RIPE support for CVE foundation
from a private thread: }The CVE Foundation has been formed to fund the CVE effort, due to }"longstanding concerns among members of the CVE Board about the }sustainability and neutrality of a globally relied-upon resource being tied }to a single government sponsor.": } } https://www.thecvefoundation.org/ I had previous opioned that it was time for EC/EU (maybe NATO) to take on funding this, and to move/replicate the effort outside of MITRE. That was before I knew of the foundation. I think that MITRE has done the best job possible ... for a beltway entity... but that it hasn't been very helpful. 3h webinar required to learn what a CVE is before you can get allocations. yes, useful to the unwashed C* masses... I'm of the opinion that RIPE can and ought to take on a role here as representatives of the ISP operator community. Both in a leadership role and as a source of funding. The FAQ says to contact info@thecvefoundation.org, and this email is BCC'ed to them. (Many open source projects get dozens to hundreds of "potential" CVEs from fuzzers who need a CVE number assigned in order to claim a bounty. There is now a cottage industry of fuzzers. It's a perverse result of the bounty programs... creating a huge amount of work to review potential issues, which often are impossible to actually exploit... and never come with fixes) -- Michael Richardson <mcr+IETF@sandelman.ca> . o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide
Peace, On Sat, 19 Apr 2025, 1:32 pm Michael Richardson, <mcr+ietf@sandelman.ca> wrote:
I had previous opioned that it was time for EC/EU (maybe NATO) to take on funding this, and to move/replicate the effort outside of MITRE.
There is an effort. https://euvd.enisa.europa.eu/ -- Töma
Hi, I am not sure if anyone should support CVE Foundation yet. You don't build trust just by founding yet-another-foundation and put CVE into the name. Not to mention that swapping one US organization for a different US organization might not be a best choice as of now. I would recommend cautious approach and perhaps thinking about the way forward. This blog post resonates with me a lot: https://opensourcesecurity.io/2025/04-can-we-trust-cve/ Cheers, Ondrej -- Ondřej Surý (He/Him) ondrej@sury.org On Fri, Apr 18, 2025, at 19:09, Michael Richardson wrote:
from a private thread:
}The CVE Foundation has been formed to fund the CVE effort, due to }"longstanding concerns among members of the CVE Board about the }sustainability and neutrality of a globally relied-upon resource being tied }to a single government sponsor.": } } https://www.thecvefoundation.org/
I had previous opioned that it was time for EC/EU (maybe NATO) to take on funding this, and to move/replicate the effort outside of MITRE. That was before I knew of the foundation.
I think that MITRE has done the best job possible ... for a beltway entity... but that it hasn't been very helpful. 3h webinar required to learn what a CVE is before you can get allocations. yes, useful to the unwashed C* masses...
I'm of the opinion that RIPE can and ought to take on a role here as representatives of the ISP operator community. Both in a leadership role and as a source of funding. The FAQ says to contact info@thecvefoundation.org, and this email is BCC'ed to them.
(Many open source projects get dozens to hundreds of "potential" CVEs from fuzzers who need a CVE number assigned in order to claim a bounty. There is now a cottage industry of fuzzers. It's a perverse result of the bounty programs... creating a huge amount of work to review potential issues, which often are impossible to actually exploit... and never come with fixes)
-- Michael Richardson <mcr+IETF@sandelman.ca <mailto:mcr%2BIETF@sandelman.ca>> . o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide
----- To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/ripe-list.ripe.net/ As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings. More details at: https://www.ripe.net/membership/mail/mailman-3-migration/
*Attachments:* • signature.asc
-- Ondřej Surý (He/Him) ondrej@sury.org
Hi, In Sweden we have Olle Johansson (that some of you might know) that coordinate our effort(s) on trying to understand what's up. I don't know whether Olle is on this list, so I copy him here. As Ondřej wrote, I do not think we should do anything in panic. We need something that fulfils our needs. Patrik On 21 Apr 2025, at 14:29, Ondřej Surý wrote:
Hi,
I am not sure if anyone should support CVE Foundation yet. You don't build trust just by founding yet-another-foundation and put CVE into the name. Not to mention that swapping one US organization for a different US organization might not be a best choice as of now.
I would recommend cautious approach and perhaps thinking about the way forward.
This blog post resonates with me a lot: https://opensourcesecurity.io/2025/04-can-we-trust-cve/
Cheers, Ondrej -- Ondřej Surý (He/Him) ondrej@sury.org
On Fri, Apr 18, 2025, at 19:09, Michael Richardson wrote:
from a private thread:
}The CVE Foundation has been formed to fund the CVE effort, due to }"longstanding concerns among members of the CVE Board about the }sustainability and neutrality of a globally relied-upon resource being tied }to a single government sponsor.": } } https://www.thecvefoundation.org/
I had previous opioned that it was time for EC/EU (maybe NATO) to take on funding this, and to move/replicate the effort outside of MITRE. That was before I knew of the foundation.
I think that MITRE has done the best job possible ... for a beltway entity... but that it hasn't been very helpful. 3h webinar required to learn what a CVE is before you can get allocations. yes, useful to the unwashed C* masses...
I'm of the opinion that RIPE can and ought to take on a role here as representatives of the ISP operator community. Both in a leadership role and as a source of funding. The FAQ says to contact info@thecvefoundation.org, and this email is BCC'ed to them.
