> Define unpatched. Software that has a vulnerability, for which the vendor has made a fix available. > Does this include free to use websites? Obviously. A

> Define unpatched. Software that has a vulnerability, for which the vendor has made a fix available. > Does this include free to use websites? Obviously. A compromised server is a compromised server that is a vector for other attacks. > What about non-profits? Legal status of the organization is entirely irrelevant. > What if a CVE does not exist? You cant legislate all software must not have security issues. CVE pathway is industry standard and the best practice we have come across. It's not full-proof but it's good enough. > (yes you said for which patches exist, why is this an exception, Because the makers will also be liable to provide patches. > how well is this exception going to hold up in the legislative session, and if it's not explicity made as a distinction, how is it going to hold up in court?) Have a public DB of CVE's, plenty of which exist. I fail to see what the problem is. > What about software I let you automatically download and automatically update, and is exposed to the internet from your machine, by default or by configuration, but is not installed by default? Software you put on the internet is your responsibility. The manufacturer must provide a pathway to update, you must make use of it. > What if I'm the manufacturer of the device? Provide patches for all CVEs that can be used on your devices. Otherwise fines. > Who defines the standards, both for the hw RNG and the algos? Plenty of very good crypto algos exist. Pick a group and give manufacturers the option to implement a subset. > The US gov't has been shown to be more or less subversive to good crypto. If you select another org, a nation state with said resources can just neuter that org by infiltration. There are branches of government. It's not one single thing. > How do you verify compatibility for this standard? Generally standards that succeed, do so by defining a common sense test suite. Where does that fit in? New agencies have to be made. Just like there are is a FDA and whoever certifies cars so they can be used on roads. > Does the fine increase per day? Why or why not? If yes, how much and why that much? > How much is the fine, is it based on revenue, profit, units shipped etc? Details that are really not an issue. > How do you pick the amount of time? I bring this up mainly in reference to Not enough time is complete bullcrap. Give them a month and the fines start. Google made a fucking disaster with Android. Anyone attempting to do anything similar today should get fined in the billion range. > How do you levy it on firms in other jurisdictions that don't let you levy fines like China? If they are selling products in a market, they can legislate standards. If you use something for free, you are liable yourself. > What if the devices are meant to be offline for a certain period of time? How much is acceptable before a device needs to call home? Specifically, what about industries where the devices will eventually sync, but may not for an indefinite period of time (military, mining, heavy construction, anything done in the middle of nowhere)? Then those devices aren't really a security issue and a danger to the rest of the Internet. > Referring to the previous question, how do you count devices that were discarded by the owner, but not reported to the manufacturer? Whoever is connecting the device to the internet is liable. Devices must have the capability to call home (manufacturers servers) and update if necessary.