11 ms·

America's cyber defenses are being dismantled from the inside

344 points by rntn 2y ago

yieldcrv 2y ago
> It's the global catalog that helps everyone – security teams, software vendors, researchers, governments – organize and talk about vulnerabilities using the same reference system so why was only the US federal government funding it, especially if it wasn't expensive to maintain? this is the follow up question to every headline and won't be seen as controversial later, so why bother treating it as controversial to say now
- esskay 2y ago
  For the same reason the US considers its self the "leader" of the world. You can't have it both ways, if you want to "lead", you've gotta pay for it.
  - ryao 2y ago
    Has the U.S. ever claimed to be the leader of the world? I do not think any country has ever claimed that title. The closest to it would be some of the remarks that are supposedly made to each Pope upon becoming Pope. That said, there is the similar sounding title called “the leader of the free world” applied to the U.S. president since the end of WWII. I always thought that was the result of military alliances, not the CVE program, which post dates it. Edit: To the downvoters, I take issue with the assertion that the U.S. has claimed the title “leader of the world”. That is applied to the Pope during papal inaugurations and as far as I know, has never been formally applied to the United States. It seems to have been invented this year as part of claims that the U.S. has an obligation to spend money on programs that benefit others, given that the current political situation has made a number of them appear to be in jeopardy, but that appears to be a rewrite of history, rather than any historical truth. My sole interest here is the historical truth, and not politics.
    - noelwelsh 2y ago
      https://en.wikipedia.org/wiki/Free_World https://en.wikipedia.org/wiki/Free_World
      - ryao 2y ago
        Leader of the world and leader of the free world are two different things. As far as I know, no country in the past century has called itself either of them. I would not be surprised if the title was applied to countries such as the Imperium Romanum and 中國 in the distant past. Even more distant would be possibly Greece given that it’s leader was called the King of Kings around the time of Troy. However, I believe both titles are applied to specific office holders in the modern day. The U.S. president is called the leader of the free world by many. I believe the title leader of the world is bestowed upon the Pope during Papal inaugurations.
        locopati 2y ago
        With all due respect, you're being pedantic. No, we're not talking about official titles bestowed from on high. The US has been considered the world leader from WW2 until sometime in the 21st century, partly because nobody else wanted to claim it, partly because American foreign policy is aggressive, partly because the American economy was the most robust on in the aftermath of WW2.
        ryao 2y ago
        The U.S. has never been the world leader. The U.S. has been a military leader for other democracies since the end of WWII. That is why the title, leader of the free world has been applied to the U.S. president, who is the leader of the various military alliances between various major democracies. If you claim the U.S. considered itself to be the world leader, then you are claiming the U.S. considered itself to be the leader of the Soviet Union, the Warsaw pact, North Korea, etcetera. That is absurd. The U.S. likely did consider itself the leader of Vietnam and Cuba before the democracies in those countries fell, although that was in a military capacity. That is why the U.S. intervened militarily in both, although both interventions failed. Saying that the U.S. got its leadership position because no one else wanted it is historically incorrect. Following WWII, every other major democratic power was in ruins while the U.S. was the sole major power left in tact. Without any military attacks on U.S. soil, U.S. military strength had skyrocketed during the war. As the war progressed, the U.S. attained the status of a great power and by the war’s end had become a nascent super power. U.S. strength continued to grow after the war due to the threat of the Soviet Union. Meanwhile, the other great powers never fully recovered militarily since they focused on their economies while relying on the U.S. for security. The U.S. gained its leadership position because no one else existed that could claim it.
  - yieldcrv 2y ago
    then you might be pleased to know that I don't want to have it either way let's fix our own cities and domestic infrastructure projects while pulling back the federal government, just like we are doing
    - mrguyorama 2y ago
      The pittance we pay to support things that benefit all humanity have never prevented us from investing in the US. You don't need to put the federal government in a wood chipper to make the US better, and in fact you often need the federal government to make the US better, like with social security, food stamps, medicaid, the interstate, railroads, most of our infrastructure, the internet, microchips, etc. In fact, if you want the best infrastructure, why wouldn't you end up importing that? Most of humanity is not a US citizen. "The best" human at something will only rarely be american. Meanwhile this admin has done nothing to improve things for americans, so stop carrying water for their horse shit. People love the meme of a runway full of F35s and saying "We are about to demonstrate why the US doesn't have socialized medicine" and it has always been a lie. We can EASILY afford 3k F35s, 13 aircraft carriers, AND healthcare. We've been paying more for healthcare than countries with socialized medicine this whole time.
      - yieldcrv 2y ago
        > We can EASILY afford 3k F35s, 13 aircraft carriers, AND healthcare I'm aware but there is no consensus for that, or addressing the budget, all while our infrastructure crumbles at the same time. Now there is at least an attempt to address our budget. Regarding foreign policy, other leading nations are not giving aid, they are investing. We could just as easily do our "soft power" stuff in a more equitable way. Every controversial budget change, that's even mocked by leaders of G-7 nations, are things those G-7 nations are already doing. Aid for repayment? yeah they're doing that. Not a controversial concept in reality. And yes, I still want the federal government to do the things you mentioned regarding federal highways, railroads... infrastructure projects we both agree on.
        mrguyorama 2y ago
- jasonjayr 2y ago
  By US funding it, the US gets to be a first mover, and a leader in this space.
- noelwelsh 2y ago
  Completely irrelevant. Deliberately or not you're repeating the Trump / DOGE talking point of government expense, focused on expenses that individually and in aggregate contribute practically nothing to the federal budget.
  - macintux 2y ago
    It's clear that Trumps sees everything as zero sum. If he can't see that he's personally and directly benefiting, clearly it's a waste of money.
  - galangalalgol 2y ago
    I agree wholeheartedly in this case. But gutting the epa will almost certainly boost the gdp far more than the amount directly saved. At least in the short term. Burning rivers are a lot harder to clean up than tech debt. I think the idea was to free up a bunch of labor to replace the perfectly good spigot of labor we had in the form of legal immigration, and get rid of a lot of regulations that inhibit short term gdp all in one swell foop. The tariffs were always primarily a negotiating strategy to get everyone to allow us to weaken the dollar, which unlike tariffs would outlast an administration and eventually bring manufacturing back for that freed up labor. In the interim there would be a ton of infrastructure spending to employ the labor as the lack is limiting our gdp by 1-2%. It was a decent plan except that long temr it ignored the environmental costs. The execution of the tariffs got screwed up though because while chaos is good for negotiation, it is not good in a sales pitch, which is essentially what this was. Let us weaken the dollar without responding and continuing to purchase bonds and we'll keep buying plent of your stuff, we have consumer demand to spare, and the gdp boost will offset the weakened dollar while making our bonds even safer as we begin to grow the gdp relative to the debt. The reason some allies like Australia and Canada got tariffs despite it not making any economic sense is different. In addition to sacrificing the environment, this plan sacrifices us democracy, and you can't have easy travel to a place with lots of individual freedom or you get the flight of all skilled labor like in Hungary. Anyway, we are going to get the bad parts of the plan without the benefits now. Not entirely too late but pretty close. We can't all wait until a blatant constitutional crisis to start protesting because the court will back down where it can without openly loosing legitimacy. And once the admin chooses to cross the red line they will be ready for the response. Show support to gop members who want to stand up but are afraid of primaries (and death threats). Even promise cross party primary support where that is possible. Don't go along with illegal stuff. Tell the dnc your only priority is democracy and to stop arguing about the rest. Go to protests. Talk to people you disagree with calmly and do it a lot. Don't flee, this is endgame, nowhere else will hold out all that long. Help people get their voter registration in order with stuff like voterider to combat voter suppression. Ok that was cathartic to type out all at once. If you don't see it then go read the history of successful and failed takeovers from rome to the present. It is a color by numbers approach that is easy to recognize once you've seen the others, but done super faster and with no visible bloodshed. And with a lot less public support than is normal for such things. Kind of impressive in a horrifying way.
- croes 2y ago
  Because it’s a US organization and is a former military think tank.
- aqme28 2y ago
  As opposed to who else funding it?
  - anannymoose 2y ago
    The UN? Make it an international cooperative effort?
    - tokai 2y ago
      As US is cutting UN funding and pushing friends away? Good luck with that.
    - freen 2y ago
      Ahh, yes, this is exactly how one goes about making it a cooperative effort, which is something this administration is clearly an expert at doing.
      - _heimdall 2y ago
        Your snark misses the fact that the program has been funded by the US for 25 years and the decision to not make it a UN project has nothing to do with the current administration.
        viraptor 2y ago
        Trying to cut it immediately instead of saying "ok, it needs to become a joint international effort starting on (a date months ahead)" is the issue with the current administration. Running it is fine, handing it over is fine, suddenly making a huge mess is not. That's the missing cooperation.
        watwut 2y ago
        I am confused about what UN has to do with America shutting down services whose primary goal was to protect American infrastructure, government and companies. Some UN nations are quite happy about this, because it will make it easier to access what they want in US.
- mxuribe 2y ago
  I think others have already stated about the U.S. having a leadership position by running this...So i'll just comment on the the funding of this DB. I mean, sure, i'm all for optimizing things...but it strikes me that some decisions by the current U.S. administration - like not wanting to fund this - seem very penny wise and pound foolish. Like, for whatever it costs to run this DB (and i truly have no idea of the costs), i bet you that the operational benefits to U.s. companies, organizations is well worth the spend. Separate of any political benefits, i'm referring to hard and tactical benefits that arise from this existing. Someone is simply looking at a long list of items on a budget, not understanding that each item might have different weights, values, etc...and simply slashing like a toddler...and either not caring the ramifications, or not understanding them (or secondary trickle effects).
- freen 2y ago
  Well, we did make the damn thing in the first place.
- panja 2y ago
  Because it's a good value for what we get
- sigmarule 2y ago
  > especially if it wasn’t expensive to maintain Okay, so we’ve established that the cost of the endeavor is low. > it’s the global catalog that helps everyone organize and talk about vulnerabilities I would argue that leading and controlling the organization that provides the world with the single most ubiquitous cybersecurity resource justifies what you characterized as a meager cost in reputational capital alone. > this is the follow up question to every headline and won't be seen as controversial later, so why bother treating it as controversial to say now It’s not controversial, just a bit aloof. Control of something like the CVE registry is essentially a geopolitical concern at this point, i.e. there has been anxiety brewing about China’s vulnerability disclosure laws for a bit now, much of which is warranted as China has been preventing the disclosure of vulnerabilities and instead stockpiling 0days and leveling up their APT groups. Even if the US wouldn’t exert such blatant influence or control over the program, the fact that vulnerability disclosures are being sent to US entities, or even just traveling through IP space we control, may be alone enough for value to be extracted. This pattern could basically be viewed as the DOGE fallacy at this point.
  - dmix 2y ago
    > I would argue that leading and controlling the organization that provides the world with the single most ubiquitous cybersecurity resource justifies what you characterized as a meager cost in reputational capital alone. Someone in the original HN thread about funding wrote a post explaining how poorly run CVE org was and it had been like that for years. It had a giant backlog, ignored criticism, and moved very slowly. Then the second it shutdown a volunteer organization was assembled overnight. > Control of something like the CVE registry is essentially a geopolitical concern at this point This is purely a reputational concern. Being on government networks doesn't make it instantly more trustworthy or safe. Just like everything regarding security it takes lots of people looking at it, people reporting issues, and an organization that deals with issues promptly.
    - sigmarule 2y ago
      > Someone in the original HN thread about funding wrote a post explaining how poorly run CVE org was and it had been like that for years. Sure, but that doesn’t change anything, does it? Most people that use or have benefited from the CVE program are not even aware of these criticisms, and I’d be willing to bet that the majority of people who _are_ aware only became so in the past week. > This is purely a reputational concern. Being on government networks doesn't make it instantly more trustworthy or safe. I did not say the concern was the safety of the CVE program. The concern is influence over the world’s inbox for 0days and the tangible ways that can be used to a nation’s benefit. It is most certainly not just a reputational concern. If China had stepped in last week and took the reins there would be groups within both industry and government having mild freakouts this week.
