Re: CVE Advancements

["Eugene H. Spafford" <gene.spafford@gmail.com>]

Let me note, from a historical perspective, that CERIAS hosted a workshop on vulnerability databases here in January 1999. The MITRE folks presented at that workshop, and decided to make their efforts public as a result. The CVE was "born" in a sense as a result of that meeting, although much of the work had been done prior. Seehttp://www.ieee-security.org/Cipher/ConfReports/1999/CR1999-WVDB99.html(I helped organize the first workshop, too, at NIST, as I recall. It wasn't as well attended.) It might be worthwhile to have a follow-up workshop for not only the CVE, but some of the other players in the arena. We could piggyback it on our annual symposium here, in April, which might make it even more of interest for some people to attend. However, if I were to do that, I'd want some definite buy-in from people, including some who would help with planning. This is not necessarily the same as a CVE editorial board meeting, which could be done in conjunction or separately with a workshop. -spaf

smime.p7s