CVE fallout: The splintering of the standard vulnerability tracking system has begun (go.theregister.com)
from Tea@programming.dev to technology@lemmy.world on 18 Apr 10:13
https://programming.dev/post/28818141

#technology

threaded - newest

Eyekaytee@aussie.zone on 18 Apr 10:50 next collapse

everything the US gov helps funds now has a question mark over whether it’ll still be here in 4 years…

hddsx@lemmy.ca on 18 Apr 10:52 next collapse

Four years? Boy, you are optimistic

Eyekaytee@aussie.zone on 18 Apr 11:03 next collapse

tbf to the US they fund an absolute ton of things, eg. I didn’t realise they helped fund lets encrypt and now the CVE database either, I assume it’ll be a drip feed of things being cancelled slowly over time as they find them all

<img alt="" src="https://aussie.zone/pictrs/image/fed4160c-da2c-4daa-b875-4b53dd0e53bd.png">

mesamunefire@lemmy.world on 18 Apr 17:24 next collapse

The US traditionally has funded quite a few “for the good of the world” programs and aid. At least until recently. Thats a good graph.

Almacca@aussie.zone on 20 Apr 01:33 collapse

The new overloads can’t be having with any of that Helping People nonsense. Not for free, anyway.

nyan@lemmy.cafe on 18 Apr 17:27 next collapse

What % of its GDP does the Netherlands have to put into international aid to make seventh place?!

JohnEdwa@sopuli.xyz on 19 Apr 22:16 collapse

7.4 billion, which is around 0.7% of GDP. 0.66% of GNI.

For comparison, the US might win out on pure billions (~65), but compared to the size of the economy, it uses a whopping 0.24% of the GNI on foreign aid, a figure that is almost certainly going to drop in the near future.

oktoberpaard@feddit.nl on 19 Apr 11:31 collapse

It looks like just the UK, France and Germany combined already add up to more aid with a combined GDP that’s much lower than the US. These kinds of graphs give a distorted picture due to the high population and GDP that the US has.

GDP: www.wolframalpha.com/input/?i=gdp+of+uk%2C+france…

Population: www.wolframalpha.com/input/?i=population+of+uk%2C…

catloaf@lemm.ee on 18 Apr 13:21 next collapse

It won’t be here next year, but it won’t be here in four years too.

Eyekaytee@aussie.zone on 19 Apr 12:40 collapse

thank you mitch hedberg :P

Almacca@aussie.zone on 20 Apr 01:34 collapse

This shit seems to change by the minute.

w3dd1e@lemm.ee on 18 Apr 14:59 collapse

I’m don’t trust any .gov sites anymore. If I’m researching and I see that it’s a government site, I move on. I can’t trust that info.

The whole thing is scary

IDKWhatUsernametoPutHereLolol@lemmy.dbzer0.com on 18 Apr 15:57 collapse

You can kinda trust them if you use an archived version of it from before.

masterspace@lemmy.ca on 18 Apr 12:52 next collapse

Lmao come on. Some people in the EU speak English and knew that naming your standard “European Union Venereal Disease” was a bad idea.

BlueBockser@programming.dev on 18 Apr 13:40 collapse

But “Congenital Venereal Edema” is better?

masterspace@lemmy.ca on 18 Apr 14:02 collapse

VD: www.urbandictionary.com/define.php?term=VD

VE: www.urbandictionary.com/define.php?term=VE

I mean, say “CVE” out loud and see if anything comes to mind, then say “EUVD” out loud and see if anything comes to mind.

I’m very pro EU, but this is just a badly chosen acronym.

zlatko@programming.dev on 19 Apr 08:14 collapse

Fucking hell, that site a million partners who all have “legitimate interest”. I’ve clicked on like a third of them and then gave up. I don’t need their shit.

thann@lemmy.dbzer0.com on 18 Apr 16:47 next collapse

Im sure DOGE will replace it with a more efficient way for the government to track all of the bugs its computers might be vulnerable to…

bitjunkie@lemmy.world on 18 Apr 19:22 collapse

…and then send them directly to Putin’s cyberwarfare unit.

zero_spelled_with_an_ecks@programming.dev on 18 Apr 16:56 next collapse

Could it be a good candidate for federation? There’s already a few naming standards that would allow a bit of a common ground. And maybe eliminate a few of the big points of failure.

fmstrat@lemmy.nowsci.com on 21 Apr 12:10 collapse

Distributed hosting isn’t really a problem here, its distributed funding for the staff.

0xD@infosec.pub on 19 Apr 11:10 collapse

OMG I’ve been motherfucking looking for this EUVD for the past weeks and only found references and info pages, but never the actual fucking database!! Finally I know it exists.

Why is it hidden? Why does it have that braindead URL? And why, for the love of god, does it have a separate numbering scheme?!

SinningStromgald@lemmy.world on 19 Apr 21:18 next collapse

I can only assume the stories about CVE have pushed it to the top but I just search “European vulnerability database” and first link went to the database.

JohnEdwa@sopuli.xyz on 19 Apr 21:53 collapse

Why does it have that braindead URL?

euvd.enisa.europa.eu -> European Union Vulnerability Database, run by the European Union Agency for Cybersecurity (from the previous name, European Network and Information Security Agency ENISA), hosted on the official website of the european union, europa.eu.

And why, for the love of god, does it have a separate numbering scheme?!

Because they want the ability to reference other vulnerability sources - like JVN - and not just CVE:

The EUVD service builds upon the CVE system and vulnerabilities in the scope of the CVE numbering service receive a CVE. In addition, the EUVD data aggregates and enriches the vulnerability information and lists an EUVD ID on top of the CVE when new vulnerability entries are created. To allow further cross referencing, the CVE identifier and additional vulnerability identifiers are listed when available. -https://euvd.enisa.europa.eu/faq

And because, you know, standards.