CVE Foundation - https://news.ycombinator.com/item?id=43704430

Replacing CVE - https://news.ycombinator.com/item?id=43708409

https://www.forbes.com/sites/kateoflahertyuk/2025/04/16/cve-...

My guess indefinitely.

DOGE might be a bunch of idiots, but in the entire DOD, there are non-idiots.

I wonder what level of compartmentalisation inside DHS means they didn't see this as having sufficient downsides?

I ask this, because I don't think anyone in the subject matter specialist space would have made a strong case "kill it, we don't need this" and I am sure if asked would have made a strong case "CRISSAKE WE NEED THIS DONT TOUCH IT" -But I could believe senior finance would do their own research (tm) and mis-understand what they saw in how other people work with CVE, and who funds it.

> https://www.thecvefoundation.org

https://mastodon.social/@serghei/114346660986059236

April 2024, https://nvd.nist.gov/general/news/nvd-program-transition-ann...

  NIST maintains the National Vulnerability Database (NVD).. This is a key piece of the nation’s cybersecurity infrastructure. There is a growing backlog of vulnerabilities.. based on.. an increase in software and, therefore, vulnerabilities, as well as a change in interagency support.. We are also looking into longer-term solutions to this challenge, including the establishment of a consortium of industry, government, and other stakeholder organizations that can collaborate on research to improve the NVD.

> Security and vulnerability handling in software is of ever increasing importance. Recent events have adversely affected many project's ability to identify and ensure these issues are addressed in a timely manner. This is extremely worrying.. Until recently many of us were relying not on the CVE project's data but on the NVD data that added that information.

Five years ago (2019), I helped to organize a presentation by the CERT Director from Carnegie Mellon, who covered the CVE backlog and lack of resources, e.g. many reported vulnerabilities never even receive a CVE number. It has since averaged < 100 views per year, even as the queue increased and funding decreased, https://www.youtube.com/watch?v=WmC65VrnBPI

https://www.computerhope.com/jargon/l/layer8.htm

Seemingly MITRE hasn't been advised yet whether the option to extend the contract from 2025-04-16 to 2026-04-16 will be executed. And there doesn't appear to be any other publicly listed approach to market for a replacement contract.

[1] https://www.fpds.gov/ezsearch/jsp/viewLinkController.jsp?age...

Given its enormous value, isn't this something that the community, especially FAANG (MAANA?) could step up and fund as a nonprofit?

I guess it's one of those things you never think about until it goes wrong.

The world would do well to move this kind of stuff out of the US quickly, just like ICANN and stuff.

Who is still stunned by these things? They want you to be stunned; they want you to tell everyone else that you're stunned to spread feelings of terror and powerlessness. If you actually are stunned, you are stunningly ignorant. If you are not and still saying it, perhaps to emphasize your unhappiness, you are a 'useful idiot'. Either way, if you are saying it, you are a useful idiot.

You should have known decades ago: The GOP impeached a President for lying about sex; they fabricated intelligence to invade another country (killing thousands of Americans and 100,000+ Iraqis) - and that was all before 2004. They've voted almost unanimously, multiple times, to bankrupt the country (by refusing to authorize debt for existing obligations). Nobody (i.e., the Dems failed to) stopped them or made them pay a price, so why wouldn't they keep doing those things. (Edit: And if you object because the analysis criticizes one side and therefore you reject it as partisan, that's a big part of the reason nothing was done.)

This time they published Project 2025, telling you what they were going to do.

Open season on American corporations for domestic and foreign hackers.

If program isn’t brought back then CVE database likely to be fragmented amongst the “private” CVE databases.

Sec Corp A has 700 well documented CVEs but Sec Corp B has 702 CVEs in their database since NIST funding pulled. What do corps do? Maybe some of them with massive budgets setup contracts with both to get “full spectrum coverage”. Maybe other non-technical companies that think of IT as strictly a cost will go with the cheapest or forego it all together.

Who knows maybe we get ~~~free labor~~~ open source community to pick up the slack?

This country with the orange man administration is quickly going to shit. Not in a “I dislike {opposing party} way” either. In a “I dislike authoritarian regimes” way.

Maybe the Dutch should go ahead.

It's enough of a public good to have a common advisory for vulnerabilities that FAANG should just kick it a few million a year. How much can it possibly cost to run this anyway?

I always suspected that "Department of Homeland Security" would lead to Banana-republic-like shenanigans --- could we defund them?

