A long, long time ago I can still remember How those CVEs would make me smile And I knew if I had my chance To patch a vuln or take a stance Maybe we’d be secure for a while
But April ides made me shiver With each leaked memo and press release delivered Bad news on the doorstep Couldn’t take one more step
I can’t remember if I sighed When I read about the program’s demise But something broke me deep inside The day the CVE died
So bye, bye, MITRE’s CVE pie Checked the vuln feed in my Feely But the Feedly ran dry And them good old nerds were drinking whiskey and rye Singin’, “This’ll be the day that I sigh This’ll be the day that I sigh”
Did you write the book of flaws And do you have faith in CISA’s cause As the budget fails you so? Do you believe in NVD Can it save our infosec sanity Now that MITRE’s left out in the cold?
Well, I know you’re chasing vulns with me Saw your commits in the CVE tree We both diffed those exploit clues Man, I miss those vuln ID blues
I was a lonely analyst on the hunt With a zero-day and a coffee cup But I knew I was out of luck The day the CVE died
I started singing Bye, bye, MITRE’s CVE pie Checked the vuln feed in my Feely But the Feedly ran dry And them good old nerds were drinking whiskey and rye Singin’, “This’ll be the day that I sigh This’ll be the day that I sigh”
Now for twenty-five years we’ve been on our own But the funding’s gone, the seeds are sown That’s not how it used to be When MITRE sang for DHS And catalogued every software mess In a voice that came from you and me
Oh, and while the vendors looked around The hackers stole the thorny crown No verdict was returned And the vuln world, it just burned And while defenders read advisories The attackers practiced in the dark And we sang dirges in the park The day the CVE died
We were singing Bye, bye, MITRE’s CVE pie Checked the vuln feed in my Feely But the Feedly ran dry And them good old nerds were drinking whiskey and rye Singin’, “This’ll be the day that I sigh This’ll be the day that I sigh”
Helter skelter before the summer swelter The KEV flew off with no shelter Zero-days high and falling fast It landed foul on the grass The vendors tried for a forward pass With MITRE on the sidelines in a cast
Now the half-time air was sweet perfume While the Red Team played a marching tune We all got up to dance Oh, but we never got the chance ‘Cause the vendors tried to take the field The bug bounty band refused to yield Do you recall what was revealed The day the CVE died?
We started singing Bye, bye, MITRE’s CVE pie Checked the vuln feed in my Feely But the Feedly ran dry And them good old nerds were drinking whiskey and rye Singin’, “This’ll be the day that I sigh
Oh, and there we were all in one place A generation lost in cyberspace With no time left to start again So come on: Jack be nimble, Jack be quick Jack Flash sat on a candlestick ‘Cause fire is the hacker’s only friend
Oh, and as I watched it on the stage My hands were clenched in fists of rage No angel born in hell Could break that budget spell And as the flames climbed high into the night To light the sacrificial rite I saw Musk laughing with delight The day the CVE died
He was singing Bye, bye, MITRE’s CVE pie Checked the vuln feed in my Feely But the Feedly ran dry And them good old nerds were drinking whiskey and rye Singin’, “This’ll be the day that I sigh
I met a dev who sang the blues And I asked her for some happy news But she just smiled and turned away I went down to the sacred store Where I’d checked for CVEs before But the sysadmin said the feeds wouldn’t play
And in the streets, the hackers screamed The CISOs cried, and the devs all dreamed But not a word was spoken The patching chain was broken And the three things I admire most: The patch, the fix, and the vuln disclosure post They caught the last train for the coast The day the CVE died
And they were singing Bye, bye, MITRE’s CVE pie Drove my vuln feed to the levee But the levee ran dry And them good old nerds were drinking whiskey and rye Singin’, “This’ll be the day that I sigh This’ll be the day that I sigh”
No comments yet.