- exceptione 2y ago
  It is a matter of whether you prefer transnational organized crime or not. Businesses, Science and individuals thrive in societies that are democratic, with separation of powers and independent judiciary. The better they function, the harder it is for crime. On the other hand, if you allow organized crime to prosper, take control of it, and on the other hand have the judiciary in your grip, you can play both cards against your political/business enemies. This is the model of Russia, where the State is deeply connected to transnational organized crime. The Kremlin powers really wanted Viktor Bout free. Now, if the power brokers in the media landscape wanted to tell you the big picture instead of hyper focusing on the day to day circus... (that is also why journalism /= actualities). So these are just necessary steps to clear roadblocks for crime networks. The same for IRS. In Russia you cannot get power without Kompromat on yourself. Like the maffia, the boss needs a kill switch on everyone. From a higher perspective, it is a bit unfortunate that these transgressive steps were foreseen in academia, those despicable expertise centra in the EU and other democratic countries, while the general public is kept in the dark by media houses. I am not sure if it still suitable for HN or that the Overton Window shifted too much already, but the other things that were forecast are the capturing of conservatism by the same networks. We expect also to see further normalization of law breaking, power abuse, power concentration and state capture by non-elected bodies. Yes, this was a normalization process of decades. But now on full acceleration. As an aside, it is not entirely a coincidence that "Accelerationism" is the ideology of associated power circles. And now you also know how Tech Bro's and Conservatism could share the same campaign. Their intended outcomes differ on some points, but they agree on the path to their respective ideals. The extreme destruction that follows will not touch them personally. To ensure that last thing they unlock powers for them self: become the law.
- OfficeChad 2y ago
  [dead]
- troyvit 2y ago
  > so why was only the US federal government funding it, especially if it wasn't expensive to maintain? I want to flip this question around as if it was asked by somebody from a country other than the U.S. If I was looking at America since 9/11 from the outside, I would see a country that was trying to destabilize itself. It started out slowly enough, but as the years have progressed the wobble has become more and more pronounced until today, where the U.S.'s trustworthiness is lower than I personally ever thought it could go. And it's going to get worse. So if I lived outside the U.S. I would be asking the very same question: Why would a government that is so unstable and so dangerously powerful be in charge of something that the world kind-of would like to depend on? And I'd start my own version of it asap. I understand from the Reg article that the U.S. extended its contract in the 11th hour, but that just speaks to the point more than anything else.
  - yieldcrv 2y ago
    It suggests that an apathetic world and private sector globally is mildly amused that the US uses its resources this way on things they rely on or it suggests that an entire world and private sector is so uncoordinated and budget strapped globally that all this - at least these things - is held together by the US I'm pleased to find out. I'm dismayed at how disruptive doing so has to be, but its either accepting the concept of American exceptionalism, or stepping up and proving the apathy was giving America a bad deal and calling into question how much of an ally anyone was
antonioevans 2y ago
So in what way does this help the American people?
- chaostheory 2y ago
  My guess is that they were overtly trying to show Russia that we aren’t a direct threat to them anymore in the vain attempt to avoid fighting a two front war in the upcoming global war. Unfortunately, Putin is likely going to keep invading up to Germany’s Fulda Gap. If we’re still a part of NATO, we would have no choice but to declare war.
  - netsharc 2y ago
    That feels overly deferrential to Putin... It's like a person with muscles witnessing a beating and then when the perpretaror notices, looking away and saying "I didn't see anything!".
    - cwillu 2y ago
      So, cowardice?
      - kevin_thibedeau 2y ago
        He'll do anything to keep his kompromat from being disclosed.
        ModernMech 2y ago
        There's no kompromat, Trump and Putin just have the same goals. This whole idea that Putin has kompromat on Trump and that's the only reason he would be deferential to Putin rests on the idea that the American president is aligned morally, politically, and strategically with the long-term interests of America. Sadly, this is not true. The oath Trump took was empty. Trump does not have a pro-America agenda; he has a pro-Trump agenda. His whims are not morally, politically, or strategically aligned with the goals and prospects of the American people, they're aligned with a global billionaire class, to which Putin belongs. That is why they get along. They are allies.
nonrandomstring 2y ago
Funding is irrelevant and a distraction. Dismantling civil cybersecurity is a way to expose a population to influence and other harms that necessitate more "strong-man" solutions later [0,1]. Only after they've destroyed "cyber defenses" can they claim a crisis and declare "cybsersecurity is dead, long live the new cybersecurity". And you can be damn sure it won't be security for you. [0] https://cybershow.uk/blog/posts/computer-security-is-a-political-struggle/ https://cybershow.uk/blog/posts/computer-security-is-a-polit... [1] https://cybershow.uk/blog/posts/usw/ https://cybershow.uk/blog/posts/usw/
BLKNSLVR 2y ago
Trump is going to be surprised for a second time that "everything's computer".
- meindnoch 2y ago
  "The computer is huge, you know, I told Elon the other day, and by the way I was the first one to say this, the computer is tremendous, tremendously important. Baron, you know, he's so good with the computer, and that's what I said many times, you know, good genes, good genes. A friend of mine, great guy, very smart guy, told me the other day, Donald, the computer, and by the way, this is what most people don't realize in our country, [...]"
  - greenie_beans 2y ago
    lmaoooo
  - lynndotpy 2y ago
    Is this a real quote from Donald Trump, or a humorous "this-is-what-he-would-say" thing?
    - JKCalhoun 2y ago
      It's hard to know. ;-)
    - kevin_thibedeau 2y ago
      This is our weapon against Skynet. DonGPT will keep it perpetually confused with it's aimless rambles.
    - 2OEH8eoCRo0 2y ago
      Look, having nuclear — my uncle was a great professor and scientist and engineer, Dr. John Trump at MIT; good genes, very good genes, OK, very smart, the Wharton School of Finance, very good, very smart — you know, if you're a conservative Republican, if I were a liberal, if, like, OK, if I ran as a liberal Democrat, they would say I'm one of the smartest people anywhere in the world — it's true! — but when you're a conservative Republican they try — oh, do they do a number — that's why I always start off: Went to Wharton, was a good student, went there, went there, did this, built a fortune — you know I have to give my like credentials all the time, because we're a little disadvantaged — but you look at the nuclear deal, the thing that really bothers me — it would have been so easy, and it's not as important as these lives are — nuclear is so powerful; my uncle explained that to me many, many years ago, the power and that was 35 years ago; he would explain the power of what's going to happen and he was right, who would have thought? — but when you look at what's going on with the four prisoners — now it used to be three, now it's four — but when it was three and even now, I would have said it's all in the messenger; fellas, and it is fellas because, you know, they don't, they haven't figured that the women are smarter right now than the men, so, you know, it's gonna take them about another 150 years — but the Persians are great negotiators, the Iranians are great negotiators, so, and they, they just killed, they just killed us, this is horrible.
prophesi 2y ago
Bit of a sparse article. The near-miss of CVE funding is certainly tragic, but there's no mention of how they siphoned data from the NLRB and locked everyone out of their accounts, and give only a quick mention to cutting federal grants for cybersecurity and CISA's funding. There's a lot more ammo out there to show how incompetent the Trump administration and Musk's DOGE team actually is.
- andrewl 2y ago
  They're actually quite competent at their real goal, which is not to make America great, but to blow it to smithereens so various titanically rich people can buy everything up, including the land, at rock bottom prices.
- judge2020 2y ago
  https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-security https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-... Goes into pretty good detail about DOGE employees going out of their way to obscure their activity on NLRB's Azure account. Surely a plus for transparency in government. > Within minutes after DOGE accessed the NLRB's systems, someone with an IP address in Russia started trying to log in, according to Berulis' disclosure. The attempts were "near real-time," according to the disclosure. Those attempts were blocked, but they were especially alarming. Whoever was attempting to log in was using one of the newly created DOGE accounts — and the person had the correct username and password, according to Berulis.
- 1970-01-01 2y ago
  Don't forget about the target on Chris Krebs for securing elections.
- skeeter2020 2y ago
  this wasn't an article it was an opinion piece.
  - prophesi 2y ago
    My bad, the headline certainly makes it sound like it should be informative.
ikekkdcjkfke 2y ago
It is sabotage, but by who?
- skizm 2y ago
  Pete Hegseth at the behest of Trump mostly: https://www.cnn.com/2025/03/02/politics/us-cyber-operations-russia-suspend/index.html https://www.cnn.com/2025/03/02/politics/us-cyber-operations-...
gadders 2y ago
"The Washington Monument syndrome, also known as the Mount Rushmore syndrome or the firemen first principle, is a term used to describe the phenomenon of government agencies in the United States cutting the most visible or appreciated service provided by the government when faced with budget cuts." https://en.wikipedia.org/wiki/Washington_Monument_syndrome https://en.wikipedia.org/wiki/Washington_Monument_syndrome
- deleted 2y ago
  [deleted]
- vonneumannstan 2y ago
  Not sure this fits. Outside HN types how much of the general public cares about or understands Cyber Security?
  - gadders 2y ago
    True, but for people in the business that are going to complain, this is the most visible high profile piece.
CivBase 2y ago
Crazy idea: Decentralize the CVE across many nations so that no single organization has the power to eliminate it. Even if the US doesn't play ball, it's a public database right? Is there anything stopping the UN, EU, UK, Australia, etc from copying it and establishing their own joint CVE?
- raverbashing 2y ago
  The EU has https://euvd.enisa.europa.eu/ https://euvd.enisa.europa.eu/
  - CivBase 2y ago
    That's good to hear.
caseysoftware 2y ago
[flagged]
- watwut 2y ago
  Following quotes are from your own article. IBM did not called them slow or lazy. IBM blamed lack of resources and claimed more resources will improve things. IBM did NOT claimed that current resources are being used ineffectively. > Budget cuts are partially responsible for CVE analysis issues. As noted by Security Magazine, NIST funding was cut by 12% this year, making it more difficult for the agency to enrich CVEs. In practice, the NVD is effectively a downstream consumer of CVE data — while the number of CVEs found and reported remains steady, NIST’s ability to assess and enrich these vulnerabilities has been significantly reduced. > The sheer number of reported vulnerabilities also poses a problem for analysis efforts; Flashpoint research found that NIST reported 33,137 vulnerabilities in 2023. . In part, rising numbers are tied to improved detection capabilities.
- deleted 2y ago
  [deleted]
deleted 2y ago
[deleted]
axus 2y ago
Signal chats are a sideshow compared to opening up the government to data breaches and foreign influence https://www.newsweek.com/doge-whistleblower-stalked-threatened-raising-alarm-2061087 https://www.newsweek.com/doge-whistleblower-stalked-threaten...
- unethical_ban 2y ago
  I have conservative family who only read/watch Fox news, OAN and some conservative meme site called twitchy, which is like if Fox news tried to be dumber. They don't see this. There is no true reporting. My mom didn't know about the breadth of tariffs. She didn't know about the DJT crypto scam. I've explained signal to her several times (prior to the news, just getting her to use it). She really doesn't understand anything complicated. She "knows Trump is a jerk" but wants, and I quote, "America for Americans" and for us to put China in its place and to secure the border. edit: I told my dad "Why do you think America is so powerful and influential? It's because we invest in the world and welcome students into this country. We aren't the center of the world for no reason". He simply replied, "We are the center of the world." Our country is filled with people like this, incapable of abstract thought and poisoned by lies.
  - totalkikedeath 2y ago
    [dead]
  - MattPalmer1086 2y ago
    People always like to think their good fortune is because they have some special sauce that others don't have. But they also resent all the obligations that go with it. Plenty of people in Britain still think the world owes us something, nearly a century after the end of our empire.
kazinator 2y ago
Maybe we need a CVE-like database that isn't dependent on the government of the USA? This is a weakness of the IT world as such.
- bigyabai 2y ago
  The US government is a pretty good steward of this sorta thing. We're generally reliable, can afford to spend a few pennies securing a lucrative international export, and hold platform-owners responsible even when their executives hide or intentionally obfuscate issues for marketing purposes. Who else can you seriously suggest, knowing the past 10 years of CVE history? Subcontract it to Cisco or Oracle?
- pabs3 2y ago
  CVE folks are working on diversifying their funding sources: https://www.thecvefoundation.org/ https://www.thecvefoundation.org/
BergAndCo 2y ago
[dead]

