> niche enthusiast markets Once correct, that is no longer a valid assessment in 2023 because of: + Deep and growing concern, in government and at the C-suite

> niche enthusiast markets Once correct, that is no longer a valid assessment in 2023 because of: + Deep and growing concern, in government and at the C-suite level, about software supply chain security which necessarily must include firmware/BSP/UEFI/BIOS and the silicon for devices equipped with on-die ROM produced by relatively unknown manufacturers. The watershed event driving this concern was the devastating SolarWinds attack, Log4J exploits, discovery that most public container repository images have known CVEs and new mainstream awareness that popular code libraries have become infected with malware because of mismanagement during redistribution by novice volunteers (sometimes several years after the original library developers have exited). + The rise of China's cyber forces (including APT41's MoonBounce [1]), whose hackers reportedly now outnumber the US government's cyber forces by 50:1 [2]. Notably, some computers arrive pre-loaded with MoonBounce. Vendors like Apple, DELL and System76 could easily detect such infection in their mainland China factories, but it's far less certain that companies like ASUS would and, obviously, much smaller companies that design AND distribute from within mainland China like Latte Whatever cannot be trusted at all because they may (literally) have a gun put to their head at any time (by the operatives of the CCP) to pre-infect their goods. Most end-customers are not going to have the resources to analyze binaries to look for MoonBounce or any of its variants (and will have even less if they're ransomware'd by APT41 or downstream script kiddies), so the onus to identify or avoid such threats is on the tech people sourcing these components. But most tech people are not even aware that wiping the hard drives and operating system will not eliminate such infections and worse, many tend to have progressive views that because war is bad for everyone, it won't come [so we don't need to let these issues drive our decision making]. If there is not change, China's cyber forces will clearly win. + Therefore big regulation IS coming to the software industry, regulation like hasn't been seen in the entire 60 year history of code [3]. In the meantime, industry is responding with so-called "Zero Trust" initiatives within their institutional networks (to try and contain infections), but unfortunately, the broadband provider networks (that should truly be viewed as giant institutional networks of small business and residential users) are not (yet) stepping up with even basic (eg, BeyondCorp [4]) Zero Trust context-awareness to regulate packet flows (eg, "why is subscriber X suddenly posting short strings to IRC and uploading huge files to AlibabaCloud at 330am local time"), so we're all still in jeopardy as people continue to buy and deploy cheap infect-ed/able devices from mainland China. [1] https://usa.kaspersky.com/about/press-releases/2022_kaspersky-uncovers-third-known-firmware-bootkit https://usa.kaspersky.com/about/press-releases/2022_kaspersk... [2] https://www.cnbc.com/2023/04/28/chinese-hackers-outnumber-fbi-cyber-staff-50-to-1-director-wray-says.html https://www.cnbc.com/2023/04/28/chinese-hackers-outnumber-fb... [3] https://digital-strategy.ec.europa.eu/en/news/new-eu-cybersecurity-rules-ensure-more-secure-hardware-and-software-products https://digital-strategy.ec.europa.eu/en/news/new-eu-cyberse... [4] https://www.beyondcorp.com https://www.beyondcorp.com