再保险:CVE程序优先级

在12/22/2015 12:55点,博伊尔,斯蒂芬诉写道:>报道在美国使用的软件和设备的部门。“美国IT领域”是什么?是“美国部门”旨在包括设备使用在家里或与固件开发国外中小企业,尤其是如果它们连接到互联网,还是这只覆盖软件和设备用于美国企业吗?同时,将美国公司使用外国软件在国外做生意时被覆盖;是“用于美国部门”吗?它是谁的责任(或应该是)生成软件和设备标识符“在美国不习惯这部门”,但用的或美国供应链和重要合作伙伴我们一起合作,信任和依靠?因为斜方和其必须承担的责任管理标识符“美国部门”,谁应该负责国际行业吗?我想知道有多少软件和多少设备存在,不会被使用在美国。试图排除”在美国从未使用过“软件和设备真的提供了一个重要的工作负载,值得付出努力的排序和错误的风险?我问,因为它似乎是一个考虑到制造商和软件供应商将尝试目标一切他们在美国市场,由于规模经济。 The criterion "used in the U.S. IT sector" is indistinct, and I doubt its usefulness and practicality. Instead, "products developed by firms or organizations based in the U.S." would be more clearcut, and so would be the responsibility. Coverage would be significantly reduced and more manageable, but consequently it would be narrow to the point of making the CVE less useful. Given the conflicting desire to restrict the workload but usefulness of prompt and broad coverage, perhaps it's time to ask other countries or regions (I mean to include the European Union in this) to be responsible for their share of produced software and to peer with MITRE using "Olympic swim lanes" (eh, Olympic as in "a time for laying aside political and religious differences") that would avoid duplication of effort and redundant identifiers? Besides directly contacting foreign organizations, I would think this is worthy of the United Nations' attention, given its goal of promoting international co-operation, and given the ubiquitous distribution of software. This sounds idealistic but the very idea is important. I believe this needs to be stated and recognized as something desirable, and even needs to be attempted so that perhaps we'll obtain through compromise an intermediate solution that works well enough. Other related "can of worms" thoughts: Can CNAs be foreign nations, or could foreign nations have the power to designate CNAs, or would it be preferable that they have their own identifiers? Would it be useful if they used different letters than 'CVE' but kept the format similar and recognizable (a Universally Unique Vulnerability ID, UUVID)? Can they be trusted enough, and what mechanisms could detect misbehavior, and then work around it or even repair it? Pascal