"Trump a Critical Vulnerability"[: Contract that funds CVE almost expired]

dataandpolitics.net

7 points·mdp2021··2 comments

It was too difficult to soften the original title, which was flat and hid the important content; I kept it (added the quote marks) and just added the context. (I did not want the original title to have people distance from the important content, but on the other hand it is also the article writer's evaluation and conclusion...)

In short,

> The Trump administration nearly let the US government’s $44 million contract with MITRE expire — a contract that funds the Common Vulnerabilities and Exposures (CVE) program. CVE is the naming and tracking system that allows security researchers, governments, and software vendors to coordinate on known vulnerabilities. It’s how the open internet defends itself. With just hours to go, the contract was renewed. // But the damage was done. // CVE doesn’t run on cash. It runs on trust

A punchy article that centres on the concept of trust. Yesterday I wrote this one [0] with similar themes.

The idea that the US administration is turning against the existing trust-based cybersecurity order is terrifying and almost unthinkable. But history shows rising authoritarian regimes usually scrub existing security apparatus before bringing in their own.

In this case they're attacking an international order, and that could lead to the US soon being on the outside of the network it (DARPA) built.

It's something I hope to talk to a resistance group "We The Builders" [1] about.

[0] https://www.cybershow.uk/blog/posts/usw/

[1] https://www.wethebuilders.org/posts/next-generation-of-emplo...

Reply on news.ycombinator.com