5 ms·

My guess is that they’ll be phased out next year. The long-term goal seems to be transitioning the CVE program into something more like an industry-led consorti

by tlogan 2y ago

My guess is that they’ll be phased out next year. The long-term goal seems to be transitioning the CVE program into something more like an industry-led consortium. (If you did not notice they operate zero budgeting approach: cut everything and if something is very important reverse it. But you cut first and then ask questions.) It’s worth noting that MITRE is a DoD contractor (with minor contracts from other agencies like this one). Having the CVE program operated by a company funded by the U.S. military raises valid concerns about conflicts of interest—especially in an ecosystem that depends on neutrality and global trust.

nxobject 2y ago
I’m a little hesitant to trust a CVE database operated by private industry on the grounds of conflict of interest for that reason, too.
- ThinkBeat 2y ago
  I am quite hesitant to trust the DOD to keep track of software vulnerabilities. Some parts are developing and exploiting vulnerabilities. And given a fresh feed of what people find, and usually a delay from notification until publication, which may sometimes just be a bit longer of a delay, would allow the DOD to weaponize the vulnerability for their own use as well.
  - j16sdiz 2y ago
    CVE Numbering Authorities (CNA) have lots of control over those.
  - derektank 2y ago
    This contract is funded by CISA, which is an agency within the Department of Homeland Security, not DoD. As far as I'm aware, there are no components of DHS with Title 10 or Title 50 authorities to conduct cyber operations, unless you count the Coast Guard but they normally operate under Title 14. So there really should be no conflicts of interest as no one in the DHS is authorized to exploit vulnerabilities as part of cyber operations.
  - ygjb 2y ago
    This illustrates a misunderstanding of how CVE functions. It's a repository of data about disclosed vulnerabilities (even if some disclosures are embargoed and not yet published - if anyone but the bughunter and dev team that owns the fix knows about it, it's disclosed :P). The actual vulnerability discovery process is external and done by individual researchers, teams and businesses who report vulnerabilities to the appropriate groups called CVE numbering authorities (CNA) who manage the assignment and publication of CVE data through their scopes. There is not much technical advantage in terms of advance disclosure since the CNA controls what data goes to CVE. As an example, a CNA like Mozilla, Apple, or Microsoft is unlikely to disclose vulnerability data via CVE until they have remediated the issue or have public guidance, and their embargo processes are likely separate from CVE publication.
- tylermw 2y ago
  MITRE is a Federally Funded Research and Development Center (FFRDC), which is a distinct type of federal contractor with strict conflict of interest regulations. They are owned by the federal government, but operated by contractors and are specifically structured and regulated to minimize conflicts of interest, so are distinct from "private industry" in many regards. You can read a congressional report by the CRS describing FFRDCs and their role here: https://www.congress.gov/crs-product/R44629 https://www.congress.gov/crs-product/R44629.
  - guerrilla 2y ago
    They were talking about AFTER that when it is privatized. That's what the comment they're responding to was talking about, not it's current state.
  - stonogo 2y ago
    MITRE is absolutely not an FFRDC. It's a regular old 501(c)(3) which happens to manage FFRDCs.
    - tylermw 2y ago
      Yes, you are correct, I should have typed "runs". But the point is that MITRE runs the U.S. National Cybersecurity FFRDC that maintains the CVE system, and FFRDCs are deliberately structured to minimize potential conflicts of interest (GP comment) and are definitely distinct from private industry (parent comment).
      - deleted 2y ago
        [deleted]
- derefr 2y ago
