Panel Discussion: This One Time at CVD Camp
summary
Open source projects becoming CNAs (GitHub/Red Hat cited) drives a real influx of IDs and the panel names 20–25% yearly CVE growth as baseline, urging automation and CVE Services adoption; SBOMs and better feeds shorten response time but do not cure coordination. Pain points include reserved but unpublished CVEs that block triage, disputed CVEs that can remain final, NDAs/bug‑bounty terms that exclude maintainers, export‑control roadblocks, and a scaling collapse unless protocols like Voltron reduce human toil.
AI-written summary · about
chapters (16)
- 0:00CVD Camp introduction
- 1:04Panelist backgrounds
- 3:55Open source projects becoming CVE Numbering Authorities
- 8:58Why groups become CNAs
- 12:53GitHub as root CNA
- 15:00Disputed CVEs and prioritization
- 18:28Researcher reports and public IDs
- 24:56Third-party code CVEs
- 25:37Supporting open source maintainers
- 28:27SBOMs for CVD problems?
- 31:38Barriers to CVD improvement
- 39:47Financial and political factors
- 44:00Setting disclosure expectations
- 47:33Human element in CVD
- 49:18Worst CVD moments
- 56:03Closing remarks and Q&A
related talks
01h 04mOpen Discussion - International Challenges with CVD, CNA, and CVE
51mCNA Birds of a Feather: Open Forum with Certified Numbering Authorities
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
45mFuture of CVE
56mCISA’s North Star Vision for the CVE Program
01h 00mThe CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data
35mKeynote: How I learned to stop worrying and love CVEs
17mThe Hidden Cost of CVEs: Can CSAF and VEX Change the Equation?