Hacker News Reader

Comment by 1970-01-01 | Hacker News Reader

1970-01-01

Less than 24 hrs into it, and now we have two problems from this defunding fiasco:

All the original problems that exist within CVE.

"Let's just reinvent the wheel!"

Yes, you have a dev background, which entitles you to an opinion, and you also have good intentions. This road is noble. However, the crux of this disaster is not technical, it's political. Maybe reinventing the wheel will be a huge success. Maybe it can wear the crown of free and open source for a while. But it's much more likely this fails as things become difficult to maintain, and you become tired, or poor, and are forced to stop, with nobody, or even worse, an enemy (this is an internationally critical database) controlling the database. So let's focus on solving the original funding disaster without jumping to forking and fracturing as a knee-jerk solution.

View on HN

Okay, so what's your proposal (or any proposal) to fix this funding disaster? As a technical person I don't know how to affect the political process, and am thus disinclined to participate meaningfully. People with political ability and/or power have bigger problems to deal with right now, and also seem unable to affect the current political process. So what options do we have but to try our best, even if those ways are ultimately doomed?

https://euvd.enisa.europa.eu/

This one is funded by the EU and accepts direct submissions. It’s probably the best replacement: state-backed, long-running, and reliable.

My understanding of CVE is superficial at best. I thought it was just an acronym publicly identifying vulnerabilities; I didn't realise there was a political structure behind it all.

While the article presents good food for thought, certification isn't a practical solution to the problem at hand. This database seems like a reasonable alternative.

It is “just” that, but: How are numbers assigned? How can others find details? Who determines when these details are public? (note: full CVE details can be used to exploit critical software) If they’re not always public, who gets to see them? And who handles that dissemination? Who takes care of duplicates?

Lots of work does go into this, even if it’s “just” an identifier.

Just because there is a problem doesn't necessarily mean you personally (or anybody, or any group of people) can solve it. Go ahead and try of you want, but also be wide-eyed about what success looks like, what the chances of it are, and what the costs will be.

Moving to more stable financial markets, away from the United States, would be a start.

>As a technical person I don't know how to affect the political process

Vote.

This is a vapid answer, like "write your senator". Of course I do, every chance I get. It doesn't seem to have meaningfully affected our political process.

It isn't. I'll expand on it. Tell your wife, your cousin, your bartender why you voted. Tell them how this CVE system is critical, and why they should care about voting for people that truly understand this. If you vote and influence others to vote, you're solving the problem fully and directly.

Voting is all but useless in deep-(any color) states though, that's the problem. I mean... yes, it's the decent thing to do, but in the end it's wasted effort in the American political system.

That's only true if you think "vote" means "vote once every 4 years, for the President".

Even if the only political action you ever do is informed voting, if you're voting in every election, knowing as much as you can about the candidates, then you have a real chance of starting to move the needle.

I mean everyone could just pitch in to support it rather than the US government? I'm sure a few big corps could od it

> let's focus on solving the original funding disaster

The _original_ funding disaster is that this problem was delegated to the economic machinery of a nation-state, and humanity is presently in the process of evolving beyond nation-states.

Innovation in communication and information archival is an extremely long evolutionary process, persisting across aeons in the case of media like DNA and language, while the trivial shuffling through different varieties of state happens on comparatively extremely short (sometimes century or shorter) scales.

So, any solution that truly addresses the _original_ funding disaster must be future-compatible with an internet in which we've overcome the burden of nation-states.

> humanity is presently in the process of evolving beyond nation-states

No, it isn't. This is some Curtis Yarvin BS.

> So, any solution that truly addresses the _original_ funding disaster must be future-compatible with an internet in which we've overcome the burden of nation-states.

What does this even mean? How do you envision a "future-compatible" CVE database? And what does it have to do with nation states?

Reply on news.ycombinator.com