  I'm the opposite — and I think this might be the "4D chess"† interpretation of this move as well. In peacetime, I think everyone is generally alright with something centralized like the CVE database. But in what increasingly seems like the lead-up to wartime... I'm hesitant to trust a CVE database operated or funded unilaterally by a single government — or even multilaterally, if the governments are all ones that all would end up on the same side of a hot war. (Why? Strategic censorship of reports while the DB's patron takes advantage of the exploit, for one. Such a database becoming a high-priority cyberwar target, for another. Strategic wasting of enemy cybersecurity resources with false announcements, for a third.) IMHO, the ideal form for the organization managing CVE, is one analogous to IANA and its Regional Internet Registries (RIRs). IANA slices up the keyspace of IPs to assign to RIRs, and arbitrates disputes — but both at such a high level that their work is effectively in a de-facto state of "done until something comes up". The RIRs do all the actual everyday work. This means that in a hot war that different RIRs end up on opposing sides of, where at least some of the RIRs can no longer trust the ownership of IANA to act in their best interests, the RIRs can just ignore IANA for a while, and keep on doing their own thing (managing allocations from their previously-agreed parts of the IP keyspace), and everything will still work. And RIRs that control parts of IP space contended over by opposed states? They can just be split up, under obvious rules (every current allocation goes to the sub-RIR associated with the state that controls the gov/mil/corp/org entity currently holding that allocation.) That's not the case with the CVE database under its current ownership. There's no established way to namespace it, no obvious way to split it up and keep it all working. And I think that this problem would be obvious to the DoD. Which is precisely why paying to host a single-source-of-truth CVE database loses its lustre when that same DoD is aware that such a split might soon have to happen. --- † I dislike the term "4D chess", because it implies one chess master who's really good at predicting non-obvious outcomes — rather than an entire military-industrial-complex acting as "see something, say something" inputs to an intelligence apparatus that does a lot of hard work and simulation analyzing potential outcomes, to produce easily-digested suggestions and action items. There just needs to be one guy in the Pentagon / the military / wherever, who realized this and sent a (classified MILNET) email about it.
  - zeebeeblebrox 2y ago
    [dead]
- cortesoft 2y ago
  You aren’t worried about the conflict of interest with a government run system, given the desire of governments to be able to intercept all communication?
  - MiguelX413 2y ago
    No, particularly because CVE has no communications functionality.
    - cortesoft 2y ago
      My worry would be that a government might want to hide a particular vulnerability it has found that enables it to break into a system.
numbsafari 2y ago
... and that industry led consortium will have a board all paid princely sums, and an executive leadership team that is conflicted to the hilt and paid kingly sums, and they will charge exorbitant rents in order to keep the lighthouse lit. There's flaws with every approach, but I much prefer the approach where this sort of thing is treated as a public good, rather than as yet another soon-to-be walled garden.
- bunderbunder 2y ago
  I keep thinking of that time Wisconsin's state government privatized a bunch of IT stuff in the interest of "government efficiency", and the cost taxpayers paid for those specific functions increased by several hundred percent while quality of service went down. At that same time, though, I worked for a contractor that I do believe saved states money compared to doing things in-house. The work we did really required specialists. But no one state had enough of the work to keep one busy all year. So sharing a pool of people to do the work among many states meant there was room for both saving the states money and allowing some profit for the company. The idea that you can just blanket assume that private industry is inherently more efficient than public works really needs to die. There doesn't seem to be any more evidence to support it than there is to support the idea that it's inherently less efficient. Life just isn't that simple. It's all case by case.
  - dimitrios1 2y ago
    For every example of privatization going wrong, there's least one example (if not two) of it going right. But serious question -- what is the difference these days anyways? Our entire government is effectively privatized anyways from the local level up to the federal. We rely on contractors for almost everything that matters. We just maintain this facade that they are not privatized.
