91–100 of 187 posts
Earlier quoted context omitted.
There is this little nugget: “The legislation also requires CISA to hire professionals with experience developing open source software to ensure that government and the community work hand-in-hand and are prepared to address incidents like the Log4j vulnerability.”
Unless it specifies who this just means they'll throw a few billion to Teksystems, CGI or whoever and then say that it was a failure like HealthCare.gov
Reading the comments so far, I'm genuinely surprised that more folks haven't applied a "follow the money" lens to their analysis. To me, it reads as a bald-faced attempt to discourage public sector entities from using OSS solutions, when in fact there are perfectly good and definitely >100% secure proprietary offerings that cost a reasonable amount when purchased from the sorts of vendors that pay lobbyists to "help"…
While skepticism is fair that should be motivation to do research to possibly find evidence of an ulterior motive. However just saying that all legislation is some scam without evidence doesn't make sense. For example, and I don't know the exact name, but the health care transparency act where pricing for treatments or whatever must be published. Who is that helping if you follow the money? Edit: I should have been m…
Earlier quoted context omitted.
Of course, which is why I think viewing this as a push for proprietary software is not a fair assessment. Increasing your company's development costs is not a way to make more profit. The point of this is that you can't treat proprietary software dependencies the same way you treat FOSS. Community FOSS projects just don't have the same development process and governance model that proprietary software does. And so, t…
> process and governance model that proprietary software does. except that a lot of proprietary software doesn't has anything like that either there is nothing in common proprietary dev practices which would have e.g. prevented log4j the main difference is that you can hold someone financially responsible in one case and not in the other (but in turn you can always fix any problem yourself, good luck fixing any propr…
Earlier quoted context omitted.
While skepticism is fair that should be motivation to do research to possibly find evidence of an ulterior motive. However just saying that all legislation is some scam without evidence doesn't make sense. For example, and I don't know the exact name, but the health care transparency act where pricing for treatments or whatever must be published. Who is that helping if you follow the money? Edit: I should have been m…
Maybe increased popularity to the legislator in question? Surely no bill comes without some ulterior motive.
This is not a push for proprietary software. It's a prelude to regulatory capture where a bunch of highly paid consultants will need to bless your open source solution for big money. It's going to be like electrical contracting. You get someone cheap to do the wiring and then a union guy comes in to sign the papers and take a pound of flesh.
We killed 100% of our Java usage over this. We simply don't have enough in-house talent to make sure things are safe in that bucket. Our customers thought this was a glorious plan as well.
I do think most of the pain should fall to the vendors of the end product, not their oss suppliers. If your shop doesn't have enough resources to validate all vendors are safe, maybe figure out how to do it with fewer vendors.
At a certain level, if you are selling deficient products to sensitive customers, you really need to be stopped. Anything impacting finance, PII, safety, infrastructure, defense, etc. Some extra regulations could go a long way in these areas.
We do B2B software in banking and this is something we've been anticipating for quite some time now. We were implicated in that log4j exploit via a (very) transitive, cross-language dependency. We killed 100% of our Java usage over this. We simply don't have enough in-house talent to make sure things are safe in that bucket. Our customers thought this was a glorious plan as well. I do think most of the pain should fa…
Did you ditch ssl over heartbleed?
FWIW, while this specific act may not be enforcing significant regulation, software developers need to understand that there's a ticking clock. Modern civic engineers went without any significant regulation, and then that changed. Software is young, it's in the phase where people aren't dying too often for the public to care. But breaches are leading to massive privacy problems, real wars and conflicts are increasing…
I see nothing new or useful here, what am I missing?
"The Securing Open Source Software Act would direct CISA to develop a risk framework to evaluate how open source code is used by the federal government. CISA would also evaluate how the same framework could be voluntarily used by critical infrastructure owners and operators. This will identify ways to mitigate risks in systems that use open source software. The legislation also requires CISA to hire professionals with experience developing open source software to ensure that government and the community work hand-in-hand and are prepared to address incidents like the Log4j vulnerability. Additionally, the legislation requires the Office of Management and Budget (OMB) to issue guidance to federal agencies on the secure usage of open source software and establishes a software security subcommittee on the CISA Cybersecurity Advisory Committee."
[1] https://insights.sei.cmu.edu/blog/taking-up-the-challenge-of...
Earlier quoted context omitted.
There are different questions that should be asked when choosing open source software vs proprietary software. If you're using proprietary software, you might ask things like, "what's your SLA?", "can we review the source code?", or "how much is a license?" If you're using open source software you might ask things like "is the project maintained?", "who developed it?", or "do we have anyone on payroll who knows how t…
For the sorts of purposes described in bill-blurb, the questions would be essentially identical.
Stuff like this:
https://daniel.haxx.se/blog/2020/12/17/curl-supports-nasa/
Or this: https://daniel.haxx.se/blog/2022/01/24/logj4-security-inquir...
… is exactly why you can’t treat them the same in these types of situations.