Challenge to the Editorial Board - 500 CVE entries by Y2K

["Steven M. Christey" <coley@linus.mitre.org>]

All:

After this week's NISSC conference, we will be able to get back on
track with respect to adding new entries to CVE, defining the related
issues, and prioritizing other technical activities.

Here are some of the high-level technical activities that still need
to be undertaken:

1) Adding more entries to CVE
2) Defining and measuring CVE compatibility
3) Discussing unresolved content decisions
4) Defining process for bringing in brand-new entries
5) Defining process/mechanisms for new CNA's to propose entries
6) Identifying and addressing mapping issues
7) Candidate issues - access to candidate data, how public, etc.

With the exception of adding more entries, all other activities will
take a lot of time, thought, experimentation, and discussion before
they can be resolved.  There may not be any real concrete results for
months.  There is also a risk of muddying the waters by pursuing too
many things at one time, as we all discovered this summer with the
onslaught of various content decisions and other issues.

With the attention that CVE has garnered in recent weeks, the Board
needs to continue to make a concrete statement of its commitment to
the CVE Initiative.  Defining, achieving, and promoting CVE
compatibility is one way to do so.  Another concrete way is to add
more CVE entries.

Based on the rate of previous approvals of CVE entries, it is not
unreasonable to believe that CVE could contain 500 entries by Friday,
December 31, 1999.  I challenge the Board to meet this goal.

Most of the remaining candidates at this time are associated with at
least one non-resolved content decision, some of which will probably
take some time to finalize.  But there aren't any candidates that are
more recent than April 1999, either.

I suggest that Board members collect a list of their "top 100" entries
that they want to be added to CVE.  I will then collect all of these
"top 100" lists, combine them, and propose additional clusters.  This
approach will help to (a) have CVE include more recently discovered
problems, (b) focus the back-log on the priorities of various Board
members, which hopefully reflect the needs of their associated
constituencies, and (c) get a much larger set of candidate numbers
available, regardless of how quickly they are approved.

Please do not send your top 100 lists yet, as I am working on defining
a specific format which will help the task of data integration.  (Note
that this task will also help to deal with other issues,
e.g. candidate submissions from other CNA's.)  I'll have a format in
about a week or so.

If Board members submit their top 100 lists by November 1, that will
allow approximately 8 weeks to approve an additional 179 entries to
achieve the goal of 500 approved entries by Y2K.

- Steve