3 ms·

> especially if it wasn’t expensive to maintain Okay, so we’ve established that the cost of the endeavor is low. > it’s the global catalog that helps everyone

> especially if it wasn’t expensive to maintain Okay, so we’ve established that the cost of the endeavor is low. > it’s the global catalog that helps everyone organize and talk about vulnerabilities I would argue that leading and controlling the organization that provides the world with the single most ubiquitous cybersecurity resource justifies what you characterized as a meager cost in reputational capital alone. > this is the follow up question to every headline and won't be seen as controversial later, so why bother treating it as controversial to say now It’s not controversial, just a bit aloof. Control of something like the CVE registry is essentially a geopolitical concern at this point, i.e. there has been anxiety brewing about China’s vulnerability disclosure laws for a bit now, much of which is warranted as China has been preventing the disclosure of vulnerabilities and instead stockpiling 0days and leveling up their APT groups. Even if the US wouldn’t exert such blatant influence or control over the program, the fact that vulnerability disclosures are being sent to US entities, or even just traveling through IP space we control, may be alone enough for value to be extracted. This pattern could basically be viewed as the DOGE fallacy at this point.

dmix 1y ago
> I would argue that leading and controlling the organization that provides the world with the single most ubiquitous cybersecurity resource justifies what you characterized as a meager cost in reputational capital alone. Someone in the original HN thread about funding wrote a post explaining how poorly run CVE org was and it had been like that for years. It had a giant backlog, ignored criticism, and moved very slowly. Then the second it shutdown a volunteer organization was assembled overnight. > Control of something like the CVE registry is essentially a geopolitical concern at this point This is purely a reputational concern. Being on government networks doesn't make it instantly more trustworthy or safe. Just like everything regarding security it takes lots of people looking at it, people reporting issues, and an organization that deals with issues promptly.
- sigmarule 1y ago
  > Someone in the original HN thread about funding wrote a post explaining how poorly run CVE org was and it had been like that for years. Sure, but that doesn’t change anything, does it? Most people that use or have benefited from the CVE program are not even aware of these criticisms, and I’d be willing to bet that the majority of people who _are_ aware only became so in the past week. > This is purely a reputational concern. Being on government networks doesn't make it instantly more trustworthy or safe. I did not say the concern was the safety of the CVE program. The concern is influence over the world’s inbox for 0days and the tangible ways that can be used to a nation’s benefit. It is most certainly not just a reputational concern. If China had stepped in last week and took the reins there would be groups within both industry and government having mild freakouts this week.

dmix 1y ago

> I would argue that leading and controlling the organization that provides the world with the single most ubiquitous cybersecurity resource justifies what you characterized as a meager cost in reputational capital alone. Someone in the original HN thread about funding wrote a post explaining how poorly run CVE org was and it had been like that for years. It had a giant backlog, ignored criticism, and moved very slowly. Then the second it shutdown a volunteer organization was assembled overnight. > Control of something like the CVE registry is essentially a geopolitical concern at this point This is purely a reputational concern. Being on government networks doesn't make it instantly more trustworthy or safe. Just like everything regarding security it takes lots of people looking at it, people reporting issues, and an organization that deals with issues promptly.

sigmarule 1y ago
> Someone in the original HN thread about funding wrote a post explaining how poorly run CVE org was and it had been like that for years. Sure, but that doesn’t change anything, does it? Most people that use or have benefited from the CVE program are not even aware of these criticisms, and I’d be willing to bet that the majority of people who _are_ aware only became so in the past week. > This is purely a reputational concern. Being on government networks doesn't make it instantly more trustworthy or safe. I did not say the concern was the safety of the CVE program. The concern is influence over the world’s inbox for 0days and the tangible ways that can be used to a nation’s benefit. It is most certainly not just a reputational concern. If China had stepped in last week and took the reins there would be groups within both industry and government having mild freakouts this week.