RE: [CVEPRI] Increasing numbers and timeliness of candidates

["Frech, Andre (ISSAtlanta)" <AFrech@iss.net>]

Steve and CVE Editorial Board Members,

For ISS, timeliness in the CVE is a very nice thing to have, but not
essential. Clusters that are spaced a little more regularly (as in every
week or two) would be easier to process than a burst of several hundred
voting issues.

When I'm in an obsessive mood, Pascal's mailing list that enumerates daily
additions, promotions, and changes is very helpful. I believe that this
service has been mentioned at least once in the past in this forum. The
daily changes are also useful for some of our other teams that prefer to use
CVE references on breaking issues.

Steve, I don't know if a compromise is possible where reviewer(s)
continuously review and release pre-candidates to be reported by Pascal's
mailing list. For groups where timeliness is not as important (or who would
like to handle issues at one time), you could continue sending
monthly/weekly/whatever voting clusters or vote online.

Andre Frech
X-Force Research Engineer
Internet Security Systems (ISS)
6303 Barfield Road
Atlanta, Georgia 30328-4233
Phone: 404-236-2927
Fax: 404-236-2624

Internet Security Systems -- The Power to Protect


> -----Original Message-----
> From: Steven M. Christey [mailto:coley@linus.mitre.org]
> Sent: Thursday, May 02, 2002 5:35 PM
> To: cve-editorial-board-list@lists.mitre.org
> Subject: Re: [CVEPRI] Increasing numbers and timeliness of candidates
> 
> 
> All,
> 
> I know that some Board members do not want to pipe up and say "me too"
> if they agree with what other members have already said.
> 
> In this case, though, it is important enough that I would like to get
> everyone's feedback, preferably on this list, but privately at the
> least.
> 
> In a nutshell, it comes down to (a) do you believe that CVE timeliness
> is important, (b) are you willing to live with a little more "noise"
> as a result of improved timeliness, (c) are monthly updates frequent
> enough, and (d) if not, then how frequent would you like the updates
> to be?
> 
> Thanks,
> - Steve
>