


>    vote was cast.  After the 2 week time period, the Editor may extend
>    the delay, or disregard the REVIEWING vote and move the candidate
>    to Interim Decision.

indicates to everyone that the issue is being reviewed by the voting
member, but should not be delayed in the approvai process.

>    member's vote cannot be counted towards the Quorum, unless the
>    competing organization has publicly acknowledged the problem.

Does this include the inferred vote that occurs when a competing
organization casts a MODIFY vote? Also, how is a competing organization
defined? Is it compartmentalized by vendors, academic, and government, or
perhaps IDS, VA, and other security products? (For that matter, are voting
members in the academic and governmental communities perceived as
competitors? :-) )

On a similar issue, would a MODIFY followed by a reference citation into
a voting member's database constitute a public acknowledgement of the
problem? I think I know the answer to this question, but I would like to see
it articulated for the record.

> Guidance
> --------


>    content decisions, instead of their own personal preferences.
>    Informally, a voting member should not REJECT a candidate if all of
>    the following apply:
>    - the candidate is not a duplicate of other candidates/entries
>    - it satisfies all approved content decisions (CD's)
>    - it satisfies CVE's vulnerability/exposure definition

Would it be appropriate to add a "no supporting documentation" clause to
this list? Although recent entries do not (usually) have this problem, some
older CANs have no references. It's not good form to prevent a voting member
from casting a REJECT just because CVE claims that an issue exists without
external support.

>    a security problem in a competitor's product, unless the competitor
>    has acknowledged that the problem exists.

Again, would a MODIFY followed by a reference citation suffice as
acknowledgement? Personally, I'm in it for the security, and I'll leave the
cutthroats in Marketing. :->

Thanks for getting these content decisions rolling.

Andre Frech

Internet Security Systems

Page Last Updated or Reviewed: May 22, 2007