[Incipient]

Basically when any software/library/whatever has a vulnerability, they have to communicate that out themselves, in some format.

If I'm developing a product built on 20 libraries, it won't just be a matter of scanning CVEs for major vulnerabilities any more, so I'm more likely to miss one.

"always update" doesn't always work, when to manage a product you realistically have to version pin.

[worthless-trash]

So, while arguably true, there wont be a single source of truth of new cve's. It doesn't however mean there wont be.

I would imagine the only SANE option would be some kind of git repository where CNA's can collaborate. Probably run some code across to make the website that people can easily access.

It's going to be a mess.

[cantrecallmypwd]

They surprise is: they won't. This will weaken the West.

This is dangerously stupid.

[t0lo]

This is deliberate. I just want to figure out the avenues of communication and coordination between trump admin and moscow so we can pin them down better.