According to Brian Krebs: <a href="https:&#x2F;&#x2F;infosec.exchange&#x2F;@briankrebs&#x2F;114343835430587973" rel="nofollow">https:&#x2F;&#x2F;infosec.exchange&#x2F;@briankrebs&#x2F;114343835430587973</a>&gt; Hearing a bit more on this. Apparently it&#x27;s up to the CVE board to decide what to do, but for now no new CVEs will be added after tomorrow. the CVE website will still be up.

They surprise is: they won&#x27;t. This will weaken the West.This is dangerously stupid.

So, while arguably true, there wont be a single source of truth of new cve&#x27;s. It doesn&#x27;t however mean there wont be.I would imagine the only SANE option would be some kind of git repository where CNA&#x27;s can collaborate. Probably run some code across to make the website that people can easily access.It&#x27;s going to be a mess.

Basically when any software&#x2F;library&#x2F;whatever has a vulnerability, they have to communicate that out themselves, in some format.If I&#x27;m developing a product built on 20 libraries, it won&#x27;t just be a matter of scanning CVEs for major vulnerabilities any more, so I&#x27;m more likely to miss one.&quot;always update&quot; doesn&#x27;t always work, when to manage a product you realistically have to version pin.

What are the implications of this? No more centralized store of vulnerability information?

NIST NVE relies on the CVE program. (vulnerabilities get reported, MITRE assigns CVEs and publishes them, NIST then copies that list and adds their own scoring etc to it)

Once they fire everyone at NIST, they’ll have that in common.

Is MITRE&#x27;s CVE program redundant with NIST&#x27;s National Vulnerability Database? I&#x27;m having a hard time telling how the two are related, or if NVD is simply performing the same service as MITRE.

The process seems to be to dismantle anything not nailed down in government.Now if you want that (even just funding) to be a thing ... you have to go through Trump &amp; Co and pay your bribe to get it back up.

This neo-liberal approach has no place for soft diplomacy, which is what US hegemoney relies on.This isn&#x27;t just a rapid disassembly of economic structures, any trust and goodwill is completely obliterated as well.

April 2024 article on the result of NVD funding cutbacks, with comments by Linux Foundation OpenSSF, security startups like ChainGuard and commercial vendors, <a href="https:&#x2F;&#x2F;www.securityweek.com&#x2F;cve-and-nvd-a-weak-and-fractured-source-of-vulnerability-truth&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.securityweek.com&#x2F;cve-and-nvd-a-weak-and-fracture...</a><pre><code> Threat intelligence firm Flashpoint noted in March 2024 it was aware of 100,000 vulnerabilities with no CVE number and consequently no inclusion in NVD. More worryingly, it said that 330 of these vulnerabilities (with no CVE number) had been exploited in the wild.. Since the start of 2024 there have been a total of 6,171 total CVE IDs with only 3,625 being enriched by NVD. That leaves a gap of 2,546 (42%!) IDs.
</code></pre>
Despite all those private companies and various OSS projects being willing to contribute ideas, infrastructure and code, they have somehow failed to coalesce into a decentralized replacement for NVD, built on CC0 data and OSS tooling.

Force of habit. We don&#x27;t have a framework for talking under these circumstances, so we apply our outdated ones.As you say, that&#x27;s exactly what got us here. But the alternatives are very unclear, and seem deeply unpleasant.

I still find it wild that so many people are trying to frame these decisions through a political lens. This is the actions of a foreign bad actor dismantling critical institutions from within, not &quot;bad policy&quot;.Surely there&#x27;s an antibody response.

Imagine being eaten alive by a cackling hyena that ambushed you and all the while being like &quot;hmm what is the appropriate steelman here? why do I deserve this? why is this just?&quot;In reality this would never happen so all these people playing steelman are just detached&#x2F;insulated.

&gt;&gt; I&#x27;m trying to steelman&gt; Why?It&#x27;s a sensible practice and good practice

It is the belief that it is not in good faith that makes it more important that you try to steelman it.If the steelmanning fails then you can you can be even more confident that it is in bad faith.

&gt; I&#x27;m trying to steelmanWhy? This administration is not acting in good faith, you don&#x27;t have to act as if they are. People and institutions doing that is part of how we got here in the first place.

important to note: the US&#x27;s food safety is already really bad. salmonella isn&#x27;t a thing you have to worry about in first world countries. can&#x27;t wait to see what plague demon spawns out of a food industry running amok after the FDA gets gutted.

the guy is ultimate small gov.
he wants to rip it out by the roots.

According to the radio this morning, they&#x27;re currently working to close all the FDA branches that do food safety testing, so, good guess?

I think it’s ignorance and arrogance. The US seems to be on a path to lose technological and science leadership. The current leadership doesn’t seem to understand things that aren’t flashy. I wonder when they’ll dial back on food safety. I am sure RFK knows some vitamins that protect against salmonella

Or cut from $877B in defense spending instead?<a href="https:&#x2F;&#x2F;usafacts.org&#x2F;government-spending&#x2F;" rel="nofollow">https:&#x2F;&#x2F;usafacts.org&#x2F;government-spending&#x2F;</a>

That&#x27;s a good idea to raise during the budget time or with some warning ahead of time. But even discussing the cost of CVE program itself is likely a waste of time and money. When trying to deal with 2tn deficit, looking at things that historically got ~$5M is just a distraction. And the lack of it may cost even more given how many existing agreements&#x2F;contracts rely on cve to be a thing - maybe just in gov lawyers having to rewrite things.

Selling bonds is not the same thing as a family budget being in the red.  Either you know this and you&#x27;re making this argument in bad faith, or you don&#x27;t and, well...

Dear god, you don&#x27;t just stop running government completely because you have a deficit.

This is an absolute pittance compared to the total budget. And considering the current administration wants a $4T tax cut they are not interested in trimming the deficit at all.

Republicans control Congress, this is bait

We have a 2tn deficit. If Congress wants to fund this, they need to make it mandatory spending and raise taxes.

&gt; I really can&#x27;t think of a non- nefarious justification for thisTragedy of the commons - NVD and the CVE project havr been backlogged and facing funding issues for a couple years now, and most security vendors are either cagey about providing vulns in a timely manner (as it can reduce their own comparative advantage), or try upsell their own alternative risk prioritization scores.Every company will gladly use NVD and CVE data, but no one wants to subsidize it and help a competitor, especially in an industry as competitive as cybersecurity.

It&#x27;s incredibly foolish. Whatever the justification is, it doesn&#x27;t matter as much as the horrible outcome.This is one of those things the government does for the benefit of the whole.

Probably the thinking goes that someone in the international community will step in. CVE is in practice a global registry for all, thus &quot;Why should the USA Department of Homeland Security pay for all the freeloaders&quot;.Still shortsighted and stupid, but it&#x27;s plausible this is intended as leverage to get someone else to pony up.

&gt; surely they can spare 0.01% of their revenueThey would, if we made companies pay their taxes.Yes, you can also run such a system based on donations. But I personally think that such a system is important enough to be paid for by the government. When you run on donations, there will always be conflicts of interest and the risk of running out of funds.But yeah, Mitre being a private organization that was paid for by the government was a problem.

