CVE program faces swift end after DHS fails to renew contract [updated]

https://www.csoonline.com/article/3963190/cve-program-faces-swift-end-after-dhs-fails-to-renew-contract-leaving-security-flaw-tracking-in-limbo.html

by healsdata • 1 year ago

1934 961 1 year ago

csoonline.com

bytematic• 1 year ago

What are the implications of this? No more centralized store of vulnerability information?

neuronexmachina• 1 year ago

According to Brian Krebs: https://infosec.exchange/@briankrebs/114343835430587973

Hearing a bit more on this. Apparently it's up to the CVE board to decide what to do, but for now no new CVEs will be added after tomorrow. the CVE website will still be up.

Incipient• 1 year ago

Basically when any software/library/whatever has a vulnerability, they have to communicate that out themselves, in some format.

If I'm developing a product built on 20 libraries, it won't just be a matter of scanning CVEs for major vulnerabilities any more, so I'm more likely to miss one.

"always update" doesn't always work, when to manage a product you realistically have to version pin.

cantrecallmypwd10• 1 year ago

They surprise is: they won't. This will weaken the West.

This is dangerously stupid.

worthless-trash4• 1 year ago

So, while arguably true, there wont be a single source of truth of new cve's. It doesn't however mean there wont be.

I would imagine the only SANE option would be some kind of git repository where CNA's can collaborate. Probably run some code across to make the website that people can easily access.

It's going to be a mess.

joshuanapoli• 1 year ago

Is MITRE's CVE program redundant with NIST's National Vulnerability Database? I'm having a hard time telling how the two are related, or if NVD is simply performing the same service as MITRE.

detaro3• 1 year ago

NIST NVE relies on the CVE program. (vulnerabilities get reported, MITRE assigns CVEs and publishes them, NIST then copies that list and adds their own scoring etc to it)

Spooky232• 1 year ago

Once they fire everyone at NIST, they’ll have that in common.

Rebelgecko• 1 year ago

I'm trying to steelman but I really can't think of a non- nefarious justification for this

duxup• 1 year ago

The process seems to be to dismantle anything not nailed down in government.

Now if you want that (even just funding) to be a thing ... you have to go through Trump & Co and pay your bribe to get it back up.

esafak• 1 year ago

Privatize all teh things?

benfortuna• 1 year ago

This neo-liberal approach has no place for soft diplomacy, which is what US hegemoney relies on.

This isn't just a rapid disassembly of economic structures, any trust and goodwill is completely obliterated as well.

transpute16• 1 year ago

April 2024 article on the result of NVD funding cutbacks, with comments by Linux Foundation OpenSSF, security startups like ChainGuard and commercial vendors, https://www.securityweek.com/cve-and-nvd-a-weak-and-fracture...

  Threat intelligence firm Flashpoint noted in March 2024 it was aware of 100,000 vulnerabilities with no CVE number and consequently no inclusion in NVD. More worryingly, it said that 330 of these vulnerabilities (with no CVE number) had been exploited in the wild.. Since the start of 2024 there have been a total of 6,171 total CVE IDs with only 3,625 being enriched by NVD. That leaves a gap of 2,546 (42%!) IDs.

Despite all those private companies and various OSS projects being willing to contribute ideas, infrastructure and code, they have somehow failed to coalesce into a decentralized replacement for NVD, built on CC0 data and OSS tooling.

giraffe_lady3• 1 year ago

I'm trying to steelman

Why? This administration is not acting in good faith, you don't have to act as if they are. People and institutions doing that is part of how we got here in the first place.

jfengel2• 1 year ago

Force of habit. We don't have a framework for talking under these circumstances, so we apply our outdated ones.

As you say, that's exactly what got us here. But the alternatives are very unclear, and seem deeply unpleasant.

King-Aaron3• 1 year ago

I still find it wild that so many people are trying to frame these decisions through a political lens. This is the actions of a foreign bad actor dismantling critical institutions from within, not "bad policy".

Surely there's an antibody response.

almostgotcaught• 1 year ago

Imagine being eaten alive by a cackling hyena that ambushed you and all the while being like "hmm what is the appropriate steelman here? why do I deserve this? why is this just?"

In reality this would never happen so all these people playing steelman are just detached/insulated.

petesergeant2• 1 year ago

> I'm trying to steelman
Why?

It's a sensible practice and good practice

emmelaich• 1 year ago

It is the belief that it is not in good faith that makes it more important that you try to steelman it.

If the steelmanning fails then you can you can be even more confident that it is in bad faith.

rqtwteye• 1 year ago

I think it’s ignorance and arrogance. The US seems to be on a path to lose technological and science leadership. The current leadership doesn’t seem to understand things that aren’t flashy. I wonder when they’ll dial back on food safety. I am sure RFK knows some vitamins that protect against salmonella

johnnyjeans• 1 year ago

important to note: the US's food safety is already really bad. salmonella isn't a thing you have to worry about in first world countries. can't wait to see what plague demon spawns out of a food industry running amok after the FDA gets gutted.

senectus1• 1 year ago

the guy is ultimate small gov. he wants to rip it out by the roots.

parrellel• 1 year ago

According to the radio this morning, they're currently working to close all the FDA branches that do food safety testing, so, good guess?

polski-g• 1 year ago

We have a 2tn deficit. If Congress wants to fund this, they need to make it mandatory spending and raise taxes.

toomuchtodo• 1 year ago

Or cut from $877B in defense spending instead?

https://usafacts.org/government-spending/

viraptor• 1 year ago

That's a good idea to raise during the budget time or with some warning ahead of time. But even discussing the cost of CVE program itself is likely a waste of time and money. When trying to deal with 2tn deficit, looking at things that historically got ~$5M is just a distraction. And the lack of it may cost even more given how many existing agreements/contracts rely on cve to be a thing - maybe just in gov lawyers having to rewrite things.

rgreek42• 1 year ago

Selling bonds is not the same thing as a family budget being in the red. Either you know this and you're making this argument in bad faith, or you don't and, well...

chris_wot8• 1 year ago

Dear god, you don't just stop running government completely because you have a deficit.

tootie• 1 year ago

This is an absolute pittance compared to the total budget. And considering the current administration wants a $4T tax cut they are not interested in trimming the deficit at all.

01HNNWZ0MV43FF4• 1 year ago

Republicans control Congress, this is bait

alephnerd2• 1 year ago

I really can't think of a non- nefarious justification for this

Tragedy of the commons - NVD and the CVE project havr been backlogged and facing funding issues for a couple years now, and most security vendors are either cagey about providing vulns in a timely manner (as it can reduce their own comparative advantage), or try upsell their own alternative risk prioritization scores.

Every company will gladly use NVD and CVE data, but no one wants to subsidize it and help a competitor, especially in an industry as competitive as cybersecurity.

WesternWind• 1 year ago

It's incredibly foolish. Whatever the justification is, it doesn't matter as much as the horrible outcome.

This is one of those things the government does for the benefit of the whole.

ajross2• 1 year ago

Probably the thinking goes that someone in the international community will step in. CVE is in practice a global registry for all, thus "Why should the USA Department of Homeland Security pay for all the freeloaders".

Still shortsighted and stupid, but it's plausible this is intended as leverage to get someone else to pony up.

Cthulhu_4• 1 year ago

Reduce government spending; since it's not actually a government organization (as far as I can tell, I never looked into it before), other organizations can fund it. How much goes into this organization a year anyway? I'm seeing a Mitre corporation that does lots of other stuff too that has a revenue of 2.2 billion a year.

Multi-trillion-dollar companies benefit from and contribute to this system, surely they can spare 0.01% of their revenue to this bit of critical infrastruture?

bert-ye• 1 year ago

surely they can spare 0.01% of their revenue

They would, if we made companies pay their taxes.

Yes, you can also run such a system based on donations. But I personally think that such a system is important enough to be paid for by the government. When you run on donations, there will always be conflicts of interest and the risk of running out of funds.

But yeah, Mitre being a private organization that was paid for by the government was a problem.

terribleperson• 1 year ago

Yes, I'm sure corporations funding the CVE system would go wonderfully. "It would be best if we don't see any severe CVEs for our products this quarter, if you want our funding next quarter."

kesor2• 1 year ago

MITRE is a non-profit, it receives about $1.5B from the federal government, and another almost $2B from Virginia.

karel-3d2• 1 year ago

Reduce spending. Steelmanning (not actually believing this): it probably cost a lot for what is essentially a database, and can be done cheaply by private sector (Google, Microsoft).

myko• 1 year ago

It's a dying empire, really nothing else to say. The USA led world order is over, we've voted ourselves out of it, and now need to learn how to deal with that.

drstewart8• 1 year ago

Wow! So who is leading the world order now (aka who is funding MITRE)?

throw4847285• 1 year ago

I'll admit this is a bugbear of mine, but I think this is the reason "steelmanning" is counterproductive.

Steelmanning is a neologism that serves no purpose other than in-group signaling. There was already a perfectly acceptable term for the same concept, one with more nuance and a rich history: Charitability.

The major difference is that charitability is about treating your interlocutor with respect. Steelmanning is about using one's own intellect to make your interlocutor's argument better than them. Because charitability is based on a concept of mutual respect, if somebody clearly doesn't respect you one iota, then why would you be charitable? Steelmanning tries to divorce the person from the argument, and is ironically both arrogant and naive.

transpute16• 1 year ago

If you work on OSS software on CVE management, then you already know that NVD funding reductions have been ongoing for more than a year.

April 2024, https://nvd.nist.gov/general/news/nvd-program-transition-ann...

  NIST maintains the National Vulnerability Database (NVD).. This is a key piece of the nation’s cybersecurity infrastructure. There is a growing backlog of vulnerabilities.. based on.. an increase in software and, therefore, vulnerabilities, as well as a change in interagency support.. We are also looking into longer-term solutions to this challenge, including the establishment of a consortium of industry, government, and other stakeholder organizations that can collaborate on research to improve the NVD.

Sep 2024, Yocto Project, "An open letter to the CVE Project and CNAs", https://github.com/yoctoproject/cve-cna-open-letter/blob/mai...

Security and vulnerability handling in software is of ever increasing importance. Recent events have adversely affected many project's ability to identify and ensure these issues are addressed in a timely manner. This is extremely worrying.. Until recently many of us were relying not on the CVE project's data but on the NVD data that added that information.

Five years ago (2019), I helped to organize a presentation by the CERT Director from Carnegie Mellon, who covered the CVE backlog and lack of resources, e.g. many reported vulnerabilities never even receive a CVE number. It has since averaged < 100 views per year, even as the queue increased and funding decreased, https://www.youtube.com/watch?v=WmC65VrnBPI

kulahan• 1 year ago

What has been ongoing for more than a year?

The funding appears to have been cut off today, and both of these comments seem to talk about continuing work and how important it is.

Do you mean to say that some form of threat to the NVD has been around for over a year now? Just want to be sure I'm parsing correctly!

transpute16• 1 year ago

Yes, NVD funding cuts and a growing CVE backlog began in late 2023.

May 2024, https://therecord.media/nist-database-backlog-growing-vulnch...

Moving forward, cybersecurity companies will have to “fill the void” .. NVD said in April [2024] that it is “working to establish a consortium to address challenges in the NVD program and develop improved tools and methods.” .. CISA acknowledged the concerns and outrage of the security community and said it is starting an enrichment effort called “Vulnrichment," which will add much of the information described by Garrity to CVEs.

The second VulnCon event took place last week and no silver bullet has appeared, https://ygreky.com/2025/04/vulncon-2025-impressions/

  Vulnerability enrichment was mentioned in many talks. However, most organizations seem to handle it internally. There doesn’t appear to be momentum toward a shared or open source solution – at least not yet.

cowpig2• 1 year ago

I've noticed that there's a post like this in most articles on HN that could be construed as negative for the current administration: some vague false statement followed by either a factually incorrect explanation or some quote that does not support the statement.

transpute16• 1 year ago

What is incorrect about the post above? There are citations from multiple reputable news outlets for each claim.

