New url policy?

[phillmv]

Hey folks,

So last few days I've noticed that we often offer more information than the equivalent OSVDB links we point to.

We don't want to duplicate ID efforts; clearly we should stick to OSVDB and CVE values. But given the choice between a github issue/an advisory published by the author(s)/maintainers and a sparse OSVDB, it seems like it would make more sense and be more informative to point to the original upstream announcement.

Given the OSVDB, one can always regenerate that link. Alternatively, we can modify the schema to add multiple urls in case there are multiple pieces of context.

Does anyone have any thoughts or objections on this?

[mveytsman]

👍

[postmodern]

Yep, go with the authoritative advisory URL from the project, if available.