Stories
Slash Boxes
Comments

SoylentNews is people

posted by Fnord666 on Thursday February 28 2019, @02:55PM   Printer-friendly
from the hello-entropy dept.

The National Vulnerability Database (NVD) is a US government-funded resource that does exactly what the name implies-acts as a database of vulnerabilities in software. It operates as a superset of the Common Vulnerabilities and Exposures (CVE) system, operated by the non-profit Mitre Corporation, with additional government funding. For years, it has been good enough—while any organization or process has room to be made more efficient, curating a database of software vulnerabilities reported through crowdsourcing is a challenging undertaking.

Risk Based Security, the private operator of competing database VulnDB, aired their grievances with the public CVE/NVD system in their 2018 Vulnerability Trends report, released Wednesday, with charged conclusions including "there is fertile grounds for attorneys and regulators to argue negligence if CVE/NVD is the only source of vulnerability intelligence being used by your organization," and "organizations are getting late and at times unreliable vulnerability information from these two sources, along with significant gaps in coverage." This criticism is neither imaginative, nor unexpected from a privately-owned competitor attempting to justify their product.

In fairness to Risk Based Security, there is a known time delay in CVSS scoring, though they overstate the severity of the problem, as an (empirical) research report finds that "there is no reason to suspect that information for severe vulnerabilities would tend to arrive later (or earlier) than information for mundane vulnerabilities."

https://www.techrepublic.com/article/software-vulnerabilities-are-becoming-more-numerous-less-understood/


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 0) by Anonymous Coward on Thursday February 28 2019, @05:31PM (2 children)

    by Anonymous Coward on Thursday February 28 2019, @05:31PM (#808207)

    Ada? Designed for military applications--life critical systems...

  • (Score: 1) by redneckmother on Thursday February 28 2019, @06:34PM (1 child)

    by redneckmother (3597) on Thursday February 28 2019, @06:34PM (#808248)

    I was surprised that Ada didn't take off, since DOD was pushing it hard. It is (was?) a decent language. Loved the strong typing, exception handling, and syntax.

    --
    Mas cerveza por favor.
    • (Score: 2) by DannyB on Thursday February 28 2019, @07:34PM

      by DannyB (5839) Subscriber Badge on Thursday February 28 2019, @07:34PM (#808301) Journal

      I first ran into ADA in college. I was told by the grown ups that I would do good to learn ADA because it would soon be the ONLY language because of the DOD.

      I simply could not believe that. I saw a lot of usefulness in other languages.

      I also considered that an ADA compiler must be a beast of sophistication and complexity. And at this time microcomputers were taking off and had, maybe 48 K of RAM. Or 64 K RAM. Later 128 K. etc.

      --
      People today are educated enough to repeat what they are taught but not to question what they are taught.