3 ms·
All for curation of components, as part of developing reliable, secure, resilient software. I just don't think you gain a lot of reliability, security or resili
by pipo234 3y ago
All for curation of components, as part of developing reliable, secure, resilient software. I just don't think you gain a lot of reliability, security or resilience by mandating a concrete&steel OS foundation. For sure, a shoddy, insecure, duck-tape application on some homebrew Linux can be ported RedHat just fine. There is nothing preventing insecure use of "Military Grade" AES256 encryption.
You just can't certify your way to resilient software.
- phoehne 3y agoNo, but this will largely target producers of software. So they'll have to show they've done their due diligence by probably producing documentation about procedures they followed, designs, conformance to the designs, procedures for on-boarding dependencies, etc. etc. That's no their real shield, however. That's the insurance policy they buy from Lloyd's, who will require that they check all the boxes. They way I won't get sued, as a developer, will probably be to work for a big company that can afford all that or add clauses to my license stating it's either 'for demonstration purposes only' or 'no licensed for use under ...'. Kind of how a lot of financial information is doled out with the disclaimer it's [sic] only for entertainment purposes.