I boosted several posts about this already, but since people keep asking if I've seen it....

MITRE has announced that its funding for the Common Vulnerabilities and Exposures (CVE) program and related programs, including the Common Weakness Enumeration Program, will expire on April 16. The CVE database is critical for anyone doing vulnerability management or security research, and for a whole lot of other uses. There isn't really anyone else left who does this, and it's typically been work that is paid for and supported by the US government, which is a major consumer of this information, btw.

I reached out to MITRE, and they confirmed it is for real. Here is the contract, which is through the Department of Homeland Security, and has been renewed annually on the 16th or 17th of April.

usaspending.gov/award/CONT_AWD…

MITRE's CVE database is likely going offline tomorrow. They have told me that for now, historical CVE records will be available at GitHub, github.com/CVEProject

Yosry Barsoum, vice president and director at MITRE's Center for Securing the Homeland, said:

“On Wednesday, April 16, 2025, funding for MITRE to develop, operate, and modernize the Common Vulnerabilities and Exposures (CVE®) Program and related programs, such as the Common Weakness Enumeration (CWE™) Program, will expire. The government continues to make considerable efforts to support MITRE’s role in the program and MITRE remains committed to CVE as a global resource.”

From the New Blog From Blazie Technologies:

Yes, BT Speak Can Do That Now- the April Edition

blazietech.com/post/april-acce…

#infosec people, THIS is big and you need it in front of management RIGHT NOW.

MITRE has informed the CVE board members that effective TONIGHT, funding to run CVE and CWE is effectively gone. The US federal government contracts MITRE to run these programs including both management, operations, and infrastructure.

This not only could but almost certainly will result in disruptions to CVE and CWE including a halt of all operations if new contracts/funding are not secured.

European critical dependencies

TLDR; Multiple countries in Europe are critically dependent on services provided by Microsoft. Querying mail-servers teaches that in some countries, over 70% of all public services rely on this American provider. Europe needs to build its own infrastructure, and open source is the most robust solution.

What we tried…

Insight 1: Every self-respecting municipality has a website and online services.
Insight 2: DNS records show us how mail is being sent for a domain.

Using these two simple concepts (which in the end weren’t always that simple, but that’s a different rabbit hole), we started a small project collecting the municipal website of as much local governments in Europe as we could collect. For that domain name, we then looked for the MX-servers (mail exchange-servers, that are responsible for sending mail). Next we started mapping those MX-servers into a few categories. First off, we gave the two biggest global players its own place on the stage. For the other servers, we grouped them per continent and for Europe made a distinction between EU-servers and non-EU servers (as this is relevant for GDPR). In a final step, we tried to visualize these records in such a way that they were easily inspectable. The result is this map.

If you’re interested in further examining the method used, or looking into the CSV files containing the MX-records for a specific country, you can find these in the git repository.

What we discovered…

Europe has been promoting interoperability and open standards for decades. They have also been encouraging the use of local services and products. For e-mail for example there is a gigantic difference between the priorities countries choose. Yet, in practice a lot of cities and governmental services got persuaded to use zero-hassle, zero-insight solutions like the ones Microsoft and Google seem to offer.

This means that many public services rely on Microsoft for their daily operations – going from document storage to automation and integration with the office tools. For this research, we’re focusing on e-mail. Especially in Scandinavia and the Benelux, Microsoft has established a strong prevalence. Purely based on the MX-records, we learn that 72% of Belgian municipalities run Microsoft mail servers and 60% of the Dutch municipalities. For Scandinavia, it’s 64% in Norway and 57% in Sweden. In Finland, it’s a whopping 77% if the cities that are being served by Microsoft.

At the same time, countries like Germany – known for its strong hacker culture and cybersecurity awareness – land at mearly 4% running Microsoft. In Hungary too, they land on hardly 3% and in Bulgaria they are surpassed by Google, together only having 4% of the mail-share.

Lessons from the political climate

Dutch municipalities raise concerns of dependency

In research conducted by Binnenlands Bestuur, published on February 13, 2025, we can read growing concerns among Dutch municipalities about their deep reliance on Microsoft’s products. Nearly every municipality uses Microsoft’s software for daily operations, from Office 365 to Azure, making a switch both expensive and technically challenging. This dependency has raised alarms over vendor lock-in, potential price hikes, and the risks posed by U.S. legislation—such as the Cloud Act—which could force Microsoft to share European data with American authorities. While many local governments wish for a robust European alternative, none currently exists, prompting calls for a strategic approach to boost digital autonomy rather than an abrupt break with Big Tech.

