Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4643

Re: tracking security issues without CVEs

Show all headers | View raw

On 2016-03-13 08:53:38, Paul Wise wrote:
> On Sat, Mar 12, 2016 at 10:51 PM, Kurt Roeckx wrote:
>> On Sun, Mar 06, 2016 at 03:33:16PM +1100, Brian May wrote:
>>> For example, if there are no CVEs are we able to use OVEs instead?
>>
>> What abaout DWF?
>
> That didn't exist at the time of Brian's post.
>
> I think OVE/OVI still have less friction than DWF, you just need to
> press a button.

Well, the friction is one thing, but we need to adopt *one* system for
the future, if CVEs are going the wayside (or even as a complementary
approach). DWF seems interesting because it incorporates CVE IDs
directly and it also allocates CVE ranges to various projects. Debian
could be one of those:

https://github.com/distributedweaknessfiling/DNA-Registry/blob/master/DNA-Registry.csv

... and manage its own allocations.

I am not sure I like the CSVs, however... and it doesn't seem to have
much adoption yet:

https://github.com/distributedweaknessfiling/DWF-Database/blob/master/DWF-Database-2016.csv

Centralisation certainly doesn't scale here...

a.

-- 
The university must paint itself black, mulatto, worker anddd
peasant. If not, people will break down their doors and paint the
university the color they like.
                        - Ernesto "che" Guevara

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

tracking security issues without CVEs Brian May <brian@linuxpenguins.xyz> - 2016-03-06 05:40 +0100
  Re: tracking security issues without CVEs Paul Wise <pabs@debian.org> - 2016-03-06 16:10 +0100
  Re: tracking security issues without CVEs Salvatore Bonaccorso <carnil@debian.org> - 2016-03-06 17:10 +0100
    Re: tracking security issues without CVEs Salvatore Bonaccorso <carnil@debian.org> - 2016-03-06 19:00 +0100
      Re: tracking security issues without CVEs Brian May <bam@debian.org> - 2016-03-06 23:40 +0100
      Re: tracking security issues without CVEs Moritz Mühlenhoff <jmm@inutil.org> - 2016-03-10 21:00 +0100
        Re: tracking security issues without CVEs Paul Wise <pabs@debian.org> - 2016-03-11 01:30 +0100
    Re: tracking security issues without CVEs Brian May <bam@debian.org> - 2016-03-06 23:40 +0100
  Re: tracking security issues without CVEs Kurt Roeckx <kurt@roeckx.be> - 2016-03-12 16:00 +0100
    Re: tracking security issues without CVEs Paul Wise <pabs@debian.org> - 2016-03-13 14:00 +0100
      Re: tracking security issues without CVEs Antoine Beaupré <anarcat@orangeseeds.org> - 2016-03-22 15:30 +0100
        Re: tracking security issues without CVEs Paul Wise <pabs@debian.org> - 2016-03-23 04:10 +0100
          Re: tracking security issues without CVEs Michael Stone <mstone@debian.org> - 2016-03-23 20:10 +0100
            Re: tracking security issues without CVEs Andrew Deck <andrew.hastings.deck@gmail.com> - 2016-03-28 16:40 +0200
              Re: tracking security issues without CVEs Paul Wise <pabs@debian.org> - 2016-04-28 08:30 +0200

csiph-web