> It's the global catalog that helps everyone – security teams, software vendors, researchers, governments – organize and talk about vulnerabilities using the same reference system
so why was only the US federal government funding it, especially if it wasn't expensive to maintain?
this is the follow up question to every headline and won't be seen as controversial later, so why bother treating it as controversial to say now
Okay, so we’ve established that the cost of the endeavor is low.
> it’s the global catalog that helps everyone organize and talk about vulnerabilities
I would argue that leading and controlling the organization that provides the world with the single most ubiquitous cybersecurity resource justifies what you characterized as a meager cost in reputational capital alone.
> this is the follow up question to every headline and won't be seen as controversial later, so why bother treating it as controversial to say now
It’s not controversial, just a bit aloof.
Control of something like the CVE registry is essentially a geopolitical concern at this point, i.e. there has been anxiety brewing about China’s vulnerability disclosure laws for a bit now, much of which is warranted as China has been preventing the disclosure of vulnerabilities and instead stockpiling 0days and leveling up their APT groups. Even if the US wouldn’t exert such blatant influence or control over the program, the fact that vulnerability disclosures are being sent to US entities, or even just traveling through IP space we control, may be alone enough for value to be extracted.
This pattern could basically be viewed as the DOGE fallacy at this point.
> I would argue that leading and controlling the organization that provides the world with the single most ubiquitous cybersecurity resource justifies what you characterized as a meager cost in reputational capital alone.
Someone in the original HN thread about funding wrote a post explaining how poorly run CVE org was and it had been like that for years. It had a giant backlog, ignored criticism, and moved very slowly.
Then the second it shutdown a volunteer organization was assembled overnight.
> Control of something like the CVE registry is essentially a geopolitical concern at this point
This is purely a reputational concern. Being on government networks doesn't make it instantly more trustworthy or safe. Just like everything regarding security it takes lots of people looking at it, people reporting issues, and an organization that deals with issues promptly.
> Someone in the original HN thread about funding wrote a post explaining how poorly run CVE org was and it had been like that for years.
Sure, but that doesn’t change anything, does it? Most people that use or have benefited from the CVE program are not even aware of these criticisms, and I’d be willing to bet that the majority of people who _are_ aware only became so in the past week.
> This is purely a reputational concern. Being on government networks doesn't make it instantly more trustworthy or safe.
I did not say the concern was the safety of the CVE program. The concern is influence over the world’s inbox for 0days and the tangible ways that can be used to a nation’s benefit. It is most certainly not just a reputational concern. If China had stepped in last week and took the reins there would be groups within both industry and government having mild freakouts this week.
I think others have already stated about the U.S. having a leadership position by running this...So i'll just comment on the the funding of this DB. I mean, sure, i'm all for optimizing things...but it strikes me that some decisions by the current U.S. administration - like not wanting to fund this - seem very penny wise and pound foolish. Like, for whatever it costs to run this DB (and i truly have no idea of the costs), i bet you that the operational benefits to U.s. companies, organizations is well worth the spend. Separate of any political benefits, i'm referring to hard and tactical benefits that arise from this existing. Someone is simply looking at a long list of items on a budget, not understanding that each item might have different weights, values, etc...and simply slashing like a toddler...and either not caring the ramifications, or not understanding them (or secondary trickle effects).
The pittance we pay to support things that benefit all humanity have never prevented us from investing in the US.
You don't need to put the federal government in a wood chipper to make the US better, and in fact you often need the federal government to make the US better, like with social security, food stamps, medicaid, the interstate, railroads, most of our infrastructure, the internet, microchips, etc.
In fact, if you want the best infrastructure, why wouldn't you end up importing that? Most of humanity is not a US citizen. "The best" human at something will only rarely be american.
Meanwhile this admin has done nothing to improve things for americans, so stop carrying water for their horse shit.
