FAfanf2·Feb 6, 2018Submission
DWF CNA registry: distributed weakness filing CVE numbering authorities
1 points · Open discussiondistributedweaknessfiling
dwf-cna-registry
HISTORICAL RECORD2018–2018
distributedweaknessfiling / dwf-cna-registry · Not publicly available
dwf-cna-registry
Discover this repository through its Hacker News conversations.
2Distinct people
2Mentions
0Explicit recommenders
What to know before exploring
What it is
A public description has not been verified.
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:03:16 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by hour2 dated mentions
Observed mentions: 2018-02-06 05:31:13 UTC to 2018-02-06 20:43:02 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| Feb 6, 05:00 | 2018-02-06 05:00:00 UTC | 2018-02-06 06:00:00 UTC | 1 | 0 | 1 |
| Feb 6, 06:00 | 2018-02-06 06:00:00 UTC | 2018-02-06 07:00:00 UTC | 0 | 0 | 0 |
| Feb 6, 07:00 | 2018-02-06 07:00:00 UTC | 2018-02-06 08:00:00 UTC | 0 | 0 | 0 |
| Feb 6, 08:00 | 2018-02-06 08:00:00 UTC | 2018-02-06 09:00:00 UTC | 0 | 0 | 0 |
| Feb 6, 09:00 | 2018-02-06 09:00:00 UTC | 2018-02-06 10:00:00 UTC | 0 | 0 | 0 |
| Feb 6, 10:00 | 2018-02-06 10:00:00 UTC | 2018-02-06 11:00:00 UTC | 0 | 0 | 0 |
| Feb 6, 11:00 | 2018-02-06 11:00:00 UTC | 2018-02-06 12:00:00 UTC | 0 | 0 | 0 |
| Feb 6, 12:00 | 2018-02-06 12:00:00 UTC | 2018-02-06 13:00:00 UTC | 0 | 0 | 0 |
| Feb 6, 13:00 | 2018-02-06 13:00:00 UTC | 2018-02-06 14:00:00 UTC | 0 | 0 | 0 |
| Feb 6, 14:00 | 2018-02-06 14:00:00 UTC | 2018-02-06 15:00:00 UTC | 0 | 0 | 0 |
| Feb 6, 15:00 | 2018-02-06 15:00:00 UTC | 2018-02-06 16:00:00 UTC | 0 | 0 | 0 |
| Feb 6, 16:00 | 2018-02-06 16:00:00 UTC | 2018-02-06 17:00:00 UTC | 0 | 0 | 0 |
| Feb 6, 17:00 | 2018-02-06 17:00:00 UTC | 2018-02-06 18:00:00 UTC | 0 | 0 | 0 |
| Feb 6, 18:00 | 2018-02-06 18:00:00 UTC | 2018-02-06 19:00:00 UTC | 0 | 0 | 0 |
| Feb 6, 19:00 | 2018-02-06 19:00:00 UTC | 2018-02-06 20:00:00 UTC | 0 | 0 | 0 |
| Feb 6, 20:00 | 2018-02-06 20:00:00 UTC | 2018-02-06 21:00:00 UTC | 1 | 1 | 0 |
What Hacker News says
2 sourceshttp://www.openwall.com/lists/oss-security/2017/10/12/2
"-> We have not reserved a CVE for this issue as Apple is a CNA and does not
> see it as a security issue.
>
And here's my main teachable moment.
If a CVE Numbering Authority (CNA) does not grant a CVE to an issue
(whether it be due to "not a bug" or non responsiveness or whatever) there
is a simple process to deal with this. You go to the CNA's parent, a list
of CNA's is currently at:
https://cve.mitre.org/cve/cna.html
in general most current CNA's have MITRE as their parent (we're working on
a federated hierarchy but we're in the early stages), so using the form:
https://cveform.mitre.org/
to request a CVE would be your next step. For the Open Source Distributed
Weakness Filing (DWF) hierarchy each CNA and sub CNA is registered at:
https://github.com/distributedweaknessfiling/DWF-C
Read the rest
NA-Registr...
so essentially you go to the parent and keep working your way up until
either you are satisfied, or you hit MITRE and they tell you to take a
hike, or give you a CVE.
Speaking of which if you are an Open Source project and want to be a CNA,
polease contact me and chances are I can set you up in a pretty quick
timeframe (faster than I assign CVEs because creating a CNA is a much
better ROI of my time than issuing a CVE). ."
- via>" Kurt Seifried -- Red Hat -- Product Security -- Cloud"