(Many open source projects get dozens to hundreds of "potential" CVEs from fuzzers who need a CVE number assigned in order to claim a bounty. There is now a cottage industry of fuzzers. It's a perverse result of the bounty programs... creating a huge amount of work to review potential issues, which often are impossible to actually exploit... and never come with fixes)
-- Michael Richardson <mcr+IETF@sandelman.ca <mailto:mcr%2BIETF@sandelman.ca>> . o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide
----- To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/ripe-list.ripe.net/ As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings. More details at: https://www.ripe.net/membership/mail/mailman-3-migration/
*Attachments:* • signature.asc
-- Ondřej Surý (He/Him) ondrej@sury.org
----- To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/ripe-list.ripe.net/ As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings. More details at: https://www.ripe.net/membership/mail/mailman-3-migration/
Thank you for the introduction Patrik. I think we have to think both short term and long term at the same time, which is confusing. I’ve been working on the long term plan for a while, which has been reviewed by a large community and you can read and comment here: https://docs.google.com/document/d/1u6yPlCla7SO6YuHakjvmcGtcEmHdp-NANaqpTDTA7Q0/edit?usp=sharing global-vuln-db docs.google.com We are working to coordinate many stakeholders to bring this discussion forward. While the problems around the CVE may be handle by the newly formed CVE Foundation, it is far too early to tell and there are some politics going on, like the CVE trade mark being owned by MITRE. We should not act too quickly here, but be a bit careful (unlike ENISA). Currently OpenSSF, Eclipse ORCWG, OWASP and a few more are trying to coordinate work. We’re lacking a lot of European participation. I have an open meeting to discuss this work with ECLIPSE ORCWG on Monday April 28 which you can find in the community calendar linked at https://orcwg.org/participate/ I would love for RIPE to be part of the work going forward. If you have any questions, please do not hesitate to contact me. Best regards, /Olle
On 22 Apr 2025, at 17:52, Patrik Fältström <paf@netnod.se> wrote:
Hi,
In Sweden we have Olle Johansson (that some of you might know) that coordinate our effort(s) on trying to understand what's up. I don't know whether Olle is on this list, so I copy him here.
As Ondřej wrote, I do not think we should do anything in panic. We need something that fulfils our needs.
Patrik
On 21 Apr 2025, at 14:29, Ondřej Surý wrote:
Hi,
I am not sure if anyone should support CVE Foundation yet. You don't build trust just by founding yet-another-foundation and put CVE into the name. Not to mention that swapping one US organization for a different US organization might not be a best choice as of now.
I would recommend cautious approach and perhaps thinking about the way forward.
This blog post resonates with me a lot: https://opensourcesecurity.io/2025/04-can-we-trust-cve/
Cheers, Ondrej -- Ondřej Surý (He/Him) ondrej@sury.org <mailto:ondrej@sury.org>
On Fri, Apr 18, 2025, at 19:09, Michael Richardson wrote:
from a private thread:
}The CVE Foundation has been formed to fund the CVE effort, due to }"longstanding concerns among members of the CVE Board about the }sustainability and neutrality of a globally relied-upon resource being tied }to a single government sponsor.": } } https://www.thecvefoundation.org/
I had previous opioned that it was time for EC/EU (maybe NATO) to take on funding this, and to move/replicate the effort outside of MITRE. That was before I knew of the foundation.
I think that MITRE has done the best job possible ... for a beltway entity... but that it hasn't been very helpful. 3h webinar required to learn what a CVE is before you can get allocations. yes, useful to the unwashed C* masses...
I'm of the opinion that RIPE can and ought to take on a role here as representatives of the ISP operator community. Both in a leadership role and as a source of funding. The FAQ says to contact info@thecvefoundation.org <mailto:info@thecvefoundation.org>, and this email is BCC'ed to them.
(Many open source projects get dozens to hundreds of "potential" CVEs from fuzzers who need a CVE number assigned in order to claim a bounty. There is now a cottage industry of fuzzers. It's a perverse result of the bounty programs... creating a huge amount of work to review potential issues, which often are impossible to actually exploit... and never come with fixes)
-- Michael Richardson <mcr+IETF@sandelman.ca <mailto:mcr%2BIETF@sandelman.ca>> . o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide
----- To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/ripe-list.ripe.net/ As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings. More details at: https://www.ripe.net/membership/mail/mailman-3-migration/
Attachments: signature.asc
-- Ondřej Surý (He/Him) ondrej@sury.org
----- To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/ripe-list.ripe.net/ As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings. More details at: https://www.ripe.net/membership/mail/mailman-3-migration/
--- * Olle E Johansson - oej@edvina.net * Cell phone +46 70 593 68 51, Office +46 8 96 40 20, Sweden * Matrix: @oej:matrix.org Mastodon: @oej@infosec.exchange * Linkedin: ollejohansson
Ondřej Surý <ondrej@dns.rocks> wrote: > I am not sure if anyone should support CVE Foundation yet. You don't build > trust just by founding yet-another-foundation and put CVE into the name. Not > to mention that swapping one US organization for a different US organization > might not be a best choice as of now. That's a good point. I'd like to see RIPE propose one of the board members for the CVE Foundation. That doesn't get EC (or NATO) off the hook of doing something non-USSA based. (EUVD is mentioned in the post) My understanding is the CVE Foundation ("the board") is still in the formative stage, and had not yet taken any kind of control over MITRE's work. > I would recommend cautious approach and perhaps thinking about the way > forward. > This blog post resonates with me a lot: > https://opensourcesecurity.io/2025/04-can-we-trust-cve/ That's an interesting read, and the other article about NVD is good too. https://anchore.com/blog/national-vulnerability-database-opaque-changes-and-... -- Michael Richardson <mcr+IETF@sandelman.ca> . o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide
participants (5)
-
Michael Richardson -
Olle E. Johansson -
Ondřej Surý -
Patrik Fältström -
Töma Gavrichenkov