344 points by rntn 2y ago

> It's the global catalog that helps everyone – security teams, software vendors, researchers, governments – organize and talk about vulnerabilities using the same reference system so why was only the US federal government funding it, especially if it wasn't expensive to maintain? this is the follow up question to every headline and won't be seen as controversial later, so why bother treating it as controversial to say now

esskay 2y ago
For the same reason the US considers its self the "leader" of the world. You can't have it both ways, if you want to "lead", you've gotta pay for it.
- ryao 2y ago
  Has the U.S. ever claimed to be the leader of the world? I do not think any country has ever claimed that title. The closest to it would be some of the remarks that are supposedly made to each Pope upon becoming Pope. That said, there is the similar sounding title called “the leader of the free world” applied to the U.S. president since the end of WWII. I always thought that was the result of military alliances, not the CVE program, which post dates it. Edit: To the downvoters, I take issue with the assertion that the U.S. has claimed the title “leader of the world”. That is applied to the Pope during papal inaugurations and as far as I know, has never been formally applied to the United States. It seems to have been invented this year as part of claims that the U.S. has an obligation to spend money on programs that benefit others, given that the current political situation has made a number of them appear to be in jeopardy, but that appears to be a rewrite of history, rather than any historical truth. My sole interest here is the historical truth, and not politics.
  - noelwelsh 2y ago
    https://en.wikipedia.org/wiki/Free_World https://en.wikipedia.org/wiki/Free_World
    - ryao 2y ago
      Leader of the world and leader of the free world are two different things. As far as I know, no country in the past century has called itself either of them. I would not be surprised if the title was applied to countries such as the Imperium Romanum and 中國 in the distant past. Even more distant would be possibly Greece given that it’s leader was called the King of Kings around the time of Troy. However, I believe both titles are applied to specific office holders in the modern day. The U.S. president is called the leader of the free world by many. I believe the title leader of the world is bestowed upon the Pope during Papal inaugurations.
      - locopati 2y ago
        With all due respect, you're being pedantic. No, we're not talking about official titles bestowed from on high. The US has been considered the world leader from WW2 until sometime in the 21st century, partly because nobody else wanted to claim it, partly because American foreign policy is aggressive, partly because the American economy was the most robust on in the aftermath of WW2.
        ryao 2y ago
        The U.S. has never been the world leader. The U.S. has been a military leader for other democracies since the end of WWII. That is why the title, leader of the free world has been applied to the U.S. president, who is the leader of the various military alliances between various major democracies. If you claim the U.S. considered itself to be the world leader, then you are claiming the U.S. considered itself to be the leader of the Soviet Union, the Warsaw pact, North Korea, etcetera. That is absurd. The U.S. likely did consider itself the leader of Vietnam and Cuba before the democracies in those countries fell, although that was in a military capacity. That is why the U.S. intervened militarily in both, although both interventions failed. Saying that the U.S. got its leadership position because no one else wanted it is historically incorrect. Following WWII, every other major democratic power was in ruins while the U.S. was the sole major power left in tact. Without any military attacks on U.S. soil, U.S. military strength had skyrocketed during the war. As the war progressed, the U.S. attained the status of a great power and by the war’s end had become a nascent super power. U.S. strength continued to grow after the war due to the threat of the Soviet Union. Meanwhile, the other great powers never fully recovered militarily since they focused on their economies while relying on the U.S. for security. The U.S. gained its leadership position because no one else existed that could claim it.
- yieldcrv 2y ago
  then you might be pleased to know that I don't want to have it either way let's fix our own cities and domestic infrastructure projects while pulling back the federal government, just like we are doing
  - mrguyorama 2y ago
    The pittance we pay to support things that benefit all humanity have never prevented us from investing in the US. You don't need to put the federal government in a wood chipper to make the US better, and in fact you often need the federal government to make the US better, like with social security, food stamps, medicaid, the interstate, railroads, most of our infrastructure, the internet, microchips, etc. In fact, if you want the best infrastructure, why wouldn't you end up importing that? Most of humanity is not a US citizen. "The best" human at something will only rarely be american. Meanwhile this admin has done nothing to improve things for americans, so stop carrying water for their horse shit. People love the meme of a runway full of F35s and saying "We are about to demonstrate why the US doesn't have socialized medicine" and it has always been a lie. We can EASILY afford 3k F35s, 13 aircraft carriers, AND healthcare. We've been paying more for healthcare than countries with socialized medicine this whole time.
    - yieldcrv 2y ago
      > We can EASILY afford 3k F35s, 13 aircraft carriers, AND healthcare I'm aware but there is no consensus for that, or addressing the budget, all while our infrastructure crumbles at the same time. Now there is at least an attempt to address our budget. Regarding foreign policy, other leading nations are not giving aid, they are investing. We could just as easily do our "soft power" stuff in a more equitable way. Every controversial budget change, that's even mocked by leaders of G-7 nations, are things those G-7 nations are already doing. Aid for repayment? yeah they're doing that. Not a controversial concept in reality. And yes, I still want the federal government to do the things you mentioned regarding federal highways, railroads... infrastructure projects we both agree on.
      - mrguyorama 2y ago
jasonjayr 2y ago
By US funding it, the US gets to be a first mover, and a leader in this space.
noelwelsh 2y ago
Completely irrelevant. Deliberately or not you're repeating the Trump / DOGE talking point of government expense, focused on expenses that individually and in aggregate contribute practically nothing to the federal budget.
- macintux 2y ago
  It's clear that Trumps sees everything as zero sum. If he can't see that he's personally and directly benefiting, clearly it's a waste of money.
- galangalalgol 2y ago
  I agree wholeheartedly in this case. But gutting the epa will almost certainly boost the gdp far more than the amount directly saved. At least in the short term. Burning rivers are a lot harder to clean up than tech debt. I think the idea was to free up a bunch of labor to replace the perfectly good spigot of labor we had in the form of legal immigration, and get rid of a lot of regulations that inhibit short term gdp all in one swell foop. The tariffs were always primarily a negotiating strategy to get everyone to allow us to weaken the dollar, which unlike tariffs would outlast an administration and eventually bring manufacturing back for that freed up labor. In the interim there would be a ton of infrastructure spending to employ the labor as the lack is limiting our gdp by 1-2%. It was a decent plan except that long temr it ignored the environmental costs. The execution of the tariffs got screwed up though because while chaos is good for negotiation, it is not good in a sales pitch, which is essentially what this was. Let us weaken the dollar without responding and continuing to purchase bonds and we'll keep buying plent of your stuff, we have consumer demand to spare, and the gdp boost will offset the weakened dollar while making our bonds even safer as we begin to grow the gdp relative to the debt. The reason some allies like Australia and Canada got tariffs despite it not making any economic sense is different. In addition to sacrificing the environment, this plan sacrifices us democracy, and you can't have easy travel to a place with lots of individual freedom or you get the flight of all skilled labor like in Hungary. Anyway, we are going to get the bad parts of the plan without the benefits now. Not entirely too late but pretty close. We can't all wait until a blatant constitutional crisis to start protesting because the court will back down where it can without openly loosing legitimacy. And once the admin chooses to cross the red line they will be ready for the response. Show support to gop members who want to stand up but are afraid of primaries (and death threats). Even promise cross party primary support where that is possible. Don't go along with illegal stuff. Tell the dnc your only priority is democracy and to stop arguing about the rest. Go to protests. Talk to people you disagree with calmly and do it a lot. Don't flee, this is endgame, nowhere else will hold out all that long. Help people get their voter registration in order with stuff like voterider to combat voter suppression. Ok that was cathartic to type out all at once. If you don't see it then go read the history of successful and failed takeovers from rome to the present. It is a color by numbers approach that is easy to recognize once you've seen the others, but done super faster and with no visible bloodshed. And with a lot less public support than is normal for such things. Kind of impressive in a horrifying way.
