MITRE support for the Common Vulnerabilities and Exposures (CVE) program will expire tomorrow

Man, I have learned so much about government agencies and funding in the past few months.

Its like how, growing up, the way I would learn about new species is because there would be some article about how they’re about to be extinct. I knew what a axolotl was in like 2005.

Learning about government agencies via the ongoing news of the catabolic collapse of the united states is an interesting pass time.

This could be bad. If the funding remains cut, IT professionals will have to go to other sources to keep up to date on newly discovered and disclosed vulnerabilities. This would be quite a pivot, as even a lot of commercial software relies on the CVE database.

I found an article that explains what CVE is, how it integrates with some other systems, and potential alternatives. Hopefully that will help others with less familiarity understand the topic a bit more.

As a former infosec worker: This could seriously hinder the reporting, tracking and dissemination of information of vulnerabilities in systems everywhere, causing a sharp decline in vulnerability patching and mitigation, and thereby resulting in systems that are more vulnerable to bad actors.

I think we almost certainly could bring the CVE database to the EU; the EU would probably fund it. However, the EU tends to move slowly. It's not going to happen in a day.

Current infosec worker; discussed with my chunk of the organization today. What we're losing will hurt security professionals' ability to rapidly, correctly triage and prioritize risks. In turn, that will cause delays and gaps in incident response. We believe the likeliest consequences are:

• Vulnerability information fragmentation. There are always vendors who really wanted to do things their own way: RedHat, for example, has always preferred its own homegrown vulnerability identifiers. Microsoft has like three of their own ID systems at this point. But these were all tied together with CVEs, which really helped the folks doing the work to do things like correlate which patches from which vendors fixed the same OpenSSL critical bug. Security practitioners will have to spend more time doing data lookups and correlation for no real benefit.
• Slow rot of the NVD. NVD is run by NIST, which is part of the Department of Commerce rather than the Department of Homeland Security. But between the staffing cuts across all agencies, plus this new wrinkle, it seems unlikely that the NVD will maintain its present status as the most-usually-correct source of information. NIST already had problems last year keeping up with scoring. Beyond making things worse for the future, it'd be tremendously annoying and disruptive if the NVD were to go offline eventually, even though it's all backed up elsewhere.
• Minor increase in zero-days. Major companies who could already assign their own CVEs ("CNAs"), like Microsoft and the Linux Foundation, will likely continue to do so ... at least for awhile. But if there's no new central clearinghouse or replacement ID assigning authority rapidly identified, a lot of smaller software vendors will go back to what they used to do: nothing, because it's a lot less work. So there probably won't be any report of those vulnerabilities until we're all learning about the exploits.

Lastly and more personally, I am expecting a barrage of disinformation -- specifically, disingenuous bloviating about CVE creep, CVSS inflation, and similar subjects. I fully expect a bunch of bootlickers to say 'good riddance' and blame everything on MITRE. Yes, no one likes having to handle a gazillion CVEs and many are kinda stupid. Yes, CVSS v3 and v4 scores are generally higher across the board than they used to be in earlier versions. But no one is arguing these systems are perfect. Throwing the (ugly) baby out with the bathwater, and then celebrating it like I've already seen a few folks online doing? That's just bad attempts at deflecting from the obvious parallels where other public agency data sources (NOAA, NWS, etc.) are being trashed for no good reason.

I'd like to hope that sanity prevails before tomorrow, but my pessimist side has been feeling right a lot lately.

I just found out about this from John Hammond's YT page a minute ago. Holy crap, they really are just throwing every bit of critical infrastructure they can grab into a bonfire.

I feel like we are speedrunning the collapse of the American empire. Sure, it was in decline anyway, but was there really a need to push as fast and hard as possible for everything to burn?