3 ms·
Questions that aren’t being answered by the NTIA pushing this. Why would a vendor do this and become liable for all inclusive software? The build chain isn’t
by bfrog 5y ago
Questions that aren’t being answered by the NTIA pushing this.
Why would a vendor do this and become liable for all inclusive software?
The build chain isn’t required to be part of the BOM so any trojaned tool in the build environment may pass along the Trojan modifying the outcome drastically, the BOM is useless there.
People were selling snake oil saying this would solve solar winds. No.
- rswail 5y agoThey're doing it because the Executive Order requires it if you want to sell software to the US Federal Government. By default, what the USG demands becomes a more general thing, as other governments and levels of government adopt the same standards. Then vendors will produce it and it will become a condition of commerical contracts. The vendor is already liable (or should be) for knowing what's in the product they've supplied. This is just a way of documenting it in a standard way.