People who actually work with CVEs have been posting about this problem on HN for 18 months.

flanked-evergl6• 1 year ago

Why do you post this on a comment that is neither of those things then?

matthewdgreen2• 1 year ago

I did find this post to be non-helpful and confusing. It would be helpful to edit it (or write differently in the future) to clarify that the sudden defunding event occurring today is separate and not related to the previous funding cuts. If that's the case.

transpute16• 1 year ago

Is there no connection between 2025 funding cuts and previous ones? e.g. If a year of work after the previous cuts resulted in an open-data collaboration between NVD and commercial vendors to share a subset of CC0 vulnerability metadata, could that industry collective now argue for government to share (with companies) the burden of funding an open, decentralized program for CVE tracking? Commercial vendors could still offer additional metadata and analytics, over and above the public baseline.

Edit_1: found a proposed bill, April 2025, https://fedscoop.com/public-private-partnerships-bill-nist-h...

A bipartisan bill that would establish a nonprofit foundation aimed at boosting private-sector partnerships at the National Institute of Standards and Technology was reintroduced in the House and the Senate.. the proposed foundation structure was described as replicating similar nonprofits that support public-private partnerships at other science agencies.. we encourage a strategy that leverages NIST’s leadership and expertise on standards development, voluntary frameworks, public-private sector collaboration, and international harmonization.. NIST’s funding has been in focus following a budget cut of roughly 12% to $1.46 billion in fiscal year 2024.

Edit_2: is there a shortage of database rows, or people to write a shell script? Why not pre-allocate N CVE IDs for every CNA, while a new plan is worked out? At least one random commercial vendor could foresee the shutdown early enough to reserve CVEs.

Garrity posted on LinkedIn, “Given the current uncertainty surrounding which services at MITRE or within the CVE Program may be affected, VulnCheck has proactively reserved 1,000 CVEs for 2025,” adding that Vulncheck “will continue to provide CVE assignments to the community in the days and weeks ahead.”

RVuRnvbM2e2• 1 year ago

There is nothing in that article mentioning funding reductions.

That article is about how the volume of software vulnerabilities are increasing, resulting in difficulty keeping up by the CVE and NVD projects.

Please stop spamming this thread with political spin.

transpute16• 1 year ago

Both CVE (MITRE contract) and NVD are funded by NIST, https://www.securitymagazine.com/articles/100795-understandi...

Since February 2024, the National Institute of Standards and Technology’s (NIST) National Vulnerability Database (NVD) has encountered delays in processing vulnerabilities.. caused by factors such as software proliferation, budget cuts and changes in support.. NIST, an agency within the United States Commerce Department, saw its budget cut by nearly 12% this year.

bradac56• 1 year ago

dupe of a dupe https://news.ycombinator.com/item?id=43700258

dang4• 1 year ago

I'm not sure, but the current article looks to have somewhat more information in it, so I've merged that thread hither instead.

92834092322• 1 year ago

Reminds me of Trump's first term where he said if we stopped testing for Covid, we'd stop catching new cases and case numbers would go down. If you stop testing for vulnerabilities then vulnerabilities go down. Easy stuff.

goku128• 1 year ago

That's exactly what they're saying about the HHS cuts and the measles outbreak.

flanked-evergl6• 1 year ago

What I don't get is why people make things up and then get angry at the thing they made up. Is there not enough real things to be angry at?

mjevans2• 1 year ago

Mr. President, Do you want China to get the reports instead, or do you want the NSA to have a lead time where the vuln's are useful tools?

hsbauauvhabzb2• 1 year ago

If you /s/China/Russia/, when asking Trump, it’s no longer a rhetorical question.

hsbauauvhabzb2• 1 year ago

For those reading, a fair few of my recent posts were downvoted after this comment, and it was initially flagged.

If I violated some rule so be it, and I could care less about internet points, but it certainly feels like suppression of individuals based on individual posts which is a behaviour that could end up being the death of hn.

mjevans2• 1 year ago

It seems phrasing it in the form of a joke was too much.

I was trying to convey (with levity/humor) WHY it should continue to be funded as well as the argument that should be made to the one currently in control of the spineless US Congress.

Yes, fixing the vulnerabilities is important. However what the government probably does gain from it is an inside advantage in the lead time for vulnerabilities to protect against, as well as to exploit on adversaries.

stego-tech• 1 year ago

Man, I just can’t even muster the snark I usually have for these sorts of boneheaded decisions.

This sucks, plain and simple.

aprilthird20214• 1 year ago

I can't believe what a bunch of bollocks this administration is. I couldn't believe it the first time, and this time I thought "Well at least I'm ready, it will be a lot like last time" and it's so much worse

01HNNWZ0MV43FF4• 1 year ago

A lot was lost in the midterms and Supreme Court appointments.

Hopefully these 4 years energize people to vote. I know protesting and direct action and so on are also important, but the gradient is not negative for voting for every office you can vote for in every election.

roughly2• 1 year ago

it will be a lot like last time

A lot of people seemed to have had this theory, despite all the evidence to the contrary.

hansvm• 1 year ago

Weren't there major problems with the current CVE implementation, especially with the waves of script kiddies and AI tools spamming the database and the fact that projects who take security seriously have little to no say in the "score" that gets assigned?

czk2• 1 year ago

and then a random 9.8 critical comes that affects some software you have in a way that makes it a 0 in your environment but it doesn't matter cause the cve tanks your organizational Security Score (tm) by 10 arbitrary points and management is wondering when you'll secure the company again because the Security Score is their only tangible deliverable to measure success

idiotsecant• 1 year ago

I feel that. So tired of management being completely uninterested in actual, actionable security holes but getting wildly spun up because they saw a notice with a big scary number that has absolutely no relevance in our architecture.

icameron• 1 year ago

Yeah like when we bundled in a .js library for client side date processing that has a CVE affecting node.js servers with high score. Our auditors don’t care they tag the whole app as high risk. It doesn’t even run on the server!

giantg2• 1 year ago

Most tracking tools have exception processes. But yeah, security as a product family instead of a simple score seems to be a foreign concept at most companies.

maronato2• 1 year ago

Don’t let the perfect be the enemy of good. It is(was?) a very useful and important system.

Trump must be receiving a lot of emails from companies wanting to fill the void, and I bet the Trumpiest of them all is going to be awarded a contract worth 10x the budget CVE had, and do a much worse job.

horacemorace• 1 year ago

It’s Way Better than what we had before: software vendors making even arbitrarier decisions about how to classify them.

There are far too many bad actors for us to operate as an industry with no yardstick.

ngneer4• 1 year ago

Spot on. Vulnerability scanners that make up an organizational Security Score (TM) tend to operate at the wrong level of abstraction, flagging some library somewhere that never runs and has nothing to do with your production flow or architecture, or some test keys with zero security impact. Go explain that to management, because obviously the security tools are right and you are wrong. This sad state of affairs is unfortunately the best that the security industry has been able to deliver. Trying to wrangle complexity by adding more complexity is the craziest notion to me. Yes, no scoring scheme is perfect, but when the scheme introduces more noise, what have we gained (well, security vendors gain, but what have organizations gained).

elric2• 1 year ago

Solving this problem in a generalized way is really hard.

Maybe I have a dependency on Foo which has a critical vulnerability in a feature that I don't use. I suppress the warning and all is well. Then two weeks later someone on my team decides to use that feature, not knowing that there's a problem with it. Now we're fucked, and we'll never know because the vulnerability has been suppressed.

sepositus• 1 year ago

I don't know of anyone who doesn't quickly become exhausted after running a CVE scanner on their code.

gcr• 1 year ago

These sound like downstream effects of funding stress to me, no?

tdb78932• 1 year ago

The scores were never going to be that accurate across people's environments (IDK how much other places relied on them, places I worked never did that much) and issues with the scores don't seem to be a good justification to torch the whole CVE system anyway.

hashstring• 1 year ago

This^ and to add to that, at the very least MITRE assigned IDs which is great. Plus they did an initial scoring, which, well… will never be perfect like you said and I’m sure these things evolve throughout time and get better (not talking necessarily CVSS vX).

What a shame on this current gov. administration, if you can even call it that.

mike_hearn3• 1 year ago

Why isn't it a good justification?

I think the question everyone in this thread should ask is: why is it the government's job to do this, especially given the prior widespread view that they're doing a bad job? Is the software industry so immiserated by poverty that it cannot organize its own distribution of security bulletins? Clearly not: GitHub already runs its own vuln tracking scheme that's better integrated with the tooling we use for open source software. The industry routinely sets up collaborations like standards bodies, information sharing groups and more. And there is as whole ecosystem of security companies to help you understand vulns in your stack.

So there seems nothing specific to CVEs that requires government involvement, but the existence of the tax funded scheme does discourage the creation of competitors that might function better.

But, to CVE or not to CVE ... that is not the question. US deficit spending is out of control. This sort of thing had to happen some day. It's what Europeans in the 2010s called "austerity" and it always makes some people scream but this graph:

https://fiscaldata.treasury.gov/americas-finance-guide/natio...

... is not sustainable. Up to 1984 overall US debt was stable. Since then its growth rate became dangerous. Debt/GDP ratio is now worse than just after WW2. The federal government is currently spending more on interest than on defense or Medicare:

https://www.crfb.org/blogs/interest-costs-have-nearly-triple...

The US is currently getting its first taste of what parts of Europe started going through in 2008, and unfortunately there's bad news: the cuts you're seeing now are mostly cosmetic. They're what can be done within the current framework of laws, sort of, with lots of bending of the rules and creative interpretations of them and maybe some oversteps. But it's just the start of what's needed. Large scale reform of the laws themselves will be required regardless of whoever wins the next elections.

cantrecallmypwd10• 1 year ago

This is bikeshedding. The point is an authoritative process and an identifier

All this does is help Putin and other rich grifters.

GolberThorce3• 1 year ago

you like to say word 'bikeshedding', adoption of formal intellectualish sounding terminology even when inappropriate is orange-site affliction I advise against. I am saying this for your own sake... speak truths with POWER

aprilthird20214• 1 year ago

Sure. There's also major problems with the video encoding pipeline at my big tech job. Let's just delete it

ajross2• 1 year ago

Weren't there major problems with the current CVE implementation

Absolutely. And if the headline was "DHS proposes improvements and streamlining to the CVE program" we'd all probably be cheering.

Leaping from "This is Flawed" to "Let's kill This" is a logical fallacy. A flawed security registry is clearly better than no security registry.

GolberThorce3• 1 year ago

There are a lot of logical fallacies. Have you heard of the sunk-cost one? Or fallacy fallacy maybe? Or ten-tendril eschatomon fallacy?

In honesty to say "logical fallacy" is spoddy, I advise against for aesthetic reason.

worthless-trash4• 1 year ago

This will get lost in the noise, but i think you mean cvss.

CVE is simply identification of a flaw, not a scoring system.

bjackman3• 1 year ago

As an active consumer of CVEs: yea there are major problems. No there's nothing better and no I don't have any better ideas.

The scores are mostly useless, I would not care if they disappeared, I do not look at them. I don't really understand why people get so upset about garbage scores though. If a high CVSS score creates a bunch of work for you then your vuln mag process is broken IMO. (Or alternatively, you are in the business of compliance rather than security. If you don't like working in compliance, CVSS scores aren't the root cause of your misery).

Having a central list of "here's a bunch of things with stable IDs that you might or might not care about" is very valuable.

Sander_Marechal2• 1 year ago

you are in the business of compliance rather than security.

So, most businesses. They all need their ISO/NIST/HIPAA/etc certs.

bamboozled3• 1 year ago

Getting a bit tired of posts like this (no offense), something dumb / nefarious happens like funding is cut for <useful thing>, then someone posts an off the cuff comment or question like, "wasn't this <useful thing> not that useful because <superficial reason>?".

Why do people do this, to down play all the destruction of the last few months? Seems to be some type of coping mechanism.

rco87865• 1 year ago

Every system has problems. The challenge is to address the problems and fix them. Not just delete the entire system and claim a win.

declan_roberts• 1 year ago

Yes it earnestly needed new direction and leadership.

bearjaws• 1 year ago

Classic "oh its broken so throw it all away".

It's the way it is because there isn't a good alternative. They cannot possibly know every environment that we operate in.

To this day we still have large corporations down playing their issues, and it was way worse 20 years ago.

ggm2• 1 year ago

I wish this hadn't happened.

I wonder what level of compartmentalisation inside DHS means they didn't see this as having sufficient downsides?

