CVE Program Almost Unfunded

Mitre’s CVE’s program—which provides common naming and other informational resources about cybersecurity vulnerabilities—was about to be cancelled, as the US Department of Homeland Security failed to renew the contact. It was funded for eleven more months at the last minute.

This is a big deal. The CVE program is one of those pieces of common infrastructure that everyone benefits from. Losing it will bring us back to a world where there’s no single way to talk about vulnerabilities. It’s kind of crazy to think that the US government might damage its own security in this way—but I suppose no crazier than any of the other ways the US is working against its own interests right now.

Sasha Romanosky, senior policy researcher at the Rand Corporation, branded the end to the CVE program as “tragic,” a sentiment echoed by many cybersecurity and CVE experts reached for comment.

“CVE naming and assignment to software packages and versions are the foundation upon which the software vulnerability ecosystem is based,” Romanosky said. “Without it, we can’t track newly discovered vulnerabilities. We can’t score their severity or predict their exploitation. And we certainly wouldn’t be able to make the best decisions regarding patching them.”

Ben Edwards, principal research scientist at Bitsight, told CSO, “My reaction is sadness and disappointment. This is a valuable resource that should absolutely be funded, and not renewing the contract is a mistake.”

He added “I am hopeful any interruption is brief and that if the contract fails to be renewed, other stakeholders within the ecosystem can pick up where MITRE left off. The federated framework and openness of the system make this possible, but it’ll be a rocky road if operations do need to shift to another entity.”

More similar quotes in the article.

My guess is that we will somehow figure out how to transition this program to continue without the US government. It’s too important to be at risk.

EDITED TO ADD: Another good article.

Posted on April 16, 2025 at 11:19 AM35 Comments

Comments

wiredog April 16, 2025 12:06 PM

I live in Northern Virginia and “But a little notice would have been nice.” applies to so much of what’s been happening lately.

Not quite “Some random person in Nebraska” is it? I wonder how many more of these things most people haven’t heard about are getting destroyed on no notice.

Doug April 16, 2025 12:06 PM

“But a little notice would have been nice.” Chaos is the name of the game baby! Keep the proletariat jumping with the latest outrage while those at top get rich. The extent of damage being done to the US is tragic. If only the voters had known how bad Shitler was going to be. If. Only.

Clive Robinson April 16, 2025 12:40 PM

@ Bruce,

With regards,

“… as the US Department of Homeland Security failed to renew the contact.”

Whilst technically true, the reality is some sad sack bag of old post digestive eruptions, just stuck a pin in a list of,

“Funding to cut to crow about to those who have less comprehension than he.”

And withdrew the funding thus giving the DHS no real choice (even though those in charge there may have foolishly thought it was a good idea).

Unfortunately for the miasma of post digestive eruptions it got serious kick back and some other suspiciously timed news items turned up the heat to near the flash point.

So as noted, and perhaps unsurprisingly,

“It was funded for eleven more months at the last minute.”

After all we can not have the Donald looking like a bad roast duck, “Peking” or otherwise.

But,

“My guess is that we will somehow figure out how to continue this program without the US government.”

I’m not sure if that is entirely a good idea.

Lets say it’s academic rather than corporate interests that continue it…

The recent Executive attacks on US Universities indicates an all to likely “arms length” way for the Executive to kill things off. We’ve already seen this with certain subjects where certain people who are most definitely NOT US Citizens and do not want “Freedom of Speach” etc getting in the way of their “alternative truth” “propaganda machines”.

Likewise with Corporates, but they are likely to “fold more quickly” in most cases.

Bob April 16, 2025 12:45 PM

What’s clear at this point is that it would be hard to find a worse steward than the Federal government. American voters just aren’t that smart, to say nothing of both the Senate and the Electoral College acting as DEI for the worst and dumbest among us.

As long a a dozen farmers in Wisconsin who have never met a black person get to be the deciding factor in our federal elections, the federal government needs to be viewed as an adversary. This is the second rise of the Confederacy. Even if they could help, they wouldn’t.

Rontea April 16, 2025 3:22 PM

The CVE (Common Vulnerabilities and Exposures) program is vital because it standardizes the identification of cybersecurity vulnerabilities, enabling easier and more consistent tracking across the industry. Without it, organizations would face significant challenges in coordinating efforts to address and patch vulnerabilities, leading to increased exposure to security threats. The program facilitates communication and helps prioritize responses to vulnerabilities, thereby playing a crucial role in protecting the integrity and security of software systems worldwide. It seems like the Cybersecurity and Infrastructure Security Agency (CISA) stepped in to provide a bridge, executing an option period on the contract to ensure no lapse in critical CVE services.

fib April 16, 2025 6:25 PM

In a perfect world, the biggest players in the software industry step up.

They benefit the most. Big tech companies rely on CVEs to secure their own products. They depend on this system every day to protect their platforms and customers.

They have the means. With their massive revenue and dedicated security teams, these companies could easily fund CVE operations. A consortium approach spreads responsibility fairly.

Shared responsibility, shared benefits. Security is everyone’s problem [isn’t it?].

Julia Clement April 16, 2025 6:51 PM

This sounds like one of those security discussions where Trent suddenly pulls off the mask to reveal he’s really Sybil acting as a Mallory / Oscar hybrid which leaves Alice and Bob searching for a new Trent.

Joking aside, ChatGPT tells me that CVE’s annual budget is probably in the low tens of millions per annum! Perhaps it is time for the EU to assume responsibility for maintaining the database? This wouldn’t even be a rounding error in their €155 billion annual budget.

lurker April 16, 2025 8:37 PM

@fib

Indeed security is everyone’s problem, and everyone’s responsibility.
But that might smell too much like socialism for some people, which is probably why the axe was swung into the CVE …

Celos April 16, 2025 10:48 PM

I think that long-term, the EU will finance this. The speed with which the Trump administration is destroying critical services is just too fast for it to really have reacted yet.

mw April 17, 2025 1:52 AM

1) The Eu will not fund this. The ENISA has started an own database https://euvd.enisa.europa.eu/
2) CVEs are not really helpful. The classification is intransparent and not helpful. Its use is mainly snake oil software/services.
3) The Linux Foundation exited month ago from MITRE and has its own database
4) Each vulnerbility is bug! And bugs should be fixed! ASAP! No exception!

ResearcherZero April 17, 2025 2:01 AM

@Bob

Farmers in Wisconsin are interchangeable with latte’ sippers in LA. It is the same emotional leverage and method of distraction which takes away your attention from the lack of real policy that politicians offer to their constituents. It is just a far greater lack of choice on offer now to the majority of the population, who lets be honest, never took much interest in what has been taking place over the last 30 years.

Now the consequences have arrived. Throughout that time there were continued warnings from professionals and experts working within and outside of government – of widening inequality, declining housing affordability and healthcare, poverty and unemployment, aging and failing infrastructure, and areas which would no longer be insurable due to the increased risk of flooding and uncontrollable wildfires – due to climate change.

Of course these problems will get worse when there are fewer experts working for government, or no experts and professionals wanting to speak up and risk losing their jobs.

This can all be simply written off as “biased public media” to keep your heads spinning. You will ALL be too busy blaming “the other side” to notice ALL of your rights vanish.

You were divided and conquered. Your courts and institutions lost much of their power, because ‘you the people’ were whistling in the wind for the last 30 years and never noticed your institutions slowly being weakened, deregulation freeing “the animal spirits”.

Any reporting will be spun into something else by White House PR and their tabloid friends, and there will be no other kind of reporting in regional and rural areas. The end.

‘https://deadline.com/2025/04/pbs-stations-public-media-federal-funding-donald-trump-123636921

Trump is now threatening funding to entire states, including healthcare and transportation.
https://www.axios.com/2025/04/14/trump-federal-medicaid-funding-states

Projects cannot proceed if there is uncertainty, with ramifications for employment.
https://www.nj.com/opinion/2025/04/trumps-transportation-funding-threats-creates-chaos-for-nj-opinion.html

Trump wants to change water policy in fire threatened areas. Divert a few rivers perhaps.

‘https://apnews.com/article/donald-trump-republicans-taxes-eea4754a0f580d451aa0588f0639d52c

Human intervention allowed the sea lamprey into the Great Lakes.
https://www.usatoday.com/story/news/nation/2025/01/06/sea-lampreys-exceed-targets-in-great-lakes/77444497007/

The channels and diversions dug by humans devastated fishing communities.
https://enviroliteracy.org/how-did-the-sea-lamprey-get-to-the-united-states/

Congressional support has so far prevented DOGE ending the sea lamprey control program.
https://www.greatlakesnow.org/2025/02/will-jd-vance-save-the-great-lakes-from-trump/

ResearcherZero April 17, 2025 2:51 AM

@Bob

But don’t worry. Those dumb uneducated hicks all gunna “get theirs”.

The only industry doing a roaring trade in these areas is the undertakers. Apart from that it is pretty boring. So boring in fact it makes people want walk out the back and…

Cancer rates are far higher in rural areas, with the largest rural–urban difference in the South. There are a range of factors which increase mortality rates in regional and rural areas including pesticide and chemical exposure and contamination of the water table, along with additional exposures due to industrial oil and chemical pollution.

Where did Deep Water Horizon impact for example?

Reduced access to medical care, compounded by geography and the long distances these bumpkins need to travel to receive treatment, lead to worse treatment outcomes.

Diet and unhealthy lifestyles are quite common in regional and rural areas.

Older rural adults are also more likely to be obese. Older rural adults have a higher prevalence of several chronic diseases compared to older urban adults, including coronary heart disease and diabetes, with higher rates of mortality from these diseases.

‘https://www.scientificamerican.com/article/people-in-rural-areas-die-at-higher-rates-than-those-in-urban-areas/

“Individuals with cancer living in rural areas have poorer outcomes compared with their urban counterparts.”

‘https://acsjournals.onlinelibrary.wiley.com/doi/full/10.3322/caac.70006

Suicide rates almost doubled between 2000-2020 in rural areas.
https://www.cdc.gov/rural-health/php/public-health-strategy/suicide-in-rural-america-prevention-strategies.html

ResearcherZero April 17, 2025 3:34 AM

So what would older (and younger) Americans living in rural areas require to reverse these trends? Can anyone answer that multi-billion dollar question?

More federal funding and services. Rather simple answer. That will not happen and they will not get those vital services, as everything is going to be run like a private business. A terrible business which tells everyone they only need to wait ten to fifteen years for jobs, which of course never eventuates, as public infrastructure and facilities are instead provided to large private companies, removing access for local communities that once utilized those services to travel – or to store and transport their produce and goods.

Instead, small businesses and farms will be forced to turn to private solutions, increasing overheads and reducing the overall income, employment and economy of local communities.

These small businesses and farms will either close or be absorbed by the larger outfits. Lenders, insurers and outlets will close local branches, further constraining options.

Escape for some will become impossible, foreclosures inevitable, as resources are stripped and the profits diverted away from the local area – rather than invested in its future.

As these people are poorly informed, many do not realize that it already happened. Perhaps it may explain though why many of them are rather unhappy and looking for someone to blame.

John Freeze April 17, 2025 5:20 AM

I am fully with PHK on that topic:
https://fosstodon.org/@bsdphk/114346662385723066

I understand why the “security industry” which feeds of the CVE register is upset about it’s potential demise.

But let’s face it: MITRE’s CVE register was a prototype, built in a world where there were (only!) 231 known security vulnerabilities in total.

We have learned a lot from that prototype.

It has shown us how big the problem is, that the IT-industry will not and can not solve the problem, and how to accidentally create fertile ground for organized crime with good intentions.

Now is the time to throw away the prototype and implement changes which will work.

  1. Full and unconditional product liability for all software.
  2. Mandatory recalls of unsafe software products.
  3. Mandatory open sourcing of all systemically important software. (“OS”, not “FOSS”)
  4. Mandatory independent 3rd party review of all systemically important software.
  5. Mandatory reporting to independent accident investigation authority, with law-given full access to all aspects.

Clive Robinson April 17, 2025 10:16 AM

@ ResearcherZero,

With regards,

“As these people are poorly informed, many do not realize that it already happened. Perhaps it may explain though why many of them are rather unhappy and looking for someone to blame.”

Or chemicals to “take their mind off” or “obliterate the mental pain”

These problems started getting really noticeable back in the 1990’s as the fall out of “freemarket” nonsense of “Mad Maggie Thatcher” UK PM and “Ronnie the ray gun” US President “love-in” of the “Big 80’s”

It effectively ended the “progressive progress” that had been the US Way since the 1930’s that had brought jobs and personal wealth to individuals and lifted them from dirt poor “share-cropper” serfdom to middle-class life styles.

Ronnie was followed by Georg H W and they set forth what some called Conservative ideals of Corporatism and Globalism where wealth was legally forced to go only one way, which was up into just one or two pockets and the social divide became a gaping chasm. Workers were systematically robbed of all rights and changes in the legal system put redress beyond all but a few.

The education system also became changed and children were actually indoctrinated to believe the Conservative Nonsense that the “self entitled” spouted to keep the reality of their actions from their door.