Yes, I&#x27;m sure corporations funding the CVE system would go wonderfully.
&quot;It would be best if we don&#x27;t see any severe CVEs for our products this quarter, if you want our funding next quarter.&quot;

MITRE is a non-profit, it receives about $1.5B from the federal government, and another almost $2B from Virginia.

Reduce government spending; since it&#x27;s not actually a government organization (as far as I can tell, I never looked into it before), other organizations can fund it. How much goes into this organization a year anyway? I&#x27;m seeing a Mitre corporation that does lots of other stuff too that has a revenue of 2.2 billion a year.Multi-trillion-dollar companies benefit from and contribute to this system, surely they can spare 0.01% of their revenue to this bit of critical infrastruture?

Reduce spending. Steelmanning (not actually believing this): it probably cost a lot for what is essentially a database, and can be done cheaply by private sector (Google, Microsoft).

Wow! So who is leading the world order now (aka who is funding MITRE)?

It&#x27;s a dying empire, really nothing else to say. The USA led world order is over, we&#x27;ve voted ourselves out of it, and now need to learn how to deal with that.

I&#x27;ll admit this is a bugbear of mine, but I think this is the reason &quot;steelmanning&quot; is counterproductive.Steelmanning is a neologism that serves no purpose other than in-group signaling. There was already a perfectly acceptable term for the same concept, one with more nuance and a rich history: Charitability.The major difference is that charitability is about treating your interlocutor with respect. Steelmanning is about using one&#x27;s own intellect to make your interlocutor&#x27;s argument better than them. Because charitability is based on a concept of mutual respect, if somebody clearly doesn&#x27;t respect you one iota, then why would you be charitable? Steelmanning tries to divorce the person from the argument, and is ironically both arrogant and naive.

I&#x27;m trying to steelman but I really can&#x27;t think of a non- nefarious justification for this

Yes, NVD funding cuts and a growing CVE backlog began in late 2023.May 2024, <a href="https:&#x2F;&#x2F;therecord.media&#x2F;nist-database-backlog-growing-vulncheck" rel="nofollow">https:&#x2F;&#x2F;therecord.media&#x2F;nist-database-backlog-growing-vulnch...</a>&gt; Moving forward, cybersecurity companies will have to “fill the void” .. NVD said in April [2024] that it is “working to establish a consortium to address challenges in the NVD program and develop improved tools and methods.” .. CISA acknowledged the concerns and outrage of the security community and said it is starting an enrichment effort called “Vulnrichment,&quot; which will add much of the information described by Garrity to CVEs.The second VulnCon event took place last week and no silver bullet has appeared, <a href="https:&#x2F;&#x2F;ygreky.com&#x2F;2025&#x2F;04&#x2F;vulncon-2025-impressions&#x2F;" rel="nofollow">https:&#x2F;&#x2F;ygreky.com&#x2F;2025&#x2F;04&#x2F;vulncon-2025-impressions&#x2F;</a><pre><code> Vulnerability enrichment was mentioned in many talks. However, most organizations seem to handle it internally. There doesn’t appear to be momentum toward a shared or open source solution – at least not yet.</code></pre>

What has been ongoing for more than a year?The funding appears to have been cut off today, and both of these comments seem to talk about continuing work and how important it is.Do you mean to say that some form of threat to the NVD has been around for over a year now? Just want to be sure I&#x27;m parsing correctly!

What is incorrect about the post above? There are citations from multiple reputable news outlets for each claim.People who actually work with CVEs have been posting about this problem on HN for 18 months.

Why do you post this on a comment that is neither of those things then?

I&#x27;ve noticed that there&#x27;s a post like this in most articles on HN that could be construed as negative for the current administration: some vague false statement followed by either a factually incorrect explanation or some quote that does not support the statement.

Is there no connection between 2025 funding cuts and previous ones? e.g. If a year of work after the previous cuts resulted in an open-data collaboration between NVD and commercial vendors to share a subset of CC0 vulnerability metadata, could that industry collective now argue for government to share (with companies) the burden of funding an open, decentralized program for CVE tracking? Commercial vendors could still offer additional metadata and analytics, over and above the public baseline.Edit_1: found a proposed bill, April 2025, <a href="https:&#x2F;&#x2F;fedscoop.com&#x2F;public-private-partnerships-bill-nist-house-senate&#x2F;" rel="nofollow">https:&#x2F;&#x2F;fedscoop.com&#x2F;public-private-partnerships-bill-nist-h...</a>&gt; A bipartisan bill that would establish a nonprofit foundation aimed at boosting private-sector partnerships at the National Institute of Standards and Technology was reintroduced in the House and the Senate.. the proposed foundation structure was described as replicating similar nonprofits that support public-private partnerships at other science agencies.. we encourage a strategy that leverages NIST’s leadership and expertise on standards development, voluntary frameworks, public-private sector collaboration, and international harmonization.. NIST’s funding has been in focus following a budget cut of roughly 12% to $1.46 billion in fiscal year 2024.Edit_2: is there a shortage of database rows, or people to write a shell script? Why not pre-allocate N CVE IDs for every CNA, while a new plan is worked out? At least one random commercial vendor could foresee the shutdown early enough to reserve CVEs.&gt; Garrity posted on LinkedIn, “Given the current uncertainty surrounding which services at MITRE or within the CVE Program may be affected, VulnCheck has proactively reserved 1,000 CVEs for 2025,” adding that Vulncheck “will continue to provide CVE assignments to the community in the days and weeks ahead.”

I did find this post to be non-helpful and confusing. It would be helpful to edit it (or write differently in the future) to clarify that the sudden defunding event occurring today is separate and not related to the previous funding cuts. If that&#x27;s the case.

Both CVE (MITRE contract) and NVD are funded by NIST, <a href="https:&#x2F;&#x2F;www.securitymagazine.com&#x2F;articles&#x2F;100795-understanding-the-impact-of-the-nist-nvd-backlog-on-msps" rel="nofollow">https:&#x2F;&#x2F;www.securitymagazine.com&#x2F;articles&#x2F;100795-understandi...</a>&gt; Since February 2024, the National Institute of Standards and Technology’s (NIST) National Vulnerability Database (NVD) has encountered delays in processing vulnerabilities.. caused by factors such as software proliferation, budget cuts and changes in support.. NIST, an agency within the United States Commerce Department, saw its budget cut by nearly 12% this year.

There is nothing in that article mentioning funding reductions.That article is about how the volume of software vulnerabilities are increasing, resulting in difficulty keeping up by the CVE and NVD projects.Please stop spamming this thread with political spin.

