2 ms·

I think the point was that executives won't have enough technical knowledge to be able to say much about it except in extremely vague terms like "we take securi

I think the point was that executives won't have enough technical knowledge to be able to say much about it except in extremely vague terms like "we take security seriously". In fact, actually having too much of a clue is a probably more of a liability when you're summoned to a meeting at the White House, as you might say something they'll hold you to.

mikeyouse 5y ago
This is such a cynical view unfortunately shared by a lot of people in the thread. For two examples, the VP Security of ASF is there, here's his resume: > https://www.linkedin.com/in/mark-j-cox/ https://www.linkedin.com/in/mark-j-cox/ Brian Behlendorf is there from the newly formed Open Source Security Foundation, here's his resume, in the form of a Wikipedia entry because he was one of the OG developers for Apache Web Server: https://en.wikipedia.org/wiki/Brian_Behlendorf https://en.wikipedia.org/wiki/Brian_Behlendorf Executives from tech companies aren't usually just random MBAs -- they're often deeply technical people who ran engineering teams with huge impact. Besides, they're not having a pair-coding session to ship a release to fix Log4J -- they're talking about a coordinated effort to prevent future vulns. Obviously engineering knowledge is necessary but the coordination aspect involves org-wide and industry-wide changes.