It really is a shame that funding cuts at NIST has led directly to this. I don't know if there is an incentive for a non-profit to come out of the woods to do the validation and enrichment process, but boy do we need it.
Like gortok has said, LLMs are just probabilistic text-prediction engines. They cannot automate the vulnerability validation lifecycle because they cannot account for improbable edge cases. They may not even get the version of the software right...
Funding cuts at NIST did not lead directly to this. You must be new here or haven’t spent a lot of time directly interfaced with NIST on cybersecurity in decades past.
And NIST’s role with CVE’s has always been purely ministerial/clerical. It has never been their job to do even a cursory investigation into the vulnerability itself.
> Currently, we are prioritizing analysis of the most significant vulnerabilities. In addition, we are working with our agency partners to bring on more support for analyzing vulnerabilities and have reassigned additional NIST staff to this task as well.
The OP described this as "NIST effectively hit pause on deep analysis. "
It does sound like they stopped doing something they used to do in 2024. I personally have definitely not spent a lot of time directly interfaced with NIST on cybersecurity in decades past, I know nothing about it, just what I read in OP.
Are you saying the OP was wrong to call what NIST used to do "deep analysis", and/or that the thing NIST stopped doing was "purely ministerial/clerical" in a way that it would not have caught fake reports anyway, contradicting the OP? Or other?
Again, to be sure, the OP's suggestion was not that this was caused by NIST funding cuts, but by "a massive surge in vulnerability reports,"
The main point is NIST is _downstream_ of CVE issuance. Yes, they can — and still do — add disputed/rejected tags to CVEs, but in many cases by then it's already "too late." The CVE has an ID and a lifespan of its own.
NIST does not and did-not/cannot/never-has unilaterally "retracted" CVEs or prevented their issuance.
But yes, NIST's situation is not good for the world. The services they provide are hugely valuable.
I only know about this what I learned from OP and you guys.
It sounds like you guys think OP was mistaken, whatever analysis NIST was doing that they reduced in 2024 would not have prevented this anyway?
Legit question, I'm trying to understand!
OP says:
> Hit by a massive surge in vulnerability reports, NIST effectively hit pause on deep analysis. CISA and other Authorized Data Publishers (ADPs) tried to step in with their own enrichment efforts, but the global pipeline is now fragmented and drowning in a massive backlog. Because no step in today's system actually requires a proof-of-concept or bug reproduction, a plausible-sounding fake advisory can slide right through the pipeline and end up in GHSA, downstream databases, and enterprise scanners.
Do i correctly understand you are saying you think they've mistunderstood the diagnosis of what changed, the 2024 change to NIST didn't actually make it any more likely for a fake advisory to go through pipeline?
I'm sitting here wondering why the Chief Master Sergeant of the U.S. Space Force has an Instagram account to begin with. I understand it's the office itself, but still don't see the reason to expand the attack surface of government offices. X makes sense, Instagram, I'm not so sure as much
I see no difference between X and Instagram in this regard whatsoever.
Think NASA, for example; it's also a government agency, and they are doing great job posting photos in Instagram, do you think anything is wrong with it?
It is just bizzare when you take a step back and remember the world 20 years ago. NASA would just post directly to their own website. Of course they would. Now imagine you go back in time 20 years ago and say "What if we took all these images you are providing for the public on their dime, compressed the hell out of them, and served them in this for profit proprietary marketing/propaganda app instead?" Engineers in 2006 would have probably looked at you like you had three heads. The question would make no sense back then.
Something to think about when we consider what is "normal" today. Not much really is normal. We've been beaten to think it is.
I feel that this is somewhat orthogonal. Yes, some questionable things have happened that made the ways how people exchange information be controlled by a handful of corporations.* But for NASA specifically, this is not relevant. They were not the ones who forced people to go to social networks; they needed to go there because this is where their audience was.
* On that note, and for the sake of the argument, I would say that the years of free uncontrolled information exchange in the Internet can probably be considered an exception. Information exchange was always controlled by governments and businesses (e.g. TV and newspapers) before, just as it is now. The fact that you or I don't like it does not change that this is how it used to be before the Internet appeared as a "free space". My generation was lucky to see how great the world with free information exchange could be, but I don't have much hope that it would stay like that for long.
I think one has historically been more text based vs image based. so for comms, i think X makes more sense. Space Force is under DoD so funding not much an issue. NASA, not so much. They have to fight for every nickle they get, so appealing to audiences via images/videos makes sense. I'm more so questioning why HE needed an account, instead of just the organization. Like Space Force posting makes more sense than him using it. I think what you're getting at is that the medium of communication has changed to social media. I get that. I just think it expands the attack surface for that org. Just have one account and post through that
Outreach, I'd guess? You've got to do outreach where the people are. X and Instagram have pretty different audiences, but they're both large, so if you're on one you probably should be on both.
This was the exact motivation that led me to develop my own news feed for a vulnerability dashboard I'm working on. I would wait for my NVD API calls to finish by scrolling tech sites but was always inundated by ads...
Like gortok has said, LLMs are just probabilistic text-prediction engines. They cannot automate the vulnerability validation lifecycle because they cannot account for improbable edge cases. They may not even get the version of the software right...