@joshbressers @gregkh @TheNewStack @sjvn agreed.
We are proposing OSS projects to be able opt out of getting CVE records "improved" by CVSS.
We are also discussing how smaller OSS projects could get an existing CNA to deal with their CVEs (their scope really), as if they were a CNA.
This within the "OSS CNA group" that has been started featuring curl, kernel, perl, and lots of linux distros ppl etc.