International Criminal Court acknowledges critical dependency

A Guardian article, published on January 20, 2025, reports on escalating tensions around international legal actions and sanctions. The piece explains that the International Criminal Court (ICC) is preparing for significant repercussions as it faces potential swift U.S. sanctions from President Trump. These sanctions are a response to recent Israeli arrest warrants issued against individuals involved in alleged war crimes. The situation has raised alarm over the ICC’s ability to operate independently, with critics arguing that political and economic pressures—especially from the U.S.—could undermine its judicial authority. In this volatile climate, legal experts warn that the unfolding events could set a dangerous precedent for international justice and the enforcement of accountability for alleged crimes.

Unpredictable pricing

Once a country is locked in to a closed system, vendors can easily raise prices at random, as transition cost is often even higher. This for example happened in Finland, where over 75% of the municipalities already depend on MS services. From a Pirha regional government meeting in November of ’24, we learn prices would go up with roughly 25% in 2025, compared to 2024.

Despite the Finnish government already changing policy in 2023, aiming to prioritize European services, it appears that in 2024 still a big majority of the public services are running the MS suite. Proving exactly how vendor lock-in can stronghold our whole infrastructure.

In Sweden too, experts have expressed their concerns about dependency on US based technology for their critical infrastructure. “The protection mechanisms that would ensure that European data do not end up in the hands of US authorities are effectively dismantled,” Heath said. He believes that Sweden must take control of its own infrastructure and not lean on the American one.

Norway is likewise uneasy about heavy reliance on U.S. cloud providers. A recent commentary noted that Norwegian public institutions are completely at the mercy of Microsoft’s cloud services today​. It warns American cloud services might even become illegal in Norway if the EU–US data deal falters​, raising doubts about the legality of using Microsoft, Google, etc. The author argues Norway faces a crossroads: become more dependent on a “crumbling American democracy” or dare to pursue new paths​. This reflects growing concern in Norway over digital sovereignty and security, urging investment in European or domestic alternatives to give authorities better control of their data.

Not only municipalities, also public services

In Denmark, the Data Protection Authority took action over public sector use of Google services. In 2022 it banned Helsingør Municipality from using Google Chromebooks and Workspace in schools due to GDPR violations​, judging that the data transfer risks were too high. Some 50 municipalities were ordered to fix their Google Workspace use to comply with the law​. The ban was later suspended while Google and authorities work on remedies, allowing Helsingør and others to temporarily continue using Google Workspace​. This controversy underscores Danish concerns about data sovereignty, security risks, and vendor lock-in, prompting consideration of alternative solutions or stricter agreements to protect citizen data.

The schizophrenia needed to solve the issues, is clearly documented in the Google story. While Google achieved to set clear guidelines for using Google Classroom, these don’t apply when using other Google products like Google Maps, Youtube or Google Search. Three year later, it seems clear that Google hasn’t succeeded in setting a clear framework, this article by Sivon from 2025 teaches us.

This critical dependency also creates situations like in Belgium, where 100% of the police force uses Microsoft for their mail service, and 57% of the fire departments run Microsoft or Google. Similar figures can be for Belgian hospitals. If Microsoft would become unavailable in Belgium, this would cause a critical chaos and cost lives.

Prioritize local economies

While Europe has a strong policy when it comes to prioritizing local economy in the context of an interoperable Europe, policy makers all around seem to be susceptible to prefer the trodden paths of MS and Google.

Obviously, companies like Microsoft also feel the heat and are scrambling to procure nice infographics and promises, they even throw in some AI candy… but in the end, they still remain a US company. So they are susceptible to US law – which can affect both our privacy and our dependence: “U.S. laws such as the CLOUD Act continue to grant the U.S. government the authority to access this data,” warned the analyst. The question therefore is whether European governments can actually restrict this kind of access. “Can a single US disposition override these obligations,” the expert wonders. “In this case, residence does not necessarily mean control.”

And while president Trump with its Department of Governmental Efficiency (DOGE) is currently pushing the boundaries of the legal frameworks quite openly, the Snowden revelations have taught us that the US services have been monitoring EU citizens for over a decade through these international companies.

