FOR IMMEDIATE RELEASE
April 16, 2025
CVE Foundation Launched to Secure the Future of the CVE Program
[Bremerton, Washington] – The CVE Foundation has been formally established to ensure the long-term viability, stability, and independence of the Common Vulnerabilities and Exposures (CVE) Program, a
CVE was used by thousands and thousands of security professionals and organizations, companies are just small part of it. Companies contributed a lot with their own research and vulnerabilities they found and reported into CVE. It was useful because it made it easier to categorize and catalogue vulnerabilities and it made everyone’s life easier. Not just companies’. It made it easier for Linux distros as well. And so on, and so on. Do Americana really think everything needs to be run as a company and for profit?
I guess we’ll now go back to the “good old days” of sharing bugs on Bugtraq.
I still can’t comprehend that Americans voted that idiot into White House. Again. Damage he is doing is out of this world and will only become apparent in years to come. Truly incredible.
Do Americana really think everything needs to be run as a company and for profit?
Unfortunately, many do. It’s fuck’n baffling as to why.
I still can’t comprehend that Americans voted that idiot into White House.
Well Russia, China, North Korea, and Iran (to name a few) with the assistance tech-bro billionaires like Elon Musk and Mark Zuckerberg have been waging an information war against the US for well over a decade. All that time, money and effort is finally paying off.
Yeah, but that’s sort of the point I was making… it was a data repository used by “thousands and thousands” of security professionals and organizations. So people who were generating revenue off of the service. I mean, they’re professionals, not hobbyists / home users.
I’m not an American, but in terms of everything running like a company/for profit, I’d say that its best if things are sustainable / able to self-maintain. If the US cutting funding means this program can’t survive, that’s an issue. If it has value to a larger community, the larger community should be able to fund its operation. There’s clearly a cost to maintaining the program, and there are clearly people who haven’t contributed to paying that cost.
In terms of going back to whatever, the foundation involved is likely to sort out alternative funding, though potentially with decreased functionality (it sounds like they had agreements to pay for secondary vulnerability report reviews, which will likely need to get scaled back). Maybe they’ll need to add in a fee for frequent feed pulls, or something similar. I wouldn’t say it’s completely toast or anythin just yet.
Idk about Tenable specifically, but a lot of the major security vendors have their own pool of security researchers who very frequently contribute to CVE. Mostly from finding vulns in their own product, but a lot of those vulns are due to upstream libraries.
What a nonsense.
CVE was used by thousands and thousands of security professionals and organizations, companies are just small part of it. Companies contributed a lot with their own research and vulnerabilities they found and reported into CVE. It was useful because it made it easier to categorize and catalogue vulnerabilities and it made everyone’s life easier. Not just companies’. It made it easier for Linux distros as well. And so on, and so on. Do Americana really think everything needs to be run as a company and for profit?
I guess we’ll now go back to the “good old days” of sharing bugs on Bugtraq.
I still can’t comprehend that Americans voted that idiot into White House. Again. Damage he is doing is out of this world and will only become apparent in years to come. Truly incredible.
Unfortunately, many do. It’s fuck’n baffling as to why.
Well Russia, China, North Korea, and Iran (to name a few) with the assistance tech-bro billionaires like Elon Musk and Mark Zuckerberg have been waging an information war against the US for well over a decade. All that time, money and effort is finally paying off.
Yeah, but that’s sort of the point I was making… it was a data repository used by “thousands and thousands” of security professionals and organizations. So people who were generating revenue off of the service. I mean, they’re professionals, not hobbyists / home users.
I’m not an American, but in terms of everything running like a company/for profit, I’d say that its best if things are sustainable / able to self-maintain. If the US cutting funding means this program can’t survive, that’s an issue. If it has value to a larger community, the larger community should be able to fund its operation. There’s clearly a cost to maintaining the program, and there are clearly people who haven’t contributed to paying that cost.
In terms of going back to whatever, the foundation involved is likely to sort out alternative funding, though potentially with decreased functionality (it sounds like they had agreements to pay for secondary vulnerability report reviews, which will likely need to get scaled back). Maybe they’ll need to add in a fee for frequent feed pulls, or something similar. I wouldn’t say it’s completely toast or anythin just yet.
Idk about Tenable specifically, but a lot of the major security vendors have their own pool of security researchers who very frequently contribute to CVE. Mostly from finding vulns in their own product, but a lot of those vulns are due to upstream libraries.