3 ms·
The entire point of such an organization would be to accept the blame if an attack was missed. But there should be no natural monopoly since anyone could offer
by tux1968 6y ago
The entire point of such an organization would be to accept the blame if an attack was missed. But there should be no natural monopoly since anyone could offer this vetting service. And as an end user there would be nothing preventing you from circumventing the repository of such a service (except for the risk you'd be taking on for yourself).
- adolph 6y agoScapegoat as a Service?
- tux1968 6y agoSure, you could look at it like that. But their only value would be if they're never (or at least very rarely) actually called upon to act as a scapegoat. All the incentives would be for them to do their job and keep compromised software out of the ecosystem. Of course nobody is perfect, but they couldn't be flippant about it and survive.
- uranusjr 6y agoWhat are the incentives? I honestly can’t tell.
- tux1968 6y agoThe only reason for such an organization to exist is to be a clearing house for software; adding a stamp of approval that it is safe and hasn't been compromised by nefarious actors. Such an organization might be funded by a trade association, industry sponsorship, or direct fees to end users. But whatever the case, it would be strongly incentivized to fulfill its mandate or else lose credibility, reputation, influence, and financial rewards.