FOR IMMEDIATE RELEASE
April 16, 2025
CVE Foundation Launched to Secure the Future of the CVE Program
[Bremerton, Washington] – The CVE Foundation has been formally established to ensure the long-term viability, stability, and independence of the Common Vulnerabilities and Exposures (CVE) Program, a
I’m honestly not totally sure what to think about this one, though I recognise that it’s a big shift/likely a negative overall result.
Reason I’m humming and hawing, is that there are lots of expensive cybersecurity type ‘things’ that rely on the CVE system, without explicitly paying in to that system / supporting it directly, from what I recall / have seen. Take someone like Tenable security, who sell vulnerability scanners that extensively use/integrate with the CVE/NVD databases… companies pay Tenable huge amounts of money for those products. Has Tenable been paying anything into the ‘shared’ public resource pool? How about all those ‘audit’ companies, who charge like 10-30k per audit for doing ‘vulnerability / penetration tests’.
IT Security has been an expensive/profitable area for a long time, while also relying on generally public/shared resources to facilitate a lot of the work. Maybe an ‘industry’ funded consortium is the more appropriate way to go.
CVE was used by thousands and thousands of security professionals and organizations, companies are just small part of it. Companies contributed a lot with their own research and vulnerabilities they found and reported into CVE. It was useful because it made it easier to categorize and catalogue vulnerabilities and it made everyone’s life easier. Not just companies’. It made it easier for Linux distros as well. And so on, and so on. Do Americana really think everything needs to be run as a company and for profit?
I guess we’ll now go back to the “good old days” of sharing bugs on Bugtraq.
I still can’t comprehend that Americans voted that idiot into White House. Again. Damage he is doing is out of this world and will only become apparent in years to come. Truly incredible.
Do Americana really think everything needs to be run as a company and for profit?
Unfortunately, many do. It’s fuck’n baffling as to why.
I still can’t comprehend that Americans voted that idiot into White House.
Well Russia, China, North Korea, and Iran (to name a few) with the assistance tech-bro billionaires like Elon Musk and Mark Zuckerberg have been waging an information war against the US for well over a decade. All that time, money and effort is finally paying off.
Yeah, but that’s sort of the point I was making… it was a data repository used by “thousands and thousands” of security professionals and organizations. So people who were generating revenue off of the service. I mean, they’re professionals, not hobbyists / home users.
I’m not an American, but in terms of everything running like a company/for profit, I’d say that its best if things are sustainable / able to self-maintain. If the US cutting funding means this program can’t survive, that’s an issue. If it has value to a larger community, the larger community should be able to fund its operation. There’s clearly a cost to maintaining the program, and there are clearly people who haven’t contributed to paying that cost.
In terms of going back to whatever, the foundation involved is likely to sort out alternative funding, though potentially with decreased functionality (it sounds like they had agreements to pay for secondary vulnerability report reviews, which will likely need to get scaled back). Maybe they’ll need to add in a fee for frequent feed pulls, or something similar. I wouldn’t say it’s completely toast or anythin just yet.
If it has value to a larger community, the larger community should be able to fund its operation.
Up until very recently it seemed perfectly reasonable to fund this sort of thing with taxes, because it benefits everyone even if they’re not directly using the database. An open source developer probably isn’t going to pay to look up vulnerabilities in the open source dependencies they use, so the database being free makes software more secure on average.
What is wrong with having free public services? If someone is abusing it, block them, or charge fees like a library.
Sure, though that’s part of the problem that the States is whining about. US taxes paid for the service, which lots of other nations/foreign companies used.
Things like Libraries require taxes to operate. You’d likely be annoyed if you were struggling, and then found out your gov was using your taxes to pay for a bunch of foreign countries to have libraries. And then you find out that those foreigners are able to use those libraries to make good money, which they don’t use to support their libraries, cause the States is already covering it. So you’re paying taxes, and struggling to do so, so that EU companies can reap profits and live comfy.
And yes, charge a fee. That’s basically what I’ve said, no? That there’s a value add, and that there are ‘professionals’/companies using it who aren’t paying for that value add. So something like a fee for frequent pulls against the vuln feeds, to replace whatever funding the US gov was giving, would make sense to me. though I suppose this has now been kicked down the road till next year.
The US specifically does spend tax money on foreign aid (or at least they used to). I have no problem with that. If you’re struggling to get by, then you should be paying effectively no taxes. If that’s not the case, then we should be fixing that, not cutting funding to things that make the world better.
As for the fee suggestion, a library does not charge for entry or for every book. There is a “free tier” that everyone can use as long as you return the books on time. You only charge the people making too many requests to make sure the service stays available to everyone.
Idk about Tenable specifically, but a lot of the major security vendors have their own pool of security researchers who very frequently contribute to CVE. Mostly from finding vulns in their own product, but a lot of those vulns are due to upstream libraries.
The CVE system protects everyone that uses computers. It is a public service that forms the core of cybersecurity in the US and many other places. It does not cost the database any more money if people use it to provide services to clients.
Letting a private corporation take it over and put it behind a paywall now means that security, like so many other things, will only be available to people with money. It will make software and hardware more expensive by adding yet another license fee or subscription if you want software that gets security updates.
In addition, a closed database is just less useful. This system works because when one person notifies the system of an exploit then every other person now knows. That kind of system is much higher quality if you have more people that are able to access it.
