3 ms·
> I would argue that leading and controlling the organization that provides the world with the single most ubiquitous cybersecurity resource justifies what you
by dmix 2y ago
> I would argue that leading and controlling the organization that provides the world with the single most ubiquitous cybersecurity resource justifies what you characterized as a meager cost in reputational capital alone.
Someone in the original HN thread about funding wrote a post explaining how poorly run CVE org was and it had been like that for years. It had a giant backlog, ignored criticism, and moved very slowly.
Then the second it shutdown a volunteer organization was assembled overnight.
> Control of something like the CVE registry is essentially a geopolitical concern at this point
This is purely a reputational concern. Being on government networks doesn't make it instantly more trustworthy or safe. Just like everything regarding security it takes lots of people looking at it, people reporting issues, and an organization that deals with issues promptly.
- sigmarule 2y ago> Someone in the original HN thread about funding wrote a post explaining how poorly run CVE org was and it had been like that for years. Sure, but that doesn’t change anything, does it? Most people that use or have benefited from the CVE program are not even aware of these criticisms, and I’d be willing to bet that the majority of people who _are_ aware only became so in the past week. > This is purely a reputational concern. Being on government networks doesn't make it instantly more trustworthy or safe. I did not say the concern was the safety of the CVE program. The concern is influence over the world’s inbox for 0days and the tangible ways that can be used to a nation’s benefit. It is most certainly not just a reputational concern. If China had stepped in last week and took the reins there would be groups within both industry and government having mild freakouts this week.