I ask this, because I don't think anyone in the subject matter specialist space would have made a strong case "kill it, we don't need this" and I am sure if asked would have made a strong case "CRISSAKE WE NEED THIS DONT TOUCH IT" -But I could believe senior finance would do their own research (tm) and mis-understand what they saw in how other people work with CVE, and who funds it.

hackyhacky• 1 year ago

I wonder what level of compartmentalisation inside DHS means they didn't see this as having sufficient downsides?

This was not a carefully-weighed decision based on a cost-benefit analysis. This was a political order, consistent with the administration's policy of "cut everything, recklessly, indiscriminately."

tmpz22• 1 year ago

Destroy, destroy, destroy. Promise to rebuild but don't. Take it all.

SecretDreams• 1 year ago

cut everything, recklessly, indiscriminately

Mostly discriminately, tbh.

derbOac• 1 year ago

There are many problems going on right now, but in terms of cuts this is one of the most problematic: everything is secret, with no oversight or deliberation. It's indistinguishable from corrupt malice because it's not done with open thoughtfulness.

tlogan4• 1 year ago

Yes, this is 100% consistent with their policy: cut everything and if you find out that something is really really needed then reverse it.

markhahn5• 1 year ago

it might be ignorance; it might be malice.

it might also be deliberate: that they actually don't think the government should be involved in this sort of thing. after all, someone could be making a profit on this, and that seems to be their highest value. if gov is involved, that makes it a communal effort, and you know what else starts with "commun-"?

yes, those reasons are stupid and ignorant AND intentional.

but is there any evidence against that interpretation?

ggm2• 1 year ago

Hanlon's razor. I also tend to impute malice to things I don't like, but I think it's hard to go past stupidity.

incompatible• 1 year ago

someone could be making a profit on this

Yes, there are apparently various ways of profiting from vulnerabilities. The interesting question would be whether any of the regime insiders have a way to profit.

Aurornis• 1 year ago

This sort of thing is happening across the federal government. There is no rhyme or reason. DOGE has been given an unrealistic target for cuts and they're desperately cutting whatever they can get their hands on. If you look at the federal budget it's nearly impossible for DOGE to hit their stated goals without touching benefits like medicare and social security (which are off limits so far) so the only option is deep, deep cuts into the narrow slice of the federal budget that excludes those protected categories.

There is no rhyme or reason to what gets cut, other than someone under pressure to hit KPIs (dollars cut) was desperately searching for things that looked easy to cancel.

This is happening everywhere the federal government touches. Most people aren't aware of it until they come around and pull the rug on something that intersects with your own life.

Even my die-hard Republican distant relatives are suddenly shocked because programs they benefited from are being cut. They thought they voted for something different.

shakna2• 1 year ago

I'd say that the rhyme and reason are quite clear [0]. They published a playbook, and they are implementing it at a record pace.

The NSC [National Security Council] staff will need to consolidate the functions of both the NSC and the Homeland Security Council (HSC), incorporate the recently established Office of the National Cyber Director, and evaluate the required regional and functional directorates.
Given the aforementioned prerequisites, the NSC should be properly resourced with sufficient policy professionals, and the NSA should prioritize staffing the vast majority of NSC directorates with aligned political appointees and trusted career officials. - Project 2025, pg 52.
... History shows that an unsupervised NSC staff can stray from its statutory role and adversely affect a President and his policies. Moreover, while the NSC should be fully incorporated into the White House, it should also be allowed to do its job without the impediment of dually hatted staff that report to other offices. - Project 2025, pg 53.

The goal is to build up a political organisation to use as a weapon, and to scrap the rest - as a legal excuse to say that the political appointments will be necessary.

[0] https://www.project2025.observer/

sofixa2• 1 year ago

This sort of thing is happening across the federal government. There is no rhyme or reason. DOGE has been given an unrealistic target for cuts and they're desperately cutting whatever they can get their hands on

You make it sound like poor DOGE employees are being forced to do this on this kind of schedule, which definitely isn't the impression I got. They're all a bunch of incompetent overconfident weirdos who think they know better and what to do. Is there any pressure to do anything quickly?

And the US federal budget is quite easy to trim. E.g. remove an aircraft carrier from the planned construction pipeline and you've saved $15 billion with no actual ramifications.

ForOldHack3• 1 year ago

The ryme is Humpty Dumpty, had a great fall. Now China and Russian security forces step up their relentless attacks. Let's hope the white house falls first.

riffraff3• 1 year ago

Even my die-hard Republican distant relatives are suddenly shocked because programs they benefited from are being cut. They thought they voted for something different.

Out of curiosity, which programs? And is this enough to change their opinion about Trump, or do they still think it'll be worth it?

bruce5112• 1 year ago

>They thought they voted for something different

Like what exactly? I mean the guy ran on cutting the budget by 2 trillion. In his last term he gave tax breaks yo the rich. Where did they think the cuts were coming from?

He ran very hard on raising tarrifs. Which demonstrably raise prices (thats literally their goal.) But now people claim "I didn't vote for this."

In truth they voted for him because he was the Republican on offer and they're die-hard Republican. The Republican party has made no secret of its agenda for decades.

I get it, people are good at cognitive dissonance. But this is the place for blunt truth. They voted for this. I'm not letting Republicans got off the hook here. They voted for this.

Just like to my Republican friends who are upset that CVE is cut. You voted for this. The general public benefit from CVE even though they dont know it exists. Just like you benefitted from dozens of other programs you didn't know existed, but have also been cut.

That's the problem with cuts. They ultimately end up hurting everyone.

Now clearly there's some fat that could be trimmed. Companies do it all the time. Done well its good. Swinging a hatchet in a crowded elevator does not seem like "Done well".

eCa• 1 year ago

They thought they voted for something different.

They voted for the leopards to eat other people’s faces, not their’s.

russellbeattie• 1 year ago

Remember, DOGE has nothing to do with money or "efficiency". It's a pure ideological dismantling of the Federal government aimed at eliminating oversight, regulations, assistance and entitlements as envisioned by ultra-conservatives for decades.

This isn't speculation or hyperbole, it's specifically laid out in their published plans: By hobbling or outright eliminating federal agencies responsible for executing the laws passed by Congress, the administration can circumvent the democratic process and impose their extreme vision of limited government on the country, regardless of popular support.

The U.S. system of government relies on established norms as much as it does law. Conservatives realized that they can ignore precedent with impunity if they had an executive willing to do so. They then spelled out exactly how, and are now enacting that plan.

Then SCOTUS's decisions last summer turbo boosted their agenda. The ruling that only Congress can hold the President legally accountable essentially means executive power is unchecked if the legislature is unwilling or unable to Impeach and convict. The President can now confidently ignore the law and judicial orders with a veneer of legality. And this is what he's doing.

(The fact that all this just so happens to benefit Russia after their decade long campaign to destabilize their opponents in the West is a topic for speculation.)

DOGE is about permanently altering how our country works modeled on the right wing worldview, plain and simple. Since that's their overall goal, they're not concerned where they swing the wrecking ball - it's all going to get destroyed eventually.

fennecfoxy3• 1 year ago

Something different like gay people, women, immigrants all suffering while they laugh. Who's laughing now? From an outsiders perspective, I sincerely hope that Republicans get to feel a fraction of what these usually marginalised groups feel every day.

You'd think that lessons would incite learning but that has never seemed to be the case throughout history.

Spooky232• 1 year ago

No, we’re in a middle of a coup. Palantir or some other odious company will get paid 100x more to do something.

cavisne• 1 year ago

MITRE has a trademark on the term CVE.

ozim2• 1 year ago

People will not submit vulns as happily to such business.

Most of vulns will go unaddressed because company like palantir will most likely want only really good vulns like 0-click RCE.

epistasis5• 1 year ago

Your words don't make any sense in this environment. The idea that any person at an agency could stand up to or convince the DOGE team of anything is preposterous.

Anything that weakens the US or puts our cybersecurity in a place that Russia can exfiltrate data will happen. This is not about the US needing anything and it's silly to think otherwise. See also the NLRB whistleblower and the security backdoors that DOGE demanded to allow data exfiltration and the subsequent death threats to the whistle blower.

You mindset is behind the times and needs to adjust to a, frankly, insane current reality.

mmooss3• 1 year ago

Your words don't make any sense in this environment. The idea that any person at an agency could stand up to or convince the DOGE team of anything is preposterous.

Your comment embraces and spreads the powerlessness they want you to feel and spread.

Of course you can stop them - like any other negotiation in life, especially non-friendly ones, you need to make it in Trump's interest either by carrot or stick. Trump has interests; identify them and identify your power in those regards ('power and interest' is the term), and use it.

Also, stop helping them make DOGE the scapegoat. It's Trump.

tgsovlerkhgsel• 1 year ago

If you made this careful analysis, you'd hear "CRISSAKE WE NEED THIS DONT TOUCH IT" for almost everything (and it likely would be right for a significant portion but not everything).

That's why the current approach seems to be to axe everything, listen to how much screaming there is, then reinstate only the projects where the screaming is really loud.

delusional2• 1 year ago

You forget that their stated policy (and I don't doubt their commitment) is that whoever complains the loudest were probably scamming. That "honest people don't complain"

conception• 1 year ago

So the dumbest way to do anything. Got it.

overfeed• 1 year ago

"kill it, we don't need this"

"We are paying MITRE how much? Bigballs and co will write a better ststem in 1 week and have it integrated with xAI. How hard could it be? Send out a first draft of an xAI contract to our DHS contact"

IOT_Apprentice• 1 year ago

They were at the mercy of 20 year olds from doge. I wonder when doge enters the NSA & NRO WHAT information will they steal & put in their hard drives.

All of this is criminal behavior on the the current regime.

eadmund• 1 year ago

I wonder what level of compartmentalisation inside DHS means they didn't see this as having sufficient downsides?

The National Vulnerability Database has been unable to keep up with the flow of CVEs for over a year now:

- https://anchore.com/blog/national-vulnerability-database-opa...

- https://www.cyberreport.io/news/cve-backlog-update-the-nvd-s...

- https://www.ibm.com/think/insights/cve-backlog-update-nvd-st...

- and many, many, many others

It has been a complete disaster for months. At this point, perhaps the thinking is to radically change approaches?

gtirloni• 1 year ago

You assume there's a plan. Interesting.

rco87865• 1 year ago

perhaps the thinking is to radically change approaches?

If there had been a replacement or reform plan for even one single iota of the things this admin has cut, I might give them the benefit of the doubt. But there's not. It's just kill, kill, kill.

metabagel• 1 year ago

Cutting the program would seem to go in the opposite direction of what is needed.

rco87865• 1 year ago

I wonder what level of compartmentalisation inside DHS means they didn't see this as having sufficient downsides?

Come on, are you living under a rock right now? There are massive indiscriminate funding cuts to anything that Elon/Doge deems to be "fraud", and they explicitly do not care about the collateral damage.

This is not about the DHS or "compartmentalization". This is just a politician running amok and having real consequences.

martin8412• 1 year ago

Also there has been funding cuts to all agencies where Musk is currently under investigation. NHTSA is getting cut so they can't get in the way of Tesla.

paulmendoza2• 1 year ago

No one analyzed it most likely. It’s possible on of the college students working for Doge doesn’t understand security because they are a child with no real world experience that Elon brought in to slash costs.

yawnxyz• 1 year ago

I guess their new business model is to sell zero days to the highest bidder

alephnerd2• 1 year ago

The private sector zero day market collapsed last year with Zerodium - corporate bug bounties, nation states in-housing offensive security operations, and the democratization of knowhow destroyed the Zero Day market.

nkassis• 1 year ago

My tinfoil hat says they want to privatize this through one of the administrations friends. A disastrous decision here.

92834092322• 1 year ago

Palantir is about to get a contract.

goku128• 1 year ago

I thought that the point of the CVE database is to improve security, not wreck it?

aprilthird20214• 1 year ago

Or worse, NSO Group

epistasis5• 1 year ago

Why would they spend money to replace it? The idea is to weaken and destroy the US and its institutions. Giving Palantir money might mean that security improves, and that goes against their goals. They have already demanded that Russia stop being treated as a cybersecurity threat in other areas of the government, this is a way to ensure that systems are vulnerable to attack.

throitallaway9• 1 year ago

Exactly. The Trump admin is well on its way tanking the USD with tariffs and getting every country (including the penguins) mad at us. The rationalization given by the admin for tariffs (trade imbalance) make zero sense, and they haven't offered anything else.

phatfish• 1 year ago

These sort of government services are always under attack by private organizations. The US Gov doesn't have to give Palantir or whoever a contract, they just cede the ground, give the right people a heads up, and then make the new subscription service a "recommended service provider" as a solid to whichever of Elon's circle gets the nod.