Such mental deficit from indoctrinated cognitive bias does cause mental schism, that whilst not recognised as schizophrenia can cause sufficient mental anguish and pain that substance abuse via alcohol and tobacco start. The results are the epidemic of obesity and unfitness that causes work injuries. As I’ve mentioned vefore the US Health Insurance scam is about two things, making obscene profits and pushing obscenely priced pills so big phama profits. So when a person comes in with a work related strain or injury all that is allowed is a quick patch-up and repeat handfuls of pills that quickly become ever stronger “pain-relief” not the rest and physio that’s actually needed. At some point the pain relief vecomes a “Central Nervous System”(CNS) depresent, which stops “pain felt in the brain” thus gets rid all be it briefly of the schism based mental pain. At which point a sizable number of people become addicts to prescription tabs. Hence the US has one of the highest if not the highest death rate in the world by prescription substance abuse.

As basic economics tells you markets are formed by demand and the price by supply. The only way to kill a market for a given good is to remove the demand. Thus the “tariffs” are never ever going to solve the demand issue, in fact it will make it worse and way more profitable for a select few.

What however tariffs do do is bring in tax to put in certain “self entitled peoples” pockets and control stock market instability such that ordinary peoples savings for acquiring a home, Higher Education for their children, and a pension for old age are in effect stolen and by the market manipulation end up in certain very favoured pockets with spare change for very unhealthy Mar-a-Lago Dinners at a $million a head and 1/4million for a World Economic Forum membership for Davos meet ups.

Who? April 17, 2025 4:07 PM

@ John Freeze

1. Full and unconditional product liability for all software.

I certainly agree to this point. I would say more, full and unconditional product liability for all software [and firmware!], with security updates for at least two decades.

I am more worried about firmware than about software, as we can choose open source projects whose support is superb. The way manufacturers (all of them, including Dell, HP, and Lenovo) manage firmware, a component that cannot be patched at the operating system level is, at least, blameworthy. Not to say, not providing the ability to completely disable componets like Intel Management Engine and AMD’s PSP turn these platforms into unnecessarily insecure devices.

ResearcherZero April 17, 2025 11:55 PM

@Clive Robinson

I just pop into my nearest Fulfillment Center for a frontal lobotomy. Though there is scant evidence this improves anyone’s mood, the marketing and brochures are fantastic.

I was thinking about Margret Thatcher and the 1980’s myself. More along the lines of how a bunch of dodgy chaps in suits ripped-off the savings of many and shot through, but I don’t think it is the appropriate time to delve into that particular can of worms. Americans tend to overreact about everything – which is probably why they require medicating.

Employee well-being is falling.

‘https://hub.jhu.edu/2024/08/29/national-decline-in-workplace-well-being/

“technological advancements have accelerated a paradoxical transformation of the domestic job market, driving innovation and economic growth while eroding professional roles”

https://sites.lsa.umich.edu/mje/2025/01/10/will-innovation-no-longer-fuel-the-job-market-how-current-automation-is-affecting-employment-in-the-tech-industry/

A principal source of confusion is the difference between jobs and output.
https://www.latimes.com/opinion/story/2025-03-27/american-manufacturing-jobs

What do statistics demonstrate about American manufacturing?
https://itif.org/publications/2024/11/04/dont-worry-about-manufacturing-jobs-worry-about-manufacturing-productivity/

Automation is the primary cause of manufacturing job market decline.

https://www.forbes.com/sites/jackkelly/2020/10/27/us-lost-over-60-million-jobs-now-robots-tech-and-artificial-intelligence-will-take-millions-more/

ResearcherZero April 18, 2025 12:07 AM

But what has that got to do with an enormous backlog of CVEs, reduced funding and staffing and country bumpkins?

If you cut the funding to services which keep employees functioning (like healthily and s–t), reduce their quality of life and over-all income, you get sick and unhappy workers.

Then use your imaginations to figure out what happens after that. 😉

burned-out employees

‘https://www.gallup.com/workplace/658235/why-americans-working-less.aspx

“The majority of manufacturing firms in the United States are quite small.”
https://nam.org/mfgdata/facts-about-manufacturing-expanded/

Yes. (not sarcastic)
https://news.harvard.edu/gazette/story/2025/01/is-small-thinking-the-new-american-way/

Clive Robinson April 18, 2025 5:11 AM

@ ResearcherZero,

Think small profit fast

It’s not just “thinking small” that creates NIMBYism…

The basic model of price by “supply and demand” says if you have a “good” you can artificially increase it’s value by curtailing or significantly reducing supply below demand.

As you can then “borrow” against the good you hold as it’s an “asset” it’s in your financial interest to block all other housing development.

There was a time in the UK and other places where people were daft enough to do “home equity release” by remortgaging over and over then spending the money on cruises and other “no retained value” services.

Thus when interest rates rose, and house value increases stopped dropped they were caught in homes they could not sell, nor afford to pay the interest, let alone the capital of their remortgage.

Others a little wiser remortgaged to by further homes that they then “rented out” using the rent to pay both the interest and the capital and in short order actually getting an “unearned income” to live on for retirment etc as well as have assets to pass on to children etc.

The down side of this more prudent behaviour is that rental costs per month went up way beyond 50% of the earned family income, in effect creating artificial poverty.

This too reduced “national fertility”. It used to be common in the US to have around five children in the early years of marriage. Now not only are people not getting married they are not having children or only one per couple.

The result is the US fertility rate is heading significantly downward… add in the other figures I mentioned earlier for early demise and the words “free-fall” and “tail-spin” become associated. As we know this has “knock on effects” that appear fairly violently when mixed with leader ambitions of certain types of authoritarians.

In the UK the current encumbants appear to think that putting massive tax loading both local and national on people who own more than one home will bring out rainbows and unicorns and all will be right in the world…

It won’t for the simple reason people are living when they can as “official singletons” even though “unofficial couples with children” thus demand for traditional homes is actually “ever higher” especially in certain places[1].

The only solution is to build new and sustainable housing but for the above reasons and one or two other profit reasons it’s not happening[2].

And this has very real security implications.

In part we see a significant rise in faux-investments robbing people of their savings for buying a home, educating their children, and having a modest income in old age. This in turn causes the likes of crime to rise on the “Willie Sutton” principle[3].

But consider the rise in online financial “cyber-crime” and the fall of traditional “street-crime” and burglary etc. Depending on who’s figures you compare it’s been said that ransomware and similar are now up with credit card fraud.

But as in a finished good has a supply chain so does financial crime and faux-profit

The thing is this “faux-profit” works the same way as “taxes” and “tariffs” it ends up in the pockets of a “chosen few” via faux-market rules and regulations…

Thus the people that can least pay, pay the most, and the significant profit goes to the very few that least need it. And thus security becomes an issue

Because the result of this is as I’m sure many have now noticed is increasing “civil disquiet” if not actual unrest. And it’s not going to get any better when those duped by authoritarians realize they have been had/robbed.

[1] I have a friend who works “freelance since lockdown” they “divorced for tax reasons” amicably… So the wife got one house the husband the other, they now have two children –and a third on the way– who officially live in the house closest to the best schools for their age range but the Ex has “visitation rights” so they also live in the other house for part of the time. It’s not illegal to do this it’s just “playing the game the system forces” on people.

[2] When young not only did I get my “electricians tickets” I also taught the subject and still as a favour “coach people”. However I nolonger practice as an electrician primarily because I’m medically “unfit” but also because I would have to pay around £3000 each year to be “registered” with politically enforced trade bodies and local authorities in whose areas I might work. Thus “doing the odd job” as a favour to friends etc as I did long ago would cost me a lot of money. So by supply and demand the price of “trades work” has escalated (but those employed by companies have had their wages held static for over a decade now).

[3] Famously the bank robber Willie Sutton when asked why he did it by an FBI agent allegedly replied,

“Because that’s where the money is.”

This “go where the money is” principle is also known as “Sutton’s Law”. And it’s why cyber criminals do what they do as ransomware etc.

Dr. Weewil April 18, 2025 9:31 AM

@Doug
If only the voters had known how bad Shitler was going to be. If. Only.

But that is the problem with democracy. Same as with those background checks for gun ownership. They only tell you if someone has done something in the past. Future results not guaranteed. Plus the proletariat suffers from bad memory syndrome, always looking for some candidate to be “The Solution”.

Clive Robinson April 18, 2025 11:29 AM

@ Jed, ALL,

With regards,

“Elon Musk did not advise against this?”

My guess is,

Either his alternative plan is more profitable, or

“Why would he when he’s busy swinging his tool around, whilst singing the Lumberjack song”[1]

[1] Python the programming language is named after six of the Cambridge University “foot lights” performers who be came “Monty Python” amongst other things they did song skits. Two of the most famous of which are,

1, The lumberjack song, https://m.youtube.com/watch?v=pfRdur8GLBM

Listen to the words some are quite appropriate for Hellon Musk

And for the rest of us a little antidote to the current madness of life,

2, Always look on the bright side of life, https://m.youtube.com/watch?v=X_-q9xeOgG4

Read the comments underneath it and you will find out why for some of us it has special memories from back in 1982 and later.

It’s also kind of appropriate for this weekend if you’ve seen “The Life of Brian” you’ll know why.

Clive Robinson April 18, 2025 1:54 PM

@ ALL,

The Musk snout in the trough is worse than a camel’s nose under the tent flap for many in the EU.