    - sollewitt 2y ago
      I’ve never seen one that worked long term. The basic premise is “what was done for $X dollars with no profit motive can be done for <$X dollars with profit motive doesn’t hold up - you make something private, it wants to make more profit. Just for the most ready to hand example for me, PG&E in SF vs public electricity utilities on the peninsula - the privatized electricity costs twice as much per kWh - and of course it does because the PG&E CEO needs to make $17M from somewhere, the share price needs to go up etc. the rich need to skim from the top, that makes the cost higher. If you have an essential industry the cynical play is to privatize to save cost, then do a bad job and then effectively make your losses public through bail-outs while still making profit.
jmull 2y ago
> The long-term goal seems to be... Where do you get that from? I've seen no sign of long-term goals, much less any mechanisms being put in place for follow-through on those goals. It seems like people keep making the mistake of believing there's a detailed plan, while all evidence tells us there isn't. I guess it's the normal human tendency to see order in the chaos.
- tlogan 2y ago
  Project 2025 lays out a clear vision for the privatization and decentralization of federal functions. It’s not subtle—it explicitly calls for it. Separate from whether we support this or not: Trump is doing—or promising to do—exactly what he said he would. We can disagree with the policies, but it’s not accurate to say he or his team are directionless or incompetent. They have a coherent (if controversial) agenda. So rather than dismissing them as clueless or idiots, it’s more productive to debate this: - Why is outsourcing CVE program to private consortia a bad idea? - Could a model exist where a private consortium is supported by federal grants, but maintains accountability and public interest safeguards?
  - chowchowchow 2y ago
    Actually Trump repeatedly said he didn't know about project 2025. He's so scattered in his campaigning that it's possible to pretty much justify any action as "what he said he would do." But saying executing project 2025 is exactly what he SAID he would do defies all reality. It may be what intelligent observers expected him to do but it is not what he said. Edit: good lord people I’m not defending Trump I’m saying he lies about everything including that he lied and said he wasn’t going to do project 2025. Read the post I’m responding to!
    - pstuart 2y ago
      > Actually Trump repeatedly said he didn't know about project 2025 * He said he'd end the war in a day. * He said he had a better health care plan. * He said he'd drop the price of eggs. * ... * He said lots of things that were not true.
agloe_dreams 2y ago
> Having the CVE program operated by a company funded by the U.S. military ...Yep, we're done as a democracy. Pack it up, boys. Edit: I know it is doom and gloom but the CVE program could easily delay information and leave holes on purpose.
absker 2y ago
MITRE is a non-profit company that operates Federally Funded Research and Development Centers (FFRDCs), which are owned and funded by the federal government and contracted out to companies like MITRE to operate them. While MITRE does have contracts with DoD (and many other agencies across the federal government as part of the FFRDCs they operate), they are not the same as a stereotypical DoD contractor as their non-profit status motivates them to work in the public interest.
jhelps 2y ago
I can see how govt funding was needed to help bootstrap the CVE program before people saw the value of it. But now that CVEs form the basis of a very lucrative ~$16b/year industry[0], wouldn't it make sense to let those companies take over? Privatizing the Internet enabled much more innovation than if it had stayed govt-funded. 0: https://www.grandviewresearch.com/industry-analysis/security-and-vulnerability-management-svm-market https://www.grandviewresearch.com/industry-analysis/security...
ottercan 2y ago
MITRE is not a DoD contractor. They are a not-for-profit institution committed to the public interest that operates six Federally Funded Research and Development Centers.
butterlover 2y ago
It’s probably more accurate to describe mitre as a publicly funded non profit operating for public benefit like the post office or PBS. It’s a stretch to describe it as an arm of the government.