If you work on OSS software on CVE management, then you already know that NVD funding reductions have been ongoing for more than a year.April 2024, <a href="https:&#x2F;&#x2F;nvd.nist.gov&#x2F;general&#x2F;news&#x2F;nvd-program-transition-announcement" rel="nofollow">https:&#x2F;&#x2F;nvd.nist.gov&#x2F;general&#x2F;news&#x2F;nvd-program-transition-ann...</a><pre><code> NIST maintains the National Vulnerability Database (NVD).. This is a key piece of the nation’s cybersecurity infrastructure. There is a growing backlog of vulnerabilities.. based on.. an increase in software and, therefore, vulnerabilities, as well as a change in interagency support.. We are also looking into longer-term solutions to this challenge, including the establishment of a consortium of industry, government, and other stakeholder organizations that can collaborate on research to improve the NVD.
</code></pre>
Sep 2024, Yocto Project, &quot;An open letter to the CVE Project and CNAs&quot;, <a href="https:&#x2F;&#x2F;github.com&#x2F;yoctoproject&#x2F;cve-cna-open-letter&#x2F;blob&#x2F;main&#x2F;cve-cna-open-letter.txt">https:&#x2F;&#x2F;github.com&#x2F;yoctoproject&#x2F;cve-cna-open-letter&#x2F;blob&#x2F;mai...</a>&gt; Security and vulnerability handling in software is of ever increasing importance. Recent events have adversely affected many project&#x27;s ability to identify and ensure these issues are addressed in a timely manner. This is extremely worrying.. Until recently many of us were relying not on the CVE project&#x27;s data but on the NVD data that added that information.Five years ago (2019), I helped to organize a presentation by the CERT Director from Carnegie Mellon, who covered the CVE backlog and lack of resources, e.g. many reported vulnerabilities never even receive a CVE number. It has since averaged &lt; 100 views per year, even as the queue increased and funding decreased, <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=WmC65VrnBPI" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=WmC65VrnBPI</a>

I&#x27;m not sure, but the current article looks to have somewhat more information in it, so I&#x27;ve merged that thread hither instead.

dupe of a dupe <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=43700258">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=43700258</a>

That&#x27;s exactly what they&#x27;re saying about the HHS cuts and the measles outbreak.

What I don&#x27;t get is why people make things up and then get angry at the thing they made up. Is there not enough real things to be angry at?

Reminds me of Trump&#x27;s first term where he said if we stopped testing for Covid, we&#x27;d stop catching new cases and case numbers would go down. If you stop testing for vulnerabilities then vulnerabilities go down. Easy stuff.

For those reading, a fair few of my recent posts were downvoted after this comment, and it was initially flagged.If I violated some rule so be it, and I could care less about internet points, but it certainly feels like suppression of individuals based on individual posts which is a behaviour that could end up being the death of hn.

If you &#x2F;s&#x2F;China&#x2F;Russia&#x2F;, when asking Trump, it’s no longer a rhetorical question.

It seems phrasing it in the form of a joke was too much.I was trying to convey (with levity&#x2F;humor) WHY it should continue to be funded as well as the argument that should be made to the one currently in control of the spineless US Congress.Yes, fixing the vulnerabilities is important. However what the government probably does gain from it is an inside advantage in the lead time for vulnerabilities to protect against, as well as to exploit on adversaries.

Mr. President, Do you want China to get the reports instead, or do you want the NSA to have a lead time where the vuln&#x27;s are useful tools?

A lot was lost in the midterms and Supreme Court appointments.Hopefully these 4 years energize people to vote. I know protesting and direct action and so on are also important, but the gradient is not negative for voting for every office you can vote for in every election.

&gt; it will be a lot like last timeA lot of people seemed to have had this theory, despite all the evidence to the contrary.

I can&#x27;t believe what a bunch of bollocks this administration is. I couldn&#x27;t believe it the first time, and this time I thought &quot;Well at least I&#x27;m ready, it will be a lot like last time&quot; and it&#x27;s so much worse

Man, I just can’t even muster the snark I usually have for these sorts of boneheaded decisions.This sucks, plain and simple.

I feel that. So tired of management being completely uninterested in actual, actionable security holes but getting wildly spun up because they saw a notice with a big scary number that has absolutely no relevance in our architecture.

Yeah like when we bundled in a .js library for client side date processing that has a CVE affecting node.js servers with high score.  Our auditors don’t care they tag the whole app as high risk. It doesn’t even run on the server!

Most tracking tools have exception processes. But yeah, security as a product family instead of a simple score seems to be a foreign concept at most companies.

Don’t let the perfect be the enemy of good. It is(was?) a very useful and important system.Trump must be receiving a lot of emails from companies wanting to fill the void, and I bet the Trumpiest of them all is going to be awarded a contract worth 10x the budget CVE had, and do a much worse job.

It’s Way Better than what we had before: software vendors making even arbitrarier decisions about how to classify them.There are far too many bad actors for us to operate as an industry with no yardstick.

Spot on. Vulnerability scanners that make up an organizational Security Score (TM) tend to operate at the wrong level of abstraction, flagging some library somewhere that never runs and has nothing to do with your production flow or architecture, or some test keys with zero security impact. Go explain that to management, because obviously the security tools are right and you are wrong. This sad state of affairs is unfortunately the best that the security industry has been able to deliver. Trying to wrangle complexity by adding more complexity is the craziest notion to me. Yes, no scoring scheme is perfect, but when the scheme introduces more noise, what have we gained (well, security vendors gain, but what have organizations gained).

Solving this problem in a generalized way is really hard.Maybe I have a dependency on Foo which has a critical vulnerability in a feature that I don&#x27;t use. I suppress the warning and all is well. Then two weeks later someone on my team decides to use that feature, not knowing that there&#x27;s a problem with it. Now we&#x27;re fucked, and we&#x27;ll never know because the vulnerability has been suppressed.

and then a random 9.8 critical comes that affects some software you have in a way that makes it a 0 in your environment but it doesn&#x27;t matter cause the cve  tanks your organizational Security Score (tm) by 10 arbitrary points and management is wondering when you&#x27;ll secure the company again because the Security Score is their only tangible deliverable to measure success

I don&#x27;t know of anyone who doesn&#x27;t quickly become exhausted after running a CVE scanner on their code.

These sound like downstream effects of funding stress to me, no?

This^ and to add to that, at the very least MITRE assigned IDs which is great. Plus they did an initial scoring, which, well… will never be perfect like you said and I’m sure these things evolve throughout time and get better (not talking necessarily CVSS vX).What a shame on this current gov. administration, if you can even call it that.

Why isn&#x27;t it a good justification?I think the question everyone in this thread should ask is: why is it the government&#x27;s job to do this, especially given the prior widespread view that they&#x27;re doing a bad job? Is the software industry so immiserated by poverty that it cannot organize its own distribution of security bulletins? Clearly not: GitHub already runs its own vuln tracking scheme that&#x27;s better integrated with the tooling we use for open source software. The industry routinely sets up collaborations like standards bodies, information sharing groups and more. And there is as whole ecosystem of security companies to help you understand vulns in your stack.So there seems nothing specific to CVEs that requires government involvement, but the existence of the tax funded scheme does discourage the creation of competitors that might function better.But, to CVE or not to CVE ... that is not the question. US deficit spending is out of control. This sort of thing had to happen some day. It&#x27;s what Europeans in the 2010s called &quot;austerity&quot; and it always makes some people scream but this graph:<a href="https:&#x2F;&#x2F;fiscaldata.treasury.gov&#x2F;americas-finance-guide&#x2F;national-debt&#x2F;" rel="nofollow">https:&#x2F;&#x2F;fiscaldata.treasury.gov&#x2F;americas-finance-guide&#x2F;natio...</a>... is not sustainable. Up to 1984 overall US debt was stable. Since then its growth rate became dangerous. Debt&#x2F;GDP ratio is now worse than just after WW2. The federal government is currently spending more on interest than on defense or Medicare:<a href="https:&#x2F;&#x2F;www.crfb.org&#x2F;blogs&#x2F;interest-costs-have-nearly-tripled-2020" rel="nofollow">https:&#x2F;&#x2F;www.crfb.org&#x2F;blogs&#x2F;interest-costs-have-nearly-triple...</a>The US is currently getting its first taste of what parts of Europe started going through in 2008, and unfortunately there&#x27;s bad news: the cuts you&#x27;re seeing now are mostly cosmetic. They&#x27;re what can be done within the current framework of laws, sort of, with lots of bending of the rules and creative interpretations of them and maybe some oversteps. But it&#x27;s just the start of what&#x27;s needed. Large scale reform of the laws themselves will be required regardless of whoever wins the next elections.

