再保险:CVE程序优先级

在12/22/2015 02:28点,Kurt Seifried写道:> CVE的目的是什么?CVE的最终目的是促进沟通和理解。恐怕很难获得CVE标识符(缓慢或根本没有反应,不透明的过程,确定一个适当的和愿意CNA)将增加的不确定性和负担证明一个问题如何通过选择标准外在主题,同时降低CVE的有用性和思想通过限制其普遍性和范围。CVE成为网络通信障碍时,就会失去其效用。如果发生这种情况,后果将anti-academic。脆弱性通信将(更多)由多个竞争分散和冗余的标识符,或根本没有标识,分配在不同的抽象级别,在不同的语言中,不一致;一些将自营、一些私人或半私立(“俱乐部”),将需要创建地图,映射可能需要付费订阅。这将是一个一步回到私人图书馆,知识的囤积和交易,鼓励更少的精确和详细的漏洞公告。少,少开,有用的安全通信将鼓励腐败和软件安全的衰变。所以,它要花钱的。 However the nature of an enumeration is, either you do it all or it's not: "An enumeration is a complete, ordered listing of all...". If MITRE wants to do a partial enumeration, let's change the name to PVE... The benefits of the CVE are international and cannot easily be segmented by country or geopolitical alliances, especially in the face of open software. If the costs are too much for the U.S. budget, get money internationally or get credit for the effort internationally, that is, trade it as a debt other countries owe the U.S. for its contributions to software and cyber security, or go home because "partial enumeration" is an oxymoron. Pascal