It’s not just the flip flopping of is a service going to be there tomorrow, or tarrif nonsense.

What’s making them nervous is Musk’s cavalier attitude to others data and his DOGiE Mutts just copying updating and deleting data they have no lawful reason to be anywhere near let alone playing with.

Oh and one of the DOGiE Mutts being involved rut up past their “dog balls” with attempted access from Russia is really upsetting some.

Thus the recent intrest on “on shoring” data back into Europe.

Europe’s cloud customers eyeing exit from US hyperscalers

https://www.theregister.com/2025/04/17/us_hyperscaler_alternatives/

“[T]he topic dominating conversations at April’s KubeCon EU event was what to do about events unfolding in the US. Even before the recent flip-flopping over tariffs, users were already questioning whether including US-based hyperscalers in their supply chain was necessarily a good thing.”

Many felt not, not even at much much lower cost. As was observed,

“Price is not everything when you need to survive hostile intent.”

As further indicated of the US Corps,

“because these people have a stranglehold on the business critical infrastructure that they [the customers] need in order to be successful.””

But most know the two who are having the finger pointed at them,

“[Nextcloud] CEO Frank Karlitschek attributed this not just to the Trump effect but to the actions of the US administration overall.

There are three factors,” he told The Register. “The first is really the unreliability, because we see what Trump is doing and the danger is that things will be just switched off from one day to another for negotiation purposes. Then we see the whole question around pricing with the tariffs.

And then the other thing is really the espionage factor. This is relatively new and surprising to me … but now you see what Musk is doing, that you can access really confidential databases … I think this is a realistic fear nowadays.”

Hmmm this could put a serious crack not just in the Nine-Eyes but even UKUSA as the Five-Eyes are already cracking up with Canada taking defence against the US in particular. But also Australia and New Zealand being increasingly economically alined with China, for obvious reasons.

Clive Robinson April 18, 2025 2:41 PM

@ Bruce, ALL,

With Mitre’s CVE’s program going from flat-lining to an irregular flutter hooked up to a “crash cart” with low battery atleast three others have popped into view to take over.

Interestingly the one set of people I would expect to take an interest the UN ITU appears mute on the subject.

The simple fact is like it or not we know Mitre kept things out of the database for domestic reasons. So we can not trust CVE under a single national-political entity. The Internet like the phone network encompasses the entire globe and liked or not the ITU has in effect a century of internationally regulating telecommunications.

In that period the technology has gone from barely analogue to fully integrated digital standards for services and their zoning.

It’s now way beyond time for the ITU to take up duties for the Internet. I warned that the ITU meet at Doha back in 2014 was likely to see the Internet fracture, and it came very close. At that time Russia stepped back a little from the line that had been drawn, but we can see they are still moving to “fracture off”.

Whilst CVE appears to be just a flyspec on the map of the Internet it’s actually in many ways one of the “foundation pieces”. In that disliked as it is, in many ways, it does help ensure the security of systems by timely notifications for most people. That is generally they are raised in a timely and importantly orderly fashion so they can be addressed by vendors developers, and likewise mitigations etc made known pending patches.

Yes the ITU being part of the UN does suffer from a lot of politics, but generally the results are equitable without favour or beholdent to any one political interest. Unlike what we have seen with CVE in the past few days.

That said it appears the EU via the “European Network and Information Security Agency”(ENISA) has stepped up in a semi-international way. And due to an upswelling of “get it out from the US” feeling due to the current executive and special advisors calumny and worse I suspect CVE is nolonger the goto repository of vulnerabilities.

ResearcherZero April 21, 2025 4:58 AM

Florida is already a little spooky and a fine place to begin breaching civil liberties via engaging in mass surveillance and spying on the communications of U.S. citizens.

‘https://techcrunch.com/2025/04/17/florida-draft-law-mandating-encryption-backdoors-for-social-media-accounts-billed-dangerous-and-dumb/

The bill specifically targets all minors so that the government can read their messages.
https://www.eff.org/deeplinks/2025/04/floridas-new-social-media-bill-says-quiet-part-out-loud-and-demands-encryption

Clive Robinson April 21, 2025 3:30 PM

@ ResearcherZero,

With regards Florida and,

“The bill specifically targets all minors so that the government can read their messages.”

It does not take much of a guess to work out which idiotic “dumber than a stump” political persuasion those behind it are and they should quite rightly “be outed” for what they are.

But the argument in the proposed bill,

‘that it would require “social media platforms to provide a mechanism to decrypt end-to-end encryption when law enforcement obtains a subpoena.”’

Is actually quite pointless. I’ve posted several times to this blog why it’s actually “not possible” to do, when talking about “deniable encryption”.

Claud Shannon pointed out that is each bit in a stream cipher “key stream” was “fully independent” –ie truly random– then,

“All messages were equiprobable”

Under that length of “key stream” / “Key Material”(KeyMat). Or to say it another way the system had “perfect secrecy” providing certain measures were taken.

Now you can have such a system using Pencil and Paper and it’s quite frequently called the “One Time Pad”(OTP).

A slight variation on it I’ve mentioned before makes the “cipher text” look indistinguishable from “plain text”.

This is down to the work of both Shannon and later Gus Simmons.

You can also extend it another way to give “originator deniability” thus give protection against 2nd Party betrayal to a third party (due to the “all messages of the same length are equiprobable” property).

Thus two smart and cautious pre-teens onwards could send messages of short length by employing the techniques.

The problem is that even with “perfect secrecy” in the communications path between the “security end points” the system may very well not be secure.

The reason for this is if both the “communications endpoint” and the “security endpoint” are both on the same device an attacker can install a “shim” or similar in the User Interface on the user device. Thus alowing an “end run attack” or what has recently been called a “See What You See”(SWYS) attack on the decrypted plain text. This is also known as a User/Client side Device Attack.

Apple but the base mechanism for SWYS into their OS several months back and claimed quite incorrectly it was for finding CSAM. The simple fact was shown that not only could it be “falsely triggered” it could easily be “bypassed” but worse any file could be scanned including looking for “Persons of Interest” in photographs and the like.

The obvious solution to this is to,

“Take the ‘Security end point’ and ‘User Interface’ ‘Off Device’.”

As well as,

“Use only ‘True Random Bit Generation’ to make the ‘KeyMat'”.

And I’ve talked about how to do this several times in the past here, as have one or two others.

My view point is the more people that know how to do this, the more privacy we all get.

As for CSAM we already know that purveyors of such unpleasantness already know how to get around “SWYS” scanning and the like. So the legislation is not going to catch “the nasty people”.

But it will catch teenagers doing dumb things which is the real purpose behind the legislation.

Criminalise dumb kids, which then prevents them voting for the rest of their lives, or getting decent work or work at all.

Then of course other legislation will be introduced to deny them other rights, like owning assets like homes or vehicles etc. Perhaps even the right to have children (as was the case less than a century ago) by compulsory sterilisation.

just me April 22, 2025 8:39 AM

@John Freeze

Are you ready to pay 1000$ for MS office? Because guess who will pay for all the mandatory liability, recalls and the other stuff. Risk and cost of SW development will raise exponentially and so will the price of end product. It will also destroy smaller SW companies and technically lock-up SW market into a form of quasi-monopoly.

Echo of past arising April 22, 2025 10:52 AM

@just me

Because guess who will pay for all the mandatory liability

This has been said about every type of product legislation to protect consumers that has ever been put toward being turned into legislation.

Guess what?

The legislation happens and the market usually continues with little or no economic change as far as the consumer sees. But consumers do tend to get better products and redress against disreputable suppliers like HP, Google, Microsoft, etc.

I guess some people don’t learn about basic economics, or they don’t bother actually checking.

Remember all that nonsense from Silicon Valley Corps over the EU GDPR?

How many of those companies actually changed for the worse in the way you claim?

I’m sure you can go look it up.

ResearcherZero April 23, 2025 6:32 AM

@just me, ALL

Libre Office is completely free, is fully compatible with Office and far better privacy.

But the general idea is that the public pays for everything, all costs are passed onto consumers one way or another and your hard earned tax dollars are awarded to contractors.

Once everyone is dogged by disasters, disease, unemployment and missiles, no-one will have time to worry about vulnerabilities and the latest zero days. The local radio station may get cut, so even if there was an emergency weather warning available you will not hear it.

There will be no more annoying public reporting about what ever scam is running next. Cuts need to be made to fund the fantasies of the extremely wealthy if they are ever going to build their own little floating cities that operate like private nation states.

Musk is the front runner for Star Wars 2.0 grift scheme named “Golden Dome”.

‘https://www.reuters.com/business/aerospace-defense/musks-spacex-is-frontrunner-build-trumps-golden-dome-missile-shield-2025-04-17/

You know the basic plot, you have seen it on the Simpsons. Fat Tony successfully extorts a large sum of money from Springfield Elementary School, forcing Principal Skinner to close it down. However, a toy company called Kid First Industries, led by Jim Hope, later buys the school and privatizes it.

