America's cyber defenses are being dismantled from the inside

(theregister.com)

321 points | by rntn 14 hours ago ago

197 comments

  • antonioevans 13 hours ago

    So in what way does this help the American people?

    • simpaticoder 11 hours ago

      >So in what way does this help the American people?

      Shutting down Mitre and the CVE is against American interests, both public and private. That said, you can make an argument, one that revolves around cost (was the CVE DB worth $50M a year, especially given its backlog?). The other part of that argument rests on assuming there will be a private or semi-private replacement for the service, that there may be many of them, and therefore they will improve. One might assert, as libertarians do, that every service that's not monopoly of force should be private.

      These aren't great arguments. $50M does seem like a lot, and maybe it could be reduced. I'd love to see an actual analysis of their operations rather then just ending the program. The second argument is worse. NIST and NOAA are examples of agencies that punch above their weight in terms of cost/benefit (the CFPB as well), and it seems like for-profit NIST and NOAA doesn't make much sense. But yes its worth considering the pros and cons of publicly funded service versus the private versions, in general. Even a bad argument is better than no argument, and the current admin does not bother to make one.

      • JKCalhoun 11 hours ago

        You seem to be doing a cost/benefit analysis. The sense we have is that the people doing the dismantling either have not done such an analysis or are at the very least keeping it from the public.

        • Suzuran 11 hours ago

          They have absolutely done a cost/benefit analysis. It works like this: "If it does not benefit me personally, directly and financially, then it costs too much."

        • Yeul 11 hours ago

          In my country such things are discussed in parliament during endless sessions about the yearly budget. They are not decreed by a god emperor at a whim.

          • skeeter2020 10 hours ago

            I find this hard to believe. Every country has various conditions and scenarios where the leader is granted god-like powers. ex: In Canada Trudeau invoked the Emergencies Act for the first time ever during covid. My understanding is that it was intended for 9/11-type actions, not protesters who should have been arrested weeks earlier. What country are you in?

            • AlexandrB 10 hours ago

              This is not quite correct. The Emergencies Act was preceded by the War Measures Act which was used during WWI and WWII as well as during the "October Crisis"[1].

              But yes, the intent is for events that threaten the nation, not protests.

              [1] https://en.wikipedia.org/wiki/October_Crisis

              • ethbr1 5 hours ago

                The nature of extraordinary powers' existence is that they will be used. You'd have thought the Roman Rep^H^H^HEmpire would have taught everyone that.

                The only defense is to inalienably assign certain rights/protections to individuals. (Which itself creates issues with their abusing them)

                • mrguyorama 2 hours ago

                  This is rhetorical sleight of hand.

                  There is no physical force in the universe that causes words written on a government letterhead to mean anything. The exact same government that granted you "inalienable rights" will ignore them when it's corrupted.

                  There is no way to construct a government such that it CANNOT execute a minority if enough people want that to happen.

                  The only answer, as it has always been, is to ceaselessly, diligently, and without fail, never vote in people like Trump.

                  Unfortunately, the republican party has spent every single moment since Nixon's resignation ensuring that the party would never let that kind of thing stop them again.

                  • ethbr1 2 hours ago

                    > The exact same government that granted you "inalienable rights" will ignore them when it's corrupted.

                    Checks and balances, multiple branches aligned along different timescales, and mandatory minimum change periods. E.g. the states that require consitutional amendments to be voted for in two consecutive elections

                    And all of that buttressed by belief in institutions and the consistency that effects.

                    It takes time to change people's minds.

      • dpkirchner 9 hours ago

        > was the CVE DB worth $50M a year, especially given its backlog?

        This is more or less a common rhetorical argument made by republicans after cutting budgets. The agency (organization, etc) is ineffective now, so we should terminate it, rather than fund it so it may be more effective.

        • freeone3000 9 hours ago

          It’s a very silly statement as well! Is having a single source of truth and the reference point for every publicly disclosed cybersecurity vulnerability worth $50M/year?

          It’s a fucking steal at that price.

        • watwut 6 hours ago

          It is not even argument that it is ineffective. Large backlog can mean it is ineffective or it can mean that there is more work to do then resources allow. There is no way to distinguish these two without further info.

        • soupfordummies 7 hours ago

          running the country like vulture private equiteers.

      • btbuildem 11 hours ago

        > there will be a private or semi-private replacement for the service

        It would, by definition as a for-profit entity, cost more and provide less value. That is a guarantee.

        • throwawaymaths 10 hours ago

          private != for profit.

          • Braxton1980 10 hours ago

            Maybe we can start a non-profit and everyone contributes to it, perhaps based on income.

      • thinkingtoilet 11 hours ago

        >$50M does seem like a lot

        $50 seems like nothing for a trillion dollar government budget.

        • simpaticoder 11 hours ago

          I almost edited my comment to anticipate this comment. It is not large compared to the budget. Nothing is. It's large in absolute terms. $50M is a lot of spend compared to most businesses with a similar scope. The product is a database of information other people report, naively it seems like a lot. It doesn't have any of the complexity of most businesses. This is not to minimize the work of fixing messy input, reproducing and properly cataloging vulnerabilities, etc. That budget is ~250 workers (assuming $100k/year with 100% overhead), ignoring infra. More than anything I'm curious how the money is being spent because without knowing that it's impossible to judge whether it's bloated or not.

          • thinkingtoilet 10 hours ago

            >More than anything I'm curious how the money is being spent because without knowing that it's impossible to judge whether it's bloated or not.

            Exactly. And it's totally fair for anyone to question the cost. However, the current administration is destroying things with the precision of a Jackson Pollack painting and no such reflection is happening.

            • Braxton1980 10 hours ago

              Question the cost how? By saying "is this alot?" Then performing no further investigation to confirm that or make a comparison basically leaving the question open which causes random to assume it's "alot"

              • simpaticoder 6 hours ago

                I can say "Gee whiz $335M per F-22 seems a bit much!" without being an expert in jets, military equipment, or going into the details of its production. I know a bit more about software so I can safely say something similar about MITRE. The fact that I don't want to spend my time doing (frankly, rather useless since I'm not a journo or in government or influential at all) investigative journalism into the specifics doesn't invalidate my opinion. Random people will read random things into whatever random content they consume; deep in an HN comment thread this is of little concern.

        • skeeter2020 10 hours ago

          I don't support this decision, but it's not like the $50M here is the keystone for the entire budget. It's actually easier to cut the smaller components and looks like progress when you're not making much movement.

      • Braxton1980 10 hours ago

        >. $50M does seem like a lot,

        What comparison are you using? What wouldn't be alot for this service?

      • rjsw 11 hours ago

        NIST used to punch above its weight, everyone that I know who worked there has left over the last few months.

      • ashoeafoot 8 hours ago

        If they write more than two paragraphs for defanging usa == russian.botnik

      • thesuitonym 10 hours ago

        $50 is about $7 per American. Could MITRE be more efficient? Yeah maybe. Probably, even. But cutting off funding entirely isn't the way to make it happen. This decision isn't about saving the American taxpayer money, it's about weaking the US, and it serves exactly one person.

        • spott 10 hours ago

          There are 150M taxpayers in the US… so $50M is about 33 cents per American…

          Unless you know something I don’t.

        • tremon 4 hours ago

          $50M divided over ~350M people is around 15 cents per citizen per year. Did you use an odd number of Australian signs in your math?

          • thesuitonym 2 hours ago

            I honestly am not sure what I did. Definitely missed a few zeroes!

      • titaphraz 9 hours ago

        What does it cost to lose the control over it? I'm sure the an equivalent database could be maintained in another country for a lot cheaper, like in China or Russia.

    • spamizbad 11 hours ago

      It doesn't. It's a side-effect of the populist right's "human capital" problem. Lots of nefarious theories abound about how this will be used to clamp down on our rights, and that may ultimately happen, but that will merely be a reaction to the consequences of their blundering actions. Today, the conventional wisdom among the Trump administration is these cybersecurity programs are a waste of money and that magically the private sector will swoop in and save us.

      We're now all going to experience the high cost of low human capital.

      • close04 11 hours ago

        Those who cause the crisis will show up soon to sell the solution, in the form of private ventures that make them a lot of money.

        This mirrors a lot the physical destruction of other countries only to come back for "reconstruction" which filled some pockets with unimaginable amounts of money.

        • 10 hours ago
          [deleted]
    • bell-cot 12 hours ago

      Might you be assuming that the current management cares about actual "help the American people" stuff?

    • mrweasel 11 hours ago

      It saves money on the government budget... or so they think. I doubt that there's anything sinister going on. It's just numbers in a government spreadsheet, and the Trump administration sees money going to projects that benefit people outside the US, regardless of their internal value, and just assumes that it's the US money spend on other nations.