People love the meme of a runway full of F35s and saying "We are about to demonstrate why the US doesn't have socialized medicine" and it has always been a lie. We can EASILY afford 3k F35s, 13 aircraft carriers, AND healthcare. We've been paying more for healthcare than countries with socialized medicine this whole time.
> We can EASILY afford 3k F35s, 13 aircraft carriers, AND healthcare
I'm aware but there is no consensus for that, or addressing the budget, all while our infrastructure crumbles at the same time.
Now there is at least an attempt to address our budget. Regarding foreign policy, other leading nations are not giving aid, they are investing. We could just as easily do our "soft power" stuff in a more equitable way. Every controversial budget change, that's even mocked by leaders of G-7 nations, are things those G-7 nations are already doing. Aid for repayment? yeah they're doing that. Not a controversial concept in reality.
And yes, I still want the federal government to do the things you mentioned regarding federal highways, railroads... infrastructure projects we both agree on.
>Now there is at least an attempt to address our budget.
NO THERE IS NOT
DOGE hasn't saved a dime, and by cutting IRS employees has already cost more than they could ever save, meanwhile the Trump admin is pushing a budget that just keeps adding to the deficit to pay for more tax cuts for the hyperwealthy.
Has the U.S. ever claimed to be the leader of the world? I do not think any country has ever claimed that title. The closest to it would be some of the remarks that are supposedly made to each Pope upon becoming Pope.
That said, there is the similar sounding title called “the leader of the free world” applied to the U.S. president since the end of WWII. I always thought that was the result of military alliances, not the CVE program, which post dates it.
Edit: To the downvoters, I take issue with the assertion that the U.S. has claimed the title “leader of the world”. That is applied to the Pope during papal inaugurations and as far as I know, has never been formally applied to the United States. It seems to have been invented this year as part of claims that the U.S. has an obligation to spend money on programs that benefit others, given that the current political situation has made a number of them appear to be in jeopardy, but that appears to be a rewrite of history, rather than any historical truth. My sole interest here is the historical truth, and not politics.
The USA has, by any measure, a veritable monopoly of coercive force on the world stage. Their military expenditure is more than the next 15 countries combined.
This means they have the capability to enforce their will globally to a significant extent. In an arena such as geopolitics, justice is the will of the stronger, no holds barred. This makes the USA arguably the primary concern in geopolitics, the ring you need to kiss to do anything on that stage.
Keep in mind that “claimed” may be referring to the sense of “won” rather than “stated”.
From that perspective it’s not too much of a stretch to call them the world leader, but that does ignore the fact that leadership implies the will to lead and to a significant extent the requisite wisdom and skills.
Leader of the world and leader of the free world are two different things. As far as I know, no country in the past century has called itself either of them. I would not be surprised if the title was applied to countries such as the Imperium Romanum and 中國 in the distant past. Even more distant would be possibly Greece given that it’s leader was called the King of Kings around the time of Troy.
However, I believe both titles are applied to specific office holders in the modern day. The U.S. president is called the leader of the free world by many. I believe the title leader of the world is bestowed upon the Pope during Papal inaugurations.
With all due respect, you're being pedantic. No, we're not talking about official titles bestowed from on high. The US has been considered the world leader from WW2 until sometime in the 21st century, partly because nobody else wanted to claim it, partly because American foreign policy is aggressive, partly because the American economy was the most robust on in the aftermath of WW2.
The U.S. has never been the world leader. The U.S. has been a military leader for other democracies since the end of WWII. That is why the title, leader of the free world has been applied to the U.S. president, who is the leader of the various military alliances between various major democracies. If you claim the U.S. considered itself to be the world leader, then you are claiming the U.S. considered itself to be the leader of the Soviet Union, the Warsaw pact, North Korea, etcetera. That is absurd. The U.S. likely did consider itself the leader of Vietnam and Cuba before the democracies in those countries fell, although that was in a military capacity. That is why the
U.S. intervened militarily in both, although both interventions failed.
Saying that the U.S. got its leadership position because no one else wanted it is historically incorrect. Following WWII, every other major democratic power was in ruins while the U.S. was the sole major power left in tact. Without any military attacks on U.S. soil, U.S. military strength had skyrocketed during the war. As the war progressed, the U.S. attained the status of a great power and by the war’s end had become a nascent super power. U.S. strength continued to grow after the war due to the threat of the Soviet Union. Meanwhile, the other great powers never fully recovered militarily since they focused on their economies while relying on the U.S. for security. The U.S. gained its leadership position because no one else existed that could claim it.
If I say, “I like to lead by example”, that can mean leadership in the moral sense of progressive politics. Americans view America that way, as the leader of liberalism and social justice. Even Americans who don’t see America or American history that way, tend to see themselves (ironically?) that way. But that’s a different meaning of leader. We lead by things like protests, humanitarian aid and having enlightened celebrities.
> so why was only the US federal government funding it, especially if it wasn't expensive to maintain?
I want to flip this question around as if it was asked by somebody from a country other than the U.S. If I was looking at America since 9/11 from the outside, I would see a country that was trying to destabilize itself. It started out slowly enough, but as the years have progressed the wobble has become more and more pronounced until today, where the U.S.'s trustworthiness is lower than I personally ever thought it could go. And it's going to get worse.
So if I lived outside the U.S. I would be asking the very same question: Why would a government that is so unstable and so dangerously powerful be in charge of something that the world kind-of would like to depend on? And I'd start my own version of it asap. I understand from the Reg article that the U.S. extended its contract in the 11th hour, but that just speaks to the point more than anything else.
It suggests that an apathetic world and private sector globally is mildly amused that the US uses its resources this way on things they rely on
or it suggests that an entire world and private sector is so uncoordinated and budget strapped globally that all this - at least these things - is held together by the US
I'm pleased to find out. I'm dismayed at how disruptive doing so has to be, but its either accepting the concept of American exceptionalism, or stepping up and proving the apathy was giving America a bad deal and calling into question how much of an ally anyone was
It is a matter of whether you prefer transnational organized crime or not.
Businesses, Science and individuals thrive in societies that are democratic, with separation of powers and independent judiciary. The better they function, the harder it is for crime.
On the other hand, if you allow organized crime to prosper, take control of it, and on the other hand have the judiciary in your grip, you can play both cards against your political/business enemies.
This is the model of Russia, where the State is deeply connected to transnational organized crime. The Kremlin powers really wanted Viktor Bout free. Now, if the power brokers in the media landscape wanted to tell you the big picture instead of hyper focusing on the day to day circus... (that is also why journalism /= actualities).
So these are just necessary steps to clear roadblocks for crime networks. The same for IRS. In Russia you cannot get power without Kompromat on yourself. Like the maffia, the boss needs a kill switch on everyone.
From a higher perspective, it is a bit unfortunate that these transgressive steps were foreseen in academia, those despicable expertise centra in the EU and other democratic countries, while the general public is kept in the dark by media houses.
I am not sure if it still suitable for HN or that the Overton Window shifted too much already, but the other things that were forecast are the capturing of conservatism by the same networks. We expect also to see further normalization of law breaking, power abuse, power concentration and state capture by non-elected bodies. Yes, this was a normalization process of decades. But now on full acceleration. As an aside, it is not entirely a coincidence that "Accelerationism" is the ideology of associated power circles.
And now you also know how Tech Bro's and Conservatism could share the same campaign. Their intended outcomes differ on some points, but they agree on the path to their respective ideals. The extreme destruction that follows will not touch them personally. To ensure that last thing they unlock powers for them self: become the law.
The US is not the best friend of UN. Out of the WHO, menaces the ICJ, vetos that go against the democratic countries and a few times match russia. Trump out of the climate accord. Trump quit UN rights council, Trump cuts UNRWA funding.
You may agree with some, but there is a pattern.
I am waiting for it to leave the FAO. Not hoping, waiting.
Your snark misses the fact that the program has been funded by the US for 25 years and the decision to not make it a UN project has nothing to do with the current administration.
Trying to cut it immediately instead of saying "ok, it needs to become a joint international effort starting on (a date months ahead)" is the issue with the current administration. Running it is fine, handing it over is fine, suddenly making a huge mess is not.
I am confused about what UN has to do with America shutting down services whose primary goal was to protect American infrastructure, government and companies.
Some UN nations are quite happy about this, because it will make it easier to access what they want in US.
Maybe it was the US that wanted it under their own control, and could enforce that via the soft-power it had. :)
Anyways, I have to agree with the others: this is not the real issue. If you wanted to change the governance on that point, you can transition these things orderly.
Like Doge, the messaging is to hide the real intentions. It doesn't take much effort to see that the actions do not really match with the messages, but if the media would not even do that bit of analysis and would not bring the disconnect front and center, then yeah, it is a winning strategy.
Completely irrelevant. Deliberately or not you're repeating the Trump / DOGE talking point of government expense, focused on expenses that individually and in aggregate contribute practically nothing to the federal budget.
I agree wholeheartedly in this case. But gutting the epa will almost certainly boost the gdp far more than the amount directly saved. At least in the short term. Burning rivers are a lot harder to clean up than tech debt. I think the idea was to free up a bunch of labor to replace the perfectly good spigot of labor we had in the form of legal immigration, and get rid of a lot of regulations that inhibit short term gdp all in one swell foop. The tariffs were always primarily a negotiating strategy to get everyone to allow us to weaken the dollar, which unlike tariffs would outlast an administration and eventually bring manufacturing back for that freed up labor. In the interim there would be a ton of infrastructure spending to employ the labor as the lack is limiting our gdp by 1-2%. It was a decent plan except that long temr it ignored the environmental costs. The execution of the tariffs got screwed up though because while chaos is good for negotiation, it is not good in a sales pitch, which is essentially what this was. Let us weaken the dollar without responding and continuing to purchase bonds and we'll keep buying plent of your stuff, we have consumer demand to spare, and the gdp boost will offset the weakened dollar while making our bonds even safer as we begin to grow the gdp relative to the debt. The reason some allies like Australia and Canada got tariffs despite it not making any economic sense is different. In addition to sacrificing the environment, this plan sacrifices us democracy, and you can't have easy travel to a place with lots of individual freedom or you get the flight of all skilled labor like in Hungary.
Anyway, we are going to get the bad parts of the plan without the benefits now. Not entirely too late but pretty close. We can't all wait until a blatant constitutional crisis to start protesting because the court will back down where it can without openly loosing legitimacy. And once the admin chooses to cross the red line they will be ready for the response. Show support to gop members who want to stand up but are afraid of primaries (and death threats). Even promise cross party primary support where that is possible. Don't go along with illegal stuff. Tell the dnc your only priority is democracy and to stop arguing about the rest. Go to protests. Talk to people you disagree with calmly and do it a lot. Don't flee, this is endgame, nowhere else will hold out all that long. Help people get their voter registration in order with stuff like voterider to combat voter suppression.
Ok that was cathartic to type out all at once. If you don't see it then go read the history of successful and failed takeovers from rome to the present. It is a color by numbers approach that is easy to recognize once you've seen the others, but done super faster and with no visible bloodshed. And with a lot less public support than is normal for such things. Kind of impressive in a horrifying way.
> Deliberately or not you're repeating the Trump / DOGE talking point of government expense
Its a run of the mill libertarian position
It doesn't matter which politician or administration does it from that perspective. Those two do happen to be a coalition with libertarian constituents that they courted for votes, so its more than happenstance that the positions and actions will sound the same.
Regardless, private funding isn't controversial. The US Federal government reaching parity with the same level of apathy of every other government organization in the world isn't controversial either.
so why was only the US federal government funding it, especially if it wasn't expensive to maintain?
this is the follow up question to every headline and won't be seen as controversial later, so why bother treating it as controversial to say now