The scores were never going to be that accurate across people&#x27;s environments (IDK how much other places relied on them, places I worked never did that much) and issues with the scores don&#x27;t seem to be a good justification to torch the whole CVE system anyway.

you like to say word &#x27;bikeshedding&#x27;, adoption of formal intellectualish sounding terminology even when inappropriate is orange-site affliction I advise against. I am saying this for your own sake... speak truths with POWER

This is bikeshedding. The point is an authoritative process and an identifierAll this does is help Putin and other rich grifters.

Sure. There&#x27;s also major problems with the video encoding pipeline at my big tech job. Let&#x27;s just delete it

There are a lot of logical fallacies. Have you heard of the sunk-cost one? Or fallacy fallacy maybe? Or ten-tendril eschatomon fallacy?In honesty to say &quot;logical fallacy&quot; is spoddy, I advise against for aesthetic reason.

&gt; Weren&#x27;t there major problems with the current CVE implementationAbsolutely. And if the headline was &quot;DHS proposes improvements and streamlining to the CVE program&quot; we&#x27;d all probably be cheering.Leaping from &quot;This is Flawed&quot; to &quot;Let&#x27;s kill This&quot; is a logical fallacy. A flawed security registry is clearly better than no security registry.

This will get lost in the noise, but i think you mean cvss.CVE is simply identification of a flaw, not a scoring system.

&gt; you are in the business of compliance rather than security.So, most businesses. They all need their ISO&#x2F;NIST&#x2F;HIPAA&#x2F;etc certs.

As an active consumer of CVEs: yea there are major problems. No there&#x27;s nothing better and no I don&#x27;t have any better ideas.The scores are mostly useless, I would not care if they disappeared, I do not look at them. I don&#x27;t really understand why people get so upset about garbage scores though. If a high CVSS score creates a bunch of work for you then your vuln mag process is broken IMO. (Or alternatively, you are in the business of compliance rather than security. If you don&#x27;t like working in compliance, CVSS scores aren&#x27;t the root cause of your misery).Having a central list of &quot;here&#x27;s a bunch of things with stable IDs that you might or might not care about&quot; is very valuable.

Getting a bit tired of posts like this (no offense), something dumb &#x2F; nefarious happens like funding is cut for &lt;useful thing&gt;, then someone posts an off the cuff comment or question like, &quot;wasn&#x27;t this &lt;useful thing&gt; not that useful because &lt;superficial reason&gt;?&quot;.Why do people do this, to down play all the destruction of the last few months? Seems to be some type of coping mechanism.

Every system has problems. The challenge is to address the problems and fix them. Not just delete the entire system and claim a win.

Yes it earnestly needed new direction and leadership.

Classic &quot;oh its broken so throw it all away&quot;.It&#x27;s the way it is because there isn&#x27;t a good alternative. They cannot possibly know every environment that we operate in.To this day we still have large corporations down playing their issues, and it was way worse 20 years ago.

Weren&#x27;t there major problems with the current CVE implementation, especially with the waves of script kiddies and AI tools spamming the database and the fact that projects who take security seriously have little to no say in the &quot;score&quot; that gets assigned?

Destroy, destroy, destroy. Promise to rebuild but don&#x27;t. Take it all.

&gt; cut everything, recklessly, indiscriminatelyMostly discriminately, tbh.

There are many problems going on right now, but in terms of cuts this is one of the most problematic: everything is secret, with no oversight or deliberation. It&#x27;s indistinguishable from corrupt malice because it&#x27;s not done with open thoughtfulness.

Yes, this is 100% consistent with their policy: cut everything and if you find out that something is really really needed then reverse it.

&gt; I wonder what level of compartmentalisation inside DHS means they didn&#x27;t see this as having sufficient downsides?This was not a carefully-weighed decision based on a cost-benefit analysis. This was a political order, consistent with the administration&#x27;s policy of &quot;cut everything, recklessly, indiscriminately.&quot;

Hanlon&#x27;s razor. I also tend to impute malice to things I don&#x27;t like, but I think it&#x27;s hard to go past stupidity.

&gt; someone could be making a profit on thisYes, there are apparently various ways of profiting from vulnerabilities. The interesting question would be whether any of the regime insiders have a way to profit.

it might be ignorance; it might be malice.it might also be deliberate: that they actually don&#x27;t think the government should be involved in this sort of thing. after all, someone could be making a profit on this, and that seems to be their highest value. if gov is involved, that makes it a communal effort, and you know what else starts with &quot;commun-&quot;?yes, those reasons are stupid and ignorant AND intentional.but is there any evidence against that interpretation?

I&#x27;d say that the rhyme and reason are quite clear [0]. They published a playbook, and they are implementing it at a record pace.&gt; The NSC [National Security Council] staff will need to consolidate the functions of both the NSC and the Homeland Security Council (HSC), incorporate the recently established Office of the National Cyber Director, and evaluate the required regional and functional directorates.&gt; Given the aforementioned prerequisites, the NSC should be properly resourced with sufficient policy professionals, and the NSA should prioritize staffing the vast majority of NSC directorates with aligned political appointees and trusted career officials. - Project 2025, pg 52.&gt; ... History shows that an unsupervised NSC staff can stray from its statutory role and adversely affect a President and his policies. Moreover, while the NSC should be fully incorporated into the White House, it should also be allowed to do its job without the impediment of dually hatted staff that report to other offices. - Project 2025, pg 53.The goal is to build up a political organisation to use as a weapon, and to scrap the rest - as a legal excuse to say that the political appointments will be necessary.[0] <a href="https:&#x2F;&#x2F;www.project2025.observer&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.project2025.observer&#x2F;</a>

&gt; This sort of thing is happening across the federal government. There is no rhyme or reason. DOGE has been given an unrealistic target for cuts and they&#x27;re desperately cutting whatever they can get their hands onYou make it sound like poor DOGE employees are being forced to do this on this kind of schedule, which definitely isn&#x27;t the impression I got. They&#x27;re all a bunch of incompetent overconfident weirdos who think they know better and what to do. Is there any pressure to do anything quickly?And the US federal budget is quite easy to trim. E.g. remove an aircraft carrier from the planned construction pipeline and you&#x27;ve saved $15 billion with no actual ramifications.