      They are not smart enough, well informed enough, nor do they particularly care to educate themselves or listen to other smarter people, they just see a number in the budget which they don't understand, so it can go. I suppose the assumption is that if it's truly important enough, someone will turn it into a business.

      • apercu 11 hours ago

        [flagged]

        • Sharlin 10 hours ago

          Evoking Hanlon's razor: The first Trump admin was mostly just incompetent. The second is in many ways much more incompetent, but now it is also actively malicious.

          • skeeter2020 10 hours ago

            last time the had to make it up after winning the election. They spent 4 years getting ready this time

          • ModernMech 10 hours ago

            > The first Trump admin was mostly just incompetent.

            Mostly is doing a lot of work here. The first Trump admin incited an insurrection. That wasn't incompetence, that was malicious. Hanlon's razor isn't it, you have to calculate p(malicious activity | caused an insurrection to stay in power) and you will arrive at a much higher posterior probability they are malicious rather than incompetent.

    • hollywood_court 12 hours ago

      It doesn't. The entire purpose is to help Trump's boss.

    • chaostheory 12 hours ago

      My guess is that they were overtly trying to show Russia that we aren’t a direct threat to them anymore in the vain attempt to avoid fighting a two front war in the upcoming global war. Unfortunately, Putin is likely going to keep invading up to Germany’s Fulda Gap. If we’re still a part of NATO, we would have no choice but to declare war.

      • sennalen 11 hours ago

        This is WW3 playing out. Russia installed its people in America to dismantle our defenses.

      • sofixa 12 hours ago

        > Unfortunately, Putin is likely going to keep invading up to Germany’s Fulda Gap

        Russia can barely handle a stalemate with Ukraine. They have zero chance offensively against Poland and the Baltics, let alone the full blown might of the EU+UK (which also have independent nuclear weapons in France and to an extent the UK). That doesn't mean that a Polish offensive can march into Moscow, but it doesn't have to for Putin to lose power. He's showing his strongman strong army bullshit to be little more than a paper tiger, and at some point even the nihilistic to death Russians will get tired of the meat grinder for literally no reason.

        • Braxton1980 10 hours ago

          So if a direct military conflict is difficult for Putin wouldn't it be best to attack the US by manipulating it's population?

        • varjag 11 hours ago

          > Russia can barely handle a stalemate with Ukraine.

          See, people look at the stalemate and often draw false conclusions. It's not that Russia was too weak militarily, it's that Ukraine put up one hell of a fight.

          And all these economy size comparisons are mostly meaningless. Sure Russia may have a GDP of Italy but by the same logic Ukraine (which is a fraction of Russian GDP) should have lost long ago.

          > They have zero chance against Poland and the Baltics

          Russia's chances against the Baltics are pretty good, I would say 1 in 3. And for Putin it's a proposition with no downside: at worst he loses another few hundred thousand subjects.

          • ivan_gammel 11 hours ago

            >Russia's chances against the Baltics are pretty good, I would say 1 in 3. And for Putin it's a proposition with no downside: at worst he loses another few hundred thousand subjects.

            Article 5 is still in effect, even if America won’t take its part. Attack of Baltics will trigger response from all neighbors including Finland, Sweden and Poland. Kaliningrad won’t last long, St.Petersburg will be within reach of artillery etc. It will be suicidal to do that.

            One thing that Westerners do not understand is that people in small towns or rural areas of Russia may be expendable, but population of St.Petersburg and Moscow is a protected class. If they suffer, the regime may actually collapse before reaching military goals. For this reason Russian mobilization barely touched both capitals.

            • pmontra 9 hours ago

              If I were Putin I'd attack some very minor NATO state to check if NATO will really send soldiers to defend it. Example: is really somebody willing to die for Estonia? (Sorry HNers from Estonia, but you are just in the worst possible place of all of NATO.) If not, NATO will crumble into pieces. If yes, let's see who's sending soldiers and who won't, and how they will react to the first week of casualties. Keep going or fold?

              Maybe before getting there, if I end up controlling the next parliament of Ukraine I'd take over Moldova, and before that let's teach a lesson to Armenia. That's to keep the army busy and not let soldiers back home where they could cause troubles or, god forbids, create a pacifist movement like after the Afghan war (the Russian one.)

              • ivan_gammel 8 hours ago

                But you are not Putin and he is not you. Attacking Ukraine wasn’t a gamble for him, it was a presumably easy win, like Georgia in 2008. Attack on NATO on Baltic shore isn’t an easy win, it’s a gamble. And what is this test for? America has already learned the lesson and is withdrawing from Russian periphery. Europe has no interest in power games, UK is in irreversible decline. NATO is not going to expand anymore in foreseeable future, primary military goal achieved and Russian authoritarianism is secure. Why he would attack Baltics?

                • varjag 4 hours ago

                  You are trying to hypothesise a rational actor except you model the actor on ordinary people.

                  An aging authoritarian is not concerned with long term security, well being of his subjects or boring diplomatic minutae. Seeing his days vanishing, he is intent on leaving a mark in history. What matters is not how pretty the mark is going to be but how visible shall it be through centuries. And since the authoritarian's strength is more often brutality than intelligence, the role model would inevitably be Stalin, Genghis Khan or Ivan the Terrible.

                  Within their framework the dictator is entirely a rational actor but on a very different vector than what think tanks usually muse about.

                • geoka9 6 hours ago

                  The latest expansion of NATO was barely a year ago (with Sweden joining).

                  Russian authoritarianism may be secure, but the current regime's power is not (not to mention their leaders' paranoia).

                  Their ambition is the control of continental Europe. It might sound crazy, but if you listen to people like Dugin, it is very clear. And it's not that unrealistic in the longer run, considering everything you listed in your post.

                  The onslaught on Europe will continue - first (already happening) on its unity through the financing and propaganda support of the right-wing populist candidates who don't know (or simply don't care) better and then, once every (relatively) little country in Europe is on their own, on their sovereignty through military threat and/or invasion.

                  I will also leave this here as I think it is pertinent to the discussion:

                  https://www.researchgate.net/publication/313258664_Putin's_R...

                  • ivan_gammel 5 hours ago

                    >listen to people like Dugin, it is very clear

                    Don’t be afraid of scarecrows. He is a powerless freak far away from the decision makers, not Rasputin. Says a lot, but doesn’t really matter. It is much more interesting what people in security council say and who gets the contracts. There’s zero indication of expansion but a lot of messages about not messing with “legitimate interests”. They protect what they think is theirs.

                    The ambition of the control over continental Europe exists only in imagination of people with no understanding of Russian internal politics. They need absence of threat and parking lot for the money, so they will play the game of influence, but war? Nonsense.

                    • geoka9 4 hours ago

                      > It is much more interesting what people in security council say

                      People in the security council were cowering with fear on 22-02-22 afraid to say the unthinkable and Putin openly gloating while forcing them to say it.

                      Dugin is a freak alright, but he has the ear of (and is privy to) the paranoid decision makers there; he was talking about the impending war long before anyone else.

                      > They need absence of threat and parking lot for the money

                      It will be much easier to park their money in any one of the small rich countries (e.g. Switzerland) once those are not encumbered by the KYC and AML rules imposed by the globalist word order. Same with their luxury properties and kids in private schools.

                      They don't need to invade every country to control the continent. Look at Finland prior to the collapse of the USSR - while staying mostly independent they still had to run their leadership choices by the Kremlin and did not even think about joining military alliances to avoid confrontation.

                      > so they will play the game of influence, but war?

                      Right, they played the game of influence with Ukraine until they lost all influence and and saw an opportunity for military success. On the other hand, they are not invading Georgia or Belarus because the governments are in their pocket and their security apparatuses are basically departments within FSB. For the same reason they won't be invading Hungary or Slovakia any time soon. But the Baltic countries? I'm not so sure.

              • sofixa 9 hours ago

                > If I were Putin I'd attack some very minor NATO state to check if NATO will really send soldiers to defend it. Example: is really somebody willing to die for Estonia

                Even if nobody else, the other Baltic states and Poland will defend them. Very decent chance of Finland, Sweden, UK, France joining as well.

                • pmontra 8 hours ago

                  Finland and Sweden yes, because they are the next ones in line on that front. UK probably but not 100%. France, it depends who'll be the president, who controls the parliament and what they'll have to say to get the votes to win the next elections.

          • johnisgood 11 hours ago

            > it's that Ukraine put up one hell of a fight.

            I would like to add that, yes, with a lot of money and weapons from the US and other countries, they would not have been able to do it without their help. Am I wrong about the aid's significance, or did it not happen?

