OSVDB (Open Sourced Vulnerability Database)

» see osvdb.org as it lived, on the wayback machine

~ the obit ~

osvdb reached me as a number rather than as a website. point nikto at a web server and the output comes back in lines that start with an identifier like osvdb-3268, telling you it found directory indexing where there should not be any, and you read the finding without ever visiting the database being quoted. chris sullo wrote nikto and was one of the people running osvdb, which is why the two are stitched together that tightly.

the project started in august 2002, in the hallways of black hat and def con, among people including h.d. moore and the researcher who published as rain.forest.puppy. the complaint was straightforward. cve existed and was useful, but it was a government-funded identifier scheme with a slow intake, and the commercial databases were owned by companies selling scanners. neither one gave you a free and technically detailed record you could query and redistribute.

it took a year and a half and a change of management to actually ship. the database opened to the public on 31 march 2004, written in php by forrest rae and later rebuilt in rails by david shettler, under a 501(c)(3) called the open security foundation. the motto was "everything is vulnerable," and it ran for over a decade on a small rotation of project leads that included jake kouns and brian martin.

~ the rap sheet ~

~ what it actually held ~

the pitch was coverage. osvdb cataloged things cve had not gotten to and things cve had declined to assign, including a long tail of small web applications and forum mods that nobody official cared about but every penetration tester ran into. by december 2013 it was past a hundred thousand entries, each one written by hand by somebody reading a mailing list post or a vendor advisory and turning it into structured data.

that is the part worth sitting with. a vulnerability entry is not scraped. somebody reads a badly written disclosure and works out which versions are actually affected, then decides what the flaw really is and types it in. multiply that by a hundred thousand and you have an object that no individual can build and no company wanted to pay for. every scanner on the market had a copy of it embedded in its output.

~ the license nobody honored ~

the data was free for non-commercial use and required a license for anything else. that boundary was ignored on a large scale. security companies shipped products built on osvdb without buying a license and without contributing anything back to the foundation, which left a nonprofit subsidizing an industry that was billing its own customers for the result.

the defensive measures came late and made things worse. the site went behind cloudflare to stop the scrapers and bulk downloads were closed to anybody not paying. researchers who had contributed for years found themselves locked out of the corpus they had helped build. by then the argument had moved past technical fixes. it was about whether the people who ran it were willing to keep doing it for nothing.

~ the last post ~

on 5 april 2016 the site went to a farewell page. brian martin wrote that several of them had struggled for well over ten years to make it work at great personal expense, and that the industry simply did not want to contribute to and support such an effort. osvdb would not return and would not be resurrected in its previous form. the blog stayed up as a place to keep arguing about vulnerability data, which it did for years afterward.

the commercial descendant already existed. vulndb, run by risk based security and staffed partly by the same people, sells what osvdb gave away, and that is the actual ending: the volunteer version closed and the paid version continued. anybody who had been citing an osvdb id in a report or a scanner signature was left pointing at nothing, and twelve years of hand-written entries went out of public reach in a single afternoon.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »