4 ms·
and how are small solo founder companies making devices going to carry and pay for this burden? i’m pretty annoyed that stuff like these requirements just make
by b20000 3y ago
and how are small solo founder companies making devices going to carry and pay for this burden?
i’m pretty annoyed that stuff like these requirements just makes it into law without getting small companies or startups to have a say in whether they want this or not.
- oneepic 3y agoYeah, even if it doesn't become a legal requirement, I could imagine companies asking for FSBoM's from their suppliers -- so it ends up being a requirement anyway if you want to compete with big co's.
- b20000 3y agowhich is why we don’t want this as it will make it harder to compete
- Ekaros 3y agoIf it really goes through. It is just adding extra standard step or tool to CI/CD chain. Problem now is that there is not good enough tools, but it is not unsolvable problem when enough people get involved.
- yjftsjthsd-h 3y agoAs opposed to what, getting a free pass to ignore security because you're small? (And really, it's a "burden" to track what you're shipping? That's all a BoM is; a standardized format to stamp a binary with a list of ingredients.) Do you think mom 'n pop diners should be exempt from health inspectors?
- kats 3y agoWhat a rude response. I doubt you have ever built any electronic products, or you would not say that.
- b20000 3y agosmall hw vendors should not carry burdens imposed by big tech as big tech goal is to create monopolies
- yjftsjthsd-h 3y agoSo that's a yes?
- b20000 3y agosecurity is not important for a lot of hardware. people working in networking or security tend to over estimate its importance.
- yjftsjthsd-h 3y agoIf it has a network connection, it can be used in a botnet. If you mean hardware that is not networked, than yes that seems like the concern is meaningfully smaller.
- rollcat 3y agoAs a co-founder of a tiny company dabbling in hardware as a side-project, yes please! Half the things we are struggling with are due to upstream hardware vendors throwing a hot mess over the fence. Linux&friends being GPL doesn't help us as much as we hoped, because many important and low-level pieces are quite opaque, closed, under-documented, etc. Anything to force the vendors to be more transparent is good for us. We already automate our builds, keep extensive notes on what works and what doesn't, etc. Our own SBOM is additive on top of the vendor's stack, so all we're really concerned with is the pieces we wrote ourselves. I don't see it as a burden any more than ensuring proper test coverage, or maintaining a lockfile of dependencies. So yes, please make this a law.
- b20000 3y agoyou don’t understand. if they make it a law, it will be worse for you, not better, since as a hardware vendor you carry the burden. you point out the problem we face today: people in open source typically work at big tech and regularly push ideas that end up costing small hw companies a lot of money. for example rust in the kernel. or over complicated frameworks for the sake of security while lots of hardware does not need security. or features that are important for servers and make those default while most hardware is not a server. and so on. if open source was primarily managed by small company contributors it would look very different.