            • sofixa 11 hours ago

              Yes, but the initial stopping of the Russian advance happened before the vast majority of that help arrived. In a way, Russia lost the war the moment it didn't finish it in a few days - it ensured Ukraine could be supplied, and that the resistance will be remembered and kept on.

          • sofixa 11 hours ago

            > See, people look at the stalemate and often draw false conclusions. It's not that Russia was too weak militarily, it's that Ukraine put up one hell of a fight

            While Ukraine unquestionably put up a hell of a fight, the fact that the numerically superior army with the better and more numerical equipment, backed by the multiple times bigger and richer country failed is a failure. Especially when you consider that Ukraine doesn't have a navy and barely had an air force and anti-air, yet Russia failed at establishing air or naval control, let alone dominance.

            > Russia's chances against the Baltics are pretty good, I would say 1 in 3.

            Russia has no chance of having a war against the Baltics only. Any aggression against them will be met with a swift reaction from Poland, which has a better equipped army than Ukraine. If Ukraine can destroy the best Russian units and hold to a stalemate the majority of the remainder for years, Poland will wipe the floor with the war criminals.

            • alxlaz 11 hours ago

              > While Ukraine unquestionably put up a hell of a fight, the fact that the numerically superior army with the better and more numerical equipment, backed by the multiple times bigger and richer country failed is a failure. Especially when you consider that Ukraine doesn't have a navy and barely had an air force and anti-air, yet Russia failed at establishing air or naval control, let alone dominance.

              That's certainly true, but much of this failure can be ascribed to:

              1. Lack of co-ordination (both inter-force and within each unit) and basic best-practices in terms of logistics. The Russian armed forces are still far from anything NATO has in this regard but are also a lot better than when the war began.

              2. Poor mobilisation and insufficient initial forces. Most of this was based on the obviously misguided notion that Russian forces would be welcome as liberators (which, haha, no, 40+ years of Soviet or Soviet-backed regimes in Eastern Europe have ensured this would not happen for generations), and is unlikely to be repeated.

              3. Considerable strategic depth, which further compounded #1 and #2, which the Baltics don't have.

              4. Considerable development of expertise on the Ukrainian side, which has been fighting in Donetsk and Luhansk since the first Russian invasion in 2014, whereas neither Poland nor the Baltics armed forces have had much exposure to real-life war outside the GWOT.

              5. A smaller mismatch in terms of equipment than media coverage makes it sound, certainly far smaller than that of the Baltics.

              The odds varjag puts forward aren't at all outlandish, especially with NATO commitment so uncertain at this time.

              • bluGill 10 hours ago

                While US commitment to NATO is uncertain, the rest of NATO still seems certain. Russia might be able to take the Baltic and/or Poland - but they won't be able to keep it. Soon as they cross the border (or more likely start building up) the rest of Europe will start building up their army to attack back.

                • pmontra 9 hours ago

                  A country attacks another one only if it doesn't have political control of it feels that never will. For example Russia doesn't have to attack Belarus and won't have to attack Hungary, and probably not Slovakia. They'll be part of the next Warsaw Pact without any bullet flying if their leaders will get guarantees that they can be leaders forever. Poland looked like it was going that way before the current administration. Ukraine itself have been pro Russia or pro NATO at different times in the last 25 years. No need to attack it when it was pro Russia. So let's see who that "rest of Europe" will be if and when there will be the need to defend some country in the East.

                  • bluGill 7 hours ago

                    Political climates can change though. Will Hungary as a whole stand for that? Ukraine woke up when it realized what the leaders were trying.

              • dylan604 10 hours ago

                Why do you think any of these issues will not also be issues on a western front?

                • alxlaz 8 hours ago

                  I am sure they will be, I'm just saying that a Western front will be extremely different from the Ukrainian front, especially in the Baltics, where #3 is particularly salient. So I would recommend caution when applying over-arching lessons from Ukraine to these situations, that's all.

            • varjag 8 hours ago

              > Especially when you consider that Ukraine doesn't have a navy and barely had an air force and anti-air, yet Russia failed at establishing air or naval control, let alone dominance.

              Ukraine had dozens of airworthy fighter jets and well over a hundred air defense batteries at the start. Many of the latter were lost in the first weeks but Ukraine was fairly packed as far as smaller nations go.

              > Russia has no chance of having a war against the Baltics only.

              No, Russian chance of occupying significant part of Baltics with realistic level of NATO involvement is 1 in 3. It would be most certainly able to overrun the three states absent NATO support.

              > Any aggression against them will be met with a swift reaction from Poland, which has a better equipped army than Ukraine. If Ukraine can destroy the best Russian units and hold to a stalemate the majority of the remainder for years, Poland will wipe the floor with the war criminals.

              That's the spirit I was mentioning yeah, "Ukrainians are bit backwards unlike we noble NATO elves". Name one thing in Polish military that Ukrainian military today doesn't have though?

              The coming war will be hell of a reality check for many.

              • geoka9 6 hours ago

                > Name one thing in Polish military that Ukrainian military today doesn't have though?

                Lack of combat experience.

                But seriously, very good analysis!

      • netsharc 12 hours ago

        That feels overly deferrential to Putin...

        It's like a person with muscles witnessing a beating and then when the perpretaror notices, looking away and saying "I didn't see anything!".

        • anonymars 11 hours ago

          Or worse, rifling through the victim's pockets (mineral deal) and demanding a thank you.

          So far John McCain had this one right. Show Putin weakness at your peril. https://www.youtube.com/watch?v=HLAzeHnNgR8

          • netsharc 11 hours ago

            The mineral deal smells like a sharing the spoils of war with Putin, I wonder if Putin mentioned it on that phone call they had.

            Thinking of a Moscow-Washington phone call makes me think of https://www.youtube.com/watch?t=6&v=6T2uBeiNXAo

            > Why do you think I'm calling you? Just to say hello? Of course I like to speak to you. Of course I like to say hello.

            Oh SNL, please make a spoof of this...

        • JKCalhoun 11 hours ago

          Yeah, Chamberlain-level deferential.

        • cwillu 12 hours ago

          So, cowardice?

          • kevin_thibedeau 11 hours ago

            He'll do anything to keep his kompromat from being disclosed.

            • ModernMech 10 hours ago

              There's no kompromat, Trump and Putin just have the same goals. This whole idea that Putin has kompromat on Trump and that's the only reason he would be deferential to Putin rests on the idea that the American president is aligned morally, politically, and strategically with the long-term interests of America. Sadly, this is not true. The oath Trump took was empty.

              Trump does not have a pro-America agenda; he has a pro-Trump agenda. His whims are not morally, politically, or strategically aligned with the goals and prospects of the American people, they're aligned with a global billionaire class, to which Putin belongs. That is why they get along. They are allies.

              • unethical_ban 8 hours ago

                This is what I have said for a long time. Trump the individual cares about Trump, he operates like an animal. He may not overtly hate the country, but he has no feeling of obligation or patriotism. I don't think he knows what patriotism is.

                If something he does helps America, it is because it helps him, or because it inflates his ego via people applauding him.

    • whynotmaybe 12 hours ago

      I guess that after "In god we trust" on the bank notes, it's now "god helps those who help themselves" for the rest.

      > The phrase is often mistaken as a scriptural quote, though it is not stated in the Bible. Some Christians consider the expression contrary to the biblical message of God's grace and help for the helpless, and its denunciation of greed and selfishness.

      https://en.m.wikipedia.org/wiki/God_helps_those_who_help_the...

      • ryao 12 hours ago

        I would think that phrase is related to the phrase, “he who does not work, does not eat”, which is in the Bible:

        https://biblehub.com/2_thessalonians/3-10.htm

        The phrase “he who does not work, does not eat” was never intended by its author to be applied to those who were physically incapable of working. You might say otherwise, but Saint Paul had been a very traditional adherent of the Jewish faith, which had required farmers to leave portions of their harvest for the poor and destitute. The idea that he thought those who were physically incapable of working should not eat is absurd. It is unlikely he had a change of heart on this matter after his conversion to Christianity given that he had viewed Christianity as the continuation of Judaism.

        Anyway, I always thought the phrase “God helps those who help themselves” meant you had to do a bare minimum within your capability to take care of yourself if you want help. I think it is a corruption to claim the phrase “God helps those who help themselves” in any way implies that God does not help those who are incapable of helping themselves.

        • JKCalhoun 11 hours ago

          I didn't know anyone was splitting hairs as to whether the phrase was to be applied to the helpless.

          Regardless, it always seems to be used as a cudgel against those whom the invoker believes is lazy or undeserving of God's help.

          (As an atheist though the phrase always seemed like a justification for why prayers were not being answered.)

          • ryao 11 hours ago

            My mother has invoked it at various points in my life to try to motivate me to do the bare minimum to help myself when she did not think I was doing even that much (and was capable of doing it). I suppose that could have seemed like a cudgel to observers, but it was not.

            As for prayers being unanswered, there are two tragedies in this world. One is not getting what you want. The other is getting it. Interestingly, the Mouse Utopia Experiment showed that giving everyone everything that they could ever want is ultimately bad for them. That is perhaps a major reason why various prayers are unanswered.

            • Retric 10 hours ago

              Mouse Utopia experiment doesn’t give mice space it’s just not the kind of restriction that’s initially obvious.

              The modern take is when you put animals into environments well outside what they evolved for you get seemingly bizarre behavior.

              • minton 10 hours ago

                I don’t think we need a study to understand that someone who always gets everything they want is usually a spoiled brat.

                • Retric 8 hours ago

                  That’s exactly the kind of assumption you should want someone to rigorously examine.

                  But more importantly it was not happening in those experiments.

              • 10 hours ago
                [deleted]
          • 11 hours ago
            [deleted]
        • catlikesshrimp 12 hours ago

          Since there is plenty of room for uncharitable interpretations, it would be controversial. More controversy about religion.

          The status quo "in god we trust" is universally hopeful.

          "God help us" can sound helpless (cheek in tongue)

          • ryao 12 hours ago

            This is the first that I have heard of them. The apparent inspiration for the phrase had never meant to be interpreted to justify a lack of charity. Only those with poor understandings of Christianity’s history and teachings would think otherwise. I would think the “uncharitable interpretations” of the phrase “God helps those who help themselves” are by those with poor understandings as well.

          • cwillu 12 hours ago

            The only difference is the vibe; the actual words have pretty similar meanings.

        • EGreg 10 hours ago

          Paul's teaching is plainly at odds with Jesus' teachings, and people do a lot of acrobatics to try to reconcile the two.

          Jesus: 25 Therefore I say unto you, Be not anxious for your life, what ye shall eat, or what ye shall drink; nor yet for your body, what ye shall put on. Is not the life more than the food, and the body than the raiment? 26 Behold the birds of the heaven, that they sow not, neither do they reap, nor gather into barns; and your heavenly Father feedeth them. Are not ye of much more value than they? 27 And which of you by being anxious can add one cubit unto [a]the measure of his life? 28 And why are ye anxious concerning raiment? Consider the lilies of the field, how they grow; they toil not, neither do they spin: 29 yet I say unto you, that even Solomon in all his glory was not arrayed like one of these. 30 But if God doth so clothe the grass of the field, which to-day is, and to-morrow is cast into the oven, shall he not much more clothe you, O ye of little faith? 31 Be not therefore anxious, saying, What shall we eat? or, What shall we drink? or, Wherewithal shall we be clothed? 32 For after all these things do the Gentiles seek; for your heavenly Father knoweth that ye have need of all these things. 33 But seek ye first his kingdom, and his righteousness; and all these things shall be added unto you. 34 Be not therefore anxious for the morrow: for the morrow will be anxious for itself. Sufficient unto the day is the evil thereof.

          Paul: 10 For even when we were with you, this we commanded you: that if any would not work, neither should he eat.

          11 For we hear that there are some among you who walk disorderly, working not at all, but are busybodies.

          12 Now those who are such, we command and exhort by our Lord Jesus Christ that they work with quietness and eat their own bread.

          Jesus: 17 As Jesus was starting out on his way to Jerusalem, a man came running up to him, knelt down, and asked, “Good Teacher, what must I do to inherit eternal life?”

          18 “Why do you call me good?” Jesus asked. “Only God is truly good. 19 But to answer your question, you know the commandments: ‘You must not murder. You must not commit adultery. You must not steal. You must not testify falsely. You must not cheat anyone. Honor your father and mother.’[a]”

          20 “Teacher,” the man replied, “I’ve obeyed all these commandments since I was young.”

          21 Looking at the man, Jesus felt genuine love for him. “There is still one thing you haven’t done,” he told him. “Go and sell all your possessions and give the money to the poor, and you will have treasure in heaven. Then come, follow me.”

          22 At this the man’s face fell, and he went away sad, for he had many possessions.

          23 Jesus looked around and said to his disciples, “How hard it is for the rich to enter the Kingdom of God!” 24 This amazed them. But Jesus said again, “Dear children, it is very hard[b] to enter the Kingdom of God. 25 In fact, it is easier for a camel to go through the eye of a needle than for a rich person to enter the Kingdom of God!”

          Jesus: 17 “Think not that I am come to destroy the Law or the Prophets. I am not come to destroy, but to fulfill.

          18 For verily I say unto you, till heaven and earth pass away, not one jot or one tittle shall in any wise pass from the law till all be fulfilled.

          19 Whosoever therefore shall break one of these least commandments and shall teach men so, he shall be called the least in the Kingdom of Heaven; but whosoever shall do and teach them, the same shall be called great in the Kingdom of Heaven.

          Paul: By calling this covenant “new,” he has made the first one obsolete; and what is obsolete and outdated will soon disappear.

          Paul: Christ redeemed us from the curse of the law by becoming a curse for us, for it is written: "Cursed is everyone who is hung on a tree." [6] 14 He redeemed us in order that the blessing given to Abraham might come to the Gentiles through Christ Jesus, so that by faith we might receive the promise of the Spirit. 15

          Jesus: * And, behold, a woman of Canaan came out of the same coasts, and cried unto him, saying, Have mercy on me, O Lord, thou son of David; my daughter is grievously vexed with a devil.

          23 But he answered her not a word. And his disciples came and besought him, saying, Send her away; for she crieth after us.

          24 But he answered and said, I am not sent but unto the lost sheep of the house of Israel.

          25 Then came she and worshipped him, saying, Lord, help me.

          26 But he answered and said, It is not meet to take the children's bread, and to cast it to dogs.

          27 And she said, Truth, Lord: yet the dogs eat of the crumbs which fall from their masters' table.

          28 Then Jesus answered and said unto her, O woman, great is thy faith: be it unto thee even as thou wilt. And her daughter was made whole from that very hour.*

          Peter was supposed to be the "disciple to the Gentiles". But Paul became one.

          But he claimed he saw Jesus on the road to Damascus, in the wilderness, and then in the inner rooms of the jail cell.

          Jesus: “So if anyone tells you, ‘There he is, out in the wilderness,’ do not go out; or, ‘Here he is, in the inner rooms,’ do not believe it.

          Paul himself admits he didn't actually study with any of Jesus' own students, but went to Arabia for 3 years and taught from his own visions. Like Mohammad did centuries later. And then later

          Paul: 15But when God, who set me apart from my mother’s womb and called me by his grace, was pleased 16to reveal his Son in me so that I might preach him among the Gentiles, my immediate response was not to consult any human being. 17I did not go up to Jerusalem to see those who were apostles before I was, but I went into Arabia. Later I returned to Damascus.

          18Then after three years, I went up to Jerusalem to get acquainted with Cephas b and stayed with him fifteen days. 19I saw none of the other apostles—only James, the Lord’s brother. 20I assure you before God that what I am writing you is no lie.

          21Then I went to Syria and Cilicia. 22I was personally unknown to the churches of Judea that are in Christ. 23They only heard the report: “The man who formerly persecuted us is now preaching the faith he once tried to destroy.” 24And they praised God because of me.

          In Acts 15: Paul finally visits Jerusalem he argues with Peter.

          Paul: When Cephas came to Antioch, I opposed him to his face, because he stood condemned... When I saw that they were not acting in line with the truth of the gospel, I said to Cephas in front of them all, “You are a Jew, yet you live like a Gentile and not like a Jew. How is it, then, that you force Gentiles to follow Jewish customs?

          But his historian Luke says the opposite about this incident -- that he was rebuked* and told to publicly show everyone he isn't teaching Jews not to follow the law, by paying for some nazarene's purification rites to shave their heads. And so he did! Publicly!

          Acts 21: 20 When they heard this, they praised God. Then they said to Paul: “You see, brother, how many thousands of Jews have believed, and all of them are zealous for the law. 21 They have been informed that you teach all the Jews who live among the Gentiles to turn away from Moses, telling them not to circumcise their children or live according to our customs. 22 What shall we do? They will certainly hear that you have come, 23 so do what we tell you. There are four men with us who have made a vow. 24 Take these men, join in their purification rites and pay their expenses, so that they can have their heads shaved. Then everyone will know there is no truth in these reports about you, but that you yourself are living in obedience to the law. 25 As for the Gentile believers, we have written to them our decision that they should abstain from food sacrificed to idols, from blood, from the meat of strangled animals and from sexual immorality.”

          And this refers to the OFFICIAL LETTER OF THE CHURCH THAT JESUS HIMSELF SET UP, led by his brother James and by Peter ("the Rock") who invoked the authority of the Holy Spirit to say to all gentile believers to essentially follow Noahide laws:

          https://www.biblegateway.com/passage/?search=Acts%2015&versi...

          Paul agreed to go to his churches and send this message. But he said instead:

          Galatians 2: As for those who were held in high esteem—whatever they were makes no difference to me; God does not show favoritism—they added nothing to my message. 7On the contrary, they recognized that I had been entrusted with the task of preaching the gospel to the uncircumcised, a just as Peter had been to the circumcised. b 8For God, who was at work in Peter as an apostle to the circumcised, was also at work in me as an apostle to the Gentiles. 9James, Cephas c and John, those esteemed as pillars, gave me and Barnabas the right hand of fellowship when they recognized the grace given to me. They agreed that we should go to the Gentiles, and they to the circumcised. 10All they asked was that we should continue to remember the poor, the very thing I had been eager to do all along.

          Seems to contradict what he was told to send to them.

          • 8 hours ago
            [deleted]
          • EGreg 8 hours ago

            I could go on. The point is this ... Paul and Luke wrote the majority of the New Testament. But their authority is circular. Jesus never taught Paul. Jesus' teachings were for Jews and he told them to follow the law. Paul said seemingly the opposite. Paul got his religion from his own visions. Paul argued with the very people Jesus did set up to run the Church. And from his letters, he doesn't seem to have related what they explicitly said, invoking all their authority. Luke somehow records that.

            Today, after the Council of Niceae by Constantine 3 centuries after the events, nearly all Christian denominations follow Pauline doctrine. But where is his authority from? How is he any different from, say, Mohammad?

            From all the Christian apologists I have talked to, they point to one verse and one verse only: Second Peter

            15 And account that the longsuffering of our Lord is salvation, even as our beloved brother Paul also, according to the wisdom given unto him, hath written unto you,

            16 as also in all his epistles, speaking in them of these things. Therein are some things hard to understand, which those who are unlearned and unstable wrest, as they do also the other Scriptures, unto their own destruction.

            But most scholars consider Second Peter not to have been even written by Peter

            https://bible.org/article/authorship-second-peter

            Harris says, “virtually none believe that 2 Peter was written by Jesus’ chief disciple.”2 And Brevard S. Childs, an excellent rhetorical critic, shows his assumption when he says, “even among scholars who recognize the non-Petrine authorship there remains the sharpest possible disagreement on a theological assessment.”3

            So what are we left with? One dubious link to Paul, from Jesus and his followers, in the entire Bible. And yet most people follow Paul.

            Thomas Jefferson: I separate therefore the gold from the dross; restore to him the former, & leave the latter to the stupidity of some, and roguery of others of his disciples. of this band of dupes and impostors, Paul was the great Coryphaeus, and first corrupter of the doctrines of Jesus.

            Anyway... that's my conclusion after studying the matter in as much depth as I could find, and talking to Christian apologists.

      • derefr 10 hours ago

        I feel like, despite the apochrycality of it, there’s a theologically-valid interpretation of the quote: namely, the same principle behind putting on your own breath mask first on a plane in an emergency.

        The Bible-compatible spin on this might be something like: if you don’t “help yourself” in the absolute strictest sense — feeding yourself, say — but only set out to help others, then you will fail to help others, as your body will fail you before you’ve done a single useful thing. It is not sainthood, not martyrdom, to refuse to do the small work required to accept the “gifts of God” (like a breath mask that keeps you alive long enough to do the work required to save your own children.)

        • ctoth 9 hours ago

          > I sent three boats!

      • 10 hours ago
        [deleted]
    • keepamovin 11 hours ago

      [flagged]

    • scythe 11 hours ago

      I'm not endorsing it, but it's roughly consistent with Trump's underlying philosophy that the international systems that USG manages are a subsidy from the US taxpayer to the rest of the world, and one which goes unappreciated. Under this premise, the USG would save money at little cost if they were replaced by industry consortiums or other countries' state initiatives. If my extrapolation is correct, even GPS might eventually be in the line of fire.

      I need to be clear that I do not endorse this view. The role of the United States in facilitating global cybersecurity, not to mention navigation, trade among much else, almost surely pays dividends far beyond what it costs us. The amount of international goodwill that the United States enjoys is remarkable particularly in light of our various foreign policy "mistakes", and I think we have these systems to thank.

      • nyeah 10 hours ago

        Let's keep things simple. You endorsed it. Here's a famous example of that endorsement style: https://www.poetryfoundation.org/poems/56968/speech-friends-...

        • ifyoubuildit 7 hours ago

          > Let's keep things simple

          It doesn't seem all that simple to dictate to someone what you think their actual opinion is and then point to Shakespeare as some kind of evidence.

          Maybe let's keep things simple by taking people at their word.

          • nyeah 5 hours ago

            I didn't say anything about the commenter's opinion. "Endorsed" was the word I used.

            • scythe 4 hours ago

              I didn't endorse anything. In fact, I presented arguments opposing the administration's view. I think it's unreasonable to argue that trying to understand people's actions is tantamount to endorsing them. We should never be reluctant to understand others' perspectives.

      • throwawaymaths 10 hours ago

        id agree with cybersecurity, but maybe not navigation? Even accounting for secondary effects, Currently supporting free navigation, especially in the Indian ocean and red sea mostly benefits other country, as the us is ~energy independent.

        • oivey 10 hours ago

          That’s not how economics works. Local energy price surges will also drive global prices up. The US is part of the global energy market. I guess you could ban export of energy and institute price controls, though.

        • XorNot 10 hours ago

          US oil and gas is not constrained to being sold solely within the US, nor is it publicly owned by the government.

          It has never mattered that the US is technically energy independent, because it's not independent of a number of other resources, and it cannot sustain the sort of cost increases which reductions in global oil and gas supply would lead to: because again, threesome resources aren't publicly owned - the higher revenues flow to the oil companies, not the tax payer.

      • Braxton1980 10 hours ago

        That's some non-endorsement.

    • llmthrow103 11 hours ago

      Since when has the American government acted based on what will or will not help the American people?

    • mfer 11 hours ago

      To play devils advocate here, a thought comes to mind...

      Should the US be the one to handle the CVE database globally? The current administration wants to see other parts of the world help carry the load. A little scare could be the push needed to make this either distributed or handled by a coalition. This could be a positive for the US (who doesn't want to be the sole funder) and for those who don't want the US to have sole control.

      • jwagenet 11 hours ago

        As with many other cuts and activities by the administration, it’s not that some programs don’t deserve scrutiny, but that the cuts are careless and shortsighted.

        • XorNot 10 hours ago

          Well, and also irrelevant. The budgetary numbers this is being claimed to be in service too will not be reached even if you dismantled every single program like this and all the related ones.

          It's the equivalent of taking a day off work to haggle over the price of a bus ticket.

      • thesuitonym 10 hours ago

        Your premise is flawed. Reframe the question like this: Should the US be the sole arbiter of software vulnerabilities? Absolutely not! But that doesn't mean the US should cut off the spigot. Other countries should start their own version of CVE, so they can check each other's work, and disclose vulnerabilities that certain governments may desire to keep secret.

    • jillesvangurp 12 hours ago

      They get to collaborate with the rest of the world on security instead of relying on their government protecting them. This will push companies that are exposed to lawsuits to up their game and re-organize. And given their exposure to lawsuits, I doubt they'll drop the ball. They can't afford to. This is one area where the private sector should not need a lot of help.

      I have a European perspective to this. This isn't as bad as it looks. The rest of the world should in any case not rely on the US federal government for their security. So, there was always going to be some duplication of effort needed here. And given the whole tariff situation, there is of course quite a bit of interest in non US based alternatives to your favorite US based trillion $ companies and their services and lots of companies giving the evil eye to any US based service providers. I've been seeing a lot of that lately with our German customers; especially in the public sector.

      Short term mildly disruptive for some companies but not something to panic over.

      • tarkin2 12 hours ago

        It helps the American people because they will need to rely on foreign countries for their cyber security?

        Heck, those nuclear subs and aircraft carriers are only making the American people less likely the collaborate with the rest of the world on security too.

        Bin the entire lot

      • JeremyNT 12 hours ago

        > And given their exposure to lawsuits, I doubt they'll drop the ball. They can't afford to.

        Color me skeptical. How many companies have lost sensitive due to extreme carelessness, time and again? The cost of taking security seriously is greater than the cost of settling after the fact.

        I feel like even the biggest data breaches result in little more than victims being offered free credit monitoring.

        • jillesvangurp 11 hours ago

          I don't think anything changes here in a material way.

  • axus 9 hours ago

    Signal chats are a sideshow compared to opening up the government to data breaches and foreign influence

    https://www.newsweek.com/doge-whistleblower-stalked-threaten...

    • unethical_ban 7 hours ago

      I have conservative family who only read/watch Fox news, OAN and some conservative meme site called twitchy, which is like if Fox news tried to be dumber.

      They don't see this. There is no true reporting. My mom didn't know about the breadth of tariffs. She didn't know about the DJT crypto scam. I've explained signal to her several times (prior to the news, just getting her to use it). She really doesn't understand anything complicated.

      She "knows Trump is a jerk" but wants, and I quote, "America for Americans" and for us to put China in its place and to secure the border.

      edit: I told my dad "Why do you think America is so powerful and influential? It's because we invest in the world and welcome students into this country. We aren't the center of the world for no reason". He simply replied, "We are the center of the world."

      Our country is filled with people like this, incapable of abstract thought and poisoned by lies.

      • MattPalmer1086 3 hours ago

        People always like to think their good fortune is because they have some special sauce that others don't have. But they also resent all the obligations that go with it.

        Plenty of people in Britain still think the world owes us something, nearly a century after the end of our empire.

      • totalkikedeath 7 hours ago

        [dead]

  • prophesi 12 hours ago

    Bit of a sparse article. The near-miss of CVE funding is certainly tragic, but there's no mention of how they siphoned data from the NLRB and locked everyone out of their accounts, and give only a quick mention to cutting federal grants for cybersecurity and CISA's funding. There's a lot more ammo out there to show how incompetent the Trump administration and Musk's DOGE team actually is.

    • judge2020 11 hours ago

      https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-...

      Goes into pretty good detail about DOGE employees going out of their way to obscure their activity on NLRB's Azure account. Surely a plus for transparency in government.

      > Within minutes after DOGE accessed the NLRB's systems, someone with an IP address in Russia started trying to log in, according to Berulis' disclosure. The attempts were "near real-time," according to the disclosure. Those attempts were blocked, but they were especially alarming. Whoever was attempting to log in was using one of the newly created DOGE accounts — and the person had the correct username and password, according to Berulis.

    • andrewl 11 hours ago

      They're actually quite competent at their real goal, which is not to make America great, but to blow it to smithereens so various titanically rich people can buy everything up, including the land, at rock bottom prices.

    • 1970-01-01 10 hours ago

      Don't forget about the target on Chris Krebs for securing elections.

    • skeeter2020 10 hours ago

      this wasn't an article it was an opinion piece.

      • prophesi 10 hours ago

        My bad, the headline certainly makes it sound like it should be informative.

  • kazinator 3 hours ago

    Maybe we need a CVE-like database that isn't dependent on the government of the USA? This is a weakness of the IT world as such.

    • bigyabai 2 hours ago

      The US government is a pretty good steward of this sorta thing. We're generally reliable, can afford to spend a few pennies securing a lucrative international export, and hold platform-owners responsible even when their executives hide or intentionally obfuscate issues for marketing purposes.

      Who else can you seriously suggest, knowing the past 10 years of CVE history? Subcontract it to Cisco or Oracle?

  • BLKNSLVR 13 hours ago

    Trump is going to be surprised for a second time that "everything's computer".

    • meindnoch 12 hours ago

      "The computer is huge, you know, I told Elon the other day, and by the way I was the first one to say this, the computer is tremendous, tremendously important. Baron, you know, he's so good with the computer, and that's what I said many times, you know, good genes, good genes. A friend of mine, great guy, very smart guy, told me the other day, Donald, the computer, and by the way, this is what most people don't realize in our country, [...]"

      • lynndotpy 11 hours ago

        Is this a real quote from Donald Trump, or a humorous "this-is-what-he-would-say" thing?

        • kevin_thibedeau 11 hours ago

          This is our weapon against Skynet. DonGPT will keep it perpetually confused with it's aimless rambles.

        • kayge 8 hours ago

          Here's a real one:

          “The county has, for whatever reason, also refused to produce the network routers. We want the routers, Sonny. Wendy, we got to get those routers, please. The routers. Come on, Kelly, we can get those routers. Those routers. You know what? We’re so beyond the routers, there’s so many fraudulent votes without the routers. But if you got those routers, what that will show, and they don’t want to give up the routers. They don’t want to give them. They are fighting like hell. Why are these commissioners fighting not to give the routers?”

          https://www.youtube.com/watch?v=dyzz9mUt6x0

        • JKCalhoun 11 hours ago

          It's hard to know. ;-)

        • 2OEH8eoCRo0 10 hours ago

          Look, having nuclear — my uncle was a great professor and scientist and engineer, Dr. John Trump at MIT; good genes, very good genes, OK, very smart, the Wharton School of Finance, very good, very smart — you know, if you're a conservative Republican, if I were a liberal, if, like, OK, if I ran as a liberal Democrat, they would say I'm one of the smartest people anywhere in the world — it's true! — but when you're a conservative Republican they try — oh, do they do a number — that's why I always start off: Went to Wharton, was a good student, went there, went there, did this, built a fortune — you know I have to give my like credentials all the time, because we're a little disadvantaged — but you look at the nuclear deal, the thing that really bothers me — it would have been so easy, and it's not as important as these lives are — nuclear is so powerful; my uncle explained that to me many, many years ago, the power and that was 35 years ago; he would explain the power of what's going to happen and he was right, who would have thought? — but when you look at what's going on with the four prisoners — now it used to be three, now it's four — but when it was three and even now, I would have said it's all in the messenger; fellas, and it is fellas because, you know, they don't, they haven't figured that the women are smarter right now than the men, so, you know, it's gonna take them about another 150 years — but the Persians are great negotiators, the Iranians are great negotiators, so, and they, they just killed, they just killed us, this is horrible.

      • greenie_beans 12 hours ago

        lmaoooo

  • nonrandomstring 13 hours ago

    Funding is irrelevant and a distraction. Dismantling civil cybersecurity is a way to expose a population to influence and other harms that necessitate more "strong-man" solutions later [0,1]. Only after they've destroyed "cyber defenses" can they claim a crisis and declare "cybsersecurity is dead, long live the new cybersecurity". And you can be damn sure it won't be security for you.

    [0] https://cybershow.uk/blog/posts/computer-security-is-a-polit...

    [1] https://cybershow.uk/blog/posts/usw/

  • ikekkdcjkfke 10 hours ago

    It is sabotage, but by who?

  • CivBase 10 hours ago

    Crazy idea: Decentralize the CVE across many nations so that no single organization has the power to eliminate it.

    Even if the US doesn't play ball, it's a public database right? Is there anything stopping the UN, EU, UK, Australia, etc from copying it and establishing their own joint CVE?

  • gadders 10 hours ago

    "The Washington Monument syndrome, also known as the Mount Rushmore syndrome or the firemen first principle, is a term used to describe the phenomenon of government agencies in the United States cutting the most visible or appreciated service provided by the government when faced with budget cuts."

    https://en.wikipedia.org/wiki/Washington_Monument_syndrome

    • vonneumannstan 9 hours ago

      Not sure this fits. Outside HN types how much of the general public cares about or understands Cyber Security?

      • gadders 8 hours ago

        True, but for people in the business that are going to complain, this is the most visible high profile piece.

    • 9 hours ago
      [deleted]
  • 9 hours ago
    [deleted]
  • caseysoftware 10 hours ago

    [flagged]

    • watwut 10 hours ago

      Following quotes are from your own article. IBM did not called them slow or lazy. IBM blamed lack of resources and claimed more resources will improve things. IBM did NOT claimed that current resources are being used ineffectively.

      > Budget cuts are partially responsible for CVE analysis issues. As noted by Security Magazine, NIST funding was cut by 12% this year, making it more difficult for the agency to enrich CVEs. In practice, the NVD is effectively a downstream consumer of CVE data — while the number of CVEs found and reported remains steady, NIST’s ability to assess and enrich these vulnerabilities has been significantly reduced.

      > The sheer number of reported vulnerabilities also poses a problem for analysis efforts; Flashpoint research found that NIST reported 33,137 vulnerabilities in 2023. . In part, rising numbers are tied to improved detection capabilities.

    • 9 hours ago
      [deleted]
  • yieldcrv 13 hours ago

    > It's the global catalog that helps everyone – security teams, software vendors, researchers, governments – organize and talk about vulnerabilities using the same reference system

    so why was only the US federal government funding it, especially if it wasn't expensive to maintain?

    this is the follow up question to every headline and won't be seen as controversial later, so why bother treating it as controversial to say now

    • sigmarule 12 hours ago

      > especially if it wasn’t expensive to maintain

      Okay, so we’ve established that the cost of the endeavor is low.

