[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: CVE ID Syntax - Seeking Suggestions for Outreach

I will also help through my social and media channels to spread the word but let me ask this question if appropriate: if all the expanded communication andoutreach to educatethe public succeeds, what does that success look like? Don't know if this is theappropriatetime to ask but I for one like knowing when I have hit the goal line so I can stop running with the ball :-)

On Wed, Apr 2, 2014 at 9:01 AM, Steven M. Christey <coley@mitre.org> wrote:

In recent months, MITRE has been working on public communications for
the CVE ID syntax change. We would like suggestions from the
Editorial Board about how to further expand our outreach and educate
the public.

1) We published more detailed technical guidance for implementers to
find and address issues related to the syntax change:


This page includes some extensive testing data so that
implementations can have confidence that they have sufficiently
addressed the ID syntax. For example, we have lists of dozens of
valid identifiers that could indicate parsing issues (such as
CVE-2014-2147483648 for triggering 32-bit representation problems),
and hundreds of invalid identifiers, some of which were drawn
directly from real-world requests to the CVE web site.

2) We have also been gathering contact information for CVE-compatible
vendors, and we expect to email them shortly. However, it's likely
that many of our contacts are from the marketing side of the
organization, so we might not always reach the right technical

3) We continue to periodically remind the public of the syntax change
through the cve-announce mailing list, Twitter, and LinkedIn.

4) We have been making syntax-related code changes to our own web
sites and internal processes. For example,
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1012 now
provides a custom page that educates consumers about potential
truncation problems and the ID protection block, and
provides more specific error messages when CVE IDs are malformed.

5) We have mentioned or focused on the syntax in talks that we've
given, especially in the last year, and will continue to do so. We
are also considering offering a webinar.

Despite these efforts, there are indications that we are not reaching
everybody who needs to handle the change, especially the developers of
CVE-compatible or CVE-using products.

There also seems to be little press interest, as the syntax change is
probably regarded as "old news."

We would like suggestions from the Board about how we can reach the
right people.

For example:

* Are there Board members who are willing to announce the change
and/or post educational material to their customer base? If so,
what form would be the most useful - PowerPoint slides, a web page,
newsletter, webinar, etc.?

* Would it be effective for us to encourage implementers to announce
when they have achieved "compliance" with the new syntax, and then
publicize these vendors? Would this be useful in fostering some
competiveness to drive organizations to a resolution?

* Are there ways that we can help customers to directly engage with
their vendors to ensure that the issues are addressed? We have not
yet directly emphasized customers in our outreach, but they might be
the most effective in contacting the right people within the vendors
and getting resolution.

Any other ideas or suggestions are welcome and encouraged!

If there is sufficient interest or need, we could have another
Editorial Board teleconference that is focused on this topic.

Thank you!

- Steve


Tim "TK" Keanini
mbl 415 328 2722
twtr @tkeanini

Page Last Updated or Reviewed: October 03, 2014