Hacker News Reader

The federal government ought to be funding NIST sufficiently to actually do sufficient analysis. Do we care about funding civil "cyber" defense or not?

(Obviously the answer is not, we only care about funding offensive capabiltiies).

View on HN

This is obviously impractical. With the volume of bug reports that are generated and such a wide breadth of software no single agency will be able to handle all reports. And honestly? It doesn't matter, even today. CVE should serve as a reasonably deduped identifier of specific vulnerabilities. It was never interesting and practical to care about 100% of vulnerabilities in a specific deployment, and it's not interesting today.

The federal government defunded the CVE program last year, I think, because it was woke.

Reply on news.ycombinator.com