      > it’s the global catalog that helps everyone organize and talk about vulnerabilities

      I would argue that leading and controlling the organization that provides the world with the single most ubiquitous cybersecurity resource justifies what you characterized as a meager cost in reputational capital alone.

      > this is the follow up question to every headline and won't be seen as controversial later, so why bother treating it as controversial to say now

      It’s not controversial, just a bit aloof.

      Control of something like the CVE registry is essentially a geopolitical concern at this point, i.e. there has been anxiety brewing about China’s vulnerability disclosure laws for a bit now, much of which is warranted as China has been preventing the disclosure of vulnerabilities and instead stockpiling 0days and leveling up their APT groups. Even if the US wouldn’t exert such blatant influence or control over the program, the fact that vulnerability disclosures are being sent to US entities, or even just traveling through IP space we control, may be alone enough for value to be extracted.

      This pattern could basically be viewed as the DOGE fallacy at this point.

      • dmix 11 hours ago

        > I would argue that leading and controlling the organization that provides the world with the single most ubiquitous cybersecurity resource justifies what you characterized as a meager cost in reputational capital alone.

        Someone in the original HN thread about funding wrote a post explaining how poorly run CVE org was and it had been like that for years. It had a giant backlog, ignored criticism, and moved very slowly.

        Then the second it shutdown a volunteer organization was assembled overnight.

        > Control of something like the CVE registry is essentially a geopolitical concern at this point

        This is purely a reputational concern. Being on government networks doesn't make it instantly more trustworthy or safe. Just like everything regarding security it takes lots of people looking at it, people reporting issues, and an organization that deals with issues promptly.

        • sigmarule 6 hours ago

          > Someone in the original HN thread about funding wrote a post explaining how poorly run CVE org was and it had been like that for years.

          Sure, but that doesn’t change anything, does it? Most people that use or have benefited from the CVE program are not even aware of these criticisms, and I’d be willing to bet that the majority of people who _are_ aware only became so in the past week.

          > This is purely a reputational concern. Being on government networks doesn't make it instantly more trustworthy or safe.

          I did not say the concern was the safety of the CVE program. The concern is influence over the world’s inbox for 0days and the tangible ways that can be used to a nation’s benefit. It is most certainly not just a reputational concern. If China had stepped in last week and took the reins there would be groups within both industry and government having mild freakouts this week.

    • mxuribe 13 hours ago

      I think others have already stated about the U.S. having a leadership position by running this...So i'll just comment on the the funding of this DB. I mean, sure, i'm all for optimizing things...but it strikes me that some decisions by the current U.S. administration - like not wanting to fund this - seem very penny wise and pound foolish. Like, for whatever it costs to run this DB (and i truly have no idea of the costs), i bet you that the operational benefits to U.s. companies, organizations is well worth the spend. Separate of any political benefits, i'm referring to hard and tactical benefits that arise from this existing. Someone is simply looking at a long list of items on a budget, not understanding that each item might have different weights, values, etc...and simply slashing like a toddler...and either not caring the ramifications, or not understanding them (or secondary trickle effects).

    • esskay 13 hours ago

      For the same reason the US considers its self the "leader" of the world. You can't have it both ways, if you want to "lead", you've gotta pay for it.

      • yieldcrv 6 hours ago

        then you might be pleased to know that I don't want to have it either way

        let's fix our own cities and domestic infrastructure projects while pulling back the federal government, just like we are doing

        • mrguyorama 2 hours ago

          The pittance we pay to support things that benefit all humanity have never prevented us from investing in the US.

          You don't need to put the federal government in a wood chipper to make the US better, and in fact you often need the federal government to make the US better, like with social security, food stamps, medicaid, the interstate, railroads, most of our infrastructure, the internet, microchips, etc.

          In fact, if you want the best infrastructure, why wouldn't you end up importing that? Most of humanity is not a US citizen. "The best" human at something will only rarely be american.

          Meanwhile this admin has done nothing to improve things for americans, so stop carrying water for their horse shit.

          People love the meme of a runway full of F35s and saying "We are about to demonstrate why the US doesn't have socialized medicine" and it has always been a lie. We can EASILY afford 3k F35s, 13 aircraft carriers, AND healthcare. We've been paying more for healthcare than countries with socialized medicine this whole time.

          • yieldcrv 36 minutes ago

            > We can EASILY afford 3k F35s, 13 aircraft carriers, AND healthcare

            I'm aware but there is no consensus for that, or addressing the budget, all while our infrastructure crumbles at the same time.

            Now there is at least an attempt to address our budget. Regarding foreign policy, other leading nations are not giving aid, they are investing. We could just as easily do our "soft power" stuff in a more equitable way. Every controversial budget change, that's even mocked by leaders of G-7 nations, are things those G-7 nations are already doing. Aid for repayment? yeah they're doing that. Not a controversial concept in reality.

            And yes, I still want the federal government to do the things you mentioned regarding federal highways, railroads... infrastructure projects we both agree on.

      • ryao 13 hours ago

        Has the U.S. ever claimed to be the leader of the world? I do not think any country has ever claimed that title. The closest to it would be some of the remarks that are supposedly made to each Pope upon becoming Pope.

        That said, there is the similar sounding title called “the leader of the free world” applied to the U.S. president since the end of WWII. I always thought that was the result of military alliances, not the CVE program, which post dates it.

        Edit: To the downvoters, I take issue with the assertion that the U.S. has claimed the title “leader of the world”. That is applied to the Pope during papal inaugurations and as far as I know, has never been formally applied to the United States. It seems to have been invented this year as part of claims that the U.S. has an obligation to spend money on programs that benefit others, given that the current political situation has made a number of them appear to be in jeopardy, but that appears to be a rewrite of history, rather than any historical truth. My sole interest here is the historical truth, and not politics.

        • K0balt 11 hours ago

          The USA has, by any measure, a veritable monopoly of coercive force on the world stage. Their military expenditure is more than the next 15 countries combined.

          This means they have the capability to enforce their will globally to a significant extent. In an arena such as geopolitics, justice is the will of the stronger, no holds barred. This makes the USA arguably the primary concern in geopolitics, the ring you need to kiss to do anything on that stage.

          Keep in mind that “claimed” may be referring to the sense of “won” rather than “stated”.

          From that perspective it’s not too much of a stretch to call them the world leader, but that does ignore the fact that leadership implies the will to lead and to a significant extent the requisite wisdom and skills.

        • noelwelsh 13 hours ago
          • ryao 13 hours ago

            Leader of the world and leader of the free world are two different things. As far as I know, no country in the past century has called itself either of them. I would not be surprised if the title was applied to countries such as the Imperium Romanum and 中國 in the distant past. Even more distant would be possibly Greece given that it’s leader was called the King of Kings around the time of Troy.

            However, I believe both titles are applied to specific office holders in the modern day. The U.S. president is called the leader of the free world by many. I believe the title leader of the world is bestowed upon the Pope during Papal inaugurations.

            • locopati 13 hours ago

              With all due respect, you're being pedantic. No, we're not talking about official titles bestowed from on high. The US has been considered the world leader from WW2 until sometime in the 21st century, partly because nobody else wanted to claim it, partly because American foreign policy is aggressive, partly because the American economy was the most robust on in the aftermath of WW2.

              • ryao 13 hours ago

                The U.S. has never been the world leader. The U.S. has been a military leader for other democracies since the end of WWII. That is why the title, leader of the free world has been applied to the U.S. president, who is the leader of the various military alliances between various major democracies. If you claim the U.S. considered itself to be the world leader, then you are claiming the U.S. considered itself to be the leader of the Soviet Union, the Warsaw pact, North Korea, etcetera. That is absurd. The U.S. likely did consider itself the leader of Vietnam and Cuba before the democracies in those countries fell, although that was in a military capacity. That is why the U.S. intervened militarily in both, although both interventions failed.

                Saying that the U.S. got its leadership position because no one else wanted it is historically incorrect. Following WWII, every other major democratic power was in ruins while the U.S. was the sole major power left in tact. Without any military attacks on U.S. soil, U.S. military strength had skyrocketed during the war. As the war progressed, the U.S. attained the status of a great power and by the war’s end had become a nascent super power. U.S. strength continued to grow after the war due to the threat of the Soviet Union. Meanwhile, the other great powers never fully recovered militarily since they focused on their economies while relying on the U.S. for security. The U.S. gained its leadership position because no one else existed that could claim it.

                • fooList 12 hours ago

                  If I say, “I like to lead by example”, that can mean leadership in the moral sense of progressive politics. Americans view America that way, as the leader of liberalism and social justice. Even Americans who don’t see America or American history that way, tend to see themselves (ironically?) that way. But that’s a different meaning of leader. We lead by things like protests, humanitarian aid and having enlightened celebrities.

        • tokai 12 hours ago

          Provide a source on the Pope thing please.

        • emptyfile 10 hours ago

          [dead]

    • troyvit 5 hours ago

      > so why was only the US federal government funding it, especially if it wasn't expensive to maintain?

      I want to flip this question around as if it was asked by somebody from a country other than the U.S. If I was looking at America since 9/11 from the outside, I would see a country that was trying to destabilize itself. It started out slowly enough, but as the years have progressed the wobble has become more and more pronounced until today, where the U.S.'s trustworthiness is lower than I personally ever thought it could go. And it's going to get worse.

      So if I lived outside the U.S. I would be asking the very same question: Why would a government that is so unstable and so dangerously powerful be in charge of something that the world kind-of would like to depend on? And I'd start my own version of it asap. I understand from the Reg article that the U.S. extended its contract in the 11th hour, but that just speaks to the point more than anything else.

      • yieldcrv 5 hours ago

        It suggests that an apathetic world and private sector globally is mildly amused that the US uses its resources this way on things they rely on

        or it suggests that an entire world and private sector is so uncoordinated and budget strapped globally that all this - at least these things - is held together by the US

        I'm pleased to find out. I'm dismayed at how disruptive doing so has to be, but its either accepting the concept of American exceptionalism, or stepping up and proving the apathy was giving America a bad deal and calling into question how much of an ally anyone was

    • jasonjayr 13 hours ago

      By US funding it, the US gets to be a first mover, and a leader in this space.

    • exceptione 12 hours ago

      It is a matter of whether you prefer transnational organized crime or not.

      Businesses, Science and individuals thrive in societies that are democratic, with separation of powers and independent judiciary. The better they function, the harder it is for crime.

      On the other hand, if you allow organized crime to prosper, take control of it, and on the other hand have the judiciary in your grip, you can play both cards against your political/business enemies.

      This is the model of Russia, where the State is deeply connected to transnational organized crime. The Kremlin powers really wanted Viktor Bout free. Now, if the power brokers in the media landscape wanted to tell you the big picture instead of hyper focusing on the day to day circus... (that is also why journalism /= actualities).

      So these are just necessary steps to clear roadblocks for crime networks. The same for IRS. In Russia you cannot get power without Kompromat on yourself. Like the maffia, the boss needs a kill switch on everyone.

      From a higher perspective, it is a bit unfortunate that these transgressive steps were foreseen in academia, those despicable expertise centra in the EU and other democratic countries, while the general public is kept in the dark by media houses.

      I am not sure if it still suitable for HN or that the Overton Window shifted too much already, but the other things that were forecast are the capturing of conservatism by the same networks. We expect also to see further normalization of law breaking, power abuse, power concentration and state capture by non-elected bodies. Yes, this was a normalization process of decades. But now on full acceleration. As an aside, it is not entirely a coincidence that "Accelerationism" is the ideology of associated power circles.

      And now you also know how Tech Bro's and Conservatism could share the same campaign. Their intended outcomes differ on some points, but they agree on the path to their respective ideals. The extreme destruction that follows will not touch them personally. To ensure that last thing they unlock powers for them self: become the law.

    • aqme28 13 hours ago

      As opposed to who else funding it?

      • anannymoose 13 hours ago

        The UN? Make it an international cooperative effort?

        • JKCalhoun 11 hours ago

          Generally you would make plans to do that first — before cutting off your nose so to speak.

        • tokai 13 hours ago

          As US is cutting UN funding and pushing friends away? Good luck with that.

        • catlikesshrimp 11 hours ago

          The US is not the best friend of UN. Out of the WHO, menaces the ICJ, vetos that go against the democratic countries and a few times match russia. Trump out of the climate accord. Trump quit UN rights council, Trump cuts UNRWA funding.

          You may agree with some, but there is a pattern.

          I am waiting for it to leave the FAO. Not hoping, waiting.

          • HideousKojima 10 hours ago

            >menaces the ICJ

            The ICJ started that particular fight by issuing arrest warrants against non-signatories, something explicitly outside of its power and purview.

        • micromacrofoot 12 hours ago

          do you think this is what they're actually trying to do

          • ndsipa_pomu 10 hours ago

            Obviously not or they would have gone about it differently - i.e. talking with other organisations and making plans

        • freen 13 hours ago

          Ahh, yes, this is exactly how one goes about making it a cooperative effort, which is something this administration is clearly an expert at doing.

          • _heimdall 13 hours ago

            Your snark misses the fact that the program has been funded by the US for 25 years and the decision to not make it a UN project has nothing to do with the current administration.

            • viraptor 12 hours ago

              Trying to cut it immediately instead of saying "ok, it needs to become a joint international effort starting on (a date months ahead)" is the issue with the current administration. Running it is fine, handing it over is fine, suddenly making a huge mess is not.

              That's the missing cooperation.

            • watwut 9 hours ago

              I am confused about what UN has to do with America shutting down services whose primary goal was to protect American infrastructure, government and companies.

              Some UN nations are quite happy about this, because it will make it easier to access what they want in US.

              • _heimdall 9 hours ago

                Only that the earlier comments raised that if the program was important it should be run by the UN rather than the US.

    • panja 13 hours ago

      Because it's a good value for what we get

    • croes 13 hours ago

      Because it’s a US organization and is a former military think tank.

    • freen 13 hours ago

      Well, we did make the damn thing in the first place.

    • noelwelsh 13 hours ago

      Completely irrelevant. Deliberately or not you're repeating the Trump / DOGE talking point of government expense, focused on expenses that individually and in aggregate contribute practically nothing to the federal budget.

      • galangalalgol 11 hours ago

        I agree wholeheartedly in this case. But gutting the epa will almost certainly boost the gdp far more than the amount directly saved. At least in the short term. Burning rivers are a lot harder to clean up than tech debt. I think the idea was to free up a bunch of labor to replace the perfectly good spigot of labor we had in the form of legal immigration, and get rid of a lot of regulations that inhibit short term gdp all in one swell foop. The tariffs were always primarily a negotiating strategy to get everyone to allow us to weaken the dollar, which unlike tariffs would outlast an administration and eventually bring manufacturing back for that freed up labor. In the interim there would be a ton of infrastructure spending to employ the labor as the lack is limiting our gdp by 1-2%. It was a decent plan except that long temr it ignored the environmental costs. The execution of the tariffs got screwed up though because while chaos is good for negotiation, it is not good in a sales pitch, which is essentially what this was. Let us weaken the dollar without responding and continuing to purchase bonds and we'll keep buying plent of your stuff, we have consumer demand to spare, and the gdp boost will offset the weakened dollar while making our bonds even safer as we begin to grow the gdp relative to the debt. The reason some allies like Australia and Canada got tariffs despite it not making any economic sense is different. In addition to sacrificing the environment, this plan sacrifices us democracy, and you can't have easy travel to a place with lots of individual freedom or you get the flight of all skilled labor like in Hungary.

        Anyway, we are going to get the bad parts of the plan without the benefits now. Not entirely too late but pretty close. We can't all wait until a blatant constitutional crisis to start protesting because the court will back down where it can without openly loosing legitimacy. And once the admin chooses to cross the red line they will be ready for the response. Show support to gop members who want to stand up but are afraid of primaries (and death threats). Even promise cross party primary support where that is possible. Don't go along with illegal stuff. Tell the dnc your only priority is democracy and to stop arguing about the rest. Go to protests. Talk to people you disagree with calmly and do it a lot. Don't flee, this is endgame, nowhere else will hold out all that long. Help people get their voter registration in order with stuff like voterider to combat voter suppression.

        Ok that was cathartic to type out all at once. If you don't see it then go read the history of successful and failed takeovers from rome to the present. It is a color by numbers approach that is easy to recognize once you've seen the others, but done super faster and with no visible bloodshed. And with a lot less public support than is normal for such things. Kind of impressive in a horrifying way.

        • 8 hours ago
          [deleted]
      • macintux 11 hours ago

        It's clear that Trumps sees everything as zero sum. If he can't see that he's personally and directly benefiting, clearly it's a waste of money.

      • yieldcrv 6 hours ago

        > Deliberately or not you're repeating the Trump / DOGE talking point of government expense

        Its a run of the mill libertarian position

        It doesn't matter which politician or administration does it from that perspective. Those two do happen to be a coalition with libertarian constituents that they courted for votes, so its more than happenstance that the positions and actions will sound the same.

        Regardless, private funding isn't controversial. The US Federal government reaching parity with the same level of apathy of every other government organization in the world isn't controversial either.

    • OfficeChad 12 hours ago

      [dead]