Home | Notifications | New Note | Local | Federated | Search | Logout

Note Detail

khm@khm@hj.9fs.net (2026-09-29 22:47:57)
so far the best-working act of self defense is to establish a project-specific CVE Numbering Authority so you get right of refusal for people trying to file against your code.  this is a mild, but not strenuous, pain in the ass.

better would be to replace the CVE program, but the only meaningful attempt to do so was DWF, which was a half-assed effort by a Red Hat staffer angling for promotion; once he left RH the project foundered and died, making it tougher for any follow-on effort to get buy-in