The ryme is Humpty Dumpty, had a great fall. Now China and Russian security forces step up their relentless attacks. Let&#x27;s hope the white house falls first.

&gt; Even my die-hard Republican distant relatives are suddenly shocked because programs they benefited from are being cut. They thought they voted for something different.Out of curiosity, which programs? And is this enough to change their opinion about Trump, or do they still think it&#x27;ll be worth it?

&gt;&gt;They thought they voted for something differentLike what exactly? I mean the guy ran on cutting the budget by 2 trillion. In his last term he gave tax breaks yo the rich. Where did they think the cuts were coming from?He ran very hard on raising tarrifs. Which demonstrably raise prices (thats literally their goal.) But now people claim &quot;I didn&#x27;t vote for this.&quot;In truth they voted for him because he was the Republican on offer and they&#x27;re die-hard Republican. The Republican party has made no secret of its agenda for decades.I get it, people are good at cognitive dissonance. But this is the place for blunt truth. They voted for this. I&#x27;m not letting Republicans got off the hook here. They voted for this.Just like to my Republican friends who are upset that CVE is cut. You voted for this. The general public benefit from CVE even though they dont know it exists. Just like you benefitted from dozens of other programs you didn&#x27;t know existed, but have also been cut.That&#x27;s the problem with cuts. They ultimately end up hurting everyone.Now clearly there&#x27;s some fat that could be trimmed. Companies do it all the time. Done well its good. Swinging a hatchet in a crowded elevator does not seem like &quot;Done well&quot;.

&gt; They thought they voted for something different.They voted for the leopards to eat other people’s faces, not their’s.

Remember, DOGE has nothing to do with money or &quot;efficiency&quot;. It&#x27;s a pure ideological dismantling of the Federal government aimed at eliminating oversight, regulations, assistance and entitlements as envisioned by ultra-conservatives for decades.This isn&#x27;t speculation or hyperbole, it&#x27;s specifically laid out in their published plans: By hobbling or outright eliminating federal agencies responsible for executing the laws passed by Congress, the administration can circumvent the democratic process and impose their extreme vision of limited government on the country, regardless of popular support.The U.S. system of government relies on established norms as much as it does law. Conservatives realized that they can ignore precedent with impunity if they had an executive willing to do so. They then spelled out exactly how, and are now enacting that plan.Then SCOTUS&#x27;s decisions last summer turbo boosted their agenda. The ruling that only Congress can hold the President legally accountable essentially means executive power is unchecked if the legislature is unwilling or unable to Impeach and convict. The President can now confidently ignore the law and judicial orders with a veneer of legality. And this is what he&#x27;s doing.(The fact that all this just so happens to benefit Russia after their decade long campaign to destabilize their opponents in the West is a topic for speculation.)DOGE is about permanently altering how our country works modeled on the right wing worldview, plain and simple. Since that&#x27;s their overall goal, they&#x27;re not concerned where they swing the wrecking ball - it&#x27;s all going to get destroyed eventually.

Something different like gay people, women, immigrants all suffering while they laugh. Who&#x27;s laughing now? From an outsiders perspective, I sincerely hope that Republicans get to feel a fraction of what these usually marginalised groups feel every day.You&#x27;d think that lessons would incite learning but that has never seemed to be the case throughout history.

This sort of thing is happening across the federal government. There is no rhyme or reason. DOGE has been given an unrealistic target for cuts and they&#x27;re desperately cutting whatever they can get their hands on. If you look at the federal budget it&#x27;s nearly impossible for DOGE to hit their stated goals without touching benefits like medicare and social security (which are off limits so far) so the only option is deep, deep cuts into the narrow slice of the federal budget that excludes those protected categories.There is no rhyme or reason to what gets cut, other than someone under pressure to hit KPIs (dollars cut) was desperately searching for things that looked easy to cancel.This is happening everywhere the federal government touches. Most people aren&#x27;t aware of it until they come around and pull the rug on something that intersects with your own life.Even my die-hard Republican distant relatives are suddenly shocked because programs they benefited from are being cut. They thought they voted for something different.

People will not submit vulns as happily to such business.Most of vulns will go unaddressed because company like palantir will most likely want only really good vulns like 0-click RCE.

No, we’re in a middle of a coup. Palantir or some other odious company will get paid 100x more to do something.

&gt; Your words don&#x27;t make any sense in this environment. The idea that any person at an agency could stand up to or convince the DOGE team of anything is preposterous.Your comment embraces and spreads the powerlessness they want you to feel and spread.Of course you can stop them - like any other negotiation in life, especially non-friendly ones, you need to make it in Trump&#x27;s interest either by carrot or stick. Trump has interests; identify them and identify your power in those regards (&#x27;power and interest&#x27; is the term), and use it.Also, stop helping them make DOGE the scapegoat. It&#x27;s Trump.

Your words don&#x27;t make any sense in this environment. The idea that any person at an agency could stand up to or convince the DOGE team of anything is preposterous.Anything that weakens the US or puts our cybersecurity in a place that Russia can exfiltrate data will happen. This is not about the US needing anything and it&#x27;s silly to think otherwise. See also the NLRB whistleblower and the security backdoors that DOGE demanded to allow data exfiltration and the subsequent death threats to the whistle blower.You mindset is behind the times and needs to adjust to a, frankly, insane current reality.

You forget that their stated policy (and I don&#x27;t doubt their commitment) is that whoever complains the loudest were probably scamming. That &quot;honest people don&#x27;t complain&quot;

So the dumbest way to do anything. Got it.

If you made this careful analysis, you&#x27;d hear &quot;CRISSAKE WE NEED THIS DONT TOUCH IT&quot; for almost everything (and it likely would be right for a significant portion but not everything).That&#x27;s why the current approach seems to be to axe everything, listen to how much screaming there is, then reinstate only the projects where the screaming is really loud.

&gt; &quot;kill it, we don&#x27;t need this&quot;&quot;We are paying MITRE how much? Bigballs and co will write a better ststem in 1 week and have it integrated with xAI. How hard could it be? Send out a first draft of an xAI contract to our DHS contact&quot;

They were at the mercy of 20 year olds from doge. I wonder when doge enters the NSA &amp; NRO WHAT information will they steal &amp; put in their hard drives.All of this is criminal behavior on the the current regime.

You assume there&#x27;s a plan. Interesting.

&gt; perhaps the thinking is to radically change approaches?If there had been a replacement or reform plan for even one single iota of the things this admin has cut, I might give them the benefit of the doubt. But there&#x27;s not. It&#x27;s just kill, kill, kill.

Cutting the program would seem to go in the opposite direction of what is needed.

