Re: MITRE is adding data intake to its CVE ID process

[Solar Designer <solar () openwall com>]

On Thu, Apr 27, 2017 at 08:37:51AM -0600, Kurt Seifried wrote:
> longer term the DWF will be taking this on, but like most things in tech
> there have been unexpected delays and issues. I'll keep the list appraised
> as things improve (we should start seeing progress in the next month or
> two).

Meanwhile, why don't you simply proceed to assign CVEs per requests made
in here like you do on (linux-)distros?  I think this would help.

As you're aware, personally I'm not into CVEs, but I liked the
side-effect that people's desire to have CVEs brought more vulnerability
information in here.  I am a bit concerned that MITRE's change may
result in us getting notified in fewer cases, especially if we continue
to redirect to MITRE those CVE requests that still arrive in here.  This
is going to result in not only fewer CVE requests sent in here, but also
in fewer vulnerabilities being disclosed in here - or at least in them
being brought in here with an extra delay (after MITRE has assigned a
CVE ID and reminded the person that they should notify oss-security,
which thankfully they do).

Alexander