|
|
Log in / Subscribe / Register

Resurrecting DWF

Resurrecting DWF

Posted Apr 8, 2021 23:36 UTC (Thu) by cjwatson (subscriber, #7322)
In reply to: Resurrecting DWF by danielthompson
Parent article: Resurrecting DWF

I help maintain a website (launchpad.net) that among many other things imports CVE information from the XML dump provided by MITRE and auto-links references that people make to them from other parts of the site: this means that for instance if people mention CVE-something in a bug report then it's easy to click through to all other bug reports on Launchpad that relate to the same CVE identifier. What should we most correctly do now that there seem to be arguably two authorities for the same namespace?

(This is not a loaded question: I'm not a security researcher nor somebody particularly invested in the existing CVE system. I just want to figure out what we should be doing to track this in case people use these new DWF-issued identifiers on Launchpad and expect them to work the same way, which seems likely. "Use a search engine" isn't an option here: we maintain these links automatically and want to keep it that way.)


to post comments

Resurrecting DWF

Posted Apr 9, 2021 0:44 UTC (Fri) by pabs (subscriber, #43278) [Link] (2 responses)

Presumably just pull in the DWF feed too and link to the DWF advisories when the CVE number doesn't appear in the MITRE advisories?

Resurrecting DWF

Posted Apr 9, 2021 8:30 UTC (Fri) by cjwatson (subscriber, #7322) [Link] (1 responses)

That is certainly an idea I'd already had, but I can think of at least three possible approaches so I was hoping for one of the DWF people to clearly state what they recommend in this sort of situation.

Resurrecting DWF

Posted Apr 18, 2021 20:07 UTC (Sun) by kurtseifried (guest, #57307) [Link]

We provide our data via GitHub, we don't (yet) provide other formats such as a CSV/etc., they lose too much data to be truly useful in my opinion (but if someone wants to make that happen then file an issue to discuss and we'll accept code most likely). Continuous ingestion via GitHub really is the best rather than waiting hours or for a daily snapshot that contains less information.


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds