SoylentNews is people
SoylentNews
The National Vulnerability Database (NVD) is a US government-funded resource that does exactly what the name implies-acts as a database of vulnerabilities in software. It operates as a superset of the Common Vulnerabilities and Exposures (CVE) system, operated by the non-profit Mitre Corporation, with additional government funding. For years, it has been good enough—while any organization or process has room to be made more efficient, curating a database of software vulnerabilities reported through crowdsourcing is a challenging undertaking.
Risk Based Security, the private operator of competing database VulnDB, aired their grievances with the public CVE/NVD system in their 2018 Vulnerability Trends report, released Wednesday, with charged conclusions including "there is fertile grounds for attorneys and regulators to argue negligence if CVE/NVD is the only source of vulnerability intelligence being used by your organization," and "organizations are getting late and at times unreliable vulnerability information from these two sources, along with significant gaps in coverage." This criticism is neither imaginative, nor unexpected from a privately-owned competitor attempting to justify their product.
In fairness to Risk Based Security, there is a known time delay in CVSS scoring, though they overstate the severity of the problem, as an (empirical) research report finds that "there is no reason to suspect that information for severe vulnerabilities would tend to arrive later (or earlier) than information for mundane vulnerabilities."
(Score: 3, Interesting) by DannyB on Thursday February 28 2019, @06:01PM (2 children)
The developer velocity thing is a management problem. A problem of mis-aligned priorities and delaying small costs that will turn into gigantic costs.
Developers are happy to think about security issues and other problems that managers are happy to sweep under the rug until someday.
The people who rely on government handouts and refuse to work should be kicked out of congress.
(Score: 2) by bob_super on Thursday February 28 2019, @07:38PM (1 child)
Who cares if it has bugs, as long as the customers' private data flows into the database ?
Let's focus on what's valuable, shall we ?
(Score: 2) by DannyB on Thursday February 28 2019, @09:24PM
No worries if the customer's data flows OUT of the database into someone else's hands.
Developer Velocity is what matters.
The people who rely on government handouts and refuse to work should be kicked out of congress.