&gt; I wonder what level of compartmentalisation inside DHS means they didn&#x27;t see this as having sufficient downsides?The National Vulnerability Database has been unable to keep up with the flow of CVEs for over a year now:- <a href="https:&#x2F;&#x2F;anchore.com&#x2F;blog&#x2F;national-vulnerability-database-opaque-changes-and-unanswered-questions&#x2F;" rel="nofollow">https:&#x2F;&#x2F;anchore.com&#x2F;blog&#x2F;national-vulnerability-database-opa...</a>- <a href="https:&#x2F;&#x2F;www.cyberreport.io&#x2F;news&#x2F;cve-backlog-update-the-nvd-struggles-as-attackers-change-tactics?article=98084" rel="nofollow">https:&#x2F;&#x2F;www.cyberreport.io&#x2F;news&#x2F;cve-backlog-update-the-nvd-s...</a>- <a href="https:&#x2F;&#x2F;www.ibm.com&#x2F;think&#x2F;insights&#x2F;cve-backlog-update-nvd-struggles-attackers-change-tactics" rel="nofollow">https:&#x2F;&#x2F;www.ibm.com&#x2F;think&#x2F;insights&#x2F;cve-backlog-update-nvd-st...</a>- and many, many, many othersIt has been a complete disaster for months. At this point, perhaps the thinking is to radically change approaches?

Also there has been funding cuts to all agencies where Musk is currently under investigation. NHTSA is getting cut so they can&#x27;t get in the way of Tesla.

&gt; I wonder what level of compartmentalisation inside DHS means they didn&#x27;t see this as having sufficient downsides?Come on, are you living under a rock right now? There are massive indiscriminate funding cuts to anything that Elon&#x2F;Doge deems to be &quot;fraud&quot;, and they explicitly do not care about the collateral damage.This is not about the DHS or &quot;compartmentalization&quot;. This is just a politician running amok and having real consequences.

No one analyzed it most likely. It’s possible on of the college students working for Doge doesn’t understand security because they are a child with no real world experience that Elon brought in to slash costs.

I wish this hadn&#x27;t happened.I wonder what level of compartmentalisation inside DHS means they didn&#x27;t see this as having sufficient downsides?I ask this, because I don&#x27;t think anyone in the subject matter specialist space would have made a strong case &quot;kill it, we don&#x27;t need this&quot; and I am sure if asked would have made a strong case &quot;CRISSAKE WE NEED THIS DONT TOUCH IT&quot; -But I could believe senior finance would do their own research (tm) and mis-understand what they saw in how other people work with CVE, and who funds it.

The private sector zero day market collapsed last year with Zerodium - corporate bug bounties, nation states in-housing offensive security operations, and the democratization of knowhow destroyed the Zero Day market.

I guess their new business model is to sell zero days to the highest bidder

I thought that the point of the CVE database is to improve security, not wreck it?

Exactly. The Trump admin is well on its way tanking the USD with tariffs and getting every country (including the penguins) mad at us. The rationalization given by the admin for tariffs (trade imbalance) make zero sense, and they haven&#x27;t offered anything else.

These sort of government services are always under attack by private organizations. The US Gov doesn&#x27;t have to give Palantir or whoever a contract, they just cede the ground, give the right people a heads up, and then make the new subscription service a &quot;recommended service provider&quot; as a solid to whichever of Elon&#x27;s circle gets the nod.In the UK the some &quot;entrepreneur&quot; was after monetizing access to the Land Registry a couple of years ago. Apparently the free UK Gov service was not fit for purpose it needed a paywall to make it better. Nothing as globally significant as the CVE database, but you can see if the vultures are going after small UK Gov services, something like the CVE database is absolutely a chance to add to the executive bonus pool.

Why would they spend money to replace it? The idea is to weaken and destroy the US and its institutions. Giving Palantir money might mean that security improves, and that goes against their goals. They have already demanded that Russia stop being treated as a cybersecurity threat in other areas of the government, this is a way to ensure that systems are vulnerable to attack.

My tinfoil hat says they want to privatize this through one of the administrations friends. A disastrous decision here.

&gt; This sounds like looking for lemonade in a genocide.It really doesn&#x27;t. This level of catastrophising has no point. It would be nice if CVE continued to exist, but it wasn&#x27;t close to perfect, and perhaps it can continue in another form. There&#x27;s no particular reason the US taxpayer has to sponsor global security threat tracking any more than any other taxpayer or customer.

&gt; But maybe this is an opportunity to do CVE better.Okay, how? This sounds like looking for lemonade in a genocide.

Trump stupidity hurts the country and world.But maybe this is an opportunity to do CVE better.

It&#x27;s more likely to boost the zero day black market. I don&#x27;t know if I want to attribute this to idiocy (indiscriminate cost cutting), greed (contracts for their crony pals) or malice (hoarding and trading 0 days).

Now the NSA can hoard more 0days and the general public suffers. Win win for this administration

I feel like we&#x27;re only a few weeks away from someone &quot;home grown&quot; experiencing an &quot;administrative error.&quot; The slide into madness continues.

Wait until they start a war against Albania.

War with China and doing enough reprehensible acts to stoke protests to declare martial law to stay in power indefinitely.

Organizing mass protests isn&#x27;t something you do instead of organizing electoral opposition. Even in countries that haven&#x27;t had fair elections for a while, people generally still organize opposition and talk about how they&#x27;re going to vote. The best way to ensure your opponents retain power is to go around telling people it&#x27;s too late and they&#x27;ve already won.

I understand you have elections in two years, don&#x27;t you ? I don&#x27;t know if a complete reversal congress is possible.That would be a good litmus test. &quot;They&quot; have not prevented special elections so far ; if &quot;They&quot; need to prevent the next one, whatever they try will happen then, I suppose ?

Number one rule in opposing anti-democracy forces is to NOT OBEY IN ADVANCE.We are going to have elections.

I find it a little incredible people are still talking about &quot;four years&quot;.They tried to reject the election result and do a coup, and were rewarded for it by getting back into power. They are refusing to follow the law or the courts. They are sending people to gulags in foreign countries. All the checks and balances were destroyed last time. The party has been stripped of anyone who would fight the admin or reject this illegality. They have set up a power grab over elections.There will not be free and fair elections in four years unless they are simply too incompetent to rig it, the rubicon was crossed long ago. Without mass protest that makes it impossible for them to hold power, American democracy is dead.They have tried to do it, they say they want to do it, they have the ability to do it, they are actively doing it, and no one is stopping them. How are people still acting like in four years they are going to neatly hand over power to be prosecuted for their crimes?

These four years are going to be the death of all of us.

The white house prefers chaos. This will certainly be a step in that direction.

if only there were 188 other countries and an entire private sector in each one that could fund this thing they are also affected by

Some companies are already clueless when it comes to CVE management. Probably won’t see the effects immediately but give it a few more years for new generation of vulns to be created&#x2F;found and we will be back to early 2000s level security.Open season on American corporations for domestic and foreign hackers.If program isn’t brought back then CVE database likely to be fragmented amongst the “private” CVE databases.Sec Corp A has 700 well documented CVEs but Sec Corp B has 702 CVEs in their database since NIST funding pulled. What do corps do? Maybe some of them with massive budgets setup contracts with both to get “full spectrum coverage”. Maybe other non-technical companies that think of IT as strictly a cost will go with the cheapest or forego it all together.Who knows maybe we get ~~~free labor~~~ open source community to pick up the slack?This country with the orange man administration is quickly going to shit. Not in a “I dislike {opposing party} way” either. In a “I dislike authoritarian regimes” way.

Project 2025 literally calls for dismantling the DHS. Seems pretty unsurprising that the CVE database wouldn’t be in the list of things they’d care to maintain in that process.