Are we willing to hand over our data and operations to a country that could pull the plug with the flick of a presidential finger?

Futureproofing our digital society

While it’s an important step to run applications from within Europe, it’s also important to realize that international relationships change. Furthermore, on the IT-market – a very international and competitive market – it’s not uncommon for companies to be bought up by bigger partners. What once was a local company, can quickly turn into a branch of a huge multinational. If this happens, both data and know-how often exchange hands and become part of a foreign entity, possibly no longer aligned with the priorities initially outlined when collaborations started.

By staying in control of the software used in your government, you eliminate the need to trust a company. In the Open Source ecosystem, there is already a long tradition of safeguarding knowledge and code to be accessible to all.

Sharing code between municipalities and governments, is also a very pragmatic way of cutting costs – allowing different partners to also tweak applications to tailor to local needs. Through the use of a strong open source license (e.g. GPL), you also protect other companies from profiting off your investment without contributing back for the betterment of the community.

Let me quote Johan Linåker in this article on the website of the French government:

The surveyed countries exhibit diverse policies, emphasizing interoperability, digital sovereignty, transparency, and cost efficiency. While cost efficiency interoperability and transparency were commonly referred to, much less attention was paid to digital sovereignty and even less to cyber security and sustainability aspects related to FOSS. The latter is rather surprising but can potentially be explained by the relatively recent uprise of these topics in public debates. We hope and strongly recommend that these topics be considered explicitly in upcoming policies.

Local talent

Europe has some of the greatest minds in the field of cybersecurity and IT. Given the job-market is ever-expanding in the US and merely on life support in Europe, it is obvious that our biggest talents cross the pond to fully harvest their potential. Now is the time to invest in our local talent, to safeguard our companies from being bought up by US investors.

Hacker communities and FOSS movements have been bringing the message for decades. Europe must decide whether to remain dependent on foreign tech giants or to invest in its own future. We have the expertise, the resources, and the legal frameworks to support a shift toward European digital sovereignty. What we need now is action from policymakers and pressure from the public to ensure that the infrastructure of tomorrow serves European interests, not those of a foreign power.

And now…

The longer we wait, the harder it will be to break free. The reliance on a single vendor is not just a matter of cost but of sovereignty, security, and resilience. If European governments do not act now, they risk facing an even greater crisis when pricing becomes unsustainable, when services are withdrawn, or when geopolitical tensions escalate. The alternative is clear: build European infrastructure, promote open standards, and foster a thriving FOSS ecosystem that guarantees long-term independence.

Are you a local or national politician? Don’t quietly make deals with the established companies because it’s the easiest deal and they have the best marketeers.

Are you an engaged citizen? Reach out to your local municipality or government and question their choices.

Further reading

• www.investigate-europe.eu/posts/europes-dire-dependency-on-microsoft
• www.theregister.com/2025/02/26/europe_has_second_thoughts_about
• www.heise.de/news/Informatiker-Ampel-hat-Ziele-fuer-Souveraenitaet-und-Open-Source-klar-verfehlt-10218368.html

Please add other articles in the comments!

#DigitalSovereignty #FOSS

Note: I've done some minor editing to the following announcement.

From the Florida Outreach Center for the Blind

FREE ZOOM WORKSHOP ON MANAGING DIABETES
Thursday, April 17, 2025
2:00 PM to 3:30 PM Eastern Time

Join the Florida Outreach Center for the Blind for a ZOOM lecture with special guest, MARLENE SNOW.

Marlene is with LOW VISION STRATEGIES and has over 15 years’ experience working with clients who have low vision. She is the only occupational therapist
in their state who is a certified diabetic educator, having a specialty certification in low vision from the American Occupational Therapy Association.

Managing Diabetes is possible, even with vision loss. Low Vision Strategies provides in-home low vision rehabilitation and shows you modifications and
adaptations that help you get back to doing what is meaningful to you, such as how to:

· Manage Diabetes on your own
· Improve your accuracy with glucose readings
· Prepare healthier meals

ZOOM Meeting ID: 835 8160 5488
Passcode: 182630
BY PHONE:
1-312-626-6799
BY COMPUTER
us02web.zoom.us/j/83581605488?… [us02web.zoom.us]

FOR INFO on the workshop, FOCB’s FREE CLASSES, TRAINING & MORE, contact us: 561-642-0005, email:
Info_FOCB@bellsouth.net

The Florida Outreach Center for the Blind is a nonprofit organization/training facility that is nationally accredited by the Association for Education
& Rehabilitation of the Blind & Visually Impaired (AER). Classes/training are available in English, Spanish, Creole and French.

