3 ms·
> process and governance model that proprietary software does. except that a lot of proprietary software doesn't has anything like that either there is nothin
by dathinab 4y ago
> process and governance model that proprietary software does.
except that a lot of proprietary software doesn't has anything like that either
there is nothing in common proprietary dev practices which would have e.g. prevented log4j
the main difference is that you can hold someone financially responsible in one case and not in the other
(but in turn you can always fix any problem yourself, good luck fixing any proprietary software after it's support runs out).
- themitigating 4y agoThey could verify the security of the oss, look for vulnerabilities, run scanners. This is possible because log4j is OSS.
- kube-system 4y agoIt does when you sell it to the government, which is what this is about. The federal government has rules regarding the acquisition of software products, and they have various governance and risk management requirements for various scenarios. Many of these were designed with proprietary software in mind. The point of this bill is to update some of those requirements to make sense with the way OSS works.