Yeah, but that's sort of the point I was making.... it was a data repository used by "thousands and thousands" of security professionals and organizations. So people who were generating revenue off of the service. I mean, they're professionals, not hobbyists / home users.

I'm not an American, but in terms of everything running like a company/for profit, I'd say that its best if things are sustainable / able to self-maintain. If the US cutting funding means this program can't survive, that's an issue. If it has value to a larger community, the larger community should be able to fund its operation. There's clearly a cost to maintaining the program, and there are clearly people who haven't contributed to paying that cost.

In terms of going back to whatever, the foundation involved is likely to sort out alternative funding, though potentially with decreased functionality (it sounds like they had agreements to pay for secondary vulnerability report reviews, which will likely need to get scaled back). Maybe they'll need to add in a fee for frequent feed pulls, or something similar. I wouldn't say it's completely toast or anythin just yet.