US abruptly turns off funding for CVE program

transpute · 2025-04-16T01:50:43 1744768243

Ongoing for more than a year.

April 2024, https://nvd.nist.gov/general/news/nvd-program-transition-ann...

  NIST maintains the National Vulnerability Database (NVD).. This is a key piece of the nation’s cybersecurity infrastructure. There is a growing backlog of vulnerabilities.. based on.. an increase in software and, therefore, vulnerabilities, as well as a change in interagency support.. We are also looking into longer-term solutions to this challenge, including the establishment of a consortium of industry, government, and other stakeholder organizations that can collaborate on research to improve the NVD.

Sep 2024, Yocto Project, "An open letter to the CVE Project and CNAs", https://github.com/yoctoproject/cve-cna-open-letter/blob/mai...

> Security and vulnerability handling in software is of ever increasing importance. Recent events have adversely affected many project's ability to identify and ensure these issues are addressed in a timely manner. This is extremely worrying.. Until recently many of us were relying not on the CVE project's data but on the NVD data that added that information.

kulahan · 2025-04-16T02:01:58 1744768918

What has been ongoing for more than a year?

The funding appears to have been cut off today, and both of these comments seem to talk about continuing work and how important it is.

Do you mean to say that some form of threat to the NVD has been around for over a year now? Just want to be sure I'm parsing correctly!

Rebelgecko · 2025-04-16T01:10:43 1744765843

I'm trying to steelman but I really can't think of a non- nefarious justification for this

duxup · 2025-04-16T01:56:32 1744768592

The process seems to be to dismantle anything not nailed down in government.

Now if you want that to be a thing ... you have to go through Trump & Co and pay your bribe to get it back up.

esafak · 2025-04-16T01:58:08 1744768688

Privatize all teh things?

sneak · 2025-04-16T01:19:54 1744766394

We don’t need to spend tax dollars to increment sequential integers.

The “CVE program” can be done by a volunteer or two in spare time. It’s not some major operation, it’s just a registry of integers that can live on GitHub.

Rebelgecko · 2025-04-16T01:56:05 1744768565

How do you get your volunteers in the first place and manage them so you know it's time to get a new one if the quality of their work is slipping?

viraptor · 2025-04-16T01:49:47 1744768187

Yet so far no volunteer has emerged and people who do run CNA are pretty busy with it.

_zer0 · 2025-04-16T01:53:52 1744768432

I think sneak would volunteer to do it since it is pretty simple according to them.

jmclnx · 2025-04-16T01:49:52 1744768192

bradac56 · 2025-04-16T01:32:57 1744767177

dupe - https://news.ycombinator.com/item?id=43698754

（评论） (comments)

（评论）
(comments)