knowaveragejoe 1y ago
  No, see, they're doing things and doing things is Good. Therefore progress is being made, and the country is being made incrementally better.
  - RankingMember 1y ago
    Poe's Law overflow detected
WD-42 1y ago
Better for who exactly? Malware authors?
nashashmi 1y ago
Actually idiots could still end up make improvements. Won’t stop them from being idiots. But what the commenter is saying is the ones who recklessly cut programs trashing away all the effort that went into the program are idiots. They are trying to make a thriving government have a reputation for failure and unreliability.
benregenspan 1y ago

plasma_beam 1y ago

It doesn't appear to have posted to FPDS yet: https://www.fpds.gov/ezsearch/fpdsportal?q=PIID%3A%2270RCSJ24FR0000018%22&templateName=1.5.3&indexName=awardfull&x=0&y=0&sortBy=SIGNED_DATE&desc=Y https://www.fpds.gov/ezsearch/fpdsportal?q=PIID%3A%2270RCSJ2... The contract expired today, but had an option period through March of 2026. DHS just needed to exercise the option. Edit: Note the contract ended today April 16 - so performance would stop midnight tonight if the option wasn't exercised. Government contracts routinely go down to the wire like this, and often are late getting exercised. Why the uproar over this one? Did CISA signal to MITRE that they weren't going to exercise the option?

marcusb 1y ago
> Did CISA signal to MITRE that they weren't going to exercise the option? An internal letter sent to CVE board members was making the rounds yesterday warning the current contract ("contracting pathway") would expire. The letter was authenticated by Brian Krebs[0]. Once Krebs authenticated the letter, people more or less assumed CISA was pulling funding, at least based on the infosec social media posts I saw. CISA officials responded to multiple media inquiries (including the OP) with a statement that more directly said the contract would expire: Although CISA’s contract with the MITRE Corporation will lapse after April 16, we are urgently working to mitigate impact and to maintain CVE services on which global stakeholders rely.[1] 0 - https://krebsonsecurity.com/2025/04/funding-expires-for-key-cyber-vulnerability-database/ https://krebsonsecurity.com/2025/04/funding-expires-for-key-... 1 - https://www.csoonline.com/article/3963190/cve-program-faces-swift-end-after-dhs-fails-to-renew-contract-leaving-security-flaw-tracking-in-limbo.html https://www.csoonline.com/article/3963190/cve-program-faces-...

andreygrehov 1y ago

But the article says, quote: > It’s unclear what led to DHS’s decision to end the contract after 25 years and then suddenly it gets extended. What does it have to do with DOGE?

KingLancelot 1y ago
[dead]
marcusb 1y ago
MITRE has been hit with DOGE-branded cuts[0] earlier this month. CISA has been impacted[1]. It seems reasonable to assume they were involved in this. 0 - https://virginiabusiness.com/nova-govcon-firm-mitre-to-lay-off-442-employees-after-doge-cuts-contracts/ https://virginiabusiness.com/nova-govcon-firm-mitre-to-lay-o... 1 - https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-staffers-amid-ongoing-federal-cuts/?guccounter=1 https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st...
- andreygrehov 1y ago
  That’s a pretty big leap. Ending a 25-year contract and laying off ~600 employees are two very different scales of impact. While DOGE-related cuts might have influenced some decisions, assuming they directly caused DHS to initially let the CVE contract lapse seems like a stretch. Just because two things happen near each other doesn’t mean one caused the other - this feels more like another chance to take a swing at DOGE, since that’s the bandwagon everyone’s riding right now.
  - marcusb 1y ago
    Yes, imagining that the quasi-government organization that is solely tasked with cutting spending might have cut spending at an agency where they are currently cutting spending is a “huge leap.” What was I thinking?
    - andreygrehov 1y ago

deleted 1y ago

[deleted]

dang 1y ago

Thanks. It's always a puzzle what to do with threads based on articles that have since been superseded by later developments. Do we start a new thread based on a new article? The new article / thread usually fails to do very well, partly because there just was a big discussion, and partly because hearing about something getting fixed is less interesting and exciting than the original stimulus. I've been playing recently with putting [fixed] at the end of the original title to indicate this sort of state change to the reader. Not sure if that's the best way, nor if the situation has genuinely been fixed or not, but I guess it's better than nothing. Swapping out the article and title would probably be too much of a rug pull on the existing thread.

dang 1y ago
Previous examples of this for anyone curious: NIH.gov DNS servers down, making PubMed, BLAST, etc. unreachable [fixed] - https://news.ycombinator.com/item?id=43229201 https://news.ycombinator.com/item?id=43229201 - March 2025 (385 comments) Mozilla site down due to "overdue hosting payments" [fixed] - https://news.ycombinator.com/item?id=43226089 https://news.ycombinator.com/item?id=43226089 - March 2025 (102 comments) Ask HN: Stripe Atlas messed up my 83B election what do I do? [fixed] - https://news.ycombinator.com/item?id=40825802 https://news.ycombinator.com/item?id=40825802 - June 2024 (3 comments)
ethbr1 1y ago
Maybe [updated] as a more neutral term to indicate post-submission change?
- dang 1y ago
  Ok! Updated above.