3 ms·
it is a nightmare for us big companies to be compliant exactly because we have millions of lines of code that we now are expected to clean up, or remove decades
by DyslexicAtheist 4y ago
it is a nightmare for us big companies to be compliant exactly because we have millions of lines of code that we now are expected to clean up, or remove decades of security debt.
from where I sit being a start-up, or SME that can make quick decisions and consolidate their security debt is a lot easier on them and worse for us big guys.
I don't want to use a phrase as "level the playing field" but the upcoming expectations of RED and CRA means most of us are praying this isn't enforced as quickly as it is written into law.
I'm totally rooting for this because its the only thing that will improve security.
- Attrecomet 4y agoAll the extra red tape and auditing doesn't come for free, so startups and SMEs without huge amounts of cash somehow lying around will struggle. Also, nothing about compliance is actually about "consolidating security debt" or "quick decisions". It's about paying someone to go through checklists and, like a reviewer of a scientific paper, find something, anything, no matter how inane, to criticize, before handing you a certification. Any slightly unconventional new idea to improve security in your product will be suffocated beneath the blanket of compliance. > I'm totally rooting for this because its the only thing that will improve security. So does the author. Well, they strongly endorse a sensible version without the vague phrases and open-source-killing blanket statements, and without brain-dead sentences like "your product must be un-DDoS-able". I do wonder, though, why you're rooting for legislation that would kill any open source project that might, conceivably, be used in a commercial setting?