7 ms·
Why own numbering instead of CVE?
by kbumsik 2mo ago
Why own numbering instead of CVE?
- vngzs 2mo agoIt lets organizations (Tailscale) control the timing and narrative around the disclosure more directly. Organizations sometimes avoid the bureaucracy of going through CVE Numbering Authorities by self-publishing. Often a CVE assignment follows self-disclosure, especially when there's pressure to interoperate with vuln-scanning/compliance tooling
- bigfatkitten 2mo agoAnd sometimes it’s just impossible to get a CVE number in a reasonable amount of time, or indeed at all.
- cyphar 2mo agoIn my experience it is really very quick and easy to get a CVE if you contact MITRE directly, and on paper you do not need to disclose too much. The GitHub CNA is (ironically) very slow by comparison but that is a GitHub issue. Tailscale can also just apply to be their own CNA and issue CVEs for their products themselves, eliminating any such issues entirely.
- wereHamster 2mo agoSome reasons why an org might want to become their own CNA: https://daniel.haxx.se/blog/2024/01/16/curl-is-a-cna/ https://daniel.haxx.se/blog/2024/01/16/curl-is-a-cna/
- Retr0id 2mo agoTo be clear creating your own custom IDs isn't the same thing as being a CNA, but some of the motivations are the same.