A long, long time ago
I can still remember
How those CVEs would make me smile
And I knew if I had my chance
To patch a vuln or take a stance
Maybe we’d be secure for a while
But April ides made me shiver
With each leaked memo and press release delivered
Bad news on the doorstep
Couldn’t take one more step
I can’t remember if I sighed
When I read about the program’s demise
But something broke me deep inside
The day the CVE died
So bye, bye, MITRE’s CVE pie
Checked the vuln feed in my Feely
But the Feedly ran dry
And them good old nerds were drinking whiskey and rye
Singin’, “This’ll be the day that I sigh
This’ll be the day that I sigh”
Did you write the book of flaws
And do you have faith in CISA’s cause
As the budget fails you so?
Do you believe in NVD
Can it save our infosec sanity
Now that MITRE’s left out in the cold?
Well, I know you’re chasing vulns with me
Saw your commits in the CVE tree
We both diffed those exploit clues
Man, I miss those vuln ID blues
I was a lonely analyst on the hunt
With a zero-day and a coffee cup
But I knew I was out of luck
The day the CVE died
I started singing
Bye, bye, MITRE’s CVE pie
Checked the vuln feed in my Feely
But the Feedly ran dry
And them good old nerds were drinking whiskey and rye
Singin’, “This’ll be the day that I sigh
This’ll be the day that I sigh”
Now for twenty-five years we’ve been on our own
But the funding’s gone, the seeds are sown
That’s not how it used to be
When MITRE sang for DHS
And catalogued every software mess
In a voice that came from you and me
Oh, and while the vendors looked around
The hackers stole the thorny crown
No verdict was returned
And the vuln world, it just burned
And while defenders read advisories
The attackers practiced in the dark
And we sang dirges in the park
The day the CVE died
We were singing
Bye, bye, MITRE’s CVE pie
Checked the vuln feed in my Feely
But the Feedly ran dry
And them good old nerds were drinking whiskey and rye
Singin’, “This’ll be the day that I sigh
This’ll be the day that I sigh”
Helter skelter before the summer swelter
The KEV flew off with no shelter
Zero-days high and falling fast
It landed foul on the grass
The vendors tried for a forward pass
With MITRE on the sidelines in a cast
Now the half-time air was sweet perfume
While the Red Team played a marching tune
We all got up to dance
Oh, but we never got the chance
‘Cause the vendors tried to take the field
The bug bounty band refused to yield
Do you recall what was revealed
The day the CVE died?
We started singing
Bye, bye, MITRE’s CVE pie
Checked the vuln feed in my Feely
But the Feedly ran dry
And them good old nerds were drinking whiskey and rye
Singin’, “This’ll be the day that I sigh
Oh, and there we were all in one place
A generation lost in cyberspace
With no time left to start again
So come on: Jack be nimble, Jack be quick
Jack Flash sat on a candlestick
‘Cause fire is the hacker’s only friend
Oh, and as I watched it on the stage
My hands were clenched in fists of rage
No angel born in hell
Could break that budget spell
And as the flames climbed high into the night
To light the sacrificial rite
I saw Musk laughing with delight
The day the CVE died
He was singing
Bye, bye, MITRE’s CVE pie
Checked the vuln feed in my Feely
But the Feedly ran dry
And them good old nerds were drinking whiskey and rye
Singin’, “This’ll be the day that I sigh
I met a dev who sang the blues
And I asked her for some happy news
But she just smiled and turned away
I went down to the sacred store
Where I’d checked for CVEs before
But the sysadmin said the feeds wouldn’t play
And in the streets, the hackers screamed
The CISOs cried, and the devs all dreamed
But not a word was spoken
The patching chain was broken
And the three things I admire most:
The patch, the fix, and the vuln disclosure post
They caught the last train for the coast
The day the CVE died
And they were singing
Bye, bye, MITRE’s CVE pie
Drove my vuln feed to the levee
But the levee ran dry
And them good old nerds were drinking whiskey and rye
Singin’, “This’ll be the day that I sigh
This’ll be the day that I sigh”
RSAC 2025 Sets A Dangerous Precedent for Cybersecurity Leadership
(I posted this on LI, but I like to own my content, so am also posting here.)
The cybersecurity community deserves better than what we’re witnessing at RSAC 2025, today.
While Kristi Noem delivers today’s keynote, the absence of traditional cybersecurity leaders from agencies like NSA and CISA speaks volumes about shifting priorities in our field. This contrast becomes even more troubling when viewed alongside recent developments with Chris Krebs. The former CISA director — widely respected for his defense of election security — has faced unprecedented retaliation: security clearances revoked, his employer SentinelOne effectively blacklisted, and federal investigations directed into his tenure for simply upholding the integrity of our democratic systems.
Meanwhile, Secretary Noem — who has publicly committed to “reining in” CISA’s disinformation efforts and called its election integrity work “shocking” — receives our industry’s most prestigious speaking platform. Her tenure at DHS has featured more political theater than substantive cybersecurity leadership — or just leadership in general — prioritizing spectacle over the technical expertise and collaborative approach our field demands.
RSAC has always represented rigorous, forward-thinking discussion about defending critical infrastructure and fostering trust in technology. By elevating political figures who undermine the very principles our community stands for — while one of our most principled voices faces silencing — we’re accepting a dangerous new standard.
The cybersecurity field requires leaders who value expertise, accountability, and the defense of democratic norms. We must ask ourselves: what message are we sending about our professional values when we applaud those who work to dismantle the very protections we’ve built?
Every individual involved with RSAC who had a part to play in this decision should be deeply, deeply ashamed of themselves.