In the UK the some "entrepreneur" was after monetizing access to the Land Registry a couple of years ago. Apparently the free UK Gov service was not fit for purpose it needed a paywall to make it better. Nothing as globally significant as the CVE database, but you can see if the vultures are going after small UK Gov services, something like the CVE database is absolutely a chance to add to the executive bonus pool.

markhahn5• 1 year ago

Trump stupidity hurts the country and world.

But maybe this is an opportunity to do CVE better.

cantrecallmypwd10• 1 year ago

But maybe this is an opportunity to do CVE better.

Okay, how? This sounds like looking for lemonade in a genocide.

robertlagrant2• 1 year ago

This sounds like looking for lemonade in a genocide.

It really doesn't. This level of catastrophising has no point. It would be nice if CVE continued to exist, but it wasn't close to perfect, and perhaps it can continue in another form. There's no particular reason the US taxpayer has to sponsor global security threat tracking any more than any other taxpayer or customer.

bathtub365• 1 year ago

Now the NSA can hoard more 0days and the general public suffers. Win win for this administration

goku128• 1 year ago

It's more likely to boost the zero day black market. I don't know if I want to attribute this to idiocy (indiscriminate cost cutting), greed (contracts for their crony pals) or malice (hoarding and trading 0 days).

gryfft2• 1 year ago

¿Por qué no los tres?

outside12342• 1 year ago

These four years are going to be the death of all of us.

cantrecallmypwd10• 1 year ago

War with China and doing enough reprehensible acts to stoke protests to declare martial law to stay in power indefinitely.

throitallaway9• 1 year ago

I feel like we're only a few weeks away from someone "home grown" experiencing an "administrative error." The slide into madness continues.

wiseowise• 1 year ago

Wait until they start a war against Albania.

Latty3• 1 year ago

I find it a little incredible people are still talking about "four years".

They tried to reject the election result and do a coup, and were rewarded for it by getting back into power. They are refusing to follow the law or the courts. They are sending people to gulags in foreign countries. All the checks and balances were destroyed last time. The party has been stripped of anyone who would fight the admin or reject this illegality. They have set up a power grab over elections.

There will not be free and fair elections in four years unless they are simply too incompetent to rig it, the rubicon was crossed long ago. Without mass protest that makes it impossible for them to hold power, American democracy is dead.

They have tried to do it, they say they want to do it, they have the ability to do it, they are actively doing it, and no one is stopping them. How are people still acting like in four years they are going to neatly hand over power to be prosecuted for their crimes?

SpicyLemonZest3• 1 year ago

Organizing mass protests isn't something you do instead of organizing electoral opposition. Even in countries that haven't had fair elections for a while, people generally still organize opposition and talk about how they're going to vote. The best way to ensure your opponents retain power is to go around telling people it's too late and they've already won.

phtrivier4• 1 year ago

I understand you have elections in two years, don't you ? I don't know if a complete reversal congress is possible.

That would be a good litmus test. "They" have not prevented special elections so far ; if "They" need to prevent the next one, whatever they try will happen then, I suppose ?

outside12342• 1 year ago

Number one rule in opposing anti-democracy forces is to NOT OBEY IN ADVANCE.

We are going to have elections.

atomicbeanie• 1 year ago

The white house prefers chaos. This will certainly be a step in that direction.

yieldcrv• 1 year ago

if only there were 188 other countries and an entire private sector in each one that could fund this thing they are also affected by

xyst• 1 year ago

Some companies are already clueless when it comes to CVE management. Probably won’t see the effects immediately but give it a few more years for new generation of vulns to be created/found and we will be back to early 2000s level security.

Open season on American corporations for domestic and foreign hackers.

If program isn’t brought back then CVE database likely to be fragmented amongst the “private” CVE databases.

Sec Corp A has 700 well documented CVEs but Sec Corp B has 702 CVEs in their database since NIST funding pulled. What do corps do? Maybe some of them with massive budgets setup contracts with both to get “full spectrum coverage”. Maybe other non-technical companies that think of IT as strictly a cost will go with the cheapest or forego it all together.

Who knows maybe we get ~~~free labor~~~ open source community to pick up the slack?

This country with the orange man administration is quickly going to shit. Not in a “I dislike {opposing party} way” either. In a “I dislike authoritarian regimes” way.

mmooss3• 1 year ago

In a stunning development

Who is still stunned by these things? They want you to be stunned; they want you to tell everyone else that you're stunned to spread feelings of terror and powerlessness. If you actually are stunned, you are stunningly ignorant. If you are not and still saying it, perhaps to emphasize your unhappiness, you are a 'useful idiot'. Either way, if you are saying it, you are a useful idiot.

You should have known decades ago: The GOP impeached a President for lying about sex; they fabricated intelligence to invade another country (killing thousands of Americans and 100,000+ Iraqis) - and that was all before 2004. They've voted almost unanimously, multiple times, to bankrupt the country (by refusing to authorize debt for existing obligations). Nobody (i.e., the Dems failed to) stopped them or made them pay a price, so why wouldn't they keep doing those things. (Edit: And if you object because the analysis criticizes one side and therefore you reject it as partisan, that's a big part of the reason nothing was done.)

This time they published Project 2025, telling you what they were going to do.

mcintyre1994• 1 year ago

Project 2025 literally calls for dismantling the DHS. Seems pretty unsurprising that the CVE database wouldn’t be in the list of things they’d care to maintain in that process.

arghandugh• 1 year ago

This industry relentlessly lionized Trump and Musk, elevating them to positions of power and handing them the power to destroy at will.

This is your moment! Enjoy it!

Gigachad• 1 year ago

It’s astounding that the users here watched all the horrendous things going on and ignored them. But now the CVE numbers are gone it’s shocking and too far.

throitallaway9• 1 year ago

Come again? This is Hacker News, a heavily moderated forum with a narrow focus. We don't discuss Israel or El Salvador here (unless it's tech related.)

flanked-evergl6• 1 year ago

Please, this place has permeated with Trump rage since before he took office. The only way you could think he was ignored is to not have read any comments.

pseudalopex9• 1 year ago

It’s astounding that the users here watched all the horrendous things going on and ignored them.

Many most voted and most commented submissions were the other things.

Ferret74462• 1 year ago

I don't see why this should be publicly funded, so I don't really see an issue with this. The industry benefits from having a CVE database, so the industry should fund it.

klysm• 1 year ago

There are going to be all kinds of messed up incentives if this is funded from industry.

throitallaway9• 1 year ago

True, although Google's Project Zero seems to be run pretty well.

Ferret74462• 1 year ago

Like what?

guhidalg2• 1 year ago

No, "the industry" is all of us alive in the 21st century who depend on software to make material decisions and to be resilient to attacks and tampering. We were all funding it, and now surely we will see some big tech company now assume responsibility from the federal government (please god don't let it be Oracle...)

skirge2• 1 year ago

so "all" should pay, not only US taxpayers.

kristjansson• 1 year ago

Because secure systems benefit the public generally, not just the corporations that make a profit operating those systems.

maronato2• 1 year ago

The industry won’t want to fund it. It’ll want to profit from it.

insane_dreamer4• 1 year ago

So you trust industry now?

sMarsIntruder3• 1 year ago

Same question would be for government funded agencies.

Xelynega2• 1 year ago

Don't open source developers and users of their software also benefit from the CVE database?

If it were privately funded, what incentive would these private companies have to track bugs for these open source projects that don't make money?

sMarsIntruder3• 1 year ago

The insane number of downvotes you’re getting for saying basic common sense stuff, it’s why we should push for stricter political rules here in HN.

You didn’t say something wrong or controversial, just an opinion. Some ideologies love to pay things with other people’s wallets, and they’ll do whatever they can to pursue this.

sMarsIntruder3• 1 year ago

Especially the L guy who downvoted this after 10 seconds. get a life

the_doctah• 1 year ago

Why is the government responsible for CVEs again?

throitallaway9• 1 year ago

Every now and then the government decides to fund things. Public schools, roads, police, firemen, GPS, NOAA, cybersecurity, government cheese, etc.

sschueller• 1 year ago

"the government" aka "We the people". It is in all our interest. This is like asking why the government is responsible for roads.

dingaling• 1 year ago

This is like asking why the government is responsible for roads.

Thought experiment:

If roads were built by private companies, could a Government justify the expense maintaining a database of all the potholes?

jowea7• 1 year ago

National (technological) security?

wichitawch2• 1 year ago

I'm surprised that it was USA's responsibility to fund this in the first place. Why weren't other countries providing funds?

defrost• 1 year ago

It's a near certitude that Russia and China each have databases of exploitable software errors and prize zero days.

It was to the advantage of the US and allies to coordinate and lead in tracking and fixing such errors.

Multiple countries, companies, and individuals contributed finding and fixing bugs.

The administrative task of keeping track was one part of a greater picture, a part that came with first to be advised and other perks.

It's not that the US had a responsibility to take on the lead admin task, more that in past times the US saw an advantage to being at the centre of global action.

This is just another part of increasing US isolationism.

wichitawch2• 1 year ago

It was to the advantage of the US and allies to coordinate and lead in tracking and fixing such errors.

From what I understand of the article, none of these allies were funding it.

Multiple countries, companies, and individuals contributed finding and fixing bugs.

Clearly that itself isn't enough. Someone has to pay for maintaining this service. It appears that no one other than USA spent money in funding it.

insane_dreamer4• 1 year ago

It's called providing leadership. Worth the money. China will happily fill the void.

bamboozled3• 1 year ago

I hate this whole disaster but why can't Europe step in for stuff like this?

lars_francke4• 1 year ago

The CVE program was started over 25 years ago. It is very reputable (until yesterday) and it was very much in the interest of the US to be seen as the stewards of this.

The funding requirements can't be that high and I'm willing to bet that other countries and entities would have happily stepped up if they had the chance.

Up until recently CVE was very centralized and only in the last few years have there been steps in more decentralization with CNAs taking more responsibility, Red Hat as a CNA of last-resort etc. So, the cost of doing all of this work has already been shifted partially (!) away from the US but I have not seen any movement towards e.g. moving the program to a foundation which could have been done.

Personally I would conclude that it was the responsibility of the US to pay for this because they wanted to and it was in their best interest to control this program.

flanked-evergl6• 1 year ago

They have the chance to step up now. Every Comercial company that is supposedly so reliant on this for their very existence has the opportunity today. They can fund it.

happosai• 1 year ago

Because USA was a superpower that can afford it easily. Taking the leadership in everything is quite cheap price to pay when the other end of the bargain is everyone else has to follow you.

Now of course USA is ceasing (voluntarily, by stripping down every international soft power effector in government) to be a superpower, to the great glee of dictators all around the world.

The "we can't afford being great" is a direct admission that USA is no longer a superpower. And is not going to become great again, just another nation again (at whims of China).

lyu072822• 1 year ago

The nazis don't think that though, uh I mean conservatives. After they've burned down everything, they expect still to be a superpower somehow. Do they think they can just start a war with everyone who doesn't play ball? It's hard to comprehend what their rational is, if there is one.

aabhay• 1 year ago

I’m surprised that the world’s greatest universities are in the United States. Why weren’t other countries providing funds?

toyg• 1 year ago

Don't worry, that will also end soon. Regimes that require political subservience from universities, like the current US administration, inevitably result in poor research capabilities in the long run.

tdb78932• 1 year ago

The US has made at least hundreds of billions of dollars from it's tech companies and has had a dominance over global tech for a long time. The tech industry has brought a crazy amount of money and power to the US so it makes sense the US puts extra effort to support it.

The US isn't supporting it out of charity, it's good for US businesses to have someone coordinating this for everyone. Why would we want to rely on other countries to be supporting our tech sector? At least now we are subject to only the capricious whims of our own government, as little comfort as that is right now (if another country was funding it we would be relying on the whims of a foreign government, which isn't ideal when tech is the golden goose of your modern economy).

jeroenhd5• 1 year ago

It's a program the US government spun up to serve America's interests. Why would someone else pay for American interests?

Other countries have their own programs, some cooperating with the US, others separate. China has the CNNVD if you're interested in helping Chinese society safe. My government operates https://advisories.ncsc.nl/advisories to serve my country's interests.

Of course, the US is free to abandon their programme and rely on Chinese, Russian, and European vulnerability databases to keep their country safe. It does save them a couple of million after all!

phtrivier4• 1 year ago

Because, contrary to popular views, there is no "government of the world".

So, since the US government needed that (it provides security to US businesses), they organised and funded it (as everything else, with US taxpayers money, and savings from investors in US and abroad.)

Now, the US government decided to commit temporary-seppuku, so a number of things will happen:

* state-level government will use their local-taxpayer money to fund similar efforts (with duplication of effort), or share it with everyone

* another country or block of country will do it, and decide whether they want to "share". (I suppose Russia and China have more of an incentive to keep their CVE DB private, given their level of dis-integration with US economy ? EU maybe ?)

* an international, ad-hoc organisation is created to share the funding (something like NATO.) Multi-latteralism is not exactly in fashion this days, but if EU does it, it will be "international" by design since we're not really a federation ; so, states in "Southern Canada" are welcome to join.

* or none of that happens, the CVE db rots for a while, until a sufficiently embarrassing cybersecurity problem occurs, and the CVE db is deemed worthy of the "10% you need to bring back" by President Elon.

Pray your company, families and friends are never on the wrong side of the "reverse-Chersteron's fence".

rurban• 1 year ago

So who will maintain it then? Either the EU or China I suppose. They can easily fund it.

Maybe the Dutch should go ahead.

lars_francke4• 1 year ago

ENISA in Europe has the mandate of building a EU vulnerability database for the NIS 2 directive anyway and it's coming soon...

And CIRCL in Luxembourg are providing vulnerability-lookup which can also assign IDs but in a more decentralized way: https://www.vulnerability-lookup.org/documentation/

VulnerableCode can help with discovery etc. https://vulnerablecode.readthedocs.io/en/latest/introduction...

So, parts of this are already in place and I assume this will be a big boost towards a new vulnerability ecosystem.

esnard• 1 year ago

This sounds like good news, thanks!

Do we already have an ETA for the ENISA vulnerability database?

jeroenhd5• 1 year ago

Us Dutch have https://advisories.ncsc.nl/advisories although a lot of that is just analysing CVEs and their impact on society.

An EU solution would probably be much better. Would suck for Americans, though, they'd need to get up early to meet European office hours.

cbondurant• 1 year ago

Am I missing something or was this literally announced with less than 24 hours of warning that one of the critical components to the cyber security landscape was disappearing.

What the fuck are you supposed to do about this. This is something that should have had multiple MONTHS of warning in order to allow those who depend on the CVE infrastructure to plan what to do next with their security posture.

mrtesthah• 1 year ago

Consider this part of the attack on the American infrastructure, economy, and society. Attacks do not abide by laws, official procedures, or come with warnings.

pjc504• 1 year ago

CVE-zero: the attack is coming from inside the White House.

cookiengineer6• 1 year ago

If there are any Europeans here, I'd love to make my vulnerability database that's accumulated from all linux security trackers and the CVE/NVD open source if I can manage to find some folks who'd help with maintenance.

Currently hosting costs are unclear, but it should be doable if we offer API access for like 5 bucks / month for private and 100 / month for corporate or similar.

Already did a backup of the NVD in the last couple hours, currently backing up the security trackers and OVAL feeds.

Gonna need some sleep now, it's morning again.

My project criteria:

- hosting within the EU

- must have a copyleft license (AGPL)

- must have open source backend and frontend

- dataset size is around 90-148 GB (compressed vs uncompressed)

- ideally an e.V. for managing funds and costs, so it can survive me

- already built my vulnerability scraper in Go, would contribute it under AGPL

- already built all schema parsers, would contribute them also under AGPL

- backend and frontend needs to be built

- would make it prerendered, so that cves can be static HTML files that can be hosted on a CDN

- needs submission/PoC/advisory web forms and database/workflow for it

- data is accumulated into a JSON format (sources are mixed non standard formats for each security tracker. Enterprise distros use odata or oval for the most parts)

If you are interested, write me on linkedin.com/in/cookiengineer or here.

f_devd2• 1 year ago

Maybe something to bring up to one of these e.V.'s if it ends up being difficult to get started: Codeberg.org, nlnet.nl, ccc.de

tagyro• 1 year ago

+1 for ccc.de

cookiengineer6• 1 year ago

Codeberg might be a nice cooperation partner for hosting the git repositories. Gonna write them!

I'm also visiting the local CCC chapters here this week, maybe it makes sense to have a separate e.V. where the CCC chapters are beneficiaries?

weinzierl• 1 year ago

Try to talk to the people from the Sovereign Tech Fund, they have a history of sponsoring security relevant projects in the EU.

jauco• 1 year ago

And maybe the sidn fund?

NekkoDroid• 1 year ago

Sovereign Tech Fund

It's actually been upgraded to the Sovereign Tech Agency now

greenRust• 1 year ago

Great idea. I'm interested in helping. I'll dm you.

Ucalegon4• 1 year ago

The EU should just buy MITRE. Move it to the EU and make it a EU based project.

panny• 1 year ago

This would be hilarious. That would be a good thumb in the eye to the current administration who complained long and loud about how Obama let ICANN leave US possession. Just imagine the campaign commercials in 2026,

The POTUS transferred our cyber defenses to the EU

Ouch

jonnybgood• 1 year ago

MITRE is a non-profit. All the EU has to do is reach out to MITRE and be willing to fund the project.

elric2• 1 year ago

I don't think the EU has any interest in this. They've been aware of the risk of relying on the US for software security for years, but AFAIK there have been no efforts to do anything about it. Maybe the current situation will kick some butts into gear ...

Off topic: your username is very appropriate given the situation.

belter6• 1 year ago

This should be work for the ENISA: https://www.enisa.europa.eu/

https://www.enisa.europa.eu/topics/vulnerability-disclosure

They have a tender going on tracking best practices: https://www.enisa.europa.eu/procurement/vulnerability-disclo...

So they will take 12 months to select for the tender...18 months pondering on the report...and in 3 years they make a tender out for a solution...

juicyyy• 1 year ago

Im also interested in helping

JimBlackwood• 1 year ago

I’m interested to help! I added you on LinkedIn, so will message there after you accept. :)

anontrot• 1 year ago

Try if you can find some help here https://openssf.org/

wustus• 1 year ago

Depending on deployment strategy I could help with Kubernetes stuff.

sneak• 1 year ago

The AGPL is a nonfree (and nonsensical) license.

There’s nothing wrong with normal GPL.

lifthrasiir• 1 year ago

Is there a non-free license approved by FSF and OSI and compatible with DFSG?

goodpoint• 1 year ago

There are already many security trackers, why writing a new one? The issue is paying people to handle the advisories.

cookiengineer6• 1 year ago

I agree with you there. Before CISA got sacked / taken down, they were working together with the BSI and other CERT agencies on a vulnerability exchange format.

This might be the optimum time to implement CSAF and to lead by example when it comes to vulnerability disclosures.

harrisi• 1 year ago

I'm not European but I'd love to help.

mwe-dfn3• 1 year ago

The European, GDPR compliant subnet of the Internet Computer could suit your needs. The app would be decentralized out of the box and it can't be shut down by a single entity like a traditional cloud provider or nation state. Hosting 100GB costs about 500$ per year [0]. This is not a traditional hosting provider, it's a decentralized cloud. Reach out on the forum [1] or to me if this sounds like a good fit to you (I think it does, from your list of requirements).

[0] https://internetcomputer.org/docs/building-apps/essentials/c... [1] https://forum.dfinity.org/

immibis• 1 year ago

Or just use a normal host where hosting 100GB costs about $60.00 per year.

f_devd2• 1 year ago

Seems way overkill & unnecessary. Wouldn't the e.V. (foundation) especially with FOSS backend/frontend already ensure continued operation? Also if it's about redudancy/resilience it seems like good ol' torrent/ipfs or even a dedicated dht (if you really want to have fast updated content) would be much more efficient.

tecleandor• 1 year ago

(Spain, doing storage and web hosting) What usually worries me the most is the administrative or management part, which I don't know how big would be for this project...

senda• 1 year ago

messaged on linkedin fyi

lars_francke4• 1 year ago

Honest question: Does this not already exist?

- https://vulnerability.circl.lu/

- https://osv.dev/

- https://vuldb.com/

And a few others?

cookiengineer6• 1 year ago

OSV is made by Google/Alphabet and therefore also prone to Trump intervention (see Gulf of Mexico executive order).

The circl.lu might be actually a potential cooperation partner.

(Vuldb is down right now)

croes• 1 year ago

https://www.enisa.europa.eu/news/another-step-forward-toward...

mitjam• 1 year ago

The main costs definitely not hosting and can be quite significant. MITRE had $2.37B revenue in 2023, most if it contributions. I don't know how much of it can be attributed to the CVE, but I assume it's not an insignificant part of it: https://projects.propublica.org/nonprofits/organizations/422...

hypercube33• 1 year ago

I would email someone like Patch My PC they seem good stewards of stuff open source from my vague looking and they are good people. They may just host a clone of it that's open.

newsclues• 1 year ago

Why EU?

Canada may be another friendly option

com• 1 year ago

Canada’s been described as the Ukraine of North America.

Let’s not site global critical infrastructure within 150km of US land borders for a generation, please.

sberder• 1 year ago

Looks like some people are already getting things moving: https://www.thecvefoundation.org/

worthless-trash4• 1 year ago

Some cnas may also submit. Is this something you are open to?

dev_l1x_be2• 1 year ago

We should host it and collect membership fee from people who need this data. This way we can make it resilient against lack of government support. I would love to pay 5-10EUR/month to use such a service.

delusional2• 1 year ago

Meh. It's not like I was going to ask the facist autocracy about my software vulnerabilities.

nelox• 1 year ago

Just what is needed with an adversary during and asymmetrical trade war.

insane_dreamer4• 1 year ago

CVE was anti-American woke.

No, more seriously, just like with shutting down NOAA services, it seems the goal is to:

1. cut services (we saved taxpayer money!!)

2. at some point later: oh, we actually need those services

3. pay <insert your favorite vendor here, preferably one connected to Musk> to provide the service (see! we don't need to pay gov employees!!) (fine print: the vendor costs 2-3x the original cost). But by then no one is looking at the spending numbers anymore.

Slick moves.

SirHumphrey• 1 year ago

And here lies the problem. Even from a libertarian perspective DOGE is counterproductive because maintaining a system is much more cost effective than starting it anew.

Especially when you cut something recklessly, figure out in month that you need back that capability right now and have very little leverage to negotiate with private providers.

When you look at the last cutting effort in the Clinton administration the difference in jarring.

Combine that with the fact that with a few exceptions DOGE has been cutting the most cost effective programs (i can’t think of a better bang for buck science program than NOAA) it’s saved very little vs the amount of pain it has caused.

darkwater2• 1 year ago

Heeeeey but he runs Tesla like this and it's an hyper-valued company!!!1! He cannot be wrong, he is a genius!!

JackYoustra2• 1 year ago

There are quite a few threads on hackernews that were cautiously optimistic about doge with, frankly, pretty naive libertarian takes about how the government works.

The government is not particular (in the sense of particularism) and cannot be easily tuned to fix particular problems; rather, its best solutions come through institutional procedure and design, such as the tension between the FAA and the NTSB that, at a first glance, would seem like obviously needless duplication and waste.

It is a broad, blunt, wasteful instrument to solve broad, blunt problems in a way that may not be the best but that work far, far better than alternatives that have been tried.

That the effort to treat government like a personal budget has ended up destroying important things is a sad inevitability of such efforts. I hope it goes remembered.

simpaticoder• 1 year ago

I hope it goes remembered.

It won't be. Willful ignorance is a cornerstone of the movement. You can't lie about what you don't know. You can't have a bad take if you don't know. Upton Sinclaire said in the 1930's: "It is difficult to get a man to understand something, when his salary depends on his not understanding it." Now add to "salary" "identity", "relationships", "sense of belonging to the group". This is why critical, independent thinking, speaking truth to power, must be separately honored and encouraged by a healthy culture, because these attributes are by default mercilessly punished. (Physical courage and heroism are honored by a healthy culture for similar reasons.)

JackYoustra2• 1 year ago

I mostly agree, although I really disagree with 'speaking truth to power' — I feel like the outsized reverence for this is exactly what got us into this mess. For YEARS, there's been a culture of celebrating opposition for opposition's sake, a performative stance of always positioning oneself against the perceived holders of power, rather than critically evaluating the actual accuracy or value of what's being said.

Democrats are repeatedly pilloried simply because they govern while the Republicans cosplay as a permanent opposition, and therefore became 'the power' to speak against. Governing inherently involves trade-offs, compromises, and complex realities that never match ideological purity. Thus, an atmosphere developed where people who engaged in governance—and therefore took responsibility for difficult, real-world outcomes—became easy targets for criticism that was more interested in the aesthetics of "truth to power" than in providing accurate analyses or constructive solutions.

As a result, "speaking truth to power" became a performance, disconnected from accountability or genuine insight. The loudest critics weren’t necessarily those with the most accurate or useful truths, just those who most visibly positioned themselves as opposing power structures. This reinforced public cynicism and undermined nuanced understanding of governance and policy, further obscuring genuine critique and necessary reforms.

1970-01-01• 1 year ago

Root cause: Layer 8 failure

https://www.computerhope.com/jargon/l/layer8.htm

apexalpha• 1 year ago

Why is this sponsored by such an American gov entity?

I guess it's one of those things you never think about until it goes wrong.

The world would do well to move this kind of stuff out of the US quickly, just like ICANN and stuff.

kbumsik2• 1 year ago

Because gov infra also relies on CVE?

porridgeraisin2• 1 year ago

Good. CVEs were the poster boy of goodharts law for the longest time. Most security vulnerabilities behind CVEs are utterly meaningless.

goku128• 1 year ago

Ah! Another one to add to the following list:

- What disease did the CDC ever prevent?

- What improvement did the NHTSA ever bring to full self driving?

- What improvement in airline safety did the FAA bring?

- What good did FEMA do in any disasters?

I don't want to quip about how their achievements are invisible because they prevented the disasters that would have brought the spotlight on them, even when they were too underfunded to properly do their jobs. But I sure would like to see the people making these smart comments to give it a try and see how that goes. Then again, I have no complaints - at this rate, we'll get that chance soon.

porridgeraisin2• 1 year ago

Likening CVE database maintainers to natural disaster response teams and an entire country's medical board is quite the achievement in hyperbole, congratulations.

Anyway, my opinion is that CVEs have a very low signal-noise ratio and vulnerability databases in general should be revamped to try and fix that problem. The current system - I don't claim to know the root cause - is simply horrible. It could be the management, the entry requirements, some loophole perhaps, etc,. I also don't claim that this is the motive behind this move, I am just hoping it gets revamped anyway as a side effect (There's another article on HN floating around that says someone else has picked up the baton - good luck to them). I also don't care for your country's politics which you seem to be eluding to in your final paragraph.

4ndrewl• 1 year ago

To the "I wish HN would stay out of politics" crew.

You can stay out of politics, but politics will always come and find you.

t0lo3• 1 year ago

Everything is political now by design. It's meant to reach into every facet of society and community and restructure it.

Braxton198013• 1 year ago

Everything was always political. Laws, the economy, conflcit. How is any person not affected by these? The government is responsible for all or a large part of how a country functions.

People who say "I'm not political" are deflecting to avoid conflict

Cthulhu_4• 1 year ago

Everything already was, you just didn't recognize it because it was to your benefit / in your interests.

paganel• 1 year ago

Agree, but it goes both ways, with technology (that many of us here have helped create and maintain) also reaching out into every facet of society and community, many times in close symbiosis with the political powers that be, to the detriment of said society and community.

Not 100% sure what I wanted to say, maybe that said politics (and the political as a whole) wouldn't have invaded almost our entire lives without the help of technology.

po1nt• 1 year ago

That's because we got reliant on the funds from government. Maybe it's time to break the dependency.

okeuro49• 1 year ago

"You can stay out of politics, but politics will always come and find you."

No, it's just recognising that it is silly to talk about politics, as certain views are just downvoted.

spookie• 1 year ago

Of all places I find this one the most shielded from this behavior as long as you're civil.

dmckeon• 1 year ago

People trying to ignore politics are like fish trying to ignore water.

strogonoff11• 1 year ago

Not talking about politics is itself a political position (in favor of status quo).

anon373839• 1 year ago

It’s really a question of time and place. There are many foundational topics in life, such as politics, religion, and philosophy. But it’s not always helpful or appropriate to discuss them in a particular setting.

That said, HN already has an extremely wide range of subject matter, so I wouldn’t say politics should be out of place here. It can, though, become a divisive distraction that disrupts other conversations, so I can appreciate that some limits are needed.

starspangled• 1 year ago

Ignore politics entirely maybe, but people who are tired of hearing the exact same extremist reductive opinions over and over again everywhere aren't necessarily ignoring politics. Yes we know it's all because conservatives are fascists and corrupt and Russian agents and liberals are communists and in bed with the Chinese, etc., not caring to hear about it again is not surrendering the battle of good vs evil.

For me, ironically, the worst casualty of "politics" infiltrating everything is... politics. I mean the respectful and reasoned discussion of politics. Not that it was ever in great supply, but now it is non-existent.

mr_toad2• 1 year ago

People trying to ignore politics are like fish trying to ignore water.

Like fish, most people do ignore it until it turns foul.

cantrecallmypwd10• 1 year ago

Yep. It's also true of people who think they can simply move out of the US and that "solves" the problem too. America's problems are still (almost) everyone's problems too.

goku128• 1 year ago

True. But it's much less of a problem outside. For example, does the gun culture in the US affect the rest of the world? It sure does. You can guess where most of the illegal weapons come from. But we rarely even think about getting shot while at school or on our way to the groceries.

blueflow• 1 year ago

The problem is not political topics, it is how people discuss them.

titaphraz2• 1 year ago

That's a massive issue. Every topic is so polarized that it's as if it's evil vs. good.

But I think people are waking up, because things they took as non-political god given right is being made political and taken away.

titaphraz2• 1 year ago

It's exhausting because of https://en.wikipedia.org/wiki/Firehose_of_falsehood

h1fra• 1 year ago

HN and founders will say "no politics here" on the regulated internet, drinking regulated water, eating regulated food, breathing regulated air.

pjc504• 1 year ago

Apart from the few maniacs On Here who seek out the unregulated intentionally. Raw milk (all those tasty diseases). "Research chemicals" (don't hear so much about that lately, but there were whole microdosing fads).

b112• 1 year ago

Will all of these things be free of micro plastics and other contaminants?

If so, is there a signup page?

fnord77• 1 year ago

regulated ...

not for long

scandox• 1 year ago

What people mean when they say this is that they don't want to engage in party political and/or tribal political discussions. They don't want to do this because it just means rehearsing talking points.

People are not dumb. They know that politics is everywhere but they want to live and love and talk about things that are interesting.

gedy2• 1 year ago

Exactly, and on the flip side many people who want to "talk politics" mainly want to shout at the outgroup and pick public fights.

belorn• 1 year ago

I view the archive.org, Wikipedia, CVE program, and Linux Kernel to all have had discussions on HN about how to they should be funded. Is that kind of politics the kind that people wish that HN stayed out from?

diogocp• 1 year ago

No, but the "everything is political" people are not capable of making that distinction. Which is probably why everything seems political to them.

atmosx• 1 year ago

This quote is essentially unworkable. Everything you say, or choose not to say, inevitably advances some political perspective over another.

What we should really aim for is thoughtful, civilized, and maybe even aesthetically pleasing discourse. That’s what educated people strive for.

Trying to “avoid politics” is like collecting seashells while a tsunami is rolling in.

surgical_fire• 1 year ago

Agreed. Those who don't care about politics are doomed to be ruled by those who care.

Moreover, avoiding politics is impossible. It's all around you. Labor, entertainment, food, housing. Burying your head in the sand will only get you to have your ass in the air.

Maybe "be polite" should be a better rule than "avoid politics".

cjs_ac• 1 year ago

It's scary how widely this varies between different communities. On Reddit, /r/politics is mostly people acting like they're auditioning for the writers' room on one of those late-night talk shows, whereas /r/ukpolitics and /r/australianpolitics are almost exclusively people making insightful, analytic comments.

elcritch• 1 year ago

The ancient Greek understanding of an “idiot” referred to someone who was a private citizen or a person who did not actively participate in public life or politics.

spacebanana7• 1 year ago

To play devil's advocate - it's horrible when gaming, programming, business or even porn forums get overrun by politics.

It's not that the political topics are unimportant but all my feeds just end up looking the same as each other and the same as a newspaper app. I hate election nights because of this.

Titan2189• 1 year ago

"porn forums" is a thing?

acdha3• 1 year ago

I miss that, too, but the way we get there is by re-establishing democratic norms and boundaries. The United States is flirting with fascism, and globally we are seeing the fallout from that and the cascading effects of climate change, not to mention the impacts of AI on employment, surveillance and censorship, social media, etc. Keeping politics out of forums like the ones you mentioned is like keeping oxygen out of a space station.

ivolimmen• 1 year ago

If you are American and you voted for this guy -> https://www.reddit.com/r/leapoardsatemyface/

scoresomefeed2• 1 year ago

Inverse devils advocate:

But look at it this way: I see the us political spectrum melting down into authoritarianism and you’re complaining you don’t need to be reminded of it.

A similar analogy would be if we are at your house, and it catches fire, and you complain that it is interfering with watching Netflix while I’m trying to call 911 for help.

From my perspective you are ignoring your own demise and from your perspective I’m just being annoying.

SkyBelow2• 1 year ago

Politics are also never discussed with any level of depth. At best, it each side throwing in their opening arguments and nothing more. More often you don't even get that and instead have attacking people directly, stereotyping, straw manning, and all sorts of logical fallacies. Discussion in such a situation does not happens, so either it is an ongoing war or some side wins and pushes out the rest. None of these outcomes would seem beneficial for here, and while I do think there would be some slightly longer form discussions here compared to most places, I don't think it would be enough to avoid the eventual decay.

keybored• 1 year ago

Apolitical person: Ugh politics is so dumb

Same person: Why is the world organized in such a dumb way?

pjmlp3• 1 year ago

Technology without politics is a pipe dream, even the FOSS licenses depend on politics.

bamboozled3• 1 year ago

100% agree, staying out of politics has been a luxury not everyone has, it's totally unavoidable now.

pif• 1 year ago

There's politics and there are facts.

Trump voters are stupid. This is a fact.

Right or left leaning, that's politics.

mrtksn3• 1 year ago

The problem with discussing politics is that it gives you the kicks. Its very easy to get into a feedback loop and take things quite far off civility. I am also guilty of it, many times.

IMHO there needs to be a mechanism for breaking the loop and then we can have civil online political discussions. Unfortunately most places just ban it or ban those who got into the loop, either way its ugly.

IRL when discussing politics and things don't go badly its thanks to 3rd party who will moderate or calm down the heated debaters.

kelsey98765431• 1 year ago

No thank you. I am absolutely uninterested in civil discussions with people who literally want to kill me and deport my good friends to guantanamo bay cuba. When you accept nazism you throw the concept of civil discourse out the window.

footlose_38152• 1 year ago

The loop is intentionally being closed and sped-up by enemies of the USA who want to exhaust the USA in every way possible.

After the infekktion of 2015, moderators of Right-leaning discussion boards started amping up their censorship. Left leaning and moderate discussion boards still tend to be more moderate, letting most discussions in and censoring less.

Most of the time, one side is trying to play an equal field, while the other shits all over it and just yells "Winning!"

deadbabe• 1 year ago

Not keeping politics out of our lives is the reason we’ve ended up with a totalitarian fascist dictatorship. If politics is forbidden, people have to just make up their own minds and vote for what makes sense to them, instead of banding together and slowly intensifying to the most radical extremes in bids to outdo each other.

Everytime you discuss politics on the internet, you entrench the current administration.

timacles• 1 year ago

Fascinating logic. The victims are at fault. If only they did something different the abusers would have never had to abuse them.

throwanem2• 1 year ago

I understand how you get here, but you haven't considered what would be required in practice to "forbid politics." Banning speech would be where you would have to start, and by the time you were finished Walter Freeman might grow a bit faint.

Pxtl• 1 year ago

the "I wish HN would stay out of politics" crew.

Sadly, this crew includes the site's moderation.

mardifoufs• 1 year ago

ah yes, losing the... CVE database is truly the wake up call to get engaged in politics.

I mean sorry but I'm not sure if you're being ironic. It sounds like something you'd read on ngate

orblivion• 1 year ago

HN can stay out of politics just fine for the most part. If a political topic comes into tech we can talk about it then, and stay out of other crap that insufferable people drag in because "there's no such thing as being neutral" or whatever.

nodesocket• 1 year ago

I’m betting CVE will get sponsored by a security company or Cloudflare.

gm3dmo• 1 year ago

Anyone feel confident that the companies who benefit massively from MITRE are even now planning to step in and provide significant funding?

gabesullice2• 1 year ago

As a newly minted cynic, this seems like a cynical play to save someone's budget.

Step 1: Post discreetly to a forum with minimal information and an absurdly short deadline

Step 2: Phone your friend, the former board member, to make your case on LinkedIn

Step 3: Ring up a friendly journalist and give them a tip

Step 4: Reference the insuing chaos as justification for keeping your project funded

Note that the article carefully avoids pinning the blame on DOGE or the Whitehouse while heavily implying it. MITRE is technically a private entity, albeit a non-profit. And the very last paragraph of the article states:

A CISA spokesperson told CSO, “CISA is the primary sponsor for the Common Vulnerabilities and Exposure (CVE) program… Although CISA’s contract with the MITRE Corporation will lapse after April 16, we are urgently working to mitigate impact and to maintain CVE services on which global stakeholders rely.”

To be clear, the point isn't to say that the CVE program isn't valuable, nor is it to say that it's good for a shenanigan like this to be necessary.

The point is that, unless you're directly involved in this subject (not impacted—involved), it's probably best to maintain a "wait and see" attitude rather than succumb to catastrophizing this news.

girvo• 1 year ago

Have you seen proof that this is what has been happening? Your explanation is much more convoluted than "DHS cut funding, like the administration has said it is going to do".

gabesullice2• 1 year ago

These explanations are not mutually exclusive.

jl63• 1 year ago

So is this going to instantly break a bunch of tools like Trivy?

wengo314• 1 year ago

vibe coding could not have come at a worse moment.

sgt• 1 year ago

Just tell the AI: "Make this code secure" /s

redleader552• 1 year ago

I see this as the perfect moment to get into consulting - either development, or security. People were not sure what jobs AI will create: "GenAI babysitting" is one of them.

skirge2• 1 year ago

only one country pays but all benefit from it. It should be funded by all who benefit like UN.

goku128• 1 year ago

I'm sure that a hundred other countries will step up to fund it. But have you given any thought about why the US was so willing to sponsor it alone in the past?

jowea7• 1 year ago

I thought most people in the US wanted the UN to have less control over this stuff? Remember the talk about moving control of the Internet to the ITU (International Telecommunication Union)?

hubabuba445• 1 year ago

The real irony here is that a lot of ycombinator founders and the people reading HN were exactly the ones making this possible and now start to wonder why the snake eats its own tail.

cantrecallmypwd10• 1 year ago

Sorry, I made the mistake of installing PyPy.

hubabuba445• 1 year ago

I assume that this comment should go somewhere else or I'm not able to decipher the message ;)

this15testingg• 1 year ago

exactly; I hope ycombinator and its proponents can enjoy living in the ancap fantasy land where you have to pay to be alerted for a climate change fueled mega hurricane (also caused by this exact same reckless, unregulated greed) because NOAA was disbanded. Billionaires shouldn't exist, but neither should millionaires.

sebstefan• 1 year ago

You don't need MITRE

For-profit private journaling is working really well for academia!

ourmandave• 1 year ago

Will they have a free tier where I can sit through 30 second ads? =(

selfmodruntime2• 1 year ago

The missing funding is something like 2 million dollars. Any US company could make this issue go away in an instant.

hubabuba445• 1 year ago

We will see. I understand that money shouldn't be an issue but trust might be, no?

Sonnigeszeug• 1 year ago

Its not a money problem, its a understanding problem.

Shouldn't the most powerful country has something like this? Being even in the forefront of it?

The USA was doing cyberprotection against Russia and cyberattacks across the world.

Now suddenly it doesn't need it anymore?

Like just did Russia go away (or has russia won and sits now in the white house)?

nosianu4• 1 year ago

Or they wanted this, because this could be part of the privatization of many government functions. They, or at least some of them, could see this as controlling this function for money. It's a regular stream too, the valuable subscription model and customers who really need the service (and if they don't, just add a new law in the name of IT security forcing firms to sign up).

hubabuba445• 1 year ago

To me it looks too chaotic to be a planned privatization plan but who knows.

rcarmo• 1 year ago

Now would be a great time for a major tech company to support them (or, even better, a consortium).

basemi• 1 year ago

For now, historical CVE records will be available at GitHub:

https://github.com/CVEProject

InsideOutSanta5• 1 year ago

This makes me wonder what other stuff most people don't know exists but is important to our society has quietly disappeared in the last few weeks. We know about this one because we know it's important. What are the things we don't know about?

jeroenhd5• 1 year ago

https://www.project2025.observer/ lists a few. Of course, those are only the agencies the Trump people know about and explicitly want to destroy, but it's a start.

knowaveragejoe• 1 year ago

The cheerleaders don't care. Americans' relative certainty and quality of life is backstopped by institutions they either barely understand or have never heard of. Let them touch the stove, I guess.

jl63• 1 year ago

It’s a reckless move to cut funding so abruptly, but taking a step back from the short-term chaos, it probably is an anomaly that this was government funded. All of private tech relies on it, and private tech is big enough to pay for it. I hope that the trillion dollar babies consider this an opportunity to pool together to form a foundation that funds this, and a bunch of other open source projects run by one random person in Nebraska.

kbumsik2• 1 year ago

it probably is an anomaly that this was government funded

Companies can definitely fund it. But to be fair the gov, including NIST, also relies on CVE.

chasontherobot• 1 year ago

ah yes, let private entities pay for it. then when there is a vulnerability with one of those entities' software, they can pay a bit more to bury it!

padjo• 1 year ago

Ah yes the old “well can’t concerned citizens band together, form a committee, collect revenue and fund things that are in the common interest” answer you hear from small government types that makes me think you lot don’t really understand what government actually is.

JCharante2• 1 year ago

it probably is an anomaly that this was government funded. All of private tech relies on it, and private tech is big enough to pay for it.

I mean doesn't big tech and the people they give salary money to pay taxes? Ground transportation companies rely on public roads and but we fund it because having the infrastructure is an economic multiplier.

I'm not arguing in favor of funding the CVE program, I just don't think that's a good reason.

jl63• 1 year ago

Opinions vary on what the purpose of government is, but if you take the view that the government's priorities should be providing services that are impossible, inefficient, or unethical to provide privately, then I don't see the CVE program making the cut, when the tech industry is collectively flush with resources and has every incentive to form an industry consortium to take it over.

A modern Open Group, perhaps?

bspammer• 1 year ago

The US government itself uses the database, so there is a strong national security interest in it not being in private hands.

phillipcarter• 1 year ago

Considering the large number of government agencies that have sponsored the program, no, I don't think it was an anomaly: https://www.cve.org/About/History

karel-3d2• 1 year ago

Phew, no new annoying CVE reports in my Docker images from today

dhx• 1 year ago

The latest contract[1] (I hope this is the right one) for MITRE's involvement with CVE and CWE programs was USD$29.1m for the period 2024-04-17 to 2025-04-16 with optional extension of expenditure up to USD$57.8m and to an end date of 2026-04-16.

Seemingly MITRE hasn't been advised yet whether the option to extend the contract from 2025-04-16 to 2026-04-16 will be executed. And there doesn't appear to be any other publicly listed approach to market for a replacement contract.

[1] https://www.fpds.gov/ezsearch/jsp/viewLinkController.jsp?age...

gwd• 1 year ago

I can't figure out why the hue and cry wasn't raised until the very last minute. Did they not know a month ago that they were running out of time? Is it standard practice for the government not to say they're going to extend the contract until the day beforehand or something?

sq_• 1 year ago

Right now, yes. You can pretty easily have a scenario where you’re talking to the agency you’re working with and they’re saying “we want to renew this, but we don’t know if they’ll give us the money in the end”.

So you’ll get a bunch of “hopefully this week” up until it expires.

pjmorris• 1 year ago

I was at VulnCon last week, and an NIST representative said that there were no plans to cut CVE funding.

Brosper• 1 year ago

Europe needs to save the world!

kesor2• 1 year ago

Good, less government involvement is better for everyone.

NilayK• 1 year ago

A coalition of CVE Board members launched a new CVE Foundation "to ensure the long-term viability, stability, and independence of the Common Vulnerabilities and Exposures (CVE) Program."
https://www.thecvefoundation.org

https://mastodon.social/@serghei/114346660986059236

hahajk• 1 year ago

So if the govt stops paying them they'll continue to do the work for free?

lou13062• 1 year ago

More likely they will seek funding from companies and other organizations, as every other foundation/consortium of this kind does.

pantropy• 1 year ago

The way their letter is worded it seems that they have a rainy day fund constituted to ride out the stormy next few week and I'm fairly certain they'll come back with more details as to how they'll be acquiring funding from now on in the next few days. Maybe paid access to an API, maybe donations from large companies that use the system, maybe something else ::shrug:: Hopefully a project as important as this doesn't just dissapear completely because of government pressure.

jmcgough• 1 year ago

They're converting to a nonprofit, so instead of federal funding they will need funding from big tech companies.

delfinom• 1 year ago

How else will they continue burning out open source maintainers with bullshit?

gnfargbl2• 1 year ago

This kind of a consortium needs to explicitly avoid being captured by both the product vendors (who could be incentivised to manipulate the CVE issuance process to support their own remediation timescales), and by security companies (who could be incentivised to obtain a competitive advantage via preferential access to the CVE database).

It isn't impossible for a commercially-funded organisation to avoid this kind of capture, but it isn't easy either. My mind immediately jumps to the relationship between the Mozilla Foundation and Google.

transpute16• 1 year ago

Then there were two: https://gcve.eu

Plus the proposed "Foundation for Standards and Metrology (FSM)" to build on NIST, https://democrats-science.house.gov/bills/the-expanding-part...

tbrownaw• 1 year ago

Don't some projects already issue their own CVEs?

pama• 1 year ago

This smells like a quick attempt to enable phishing for vulnerabilities, and not a legit way to make progress. The comment is from a person that runs a security startup and the site is a google site that people can report to google as a scam. (Edit: downvote as you like it— perhaps my language was too harsh to help make the point clear. It is interesting how easy non-sec people fall for names and quotes and authority.. building trust does not come overnight, in fact it is never fully there, and infosec experts would not fall for such supply chain redirections with questionable future. Hopefully we will not have to test this idea soon, though some level of reliability and long-term automation would be welcome. We need technical, generally agreed upon systems, not a “foundation”).

londons_explore2• 1 year ago

How much was this contract worth?

If it was $5000/yr it's very different to if it's $5M/year for what amounts to little more than an instance of mediawiki.

harisec• 1 year ago

$44M/year?

https://www.usaspending.gov/award/CONT_AWD_70RCSJ23FR0000015...

londons_explore2• 1 year ago

Totally worth cancelling then.

Some volunteer will set up a GitHub pages and mailing list to fulfill the same duties.

anilakar• 1 year ago

Let me guess: Trump is going to make China pay for it.

jibal3• 1 year ago

Bad guys helping out bad guys--it's what mobsters do.

mzhaase• 1 year ago

Long term its probably good to have a less US-centric world.

jeroenhd5• 1 year ago

This is a chance for the EU to step up and take over. If the US government won't pay for the CVE program, the EU surely could. Many EU countries already run a program like this to server their own interests, and I believe the EU does as well.

