|
|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Notice of Pilot Activity in CVE Auto WG
- To: Kurt Seifried <kurt@seifried.org>, "Waltermire, David A. (Fed)" <david.waltermire@nist.gov>
- Subject: Re: Notice of Pilot Activity in CVE Auto WG
- From: Art Manion <amanion@cert.org>
- Date: Tue, 9 May 2017 15:09:37 -0400
- Authentication-results: spf=none (sender IP is 129.83.29.3) smtp.mailfrom=LISTS.MITRE.ORG; mitre.mail.onmicrosoft.com; dkim=none (message not signed) header.d=none;mitre.mail.onmicrosoft.com; dmarc=none action=none header.from=cert.org;
- Cc: "Booth, Harold (Fed)" <harold.booth@nist.gov>, cve-editorial-board-list <cve-editorial-board-list@lists.mitre.org>, cve-board-auto-list <cve-board-auto-list@lists.mitre.org>
- Delivery-date: Tue May 9 15:46:03 2017
- In-reply-to: <CABqVa39oKW6nTM9DD3uN0ZgwOcC-C+niSmOeVa6=zYfMrbGSyA@mail.gmail.com>
- List-help: <mailto:LISTSERV@LISTS.MITRE.ORG?body=INFO%20CVE-EDITORIAL-BOARD-LIST>
- List-owner: <mailto:CVE-EDITORIAL-BOARD-LIST-request@LISTS.MITRE.ORG>
- List-subscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-subscribe-request@LISTS.MITRE.ORG>
- List-unsubscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-unsubscribe-request@LISTS.MITRE.ORG>
- References: <CY4PR09MB12557F8D40B47F9652F8FA5AE6EE0@CY4PR09MB1255.namprd09.prod.outlook.com> <MWHPR09MB1440D9E1D16CBB4ED7D2C995F0EF0@MWHPR09MB1440.namprd09.prod.outlook.com> <CABqVa39oKW6nTM9DD3uN0ZgwOcC-C+niSmOeVa6=zYfMrbGSyA@mail.gmail.com>
- Sender: "owner-cve-editorial-board-list@lists.mitre.org" <owner-cve-editorial-board-list@lists.mitre.org>
- Thread-index: AdLIPXFZt5GwZZF0QtiX2zCa7r/aiAAsRStQAAISIQAAAD+hgA==
- Thread-topic: Notice of Pilot Activity in CVE Auto WG
- User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.8.0
On 5/9/17 3:02 PM, Kurt Seifried wrote:
> So I assumed we'd have a publishing model where CNA's just publish to
> their parent until it hits MITRE.
I'd suggest a model where every CNA publishes, in at least the CVE MVP
format (but more is OK, such as DWF requirements). I guess this is pull
not push? Parent CNAs would be required to pull/aggregate from their
children.
This way, anybody can pull from any CNA, MITRE or NVD can pull from
all/lots of CNAs. This allows a lot more flexibility in aggregation,
possibly at the cost of more effort for a central aggregator (MITRE).
I think Atom/PubSub is more than this, but I haven't read up on it.
- Art
> So I assumed we'd have a publishing model where CNA's just publish to
> their parent until it hits MITRE.
I'd suggest a model where every CNA publishes, in at least the CVE MVP
format (but more is OK, such as DWF requirements). I guess this is pull
not push? Parent CNAs would be required to pull/aggregate from their
children.
This way, anybody can pull from any CNA, MITRE or NVD can pull from
all/lots of CNAs. This allows a lot more flexibility in aggregation,
possibly at the cost of more effort for a central aggregator (MITRE).
I think Atom/PubSub is more than this, but I haven't read up on it.
- Art
- Follow-Ups:
- Re: Notice of Pilot Activity in CVE Auto WG
- From: Kurt Seifried <kurt@seifried.org>
- Re: Notice of Pilot Activity in CVE Auto WG
- References:
- Notice of Pilot Activity in CVE Auto WG
- From: "Booth, Harold (Fed)" <harold.booth@nist.gov>
- RE: Notice of Pilot Activity in CVE Auto WG
- From: "Waltermire, David A. (Fed)" <david.waltermire@nist.gov>
- Re: Notice of Pilot Activity in CVE Auto WG
- From: Kurt Seifried <kurt@seifried.org>
- Notice of Pilot Activity in CVE Auto WG
- Prev by Date: RE: CVE Will Reject a Group of Unused CVE IDs
- Next by Date: Re: Notice of Pilot Activity in CVE Auto WG
- Previous by thread: Re: Notice of Pilot Activity in CVE Auto WG
- Next by thread: Re: Notice of Pilot Activity in CVE Auto WG
- Index(es):