Step 1: Post discreetly to a forum with minimal information and an absurdly short deadline

Step 2: Phone your friend, the former board member, to make your case on LinkedIn

Step 3: Ring up a friendly journalist and give them a tip

Step 4: Reference the insuing chaos as justification for keeping your project funded

Note that the article carefully avoids pinning the blame on DOGE or the Whitehouse while heavily implying it. MITRE is technically a private entity, albeit a non-profit. And the very last paragraph of the article states:

> A CISA spokesperson told CSO, “CISA is the primary sponsor for the Common Vulnerabilities and Exposure (CVE) program… Although CISA’s contract with the MITRE Corporation will lapse after April 16, we are urgently working to mitigate impact and to maintain CVE services on which global stakeholders rely.”

To be clear, the point isn't to say that the CVE program isn't valuable, nor is it to say that it's good for a shenanigan like this to be necessary.

The point is that, unless you're directly involved in this subject (not impacted—involved), it's probably best to maintain a "wait and see" attitude rather than succumb to catastrophizing this news.

So CVE is a child of US 3 letter agencies ? Good to know.

Just because they're scattershot cutting doesn't mean they're stupid.

The government is not particular (in the sense of particularism) and cannot be easily tuned to fix particular problems; rather, its best solutions come through institutional procedure and design, such as the tension between the FAA and the NTSB that, at a first glance, would seem like obviously needless duplication and waste.

It is a broad, blunt, wasteful instrument to solve broad, blunt problems in a way that may not be the best but that work far, far better than alternatives that have been tried.

That the effort to treat government like a personal budget has ended up destroying important things is a sad inevitability of such efforts. I hope it goes remembered.

What the fuck are you supposed to do about this. This is something that should have had multiple MONTHS of warning in order to allow those who depend on the CVE infrastructure to plan what to do next with their security posture.

If it was $5000/yr it's very different to if it's $5M/year for what amounts to little more than an instance of mediawiki.

https://github.com/CVEProject

This is your moment! Enjoy it!

Currently hosting costs are unclear, but it should be doable if we offer API access for like 5 bucks / month for private and 100 / month for corporate or similar.

Already did a backup of the NVD in the last couple hours, currently backing up the security trackers and OVAL feeds.

Gonna need some sleep now, it's morning again.

My project criteria:

- hosting within the EU

- must have a copyleft license (AGPL)

- must have open source backend and frontend

- dataset size is around 90-148 GB (compressed vs uncompressed)

- ideally an e.V. for managing funds and costs, so it can survive me

- already built my vulnerability scraper in Go, would contribute it under AGPL

- already built all schema parsers, would contribute them also under AGPL

- backend and frontend needs to be built

- would make it prerendered, so that cves can be static HTML files that can be hosted on a CDN

- needs submission/PoC/advisory web forms and database/workflow for it

- data is accumulated into a JSON format (sources are mixed non standard formats for each security tracker. Enterprise distros use odata or oval for the most parts)

If you are interested, write me on linkedin.com/in/cookiengineer or here.

No, more seriously, just like with shutting down NOAA services, it seems the goal is to:

1. cut services (we saved taxpayer money!!)

2. at some point later: oh, we actually need those services

3. pay <insert your favorite vendor here, preferably one connected to Musk> to provide the service (see! we don't need to pay gov employees!!) (fine print: the vendor costs 2-3x the original cost). But by then no one is looking at the spending numbers anymore.

Slick moves.

You can stay out of politics, but politics will always come and find you.

Disclaimer: This is not business advice and should be read using Cartman’s voice.

Step 1: Announce publicly that you are not renewing your contract.

Step 2: If the market has viable alternatives or the service you are negotiating isn’t that hard to replicate, other actors will manifest to fill in the gaps, especially if your business is attractive. (E.g., The top comment is building an alternative; other comments point to alternative services.)

Step 3: Congratulations, you now have leverage for a significant discount with your previous provider because they face the real prospect of losing your business entirely to a competitor. If the competitor is private, you can even double dip by investing in their company before attributing them the contract.

This sucks, plain and simple.

But maybe this is an opportunity to do CVE better.

Some form of a foundation or NGO could be given a reasonable endowment from the industry to operate the CVE program.

O am quite hesitant to trust the DOD to keep track of software vulnerabilities. Some parts are developing and exploiting vulnerabilities. And given a fresh feed of what people find, and usually a delay from notification until publication, which may sometimes just be a bit longer of a delay, would allow the DOD to weaponize the vulnerability for their own use as well.