croes 2y ago
Because it’s a US organization and is a former military think tank.
aqme28 2y ago
As opposed to who else funding it?
- anannymoose 2y ago
  The UN? Make it an international cooperative effort?
  - tokai 2y ago
    As US is cutting UN funding and pushing friends away? Good luck with that.
  - freen 2y ago
    Ahh, yes, this is exactly how one goes about making it a cooperative effort, which is something this administration is clearly an expert at doing.
    - _heimdall 2y ago
      Your snark misses the fact that the program has been funded by the US for 25 years and the decision to not make it a UN project has nothing to do with the current administration.
      - viraptor 2y ago
        Trying to cut it immediately instead of saying "ok, it needs to become a joint international effort starting on (a date months ahead)" is the issue with the current administration. Running it is fine, handing it over is fine, suddenly making a huge mess is not. That's the missing cooperation.
      - watwut 2y ago
        I am confused about what UN has to do with America shutting down services whose primary goal was to protect American infrastructure, government and companies. Some UN nations are quite happy about this, because it will make it easier to access what they want in US.
mxuribe 2y ago
I think others have already stated about the U.S. having a leadership position by running this...So i'll just comment on the the funding of this DB. I mean, sure, i'm all for optimizing things...but it strikes me that some decisions by the current U.S. administration - like not wanting to fund this - seem very penny wise and pound foolish. Like, for whatever it costs to run this DB (and i truly have no idea of the costs), i bet you that the operational benefits to U.s. companies, organizations is well worth the spend. Separate of any political benefits, i'm referring to hard and tactical benefits that arise from this existing. Someone is simply looking at a long list of items on a budget, not understanding that each item might have different weights, values, etc...and simply slashing like a toddler...and either not caring the ramifications, or not understanding them (or secondary trickle effects).
freen 2y ago
Well, we did make the damn thing in the first place.
panja 2y ago
Because it's a good value for what we get
sigmarule 2y ago
> especially if it wasn’t expensive to maintain Okay, so we’ve established that the cost of the endeavor is low. > it’s the global catalog that helps everyone organize and talk about vulnerabilities I would argue that leading and controlling the organization that provides the world with the single most ubiquitous cybersecurity resource justifies what you characterized as a meager cost in reputational capital alone. > this is the follow up question to every headline and won't be seen as controversial later, so why bother treating it as controversial to say now It’s not controversial, just a bit aloof. Control of something like the CVE registry is essentially a geopolitical concern at this point, i.e. there has been anxiety brewing about China’s vulnerability disclosure laws for a bit now, much of which is warranted as China has been preventing the disclosure of vulnerabilities and instead stockpiling 0days and leveling up their APT groups. Even if the US wouldn’t exert such blatant influence or control over the program, the fact that vulnerability disclosures are being sent to US entities, or even just traveling through IP space we control, may be alone enough for value to be extracted. This pattern could basically be viewed as the DOGE fallacy at this point.
- dmix 2y ago
  > I would argue that leading and controlling the organization that provides the world with the single most ubiquitous cybersecurity resource justifies what you characterized as a meager cost in reputational capital alone. Someone in the original HN thread about funding wrote a post explaining how poorly run CVE org was and it had been like that for years. It had a giant backlog, ignored criticism, and moved very slowly. Then the second it shutdown a volunteer organization was assembled overnight. > Control of something like the CVE registry is essentially a geopolitical concern at this point This is purely a reputational concern. Being on government networks doesn't make it instantly more trustworthy or safe. Just like everything regarding security it takes lots of people looking at it, people reporting issues, and an organization that deals with issues promptly.
  - sigmarule 2y ago
    > Someone in the original HN thread about funding wrote a post explaining how poorly run CVE org was and it had been like that for years. Sure, but that doesn’t change anything, does it? Most people that use or have benefited from the CVE program are not even aware of these criticisms, and I’d be willing to bet that the majority of people who _are_ aware only became so in the past week. > This is purely a reputational concern. Being on government networks doesn't make it instantly more trustworthy or safe. I did not say the concern was the safety of the CVE program. The concern is influence over the world’s inbox for 0days and the tangible ways that can be used to a nation’s benefit. It is most certainly not just a reputational concern. If China had stepped in last week and took the reins there would be groups within both industry and government having mild freakouts this week.
exceptione 2y ago
It is a matter of whether you prefer transnational organized crime or not. Businesses, Science and individuals thrive in societies that are democratic, with separation of powers and independent judiciary. The better they function, the harder it is for crime. On the other hand, if you allow organized crime to prosper, take control of it, and on the other hand have the judiciary in your grip, you can play both cards against your political/business enemies. This is the model of Russia, where the State is deeply connected to transnational organized crime. The Kremlin powers really wanted Viktor Bout free. Now, if the power brokers in the media landscape wanted to tell you the big picture instead of hyper focusing on the day to day circus... (that is also why journalism /= actualities). So these are just necessary steps to clear roadblocks for crime networks. The same for IRS. In Russia you cannot get power without Kompromat on yourself. Like the maffia, the boss needs a kill switch on everyone. From a higher perspective, it is a bit unfortunate that these transgressive steps were foreseen in academia, those despicable expertise centra in the EU and other democratic countries, while the general public is kept in the dark by media houses. I am not sure if it still suitable for HN or that the Overton Window shifted too much already, but the other things that were forecast are the capturing of conservatism by the same networks. We expect also to see further normalization of law breaking, power abuse, power concentration and state capture by non-elected bodies. Yes, this was a normalization process of decades. But now on full acceleration. As an aside, it is not entirely a coincidence that "Accelerationism" is the ideology of associated power circles. And now you also know how Tech Bro's and Conservatism could share the same campaign. Their intended outcomes differ on some points, but they agree on the path to their respective ideals. The extreme destruction that follows will not touch them personally. To ensure that last thing they unlock powers for them self: become the law.
OfficeChad 2y ago
[dead]
troyvit 2y ago
> so why was only the US federal government funding it, especially if it wasn't expensive to maintain? I want to flip this question around as if it was asked by somebody from a country other than the U.S. If I was looking at America since 9/11 from the outside, I would see a country that was trying to destabilize itself. It started out slowly enough, but as the years have progressed the wobble has become more and more pronounced until today, where the U.S.'s trustworthiness is lower than I personally ever thought it could go. And it's going to get worse. So if I lived outside the U.S. I would be asking the very same question: Why would a government that is so unstable and so dangerously powerful be in charge of something that the world kind-of would like to depend on? And I'd start my own version of it asap. I understand from the Reg article that the U.S. extended its contract in the 11th hour, but that just speaks to the point more than anything else.
- yieldcrv 2y ago
  It suggests that an apathetic world and private sector globally is mildly amused that the US uses its resources this way on things they rely on or it suggests that an entire world and private sector is so uncoordinated and budget strapped globally that all this - at least these things - is held together by the US I'm pleased to find out. I'm dismayed at how disruptive doing so has to be, but its either accepting the concept of American exceptionalism, or stepping up and proving the apathy was giving America a bad deal and calling into question how much of an ally anyone was

