RE: We Need a Revote with a different Option A! Was RE: CVE ID Syntax Change - Second Round Voting Ballot (Deadline Wednesday, May 22, 2013, 11:59 PM EDT)

[security curmudgeon <jericho@attrition.org>]

On Fri, 17 May 2013, Christey, Steven M. wrote:

: Ken,
: 
: Your recommendation for 6 digits is the same as the original Option A, 
: which as we know was tied with Option B.  In addition, during the last 
: discussion period, several people said that they preferred 9 digits or 
: more.  Can you clarify your recommendation?

The original vote was for 6 digits.

We discussed, and largely agreed that 7 would satisfy the concern of 
'future proofing'. At least, those in favor of A did.

At some point, that option mystically changed to 8 digits when it wasn't 
the concensus. I believe the current CVE overflords arbitrarily made that 
decision for us. In doing so, they scuttled Option A as a real choice. 
Witness, I changed my vote away from A because in moving to 8 digits, I 
think that despite the fixed length, it would introduce as many, if 
not mo more errors than Option B.

Had it been 7 digits, I would have stuck with Option A most likely.

At the very least, I would like it on record as to why the jump from 7 to 
8 occurred, and who was responsible for that.