&gt; In a stunning developmentWho is still stunned by these things? They want you to be stunned; they want you to tell everyone else that you&#x27;re stunned to spread feelings of terror and powerlessness. If you actually are stunned, you are stunningly ignorant. If you are not and still saying it, perhaps to emphasize your unhappiness, you are a &#x27;useful idiot&#x27;. Either way, if you are saying it, you are a useful idiot.You should have known decades ago: The GOP impeached a President for lying about sex; they fabricated intelligence to invade another country (killing thousands of Americans and 100,000+ Iraqis) - and that was all before 2004. They&#x27;ve voted almost unanimously, multiple times, to bankrupt the country (by refusing to authorize debt for existing obligations). Nobody (i.e., the Dems failed to) stopped them or made them pay a price, so why wouldn&#x27;t they keep doing those things. (Edit: And if you object because the analysis criticizes one side and therefore you reject it as partisan, that&#x27;s a big part of the reason nothing was done.)This time they published Project 2025, telling you what they were going to do.

Come again? This is Hacker News, a heavily moderated forum with a narrow focus. We don&#x27;t discuss Israel or El Salvador here (unless it&#x27;s tech related.)

Please, this place has permeated with Trump rage since before he took office. The only way you could think he was ignored is to not have read any comments.

&gt; It’s astounding that the users here watched all the horrendous things going on and ignored them.Many most voted and most commented submissions were the other things.

It’s astounding that the users here watched all the horrendous things going on and ignored them. But now the CVE numbers are gone it’s shocking and too far.

This industry relentlessly lionized Trump and Musk, elevating them to positions of power and handing them the power to destroy at will.This is your moment! Enjoy it!

True, although Google&#x27;s Project Zero seems to be run pretty well.

There are going to be all kinds of messed up incentives if this is funded from industry.

so &quot;all&quot; should pay, not only US taxpayers.

No, &quot;the industry&quot; is all of us alive in the 21st century who depend on software to make material decisions and to be resilient to attacks and tampering. We were all funding it, and now surely we will see some big tech company now assume responsibility from the federal government (please god don&#x27;t let it be Oracle...)

Because secure systems benefit the public generally, not just the corporations that make a profit operating those systems.

The industry won’t want to fund it. It’ll want to profit from it.

Same question would be for government funded agencies.

Don&#x27;t open source developers and users of their software also benefit from the CVE database?If it were privately funded, what incentive would these private companies have to track bugs for these open source projects that don&#x27;t make money?

Especially the L guy who downvoted this after 10 seconds. get a life

The insane number of downvotes you’re getting for saying basic common sense stuff, it’s why we should push for stricter political rules here in HN.You didn’t say something wrong or controversial, just an opinion.
Some ideologies love to pay things with other people’s wallets, and they’ll do whatever they can to pursue this.

I don&#x27;t see why this should be publicly funded, so I don&#x27;t really see an issue with this.  The industry benefits from having a CVE database, so the industry should fund it.

Every now and then the government decides to fund things. Public schools, roads, police, firemen, GPS, NOAA, cybersecurity, government cheese, etc.

&gt; This is like asking why the government is responsible for roads.Thought experiment:If roads were built by private companies, could a Government justify the expense maintaining a database of all the potholes?

&quot;the government&quot; aka &quot;We the people&quot;. It is in all our interest. This is like asking why the government is responsible for roads.

Why is the government responsible for CVEs again?

&gt; It was to the advantage of the US and allies to coordinate and lead in tracking and fixing such errors.From what I understand of the article, none of these allies were funding it.&gt; Multiple countries, companies, and individuals contributed finding and fixing bugs.Clearly that itself isn&#x27;t enough. Someone has to pay for maintaining this service. It appears that no one other than USA spent money in funding it.

It&#x27;s a near certitude that Russia and China each have databases of exploitable software errors and prize zero days.It was to the advantage of the US and allies to coordinate and lead in tracking and fixing such errors.Multiple countries, companies, and individuals contributed finding and fixing bugs.The administrative task of keeping track was one part of a greater picture, a part that came with first to be advised and other perks.It&#x27;s not that the US had a responsibility to take on the lead admin task, more that in past times the US saw an advantage to being at the centre of global action.This is just another part of increasing US isolationism.

I hate this whole disaster but why can&#x27;t Europe step in for stuff like this?

It&#x27;s called providing leadership. Worth the money. China will happily fill the void.

They have the chance to step up now. Every Comercial company that is supposedly so reliant on this for their very existence has the opportunity today. They can fund it.

The CVE program was started over 25 years ago. It is very reputable (until yesterday) and it was very much in the interest of the US to be seen as the stewards of this.The funding requirements can&#x27;t be that high and I&#x27;m willing to bet that other countries and entities would have happily stepped up if they had the chance.Up until recently CVE was very centralized and only in the last few years have there been steps in more decentralization with CNAs taking more responsibility, Red Hat as a CNA of last-resort etc.
So, the cost of doing all of this work has already been shifted partially (!) away from the US but I have not seen any movement towards e.g. moving the program to a foundation which could have been done.Personally I would conclude that it was the responsibility of the US to pay for this because they wanted to and it was in their best interest to control this program.

The nazis don&#x27;t think that though, uh I mean conservatives. After they&#x27;ve burned down everything, they expect still to be a superpower somehow. Do they think they can just start a war with everyone who doesn&#x27;t play ball? It&#x27;s hard to comprehend what their rational is, if there is one.

Because USA was a superpower that can afford it easily. Taking the leadership in everything is quite cheap price to pay when the other end of the bargain is everyone else has to follow you.Now of course USA is ceasing (voluntarily, by stripping down every international soft power effector in government) to be a superpower, to the great glee of dictators all around the world.The &quot;we can&#x27;t afford being great&quot; is a direct admission that USA is no longer a superpower. And is not going to become great again, just another nation again (at whims of China).

Don&#x27;t worry, that will also end soon. Regimes that require political subservience from universities, like the current US administration, inevitably result in poor research capabilities in the long run.

I’m surprised that the world’s greatest universities are in the United States. Why weren’t other countries providing funds?

The US has made at least hundreds of billions of dollars from it&#x27;s tech companies and has had a dominance over global tech for a long time. The tech industry has brought a crazy amount of money and power to the US so it makes sense the US puts extra effort to support it.The US isn&#x27;t supporting it out of charity, it&#x27;s good for US businesses to have someone coordinating this for everyone. Why would we want to rely on other countries to be supporting our tech sector? At least now we are subject to only the capricious whims of our own government, as little comfort as that is right now (if another country was funding it we would be relying on the whims of a foreign government, which isn&#x27;t ideal when tech is the golden goose of your modern economy).

It&#x27;s a program the US government spun up to serve America&#x27;s interests. Why would someone else pay for American interests?Other countries have their own programs, some cooperating with the US, others separate. China has the CNNVD if you&#x27;re interested in helping Chinese society safe. My government operates <a href="https:&#x2F;&#x2F;advisories.ncsc.nl&#x2F;advisories" rel="nofollow">https:&#x2F;&#x2F;advisories.ncsc.nl&#x2F;advisories</a> to serve my country&#x27;s interests.Of course, the US is free to abandon their programme and rely on Chinese, Russian, and European vulnerability databases to keep their country safe. It does save them a couple of million after all!

Because, contrary to popular views, there is no &quot;government of the world&quot;.So, since the US government needed that (it provides security to US businesses), they organised and funded it (as everything else, with US taxpayers money, and savings from investors in US and abroad.)Now, the US government decided to commit temporary-seppuku, so a number of things will happen:* state-level government will use their local-taxpayer money to fund similar efforts (with duplication of effort), or share it with everyone* another country or block of country will do it, and decide whether they want to &quot;share&quot;. (I suppose Russia and China have more of an incentive to keep their CVE DB private, given their level of dis-integration with US economy ? EU maybe ?)* an international, ad-hoc organisation is created to share the funding (something like NATO.) Multi-latteralism is not exactly in fashion this days, but if EU does it, it will be &quot;international&quot; by design since we&#x27;re not really a federation ; so, states in &quot;Southern Canada&quot; are welcome to join.* or none of that happens, the CVE db rots for a while, until a sufficiently embarrassing cybersecurity problem occurs, and the CVE db is deemed worthy of the &quot;10% you need to bring back&quot; by President Elon.Pray your company, families and friends are never on the wrong side of the &quot;reverse-Chersteron&#x27;s fence&quot;.

I&#x27;m surprised that it was USA&#x27;s responsibility to fund this in the first place. Why weren&#x27;t other countries providing funds?

This sounds like good news, thanks!Do we already have an ETA for the ENISA vulnerability database?

ENISA in Europe has the mandate of building a EU vulnerability database for the NIS 2 directive anyway and it&#x27;s coming soon...And CIRCL in Luxembourg are providing vulnerability-lookup which can also assign IDs but in a more decentralized way: <a href="https:&#x2F;&#x2F;www.vulnerability-lookup.org&#x2F;documentation&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.vulnerability-lookup.org&#x2F;documentation&#x2F;</a>VulnerableCode can help with discovery etc. 
<a href="https:&#x2F;&#x2F;vulnerablecode.readthedocs.io&#x2F;en&#x2F;latest&#x2F;introduction.html#what-can-i-do-with-vulnerablecode" rel="nofollow">https:&#x2F;&#x2F;vulnerablecode.readthedocs.io&#x2F;en&#x2F;latest&#x2F;introduction...</a>So, parts of this are already in place and I assume this will be a big boost towards a new vulnerability ecosystem.

Us Dutch have <a href="https:&#x2F;&#x2F;advisories.ncsc.nl&#x2F;advisories" rel="nofollow">https:&#x2F;&#x2F;advisories.ncsc.nl&#x2F;advisories</a> although a lot of that is just analysing CVEs and their impact on society.An EU solution would probably be much better. Would suck for Americans, though, they&#x27;d need to get up early to meet European office hours.

So who will maintain it then? Either the EU or China I suppose. They can easily fund it.Maybe the Dutch should go ahead.

Consider this part of the attack on the American infrastructure, economy, and society. Attacks do not abide by laws, official procedures, or come with warnings.

CVE-zero: the attack is coming from inside the White House.

Am I missing something or was this literally announced with less than 24 hours of warning that one of the critical components to the cyber security landscape was disappearing.What the fuck are you supposed to do about this. This is something that should have had multiple MONTHS of warning in order to allow those who depend on the CVE infrastructure to plan what to do next with their security posture.

Codeberg might be a nice cooperation partner for hosting the git repositories. Gonna write them!I&#x27;m also visiting the local CCC chapters here this week, maybe it makes sense to have a separate e.V. where the CCC chapters are beneficiaries?

Maybe something to bring up to one of these e.V.&#x27;s if it ends up being difficult to get started: Codeberg.org, nlnet.nl, ccc.de

&gt; Sovereign Tech FundIt&#x27;s actually been upgraded to the Sovereign Tech Agency now

Try to talk to the people from the Sovereign Tech Fund, they have a history of sponsoring security relevant projects in the EU.

Great idea. I&#x27;m interested in helping. I&#x27;ll dm you.

This would be hilarious. That would be a good thumb in the eye to the current administration who complained long and loud about how Obama let ICANN leave US possession. Just imagine the campaign commercials in 2026,&gt;The POTUS transferred our cyber defenses to the EUOuch

MITRE is a non-profit. All the EU has to do is reach out to MITRE and be willing to fund the project.

I don&#x27;t think the EU has any interest in this. They&#x27;ve been aware of the risk of relying on the US for software security for years, but AFAIK there have been no efforts to do anything about it. Maybe the current situation will kick some butts into gear ...Off topic: your username is very appropriate given the situation.

This should be work for the ENISA: <a href="https:&#x2F;&#x2F;www.enisa.europa.eu&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.enisa.europa.eu&#x2F;</a><a href="https:&#x2F;&#x2F;www.enisa.europa.eu&#x2F;topics&#x2F;vulnerability-disclosure" rel="nofollow">https:&#x2F;&#x2F;www.enisa.europa.eu&#x2F;topics&#x2F;vulnerability-disclosure</a>They have a tender going on tracking best practices: <a href="https:&#x2F;&#x2F;www.enisa.europa.eu&#x2F;procurement&#x2F;vulnerability-disclosure-policies-and-vulnerability-databases" rel="nofollow">https:&#x2F;&#x2F;www.enisa.europa.eu&#x2F;procurement&#x2F;vulnerability-disclo...</a>So they will take 12 months to select for the tender...18 months pondering on the report...and in 3 years they make a tender out for a solution...

The EU should just buy MITRE. Move it to the EU and make it a EU based project.

I’m interested to help! I added you on LinkedIn, so will message there after you accept. :)

Try if you can find some help here <a href="https:&#x2F;&#x2F;openssf.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;openssf.org&#x2F;</a>

If there are any Europeans here, I&#x27;d love to make my vulnerability database that&#x27;s accumulated from all linux security trackers and the CVE&#x2F;NVD open source if I can manage to find some folks who&#x27;d help with maintenance.Currently hosting costs are unclear, but it should be doable if we offer API access for like 5 bucks &#x2F; month for private and 100 &#x2F; month for corporate or similar.Already did a backup of the NVD in the last couple hours, currently backing up the security trackers and OVAL feeds.Gonna need some sleep now, it&#x27;s morning again.My project criteria:- hosting within the EU- must have a copyleft license (AGPL)- must have open source backend and frontend- dataset size is around 90-148 GB (compressed vs uncompressed)- ideally an e.V. for managing funds and costs, so it can survive me- already built my vulnerability scraper in Go, would contribute it under AGPL- already built all schema parsers, would contribute them also under AGPL- backend and frontend needs to be built- would make it prerendered, so that cves can be static HTML files that can be hosted on a CDN- needs submission&#x2F;PoC&#x2F;advisory web forms and database&#x2F;workflow for it- data is accumulated into a JSON format (sources are mixed non standard formats for each security tracker. Enterprise distros use odata or oval for the most parts)If you are interested, write me on linkedin.com&#x2F;in&#x2F;cookiengineer or here.

CVE program faces swift end after DHS fails to renew contract [updated]