MITRE reorganized their assignment policy last year. They introduced a list of covered products and excluded other products from CVEs.
This year, they again opened up CVEs to all existing software, except open source software not in a list of covered products. Those are delegated to the DWF. But they also say that they are the CNA for "any other products not list on this page".
The DWF says that they only cover issues that are already public. This means that one would first have to disclose an issue without CVE before requesting a CVE, which seems to be going against the purpose of CVEs. I would assume that the purpose of the DWF is mainly to cover issues for which the researcher for some reason did not want to request a CVE themselves? And can it be assumed that the process of assigning CVEs to issues which are send to mailing lists (what MITRE called "Partial Coverage Sources") is discontinued with the establishment of the DWF (so there is no danger of double-assignment)?
Should I request a CVE via MITRE for issues in open-source software which are not yet public and not in the list of covered products, or should I publish them and afterwards request a CVE via DWF?