Resurrecting DWF

> The CVE project seems to feel differently, as it put out a tweet disavowing CVE IDs that do not come from the CNAs. CVE board member Tod Beardsley also filed a pull request to change the identifiers to DWF-xxxx-yyyyy, which "will disambiguate vulnerability identifiers sourced from the DWF project from those produced by the federation of CVE Numbering Authorities, and avoid any confusion in downstream users of these identifiers".

I have no sympathy for the CVE project here. It sounds like they had every opportunity to fix this problem, and utterly failed to do anything effective. The concept of "fill out a web form, get a CVE ID" is not exactly novel.

If they had instead announced that, starting tomorrow, they were going to adopt the DWF approach and deprecate the whole CNA system, I might feel differently. But that's not at all what their tweet says. Indeed, it doesn't even properly acknowledge the existence of DWF, instead referring vaguely to "CVE IDs obtained in some other way [than from a CNA]."

Unfortunately, there's a good chance this ends in some sort of ugly legal battle over trademarks. Which is a crying shame, seeing as there is a blatantly obvious way for the parties to compromise:

* DWF agrees to operate as a "real" CNA, and not a rival organization. It issues "real" CVE IDs and complies with most or all of the CNA requirements (whatever those are?).
* CVE agrees to let DWF issue enough "real" CVE IDs to fulfill their stated purposes, perhaps giving them larger or more blocks of CVEs than most CNAs get, and/or leeway with respect to other CNA requirements (to the extent that those requirements would otherwise interfere with DWF's structure, goals, or finances).

A good compromise leaves everyone unhappy, of course, but it's better than litigation. In my judgment, this is primarily CVE's mess to clean up, so I'm intentionally biasing this compromise in DWF's favor, but of course reality may result in a less equitable outcome.