Hacker News Reader

Tell us about a system for managing vulnerability database that works across enterprise, private and open source, is staffed enough to research both impact and disputes, is funded enough to work for decades, isn't partisan to any industry interests, can classify vulnerabilities in a non ambiguous way, can handle public submissions at any volume in a timely manner...

and one that will never make decisions that is incorrect or disliked by any party.

View on HN

I'll get back to this conversation after Mitre publicly says "We handled CVE-123 wrong". Everybody gets one wrong sometimes, but what happens after that

The linked article ends with mitre confirming the outcome is what the curl project wanted. The dispute process is there exactly because some cases are ambiguous, or hard, or people involved are annoying. Whenever there are two sides with a dispute, one will likely claim Mitre handled something wrong, by definition of a dispute. They get to make decisions. So what exactly do you want from this case? Perfect decision making every time? They're handling thousands of cases and there will always be mistakes at that scale - some will be subjective things that people will disagree about forever.

Reply on news.ycombinator.com