If the US is willing to give up influence and control over the cybersecurity sector, we should accept that gift and use it to our advantage.

moomin• 1 year ago

I’m sure a much better private sector alternative will appear any day, in line with conservative dogma.

rvba• 1 year ago

Why cant wikipedia foundation step in? They have millions of dollars.

drdrek• 1 year ago

LOL this is Amazing... Holy shit

gorbachev• 1 year ago

I wonder what would happen to CVE program funding if Tesla and SpaceX would be zero-dayed to hell and back.

redleader552• 1 year ago

We will soon find out, probably.

phtrivier4• 1 year ago

I'm really curious about the "soon" part, though. What is the timeline for something very visible to happen, and still be directly relatable to DOGE ?

Just imagine if it happens in three years, after the midterms - someone will be able to blame the Dems for it :) !

dools• 1 year ago

Uh oh did someone CVE grok or twitter?

WillAdams• 1 year ago

FWIW, I've never understood why this sort of thing wasn't just directly handled by the NSA --- aren't they the group which should be tasked with cybersecurity?

I always suspected that "Department of Homeland Security" would lead to Banana-republic-like shenanigans --- could we defund them?

donohoe• 1 year ago

I don’t think anyone trusts the NSA to run a program like this.

dfedbeef2• 1 year ago

"National Security" doesn't mean you personally. It's the government only. There's a conflict of interest that immediately arises if a part of the DoD (who owns cyberwarafe, which uses vulns) maintains a public vuln database.

(Edited to be less salty, sorry)

thih9• 1 year ago

I can’t see any long term benefits for the US. It looks like the current administration is fine with chaos and disruption on an unprecedented scale.

donatj• 1 year ago

Practically speaking, how much could it cost to maintain the CVE database?

Given its enormous value, isn't this something that the community, especially FAANG (MAANA?) could step up and fund as a nonprofit?

uptownfunk• 1 year ago

Seems like a big miss on the part of DOGE?

i_love_retros• 1 year ago

At this point it's not crazy to believe Russia is running the country

dfedbeef2• 1 year ago

This level of stupidity seems pretty American to me

paulmendoza2• 1 year ago

Anyone who voted for Trump voted for this type of dumb action. This is a major loss for society and safety.

jnovacho• 1 year ago

It looks like the decision has been reverted, for now at least: https://www.forbes.com/sites/kateoflahertyuk/2025/04/16/cve-...

jeff_carr• 1 year ago

The contract with MITRE has been extended.

https://www.forbes.com/sites/kateoflahertyuk/2025/04/16/cve-...

My guess indefinitely.

DOGE might be a bunch of idiots, but in the entire DOD, there are non-idiots.

metalliqaz• 1 year ago

not just idiots... malicious idiots

lenerdenator• 1 year ago

Malicious idiots surrounded by sheepish intelligent people.

tomrod• 1 year ago

Per news reporting, not just malicious idiots but foreign agents.

tlogan4• 1 year ago

My guess is that they’ll be phased out next year. The long-term goal seems to be transitioning the CVE program into something more like an industry-led consortium. (If you did not notice they operate zero budgeting approach: cut everything and if something is very important reverse it. But you cut first and then ask questions.)

It’s worth noting that MITRE is a DoD contractor (with minor contracts from other agencies like this one). Having the CVE program operated by a company funded by the U.S. military raises valid concerns about conflicts of interest—especially in an ecosystem that depends on neutrality and global trust.

nxobject• 1 year ago

I’m a little hesitant to trust a CVE database operated by private industry on the grounds of conflict of interest for that reason, too.

numbsafari• 1 year ago

... and that industry led consortium will have a board all paid princely sums, and an executive leadership team that is conflicted to the hilt and paid kingly sums, and they will charge exorbitant rents in order to keep the lighthouse lit.

There's flaws with every approach, but I much prefer the approach where this sort of thing is treated as a public good, rather than as yet another soon-to-be walled garden.

jmull3• 1 year ago

The long-term goal seems to be...

Where do you get that from?

I've seen no sign of long-term goals, much less any mechanisms being put in place for follow-through on those goals.

It seems like people keep making the mistake of believing there's a detailed plan, while all evidence tells us there isn't. I guess it's the normal human tendency to see order in the chaos.

agloe_dreams• 1 year ago

Having the CVE program operated by a company funded by the U.S. military

...Yep, we're done as a democracy. Pack it up, boys.

Edit: I know it is doom and gloom but the CVE program could easily delay information and leave holes on purpose.

absker• 1 year ago

MITRE is a non-profit company that operates Federally Funded Research and Development Centers (FFRDCs), which are owned and funded by the federal government and contracted out to companies like MITRE to operate them.

While MITRE does have contracts with DoD (and many other agencies across the federal government as part of the FFRDCs they operate), they are not the same as a stereotypical DoD contractor as their non-profit status motivates them to work in the public interest.

jhelps• 1 year ago

I can see how govt funding was needed to help bootstrap the CVE program before people saw the value of it.

But now that CVEs form the basis of a very lucrative ~$16b/year industry[0], wouldn't it make sense to let those companies take over?

Privatizing the Internet enabled much more innovation than if it had stayed govt-funded.

0: https://www.grandviewresearch.com/industry-analysis/security...

ottercan• 1 year ago

MITRE is not a DoD contractor. They are a not-for-profit institution committed to the public interest that operates six Federally Funded Research and Development Centers.

butterlover• 1 year ago

It’s probably more accurate to describe mitre as a publicly funded non profit operating for public benefit like the post office or PBS.

It’s a stretch to describe it as an arm of the government.

lynndotpy3• 1 year ago

This is good news, but in general. We can not rely on the DoD to make smart decisions.

Ultimately, Pete Hegseth, with a career as a Fox News character, calls the shot.

EgregiousCube• 1 year ago

A bit disingenuous; he also had a career as a soldier.

plasma_beam2• 1 year ago

This is DHS, not DOD.

plasma_beam2• 1 year ago

It doesn't appear to have posted to FPDS yet: https://www.fpds.gov/ezsearch/fpdsportal?q=PIID%3A%2270RCSJ2...

The contract expired today, but had an option period through March of 2026. DHS just needed to exercise the option.

Edit: Note the contract ended today April 16 - so performance would stop midnight tonight if the option wasn't exercised. Government contracts routinely go down to the wire like this, and often are late getting exercised. Why the uproar over this one? Did CISA signal to MITRE that they weren't going to exercise the option?

marcusb5• 1 year ago

Did CISA signal to MITRE that they weren't going to exercise the option?

An internal letter sent to CVE board members was making the rounds yesterday warning the current contract ("contracting pathway") would expire. The letter was authenticated by Brian Krebs[0]. Once Krebs authenticated the letter, people more or less assumed CISA was pulling funding, at least based on the infosec social media posts I saw.

CISA officials responded to multiple media inquiries (including the OP) with a statement that more directly said the contract would expire:

  Although CISA’s contract with the MITRE Corporation will lapse after April 16, we are urgently working to mitigate impact and to maintain CVE services on which global stakeholders rely.[1]

0 - https://krebsonsecurity.com/2025/04/funding-expires-for-key-...

1 - https://www.csoonline.com/article/3963190/cve-program-faces-...

andreygrehov4• 1 year ago

But the article says, quote:

It’s unclear what led to DHS’s decision to end the contract after 25 years

and then suddenly it gets extended. What does it have to do with DOGE?

marcusb5• 1 year ago

MITRE has been hit with DOGE-branded cuts[0] earlier this month. CISA has been impacted[1]. It seems reasonable to assume they were involved in this.

0 - https://virginiabusiness.com/nova-govcon-firm-mitre-to-lay-o...

1 - https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st...

dang4• 1 year ago

Thanks. It's always a puzzle what to do with threads based on articles that have since been superseded by later developments. Do we start a new thread based on a new article? The new article / thread usually fails to do very well, partly because there just was a big discussion, and partly because hearing about something getting fixed is less interesting and exciting than the original stimulus.

I've been playing recently with putting [fixed] at the end of the original title to indicate this sort of state change to the reader. Not sure if that's the best way, nor if the situation has genuinely been fixed or not, but I guess it's better than nothing. Swapping out the article and title would probably be too much of a rug pull on the existing thread.

ethbr12• 1 year ago

Maybe [updated] as a more neutral term to indicate post-submission change?

hatly22• 1 year ago

Maybe Europe should charge the US for access to their CVE databases.

jovial_cavalier• 1 year ago

I didn't realize that CVE was funded by the DHS. Isn't it better for it to be independent and not funded by an intelligence agency?

It's enough of a public good to have a common advisory for vulnerabilities that FAANG should just kick it a few million a year. How much can it possibly cost to run this anyway?

trothamel• 1 year ago

Does anyone know what the CVE program was costing per year? I searched around a bit, but wasn't able to find the number.

m4r71n• 1 year ago

The title of this article is simply false. The CVE Program is a separate entity from MITRE and is most definitely not ending. The CVE Program has been acquiring assets from MITRE for years now. That is why the main site shifted from cve.mitre.org to cve.org. MITRE has always simply been the workhorse of the program, and now that is being shifted to others (CVE foundation, which has global representation).

gcollard-• 1 year ago

Forget everything you know and consider that it might be a misguided and risky negotiation tactic.

Disclaimer: This is not business advice and should be read using Cartman’s voice.

Step 1: Announce publicly that you are not renewing your contract.

Step 2: If the market has viable alternatives or the service you are negotiating isn’t that hard to replicate, other actors will manifest to fill in the gaps, especially if your business is attractive. (E.g., The top comment is building an alternative; other comments point to alternative services.)

Step 3: Congratulations, you now have leverage for a significant discount with your previous provider because they face the real prospect of losing your business entirely to a competitor. If the competitor is private, you can even double dip by investing in their company before attributing them the contract.

Aperocky• 1 year ago

There's always a cost even if there doesn't seem to be one, credibility is measurable in markets and when it bite I think we'll all be in rough times.

ThinkBeat2• 1 year ago

There seems to be little reason for the US government to pay for this since it is vital information that a lot of companies rely upon.

Some form of a foundation or NGO could be given a reasonable endowment from the industry to operate the CVE program.

O am quite hesitant to trust the DOD to keep track of software vulnerabilities. Some parts are developing and exploiting vulnerabilities. And given a fresh feed of what people find, and usually a delay from notification until publication, which may sometimes just be a bit longer of a delay, would allow the DOD to weaponize the vulnerability for their own use as well.

froggertoaster2• 1 year ago

Believe me when I say that DOGE is filled with smart people (I know a few of them).

Just because they're scattershot cutting doesn't mean they're stupid.

raegis• 1 year ago

I guess I'm naive, but given the current situation, wouldn't a smart person resign from DOGE? If I were smart and highly employable, like these guys, I would not want to be associated with all the indiscriminate firings of DOGE.

froggertoaster2• 1 year ago

I guess it depends on what you value.

I think it speaks a lot about a person who assumes "a smart person would resign from DOGE".

p0w3n3d• 1 year ago

One man appears at one position and so many things stop working in so little time

Alifatisk• 1 year ago

Yet, he is still praised and cherished. I can't comprehend how.

RKFADU_UOFCCLEL• 1 year ago

Including this as a prime example, the overall trend seems to be that we're going back to the bad old days where a kid gets to code the entire security infrastructure because the CEO thinks he's smart and then the bugs are covered up with legal threats (because they were able to mislead the courts), obfuscation, while being easily discoverable by 3rd parties. Another example is the way the bug bounty gimmick is run and most researchers never disclose their findings nor are they patched in any consistent manner, plus the companies threaten to sue you for disclosing even if it's 100 years later.

blindriver• 1 year ago

How much does CVE cost to maintain and why must the US fund the entire thing?

manmal• 1 year ago

The bureaucracy of internationalizing it would likely be more expensive than the current cost.

GuinansEyebrows2• 1 year ago

We can afford it.

andrehacker• 1 year ago

Maybe change the headline now ? As-is the headline is click-baity. (spoiler alert: the contract has been extended)

rbolla• 1 year ago

Important update April 16, 2025: Since this story was first published, CISA signed a contract extension that averts a shutdown of the MITRE CVE program.

dang4• 1 year ago

Related ongoing threads:

CVE Foundation - https://news.ycombinator.com/item?id=43704430

Replacing CVE - https://news.ycombinator.com/item?id=43708409

hulitu• 1 year ago

CVE program faces swift end after DHS fails to renew contract

So CVE is a child of US 3 letter agencies ? Good to know.

CVE program faces swift end after DHS fails to renew contract [updated]

Related Stories