Re: FYI NVD legacy feeds are deprecated
Hi,
On Tue, Oct 11, 2022 at 11:57:23PM -0700, Andrew Pollock wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Hi,
>
> I was poking around at the scripts at
> https://salsa.debian.org/security-tracker-team/security-tracker and I
> noticed you're consuming the NVD's legacy JSON feeds.
>
> I wanted to make sure you're aware of deprecation and upcoming removal per
> https://nvd.nist.gov/General/News/change-timeline
>
> My day job involves working on OSV[1], and I'm planning on getting in touch
> soon to discuss if the OSV schema[2] would be useful to publish natively
> along with your existing DSAs. I'm first taking the time to school myself
> on how things currently operate before popping out of the blue with a
> proposal.
>
> I only recently learned of the deprecation myself, and it's required some
> course correction in how we're ingesting data from the NVD.
Actually we do not use to dislay NVD severities anymore (they are
quite useless in our context) and should remove them as well where
remaining as well from the rest of the tracker.
Thank you.
Regards,
Salvatore
Reply to: