HN Reader

I read this twice trying to figure out why it matters if we trust NVD. It's a number assigned to vulnerability reports; that's it. Who cares?

> If this is a topic you’re interested in, there’s a discord chocked full of people discussing vulnerability things, feel free to join.

Are open-source-y type infosec people choosing Discord?

The post spends too much time speculating about how CVE is mismanaged without providing anything beyond their unmet expectations. Pointing to VulnCon attendance as an act of betrayal seems pretty reductive.

Didn’t make it through the rest, it was too hyperbolic and opinionated without substance.

The author spoke of uncertainty that CVE will be around, and also said that some parties involved didn't appear forthright on some occasions. What wasn't clear to me is the "What's your threat model?" here.

I'm glad I ain't the only one who understands that transparency is a dependency of trust.