1

How authoritative and comprehensive is NIST's CPE, as a list of applications, hardware and operating systems? It's clearly a vast labour for which I am grateful, but I need to know how good it is.

Specifically, I am wondering about coverage of manufacturers (inclusion seems a bit optional, particularly for Open Source), products, depth of versions (e.g. RHEL 6.x sub-versions all listed but version 5 mentioned without sub-version lists), naming (e.g. Red Hat vs RedHat), and currency (how quickly do new products find their way into the list?)

Improve this question

1 Answer 1

Reset to default
2

It seems hard to measure or define just how comprehensive the list of manufacturers or products are - you would need to somehow measure it against an even more comprehensive list

For naming, they have produced a Naming Specification detailing how the process works: https://csrc.nist.gov/publications/detail/nistir/7695/final

For currency, again you would need compare against some other source of data but you could spot check specific items. It is updated very frequently - there is a consistent pattern of a large number of updates going back many years, which you can see here: https://nvd.nist.gov/products/cpe/statistics

Improve this answer
2
  • Thanks for the helpful response. Not sure one necessarily needs a more comprehensive list. If you have a map of a town you don't need a better map to assess whether it's good: you can try using the map a few times irl. Just looking myself e.g. Red Hat gave an indication very quickly of a few possible holes. I expect that some expert here will have a much better picture than I do.
    – Laska
    May 30, 2019 at 12:29
  • @Laska I sort of expect no expert to have a good picture. Using the map analogy, you're only going to find how useful the map is for your piece of the world. You can't know how good the map is for everyone else. I suspect CPE is similar. For many it's going to be comprehensive. For others it's going to be useless. There's plenty of people that use 30+ year old software applications. I doubt that's going to be in CPE.
    – Steve Sether
    May 30, 2019 at 19:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .