Hacker News new | ask | show | jobs
by kbumsik 16 days ago
Why own numbering instead of CVE?
2 comments

It lets organizations (Tailscale) control the timing and narrative around the disclosure more directly. Organizations sometimes avoid the bureaucracy of going through CVE Numbering Authorities by self-publishing. Often a CVE assignment follows self-disclosure, especially when there's pressure to interoperate with vuln-scanning/compliance tooling
And sometimes it’s just impossible to get a CVE number in a reasonable amount of time, or indeed at all.
In my experience it is really very quick and easy to get a CVE if you contact MITRE directly, and on paper you do not need to disclose too much. The GitHub CNA is (ironically) very slow by comparison but that is a GitHub issue.

Tailscale can also just apply to be their own CNA and issue CVEs for their products themselves, eliminating any such issues entirely.

Some reasons why an org might want to become their own CNA: https://daniel.haxx.se/blog/2024/01/16/curl-is-a-cna/
To be clear creating your own custom IDs isn't the same thing as being a CNA, but some of the motivations are the same.