Open Source Vulnerability Database Goes Live

Alascom writes "The Open Source Vulnerability Database project has finally gone live. The project aims to provide comprehensive, free and unbiased (no vendor spin) vulnerability information. The database is being incorporated into such fine open source utilities as SNORT and NESSUS."

Comments

Running on PostgreSQL, too...

[tcopeland]

...per the database info page.

<shameless>
Hey OSVBD folks, here's a little utility to do do some PostgreSQL query analysis!
</shameless>

Naming is important

[Space cowboy]

The name implied to me that it is only vulnerabilities in Open Source programs/systems that will be tracked, but reading the FAQ it seems to be that the database itself is open-source, and the database covers all systems. I think they could have named it better.

Simon

securityfocus

[Anonymous Coward]

is'nt securityfocus doing that already?

Mmmmm....

[jwthompson2]

No vendor spin on security issues. Now we can know the truth to the best of our ability without corporate FUD, hype or downplay.

Gotta love technology when it helps get the full-truth out there.

Can hear MS from here

[Phisbut]

I can hear it from here... Microsoft saying "See, Open Source isn't more secure than our stuff... there is a public database that all hackers and crackers can use to exploit known vulnerabilities..."

How long will it take till they say that?

Re:Can hear MS from here

[MrRuslan]

I tought The Knowledge Base base was limited to mostly microsoft products...What I had in mind was a an independent database for all Windows software because some software causes windows to be worse than it actually is...And not just for bugs but also for general issues and annoyences...Like AOL advertising itself evrywhere after you install winamp or aim, and software changing your hompage and advertising in weired places on your system.

Re:Can hear MS from here

[kernelfoobar]

I've got to add tho, comparing security based on web search result not very precise.

Cool!

[MrFreshly]

This should be done for all types of software...Perhaps developers will be a little more careful with their codeing and end users will be able to see just how secure the software is before they commit to it.

Finally == Security Focus BIASED as hell

[Anonymous Coward]

Security Focus became BIASED as heel from when Symantec bought them. Finally a really neutral source of information. Thank you for doing this guys ...

Re:Oh, yeah, this'll be *real* useful

[AKnightCowboy]

Yeah, this'll be *real* useful. A database with entries that become obsolete after eight hours. "There's a Linux kernel vulnerability, and it...aw, darn." ;-)

Why would the data become obsolete after 8 hours? Not everyone runs out and installs the latest version of something for the hell of it you know.

Re:already been done

[brennz]

The CVE is "A Dictionary, NOT a Database" of vulnerabilities. It appears you aren't familiar with the CVE

You would be better off to compare the OSVDB against the ICAT metabase

The ICAT has some serious shortcomings which makes my work a big PAIN! (try to cross reference a specific vulnerability that matches 10 vulnerabilities).

OSVDB appears to better personify the open source paradigm in general, as such, I'd like to extend a warm welcome.

We expect great things from you.

Re:Old news

[pmfp]

Which makes me wonder about Debian, they backport the patches and have a slow release cycle. The systems appear to be old and vulnerable, with only half of it being true... doesn't really match this reporting.