Andrew Lilley Brinker

You know his opposition has nothing when the scandal is “sometimes he plays basketball at the police academy”

Magical Athlete is a very fun board game *and* demonstrates the chaos that can emerge from the intersection of facially-simple rules.

The premise of the game is players play multiple rounds racing around a relatively simple board. Each racer character has a single power, and each power can be explained in 1-2 sentences. Yet the intersection of powers can lead to absolutely chaotic turns.

Oh nice, the CVE program now ships an official JS library for validating CVE records before submitting them. I originally pitched this at a CVE Quality Working group meeting. Glad it’s out now!

Previously, the best you could do was check against the official JSON schema, but that didn’t cover all the checks that the REST API actually does. This library fixes that. It’s JSON schema validation plus all the other checks, and it’s used inside the API itself so the library won’t drift.

Oh nice, the CVE program now ships an official JS library for validating CVE records before submitting them. I originally pitched this at a CVE Quality Working group meeting. Glad it’s out now!

In addition to the abject racism, the rest of the new rules make clear r/opensource is committed to being a highly insular, exclusionary community. Projects posted must be successful long-term projects with active communities. The person posting must be a long-time active Redditor.

Good news in vuln management world: CNAs of Last Resort issue less than 5% of all vulnerabilities now. That’s a win for the quality of CVE records. No org is equipped to do high-context vuln-report assessments from security researchers across *all* software or hardware.

There’s a weird ecosystem of vuln management greybeards who spend a lot of time fixated on the quality of CNA-LR CVE records, while missing how the importance of those has been dropping. The CVE program recognized 10 years ago that they needed federation to scale, so they made it happen.

You might wonder why the graph started ticking up around ~2016. That’s when CVE began aggressively enrolling more CVE Numbering Authorities! CVE is a federated system, and CNAs are the orgs approved to issue new CVE Records. In Jan 2016 there were 23 CNAs. Today there are 559.

Got curious and had Claude whip these up from the cvelistv5 repo.

You might wonder why the graph started ticking up around ~2016. That’s when CVE began aggressively enrolling more CVE Numbering Authorities! CVE is a federated system, and CNAs are the orgs approved to issue new CVE Records. In Jan 2016 there were 23 CNAs. Today there are 559.

This federation avoids bottlenecking CVE issuance on a small number of orgs. It also means CVEs can be issued by orgs with more domain expertise in the specific software/hardware affected by the vuln! (disclosure: I previously worked at MITRE on the CVE program, though not in MITRE’s CNA side)

Coordinated disclosure is good, especially since a description of a vuln is often enough for AI to discover it even if you don’t publish a PoC exploit. You don’t *have* to coordinate, but I and others will think less of you when you prioritize self-promotion over protecting users.

A large number of National Bodies (country-specific standards orgs participating in WG21 at ISO) abstained or voted against approving C++26. NBs vote as units for the approval of a complete draft standard. The main sticking point is about contracts.

IMO, if C++ really fails to ship contracts here, thereby slipping them to C++29 at the earliest, it’s another nail in the coffin and C++ will continue on its slow decline toward being a legacy language.

A large number of National Bodies (country-specific standards orgs participating in WG21 at ISO) abstained or voted against approving C++26. NBs vote as units for the approval of a complete draft standard. The main sticking point is about contracts.

Bad day to launch my PHP based certificate authority

Vaccines equipped. +2 immunity, 1 stack of Arm Hurts

Vaccines are good and you should get your flu and COVID shots if you haven’t yet.

Lobsters admins trying to fix the mess of how LLMs are treated on the site is laudable, but likely to be very painful since the site has grown an extraordinarily hostile and abusive culture generally and toward LLMs specifically.

One enormous joy with Claude Code on my phone is I can make little chunks of progress on fun projects when I otherwise might have scrolled reels or Bluesky.

I’m not trying to maximize productivity or anything, and feel no pull that I *need* to work on projects when I can. It’s just fun to have the option! Relatedly, I might have new stuff to share soon!