再保险:问题是:老组织提名一个新人

>等…> >的先例从什么时候开始,现有组织有权>取代>这样的人吗?不是董事会选举在个人绩效这些> >年?> >仅仅因为一个人/组织在黑板上已有十六年,> >的意思是他们不提供任何价值。智慧> >,我深深尊重卡斯珀Dik,我总是。我经常通信> >他十年前关于太阳的漏洞,是他的作品的> >粉丝,并且知道他十分了解我们的行业。> >说,十六年,他已经两次向董事会发布列表* *(相比> Landfield 68次,Seifried 47倍,斯科特14倍……和两个> >有蜜蜂在黑板上下两年)。不管出于什么原因,>卡斯珀>没有提交董事会和选择提供了他非凡的经验> >那些多年努力和洞察力,和作为一个产业,我们> >是更糟。我想辞职的原因是我没有贡献; I think I asked for this several years ago, IIRC, also because my role at Oracle did not and hasn't for quite some time the proper role for a CVE board member. >Oracle, as a company, does not embody the goals and mindset of a CNA >at >all. They have explicitly *countered* many of the things we strive >for, >primarily around vulnerability clarity in tracking and abstraction, >and >continue to fight that to this day. As an organization, Oracle is not >fit >to be a CNA, despite it being terribly convenient for MITRE. >Remove Casper from the picture, which you just did, and Oracle is no >different than any other random company that wishes to have a presence >on >this board. In fact, they are actually LESS suited to than a newcomer >that >may be more open to the industry goals CVE is designed for. > >If there is some policy about existing CNAs automagically getting a >spot >on the board, please cite that public reference so I can kick myself >for >not noticing and arguing it sooner. Joe told me that the CVE board would like to keep a company as large as Oracle on board; so I looked around and found some people who work better as CVE members but I only did that because I was asked to do so. It is also clear that Sun Microsystems had quite a different policy for communicating about security problems; Oracle does not allow any such discussions or communication such as "this problem does not affect Solaris". However, this is only a small part of my job and the take over was by and large a positive effect for our organization so I did not feel I should leave Oracle. We can hope that the people in charge at Oracle see the light. There are a lot of smart people as Oracle; politics, however, can't be changed by being smart. Casper