Post #3827888

2026-07-15 00:31 UTC

@adulau@infosec.exchange Huh, I see. Perhaps it will prove to be academic but I do wonder what the downstream reader is supposed to do when two or more publishers disagree in part or in whole on some advisory. @westonsteimel@hachyderm.io @gcve@social.circl.lu

Replies (1)

@westonsteimel@hachyderm.io 2026-07-15 08:01

@darakian@fosstodon.org @adulau@infosec.exchange @gcve@social.circl.lu Yeah, I get that it is a quite different approach than we have been used to, but I am optimistic it can work. We shall see. I did just add a comment to the proposal around maybe offering a view in future for those that want to trust the community curations that auto-merges them with the 0 GNA records to present a unified CVE view so that all consumers don't have to reimplement that logic. But if a particular consumer disagrees with even that view for a particular record then yeah the solution is to fork to their own namespace with an opposes or equals relationship and then prefer that data in their own feeds. I do understand the concern though, and I know you have a lot of experience with this, so I think we all really appreciate the feedback.

Open ##3827887