6 ms·
Right, but it's focused on helping the government decide what open source not to use, rather than on actually making open source more secure.
by jrochkind1 4y ago
Right, but it's focused on helping the government decide what open source not to use, rather than on actually making open source more secure.
- kube-system 4y agoThe risk framework isn’t written yet, this just directs CISA to write one. While evaluating dependencies is often a part of what you’d do in a risk framework, it’s typically just one part.