this post was submitted on 16 Apr 2025

361 points (98.4% liked)

Technology

69421 readers

2460 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related news or articles.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago

MODERATORS

L3s@lemmy.world

enu@lemmy.world

technopagan@lemmy.world

L4s@lemmy.world

L3s@hackingne.ws

L4s@hackingne.ws

361

US Government Almost Kills Critical Cybersecurity Database (www.techdirt.com)

submitted 1 week ago by cm0002@lemmy.world to c/technology@lemmy.world

18 comments fedilink hide all child comments

top 18 comments

sorted by: hot top controversial new old

[–] sunbunman@sh.itjust.works 37 points 1 week ago* (last edited 1 week ago) (1 children)

The world really needs to work on decoupling their dependency on the US especially for something this vital. This should already have been a UN funded and run program at a minimum.

[–] clutchtwopointzero@lemmy.world 4 points 1 week ago

The UN has too many programs to handle and a limited budget

[–] sfxrlz@lemmy.dbzer0.com 19 points 1 week ago

It’s the fascists playbook but the fucker can’t read properly.

[+] giacomo@lemm.ee -26 points 1 week ago (3 children)

can they put cve on a blockchain? or some publicly auditable distributed database?

its worrisome that all it takes is a funding cut to shut it down.

[–] echodot@feddit.uk 37 points 1 week ago (1 children)

Oh yes blockchain the solution to the world's problem. Provided the world's problem is that the current solution works too well and we don't like that.

We need to back this data up but that doesn't require anything anywhere near as complicated and over-engineered as blockchain, we can just have something as simple as multiple servers.

[–] giacomo@lemm.ee -5 points 1 week ago (1 children)

That works too, but who controls the servers, and how is the authority handled? Backing up the data is one thing, and that can be easily done I believe. But what about for future advisories? They are published via one of the authoritative servers and synced to the other authoritative servers? How is that information verified to ensure bad actors aren't publishing bullshit information?

I don't think blockchain is necessarily the answer. The whole thing can just be done with signing keys, yeah?

I know everyone hates on blockchain, but I think its kinda neat and would like to see some cool applications with it one day.

[–] echodot@feddit.uk 6 points 1 week ago* (last edited 1 week ago) (1 children)

That's an easy problem to solve you just hash the database. Blockchain is good at solving the problem when you don't have a reliable central authority but if you do have a reliable central authority there's no point adding blockchain to it.

And we already have the reliable central authority, we have the original database.

[–] valkyrieangela@lemmy.blahaj.zone 4 points 1 week ago (1 children)

Doesn't block chaining a massive database like this also open the doors for bad actors to insert BS entries to the chain, or making illegitimate copies of the chain and redistributing them as a "genuine" copy? My understanding is that the chain may be genuine but the human readable data attached to it could be falsified, so it may be unique but it would be useless or malicious.

[–] echodot@feddit.uk 2 points 1 week ago

Exactly, blockchain technology doesn't do anything to prevent people from just straight up lying. I've heard people suggest that blockchain could be used to create a distributed Wikipedia, and somehow it would be immune to trolls because "blockchain".

Also blockchain is susceptible to something called a 51% attack, where if you can compromise more than half of all of the nodes then the illegitimate version becomes the trusted version over the legitimate version, without ever having to compromise the original version, (because 51% of the vote is 100% of the control). The only reason that doesn't really happen with cryptocurrencies is that there are so many people who use cryptocurrencies that the numbers required to pull off at 51% attack would be unachievable even for a nation state.

However I can't believe that this database would be anywhere near that distributed so a committed actor could very well achieve a 51% attack.

It's not as if other nation states don't maintain their own versions of this anyway (it would be stupid to trust the United States exclusively even if it weren't for Trump), as do a lot of the cyber security companies. So it's not really a problem anyway.

[–] elvith@feddit.org 19 points 1 week ago

And a blockchain helps to solve which part of the problem? Some were working on mirroring all data to a git repository. In theory, that allows for easy access on all the data, versioning (with commits) and - through forks and merge requests - collaboration and distribution. Also git is a distributed repository that clones the whole history to your local drive.

https://github.com/MITRE-Cyber-Security-CVE-Database/mitre-cve-database

But with the announcement of the cve foundation, I don't know whether they will really import all the data in this git repository.

[–] elrecoal19_1@lemmy.world 5 points 1 week ago* (last edited 1 week ago) (1 children)

...and what is gonna keep it up if it goes to the blockchain? Air? Do you think they won't need funding on the blockchain? Lol

[–] giacomo@lemm.ee -2 points 1 week ago (1 children)

[–] elrecoal19_1@lemmy.world 2 points 1 week ago (1 children)

That's delusional as fuck

[–] giacomo@lemm.ee 0 points 1 week ago (1 children)

what, that I do not think that?

what are you trying to argue?

[–] elrecoal19_1@lemmy.world 3 points 1 week ago (1 children)

Your response read as "No, they wouldn't need funding" lmao

[–] giacomo@lemm.ee 1 points 1 week ago (1 children)

oh no.

You asked me "Do you think they won’t need funding on the blockchain?" No, I don't think that.

I do think they need funding.

[–] elrecoal19_1@lemmy.world 2 points 1 week ago (1 children)

How is the blockchain gonna solve that then? If anything it will make it more difficult since even more people don't know how blockchains work than people who don't know how regular web works.

[–] giacomo@lemm.ee 1 points 1 week ago

I do not think blockchain would solve any funding issues. Its more so about the information and it's validity in a decentralized network. I realize blockchain is almost exclusively associated with cryptocoins, but it seems like there should be other use cases for the technology. It would be cool to have a centralized ledger of CVEs where the information is agreed upon by partners; be it various vendors, governments, and institutions.

I am definitely not a blockchain expert, or even a novice. I'm probably closer to the people that don't know how the regular web works. With the rise of de-centralized/federated social media an communications, I'd think people would be interested in a similar framework for something like the CVE database. I'm not say blockchain is the answer for this issue either, it was just an idea. An idea that people are not big fans of apparently, and that's fine. I think a different commenter mentioned using git, so there's another idea.

Regardless of the method, I see de-centralization as a benefit and hopefully other do as well.