3 ms·
US Gov (OMB) publishes guidance on compliance for SSDF – includes open source
- ggm 3y agoThis is going to need digesting. It's not sensible to cast "open source" into the bucket of higher risk simply because it's open source. Equally, its not sensible to bless open source as "better" simply because its open source. There are fantastically good closed source solutions, and truly abysmal open source solutions, and a huge range inbetween. At this point, if you said you depended on OpenSSL I'd say there are more risks than eg using Peter Gutmann's code, or libressl, depending on the context. Are there more or less risks than depending on a java library? I wouldn't know where to begin asking that question. So, "certify it" has some merit for me in externalising the risks into a circuit of people I trust. Which in the end, is what NIST is probably saying: Find people you trust and work with them, but checklist and verify.