by tlogan 2y ago

nxobject 2y ago

I’m a little hesitant to trust a CVE database operated by private industry on the grounds of conflict of interest for that reason, too.

ThinkBeat 2y ago
I am quite hesitant to trust the DOD to keep track of software vulnerabilities. Some parts are developing and exploiting vulnerabilities. And given a fresh feed of what people find, and usually a delay from notification until publication, which may sometimes just be a bit longer of a delay, would allow the DOD to weaponize the vulnerability for their own use as well.
- j16sdiz 2y ago
  CVE Numbering Authorities (CNA) have lots of control over those.
- derektank 2y ago
  This contract is funded by CISA, which is an agency within the Department of Homeland Security, not DoD. As far as I'm aware, there are no components of DHS with Title 10 or Title 50 authorities to conduct cyber operations, unless you count the Coast Guard but they normally operate under Title 14. So there really should be no conflicts of interest as no one in the DHS is authorized to exploit vulnerabilities as part of cyber operations.
- ygjb 2y ago
  This illustrates a misunderstanding of how CVE functions. It's a repository of data about disclosed vulnerabilities (even if some disclosures are embargoed and not yet published - if anyone but the bughunter and dev team that owns the fix knows about it, it's disclosed :P). The actual vulnerability discovery process is external and done by individual researchers, teams and businesses who report vulnerabilities to the appropriate groups called CVE numbering authorities (CNA) who manage the assignment and publication of CVE data through their scopes. There is not much technical advantage in terms of advance disclosure since the CNA controls what data goes to CVE. As an example, a CNA like Mozilla, Apple, or Microsoft is unlikely to disclose vulnerability data via CVE until they have remediated the issue or have public guidance, and their embargo processes are likely separate from CVE publication.
tylermw 2y ago
MITRE is a Federally Funded Research and Development Center (FFRDC), which is a distinct type of federal contractor with strict conflict of interest regulations. They are owned by the federal government, but operated by contractors and are specifically structured and regulated to minimize conflicts of interest, so are distinct from "private industry" in many regards. You can read a congressional report by the CRS describing FFRDCs and their role here: https://www.congress.gov/crs-product/R44629 https://www.congress.gov/crs-product/R44629.
- guerrilla 2y ago
  They were talking about AFTER that when it is privatized. That's what the comment they're responding to was talking about, not it's current state.
- stonogo 2y ago
  MITRE is absolutely not an FFRDC. It's a regular old 501(c)(3) which happens to manage FFRDCs.
  - tylermw 2y ago
    Yes, you are correct, I should have typed "runs". But the point is that MITRE runs the U.S. National Cybersecurity FFRDC that maintains the CVE system, and FFRDCs are deliberately structured to minimize potential conflicts of interest (GP comment) and are definitely distinct from private industry (parent comment).
    - deleted 2y ago
      [deleted]
derefr 2y ago
I'm the opposite — and I think this might be the "4D chess"† interpretation of this move as well. In peacetime, I think everyone is generally alright with something centralized like the CVE database. But in what increasingly seems like the lead-up to wartime... I'm hesitant to trust a CVE database operated or funded unilaterally by a single government — or even multilaterally, if the governments are all ones that all would end up on the same side of a hot war. (Why? Strategic censorship of reports while the DB's patron takes advantage of the exploit, for one. Such a database becoming a high-priority cyberwar target, for another. Strategic wasting of enemy cybersecurity resources with false announcements, for a third.) IMHO, the ideal form for the organization managing CVE, is one analogous to IANA and its Regional Internet Registries (RIRs). IANA slices up the keyspace of IPs to assign to RIRs, and arbitrates disputes — but both at such a high level that their work is effectively in a de-facto state of "done until something comes up". The RIRs do all the actual everyday work. This means that in a hot war that different RIRs end up on opposing sides of, where at least some of the RIRs can no longer trust the ownership of IANA to act in their best interests, the RIRs can just ignore IANA for a while, and keep on doing their own thing (managing allocations from their previously-agreed parts of the IP keyspace), and everything will still work. And RIRs that control parts of IP space contended over by opposed states? They can just be split up, under obvious rules (every current allocation goes to the sub-RIR associated with the state that controls the gov/mil/corp/org entity currently holding that allocation.) That's not the case with the CVE database under its current ownership. There's no established way to namespace it, no obvious way to split it up and keep it all working. And I think that this problem would be obvious to the DoD. Which is precisely why paying to host a single-source-of-truth CVE database loses its lustre when that same DoD is aware that such a split might soon have to happen. --- † I dislike the term "4D chess", because it implies one chess master who's really good at predicting non-obvious outcomes — rather than an entire military-industrial-complex acting as "see something, say something" inputs to an intelligence apparatus that does a lot of hard work and simulation analyzing potential outcomes, to produce easily-digested suggestions and action items. There just needs to be one guy in the Pentagon / the military / wherever, who realized this and sent a (classified MILNET) email about it.
- zeebeeblebrox 2y ago
  [dead]
cortesoft 2y ago
You aren’t worried about the conflict of interest with a government run system, given the desire of governments to be able to intercept all communication?
- MiguelX413 2y ago
  No, particularly because CVE has no communications functionality.
  - cortesoft 2y ago
    My worry would be that a government might want to hide a particular vulnerability it has found that enables it to break into a system.

numbsafari 2y ago

... and that industry led consortium will have a board all paid princely sums, and an executive leadership team that is conflicted to the hilt and paid kingly sums, and they will charge exorbitant rents in order to keep the lighthouse lit. There's flaws with every approach, but I much prefer the approach where this sort of thing is treated as a public good, rather than as yet another soon-to-be walled garden.