antonioevans 2y ago

So in what way does this help the American people?

chaostheory 2y ago
My guess is that they were overtly trying to show Russia that we aren’t a direct threat to them anymore in the vain attempt to avoid fighting a two front war in the upcoming global war. Unfortunately, Putin is likely going to keep invading up to Germany’s Fulda Gap. If we’re still a part of NATO, we would have no choice but to declare war.
- netsharc 2y ago
  That feels overly deferrential to Putin... It's like a person with muscles witnessing a beating and then when the perpretaror notices, looking away and saying "I didn't see anything!".
  - cwillu 2y ago
    So, cowardice?
    - kevin_thibedeau 2y ago
      He'll do anything to keep his kompromat from being disclosed.
      - ModernMech 2y ago
        There's no kompromat, Trump and Putin just have the same goals. This whole idea that Putin has kompromat on Trump and that's the only reason he would be deferential to Putin rests on the idea that the American president is aligned morally, politically, and strategically with the long-term interests of America. Sadly, this is not true. The oath Trump took was empty. Trump does not have a pro-America agenda; he has a pro-Trump agenda. His whims are not morally, politically, or strategically aligned with the goals and prospects of the American people, they're aligned with a global billionaire class, to which Putin belongs. That is why they get along. They are allies.

nonrandomstring 2y ago

Funding is irrelevant and a distraction. Dismantling civil cybersecurity is a way to expose a population to influence and other harms that necessitate more "strong-man" solutions later [0,1]. Only after they've destroyed "cyber defenses" can they claim a crisis and declare "cybsersecurity is dead, long live the new cybersecurity". And you can be damn sure it won't be security for you. [0] https://cybershow.uk/blog/posts/computer-security-is-a-political-struggle/ https://cybershow.uk/blog/posts/computer-security-is-a-polit... [1] https://cybershow.uk/blog/posts/usw/ https://cybershow.uk/blog/posts/usw/

BLKNSLVR 2y ago

Trump is going to be surprised for a second time that "everything's computer".

meindnoch 2y ago
"The computer is huge, you know, I told Elon the other day, and by the way I was the first one to say this, the computer is tremendous, tremendously important. Baron, you know, he's so good with the computer, and that's what I said many times, you know, good genes, good genes. A friend of mine, great guy, very smart guy, told me the other day, Donald, the computer, and by the way, this is what most people don't realize in our country, [...]"
- greenie_beans 2y ago
  lmaoooo
- lynndotpy 2y ago
  Is this a real quote from Donald Trump, or a humorous "this-is-what-he-would-say" thing?
  - JKCalhoun 2y ago
    It's hard to know. ;-)
  - kevin_thibedeau 2y ago
    This is our weapon against Skynet. DonGPT will keep it perpetually confused with it's aimless rambles.
  - 2OEH8eoCRo0 2y ago
    Look, having nuclear — my uncle was a great professor and scientist and engineer, Dr. John Trump at MIT; good genes, very good genes, OK, very smart, the Wharton School of Finance, very good, very smart — you know, if you're a conservative Republican, if I were a liberal, if, like, OK, if I ran as a liberal Democrat, they would say I'm one of the smartest people anywhere in the world — it's true! — but when you're a conservative Republican they try — oh, do they do a number — that's why I always start off: Went to Wharton, was a good student, went there, went there, did this, built a fortune — you know I have to give my like credentials all the time, because we're a little disadvantaged — but you look at the nuclear deal, the thing that really bothers me — it would have been so easy, and it's not as important as these lives are — nuclear is so powerful; my uncle explained that to me many, many years ago, the power and that was 35 years ago; he would explain the power of what's going to happen and he was right, who would have thought? — but when you look at what's going on with the four prisoners — now it used to be three, now it's four — but when it was three and even now, I would have said it's all in the messenger; fellas, and it is fellas because, you know, they don't, they haven't figured that the women are smarter right now than the men, so, you know, it's gonna take them about another 150 years — but the Persians are great negotiators, the Iranians are great negotiators, so, and they, they just killed, they just killed us, this is horrible.

