Re: Upcoming changes for CVE

[jericho <jericho@attrition.org>]

On Thu, 24 Sep 2015, Boyle, Stephen V. wrote:

        ^^^^^^^^^^^

: CVE Numbering Authorities (CNAs)
: -------------------------------------------

: Tiffany will be engaging with the Board, and will email to described the 
: objectives and plans for updating multiple aspects of the CNA 
: relationship and functioning. Our aim is to improve both sides of the 
: operation and reliability of CNAs, to have CNAs evolve to take on a 
: larger role in the creation of CVEs, and to ultimately expand the number 
: of CNAs.

Well over 60 days, no documentation drafts available, and no mail from 
Tiffany to the board regarding this.

Honestly, it should not take more than two months to write CNA guidelines, 
even with all of the issues at hand.

I am specifically replying to this piece after more than one person has 
approached me the last few days, expressing frustration over not getting 
CVE assignments, and after being told 'no' they can't be a CNA, even when 
they are well-qualified and well-suited to be one.