bunderbunder 2y ago
I keep thinking of that time Wisconsin's state government privatized a bunch of IT stuff in the interest of "government efficiency", and the cost taxpayers paid for those specific functions increased by several hundred percent while quality of service went down. At that same time, though, I worked for a contractor that I do believe saved states money compared to doing things in-house. The work we did really required specialists. But no one state had enough of the work to keep one busy all year. So sharing a pool of people to do the work among many states meant there was room for both saving the states money and allowing some profit for the company. The idea that you can just blanket assume that private industry is inherently more efficient than public works really needs to die. There doesn't seem to be any more evidence to support it than there is to support the idea that it's inherently less efficient. Life just isn't that simple. It's all case by case.
- dimitrios1 2y ago
  For every example of privatization going wrong, there's least one example (if not two) of it going right. But serious question -- what is the difference these days anyways? Our entire government is effectively privatized anyways from the local level up to the federal. We rely on contractors for almost everything that matters. We just maintain this facade that they are not privatized.
  - sollewitt 2y ago
    I’ve never seen one that worked long term. The basic premise is “what was done for $X dollars with no profit motive can be done for <$X dollars with profit motive doesn’t hold up - you make something private, it wants to make more profit. Just for the most ready to hand example for me, PG&E in SF vs public electricity utilities on the peninsula - the privatized electricity costs twice as much per kWh - and of course it does because the PG&E CEO needs to make $17M from somewhere, the share price needs to go up etc. the rich need to skim from the top, that makes the cost higher. If you have an essential industry the cynical play is to privatize to save cost, then do a bad job and then effectively make your losses public through bail-outs while still making profit.

jmull 2y ago

> The long-term goal seems to be... Where do you get that from? I've seen no sign of long-term goals, much less any mechanisms being put in place for follow-through on those goals. It seems like people keep making the mistake of believing there's a detailed plan, while all evidence tells us there isn't. I guess it's the normal human tendency to see order in the chaos.

tlogan 2y ago
Project 2025 lays out a clear vision for the privatization and decentralization of federal functions. It’s not subtle—it explicitly calls for it. Separate from whether we support this or not: Trump is doing—or promising to do—exactly what he said he would. We can disagree with the policies, but it’s not accurate to say he or his team are directionless or incompetent. They have a coherent (if controversial) agenda. So rather than dismissing them as clueless or idiots, it’s more productive to debate this: - Why is outsourcing CVE program to private consortia a bad idea? - Could a model exist where a private consortium is supported by federal grants, but maintains accountability and public interest safeguards?
- chowchowchow 2y ago
  Actually Trump repeatedly said he didn't know about project 2025. He's so scattered in his campaigning that it's possible to pretty much justify any action as "what he said he would do." But saying executing project 2025 is exactly what he SAID he would do defies all reality. It may be what intelligent observers expected him to do but it is not what he said. Edit: good lord people I’m not defending Trump I’m saying he lies about everything including that he lied and said he wasn’t going to do project 2025. Read the post I’m responding to!
  - pstuart 2y ago
    > Actually Trump repeatedly said he didn't know about project 2025 * He said he'd end the war in a day. * He said he had a better health care plan. * He said he'd drop the price of eggs. * ... * He said lots of things that were not true.

agloe_dreams 2y ago

> Having the CVE program operated by a company funded by the U.S. military ...Yep, we're done as a democracy. Pack it up, boys. Edit: I know it is doom and gloom but the CVE program could easily delay information and leave holes on purpose.

absker 2y ago

MITRE is a non-profit company that operates Federally Funded Research and Development Centers (FFRDCs), which are owned and funded by the federal government and contracted out to companies like MITRE to operate them. While MITRE does have contracts with DoD (and many other agencies across the federal government as part of the FFRDCs they operate), they are not the same as a stereotypical DoD contractor as their non-profit status motivates them to work in the public interest.

jhelps 2y ago

I can see how govt funding was needed to help bootstrap the CVE program before people saw the value of it. But now that CVEs form the basis of a very lucrative ~$16b/year industry[0], wouldn't it make sense to let those companies take over? Privatizing the Internet enabled much more innovation than if it had stayed govt-funded. 0: https://www.grandviewresearch.com/industry-analysis/security-and-vulnerability-management-svm-market https://www.grandviewresearch.com/industry-analysis/security...

ottercan 2y ago

MITRE is not a DoD contractor. They are a not-for-profit institution committed to the public interest that operates six Federally Funded Research and Development Centers.

butterlover 2y ago

It’s probably more accurate to describe mitre as a publicly funded non profit operating for public benefit like the post office or PBS. It’s a stretch to describe it as an arm of the government.