5 ms·
This is not a push for proprietary software. It's a prelude to regulatory capture where a bunch of highly paid consultants will need to bless your open source s
by danbmil99 4y ago
This is not a push for proprietary software. It's a prelude to regulatory capture where a bunch of highly paid consultants will need to bless your open source solution for big money.
It's going to be like electrical contracting. You get someone cheap to do the wiring and then a union guy comes in to sign the papers and take a pound of flesh.
- transpute 4y agoMaybe, if electrical contracting used blockchains like sigstore, https://www.sigstore.dev/ https://www.sigstore.dev/ from OpenSSF, https://openssf.org https://openssf.org.
- jeffbee 4y agoWe already have this. You hire some idiot to sign off on your FIPS-140. They are getting paid under the table by IBM. They swear that the only way to comply with FIPS-140 is to use RHEL. The only company I ever worked at that hasn't fallen for this scam is Google, who self-certify everything including their crypto stack. But every other smaller company (i.e. all other companies) are just terrified of not getting government contracts and are in thrall to these consultants.
- grosswait 4y agoFIPS validation does not have a self certify path
- transpute 4y ago> Google, who self-certify everything including their crypto stack. This probably means paying for an independent lab's FIPS validation of Google's crypto stack, rather than using one from RHEL (where RH/IBM paid for the FIPS validation).