An industry being created and earning money by providing cybersecurity services shows how useful such a system is for everyone. There are good paying jobs that depend on this data being freely available. New startups only need to provide service, they don’t need to raise the funds to buy into the security database because it is a public service. They also pay taxes (a significant amount if they’re charging $30,000 per audit), more than enough profit for the government to operate a database.
I’m honestly not totally sure what to think about this one, though I recognise that it’s a big shift/likely a negative overall result.
Reason I’m humming and hawing, is that there are lots of expensive cybersecurity type ‘things’ that rely on the CVE system, without explicitly paying in to that system / supporting it directly, from what I recall / have seen. Take someone like Tenable security, who sell vulnerability scanners that extensively use/integrate with the CVE/NVD databases… companies pay Tenable huge amounts of money for those products. Has Tenable been paying anything into the ‘shared’ public resource pool? How about all those ‘audit’ companies, who charge like 10-30k per audit for doing ‘vulnerability / penetration tests’.
IT Security has been an expensive/profitable area for a long time, while also relying on generally public/shared resources to facilitate a lot of the work. Maybe an ‘industry’ funded consortium is the more appropriate way to go.
What a nonsense.
CVE was used by thousands and thousands of security professionals and organizations, companies are just small part of it. Companies contributed a lot with their own research and vulnerabilities they found and reported into CVE. It was useful because it made it easier to categorize and catalogue vulnerabilities and it made everyone’s life easier. Not just companies’. It made it easier for Linux distros as well. And so on, and so on. Do Americana really think everything needs to be run as a company and for profit?
I guess we’ll now go back to the “good old days” of sharing bugs on Bugtraq.
I still can’t comprehend that Americans voted that idiot into White House. Again. Damage he is doing is out of this world and will only become apparent in years to come. Truly incredible.
Unfortunately, many do. It’s fuck’n baffling as to why.
Well Russia, China, North Korea, and Iran (to name a few) with the assistance tech-bro billionaires like Elon Musk and Mark Zuckerberg have been waging an information war against the US for well over a decade. All that time, money and effort is finally paying off.
Yeah, but that’s sort of the point I was making… it was a data repository used by “thousands and thousands” of security professionals and organizations. So people who were generating revenue off of the service. I mean, they’re professionals, not hobbyists / home users.
I’m not an American, but in terms of everything running like a company/for profit, I’d say that its best if things are sustainable / able to self-maintain. If the US cutting funding means this program can’t survive, that’s an issue. If it has value to a larger community, the larger community should be able to fund its operation. There’s clearly a cost to maintaining the program, and there are clearly people who haven’t contributed to paying that cost.
In terms of going back to whatever, the foundation involved is likely to sort out alternative funding, though potentially with decreased functionality (it sounds like they had agreements to pay for secondary vulnerability report reviews, which will likely need to get scaled back). Maybe they’ll need to add in a fee for frequent feed pulls, or something similar. I wouldn’t say it’s completely toast or anythin just yet.
Up until very recently it seemed perfectly reasonable to fund this sort of thing with taxes, because it benefits everyone even if they’re not directly using the database. An open source developer probably isn’t going to pay to look up vulnerabilities in the open source dependencies they use, so the database being free makes software more secure on average.
What is wrong with having free public services? If someone is abusing it, block them, or charge fees like a library.
Sure, though that’s part of the problem that the States is whining about. US taxes paid for the service, which lots of other nations/foreign companies used.
Things like Libraries require taxes to operate. You’d likely be annoyed if you were struggling, and then found out your gov was using your taxes to pay for a bunch of foreign countries to have libraries. And then you find out that those foreigners are able to use those libraries to make good money, which they don’t use to support their libraries, cause the States is already covering it. So you’re paying taxes, and struggling to do so, so that EU companies can reap profits and live comfy.
And yes, charge a fee. That’s basically what I’ve said, no? That there’s a value add, and that there are ‘professionals’/companies using it who aren’t paying for that value add. So something like a fee for frequent pulls against the vuln feeds, to replace whatever funding the US gov was giving, would make sense to me. though I suppose this has now been kicked down the road till next year.
The US specifically does spend tax money on foreign aid (or at least they used to). I have no problem with that. If you’re struggling to get by, then you should be paying effectively no taxes. If that’s not the case, then we should be fixing that, not cutting funding to things that make the world better.
As for the fee suggestion, a library does not charge for entry or for every book. There is a “free tier” that everyone can use as long as you return the books on time. You only charge the people making too many requests to make sure the service stays available to everyone.
Idk about Tenable specifically, but a lot of the major security vendors have their own pool of security researchers who very frequently contribute to CVE. Mostly from finding vulns in their own product, but a lot of those vulns are due to upstream libraries.
The CVE system protects everyone that uses computers. It is a public service that forms the core of cybersecurity in the US and many other places. It does not cost the database any more money if people use it to provide services to clients.
Letting a private corporation take it over and put it behind a paywall now means that security, like so many other things, will only be available to people with money. It will make software and hardware more expensive by adding yet another license fee or subscription if you want software that gets security updates.
In addition, a closed database is just less useful. This system works because when one person notifies the system of an exploit then every other person now knows. That kind of system is much higher quality if you have more people that are able to access it.
An industry being created and earning money by providing cybersecurity services shows how useful such a system is for everyone. There are good paying jobs that depend on this data being freely available. New startups only need to provide service, they don’t need to raise the funds to buy into the security database because it is a public service. They also pay taxes (a significant amount if they’re charging $30,000 per audit), more than enough profit for the government to operate a database.