prophesi 2y ago

Bit of a sparse article. The near-miss of CVE funding is certainly tragic, but there's no mention of how they siphoned data from the NLRB and locked everyone out of their accounts, and give only a quick mention to cutting federal grants for cybersecurity and CISA's funding. There's a lot more ammo out there to show how incompetent the Trump administration and Musk's DOGE team actually is.

andrewl 2y ago
They're actually quite competent at their real goal, which is not to make America great, but to blow it to smithereens so various titanically rich people can buy everything up, including the land, at rock bottom prices.
judge2020 2y ago
https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-security https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-... Goes into pretty good detail about DOGE employees going out of their way to obscure their activity on NLRB's Azure account. Surely a plus for transparency in government. > Within minutes after DOGE accessed the NLRB's systems, someone with an IP address in Russia started trying to log in, according to Berulis' disclosure. The attempts were "near real-time," according to the disclosure. Those attempts were blocked, but they were especially alarming. Whoever was attempting to log in was using one of the newly created DOGE accounts — and the person had the correct username and password, according to Berulis.
1970-01-01 2y ago
Don't forget about the target on Chris Krebs for securing elections.
skeeter2020 2y ago
this wasn't an article it was an opinion piece.
- prophesi 2y ago
  My bad, the headline certainly makes it sound like it should be informative.

ikekkdcjkfke 2y ago

It is sabotage, but by who?

skizm 2y ago
Pete Hegseth at the behest of Trump mostly: https://www.cnn.com/2025/03/02/politics/us-cyber-operations-russia-suspend/index.html https://www.cnn.com/2025/03/02/politics/us-cyber-operations-...

gadders 2y ago

"The Washington Monument syndrome, also known as the Mount Rushmore syndrome or the firemen first principle, is a term used to describe the phenomenon of government agencies in the United States cutting the most visible or appreciated service provided by the government when faced with budget cuts." https://en.wikipedia.org/wiki/Washington_Monument_syndrome https://en.wikipedia.org/wiki/Washington_Monument_syndrome

deleted 2y ago
[deleted]
vonneumannstan 2y ago
Not sure this fits. Outside HN types how much of the general public cares about or understands Cyber Security?
- gadders 2y ago
  True, but for people in the business that are going to complain, this is the most visible high profile piece.

CivBase 2y ago

Crazy idea: Decentralize the CVE across many nations so that no single organization has the power to eliminate it. Even if the US doesn't play ball, it's a public database right? Is there anything stopping the UN, EU, UK, Australia, etc from copying it and establishing their own joint CVE?

raverbashing 2y ago
The EU has https://euvd.enisa.europa.eu/ https://euvd.enisa.europa.eu/
- CivBase 2y ago
  That's good to hear.

caseysoftware 2y ago

[flagged]

watwut 2y ago
Following quotes are from your own article. IBM did not called them slow or lazy. IBM blamed lack of resources and claimed more resources will improve things. IBM did NOT claimed that current resources are being used ineffectively. > Budget cuts are partially responsible for CVE analysis issues. As noted by Security Magazine, NIST funding was cut by 12% this year, making it more difficult for the agency to enrich CVEs. In practice, the NVD is effectively a downstream consumer of CVE data — while the number of CVEs found and reported remains steady, NIST’s ability to assess and enrich these vulnerabilities has been significantly reduced. > The sheer number of reported vulnerabilities also poses a problem for analysis efforts; Flashpoint research found that NIST reported 33,137 vulnerabilities in 2023. . In part, rising numbers are tied to improved detection capabilities.
deleted 2y ago
[deleted]

deleted 2y ago

[deleted]

axus 2y ago

Signal chats are a sideshow compared to opening up the government to data breaches and foreign influence https://www.newsweek.com/doge-whistleblower-stalked-threatened-raising-alarm-2061087 https://www.newsweek.com/doge-whistleblower-stalked-threaten...

unethical_ban 2y ago
I have conservative family who only read/watch Fox news, OAN and some conservative meme site called twitchy, which is like if Fox news tried to be dumber. They don't see this. There is no true reporting. My mom didn't know about the breadth of tariffs. She didn't know about the DJT crypto scam. I've explained signal to her several times (prior to the news, just getting her to use it). She really doesn't understand anything complicated. She "knows Trump is a jerk" but wants, and I quote, "America for Americans" and for us to put China in its place and to secure the border. edit: I told my dad "Why do you think America is so powerful and influential? It's because we invest in the world and welcome students into this country. We aren't the center of the world for no reason". He simply replied, "We are the center of the world." Our country is filled with people like this, incapable of abstract thought and poisoned by lies.
- totalkikedeath 2y ago
  [dead]
- MattPalmer1086 2y ago
  People always like to think their good fortune is because they have some special sauce that others don't have. But they also resent all the obligations that go with it. Plenty of people in Britain still think the world owes us something, nearly a century after the end of our empire.

kazinator 2y ago

Maybe we need a CVE-like database that isn't dependent on the government of the USA? This is a weakness of the IT world as such.

bigyabai 2y ago
The US government is a pretty good steward of this sorta thing. We're generally reliable, can afford to spend a few pennies securing a lucrative international export, and hold platform-owners responsible even when their executives hide or intentionally obfuscate issues for marketing purposes. Who else can you seriously suggest, knowing the past 10 years of CVE history? Subcontract it to Cisco or Oracle?
pabs3 2y ago
CVE folks are working on diversifying their funding sources: https://www.thecvefoundation.org/ https://www.thecvefoundation.org/

BergAndCo 2y ago

[dead]