Re: CVE program priorities

[Art Manion <amanion@cert.org>]

On 2015-12-29 14:56, Art Manion wrote:
> I'd like to suggest a step back (or possibly up) and ask if the Board
> (and other interested parties?) would be willing to focus first on
> problems/issues with CVE before getting into solutions.
> 
>   "Do not propose solutions until the problem has been discussed as
> thoroughly as possible without suggesting any."
> 
>   http://lesswrong.com/lw/ka/hold_off_on_proposing_solutions/

Having given it some more thought, and with some hope that we'll convene
an in-person meeting, I'd like to step back even further to what I'll
call use cases.

What is CVE used for, by whom, and how?

There is more than one answer, there is probably a "when" aspect too
(use cases change over time), and we may not know all the use cases or
be able to predict future ones.  Nonetheless, having some idea (and
agreement) on what CVE is for makes the discussion about problems
actually meaningful.  To have a problem, there is a (possibly assumed)
use that isn't being met.

So use cases, problems, solutions is the order I'm proposing, and this
should frame our in-person meeting, and even work leading up to the meeting.

Regards,

 - Art

PS, if you think I'm a process nut, I'm really not.  But I've seen
enough complicated, multi-party discussions to know that without some
process/framing, we're all spinning our wheels.