Website:
blindfocb.org
Like us on Facebook!
facebook.com/FOCBInc
Join us on Twitter!
x.com/FlaOutreachCtr

Home - Florida Outreach Center for the Blind

A Full Service Training Center For People Who Are Blind and Visually Impaired FOCB depends on the generosity of volunteers to assist with its ever-growing needs.

^{Florida Outreach Center for the Blind}

Wow. CVE database is in serious trouble, tomorrow.

The cyber industry as a whole is in trouble also really, it’s the elephant in the room - the collapse of the White House’s support for cybersecurity is obvious and pronounced due to widespread cutbacks.

US judge to question Trump officials' refusal to return Kilmar Abrego Garcia
https://apnews.com/article/kilmar-abrego-garcia-el-salvador-trump-deported-e537cfb69a9840046b5d3e512509e9a8?utm_source=flipboard&utm_medium=activitypub

Posted into U.S. News @u-s-news-AssociatedPress

US judge to question Trump officials' refusal to return Kilmar Abrego Garcia

A federal judge in Maryland is expected to question the Trump administration about its continued refusal to retrieve Kilmar Abrego Garcia from an El Salvador prison. A hearing is scheduled for late Tuesday afternoon in a U.S. District Court.

^{Michael Kunzelman (AP News)}

KELLY (AZ)
WARNOCK (GA)
PETERS (MI)
SHAHEEN (NH)
HASSAN (NH)
CORTEZ MASTO (NV)
ROSEN (NV)

It’s important for these Democratic senators to hear from their constituents right now. Email your senators and tell them to protect our elections by rejecting the GOP’s voter suppression bill. act.indivisible.org/sign/tell-…

Tell Your Senator(s) to Vote NO on the Silencing Americans Act

Republicans are once again pushing what we’re calling the “Silencing Americans Act”, a dangerous bill that would create unnecessary obstacles for millions of eligible Americans trying to register to vote.

^{Indivisible Guide}

The EU is mandating messaging apps be compatible with each other, but the current plan is looking less like #federation and more like "register your chat app with Meta, send them all your data, and link with their prescribed APIs that they may decide to change any day"

At the risk of preaching to the converted, here's @guusdk advocating for *real* interoperability between messaging apps, using an existing, battle-tested, #IETF-backed standard: #XMPP!

discourse.igniterealtime.org/t…

It’s time for real interoperability. Let’s make it happen!

When I explain to others what I do for a living, I often ask why it is that we are not surprised that one can use a Gmail account to send an email to someone who uses an Outlook account, yet many people fully accept that you can’t send a message to s…

^{Ignite Realtime Community Forums}

We’re now on Mastodon — with our very own instance! Let's celebrate together with a giveaway! 🎉

Prizes include:
-VIP DC tour in Falkenstein
-3D printer
-Gaming gear set
-Hetzner merch incl. Tiny Hero

How to enter:
-Follow us
-Boost this post
-Comment: Which Hetzner product you use & why you’d recommend it
-Email us at mastodon-contact@hetzner.com with your Mastodon handle, full shipping address & customer number, if available

Deadline: May 4, 2025, 23:59 CEST
ToP: htznr.li/HoM

Just over 8 years ago, I accidentally recorded about 11 days of audio from the Internet stream of a former local radio station (I only meant to record a clip from the morning show). More info, and the full audio (assuming I won't get in trouble for this), here: mwcampbell.us/q92-time-capsule…

I started re-listening to this yesterday, and here's one excerpt: an EDM remix of "Counting Stars" by OneRepublic, surrounded by station IDs. Anyone know what this mix is called?mwcampbell.us/q92-time-capsule…

We published a guide showing how to use Matrix bridge from ejabberd, demonstrating how you can talk with Matrix users from your XMPP client.

Let us know if you still have questions !

process-one.net/blog/hello-fro…

Hello from the other side: Matrix ↔ XMPP via ejabberd 25.03

In this guide, you'll learn how to send direct messages between Matrix and XMPP users, and even join public Matrix rooms using your favorite XMPP client.

^{Adrien (ProcessOne)}