The future is up for grabs – and the public will have to pay for that vision. Elon Musk already received $100b in government contracts as a result of campaign contributions. The technocrats plan to build their very own thiefdoms – where algorithms, AI and digital surveillance replace democracy, individual liberty and the free market. 🙁

https://www.businessinsider.com/elon-musk-doge-cuts-federal-worker-firings-government-plan-2025-4

The Golden Mirage will cost an awful lot, deliver naught and accelerate an arms race!
https://aerospaceamerica.aiaa.org/features/golden-dome-smart-strategy-or-risky-business/

So much dirty money is sloshing around, scammers are now targeting the politicians! yay 🙂
https://www.opensecrets.org/news/2025/04/fraud-alert-thieves-just-stole-big-money-from-a-dozen-politicians-and-political-committees/

ResearcherZero April 23, 2025 6:55 AM

Private floating city states are not my cup of tea, but think of the benefits.

You will never lose your car keys because the chip will be inserted into your body. You will never get lost because something will always be watching. If you cannot pay the rent there will be an appropriate social credit scheme, where you can make up for it in rubbish disposal, slaving away washing dishes and cleaning up after the premium class of tenants.

Once your contribution to society is finished your body can contribute to the nutrient pool needed to supply the vertical gardens that supply the floating city states. The entry price might be a little excessive – but the exit price will cost you nothing. The space you once occupied will be sold to the next highest bidder looking to escape the American wastelands.

‘https://apnews.com/article/recession-imf-economy-tariffs-5ec37492c9fac499923c094776b87552

ResearcherZero April 23, 2025 9:40 PM

To be serious, there are very real issues for real people.

Farming communities will be smashed as prices tumble and markets for crops vanish.

‘https://www.nbcnews.com/politics/economics/farmers-face-steep-losses-middle-trumps-trade-war-funding-cuts-rcna195967

12 states are suing Trump over the economic fallout caused by tariffs.
https://www.cbsnews.com/news/states-sue-trump-over-tariffs/

As American agricultural input and equipment costs rise, China is looking to open new markets in places like Latin America and sourcing its produce requirements elsewhere.

https://www.nytimes.com/2025/04/20/business/tariffs-china-us-farmers.html

“We don’t have any margin for error. …We’re going to lose a generation of young farmers.”
https://www.politico.com/news/2025/04/04/farmers-tariffs-trump-trade-war-00271146

ResearcherZero April 23, 2025 10:02 PM

@Clive Robinson

Basic Signals skills, circuit design, transmitter assembly is all fairly easy once people understand the principles and get a little practice at it. There are starter kits too for the uninitiated and beginner kits for children to teach the basic skills of electronics.

OTP should be basic education for all primary school children. It is a critical communication skill, along with operating a radio. Putting up a mast might be a little outside the normal school curriculum, but doing it safely should also be taught. Many farm kids already know the basics of operating a radio and handling farming equipment. Securely receiving and decrypting messages from their friends would also be a lot of fun.

Children are going to need some healthy distractions to keep them entertained.

…Floating cities and Star Wars is obviously all horse manure.

There will be no floating cities in space or on the ocean. There will be no “Star Wars”. This is a land grab, a resource grab and a money grab. It is purely to ensure the homes and investments of some are not threatened by changing economic conditions, or threats like fire and flood. That they themselves are above the metaphoric “water line”.

Up to 40 per cent may be lost from the global economy over the next 75 years. In order to make up for that loss, drastic changes are being made. The prime cuts of the fat American hog were selected long before it began to be butchered. A series of suitable distractions have kept the public transfixed while this took place. The innards and the guts (public health, public education, public services), are being tossed aside.

Many do not stop to wonder about the origins of homelessness. As small businesses fold, suitably located holdings will be acquired. Lands seized if necessary. They have the right officials in their pocket for it when they need to put the screws in. Once enough people fear for their own livelihoods, they turn a blind eye to their neighbour’s peril.

Peter Theil reshaped Republican priorities to mirror his own interests. There will be no public housing plan for the elderly women or families who can no longer pay the bills.

‘https://www.techtarget.com/searchCIO/news/366618242/Venture-capital-ties-could-shift-US-government-policies

Enormous wealth lays beneath farmlands. Getting it out means pushing the rural folk aside.
https://www.brennancenter.org/our-work/analysis-opinion/moneys-control-over-politics-has-never-been-greater

Money buys access. It also allows for pay-to-play schemes and insider information.

https://sms.onlinelibrary.wiley.com/doi/full/10.1002/sej.1374

Leave a comment

Blog moderation policy

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.