5 ms·
Hell, even if governments are squeamish about requiring code to be fully open and public, they can still require the manufacturers to privately submit to the go
by kibwen 3y ago
Hell, even if governments are squeamish about requiring code to be fully open and public, they can still require the manufacturers to privately submit to the government all code that powers public infrastructure (like trains), to be made available to any relevant party upon request.
- nielsole 3y agocode escrow in general should be much more common.
- deleted 3y ago[deleted]
- rlpb 3y agoAn organisation that is prepared to write "sabotage" software would have no problem deploying software that is different to the software they submit.
- bmacho 3y agoCompile the code yourself?
- mordae 3y agoRight. Mandate that the software is delivered with CI pipeline running in the client's environment with 100% reproducible builds and verify checksums.
- Ygg2 3y agoImplying that's an impossible obstacle. Reproducibility is a thing. Make it so code needs to be reproducibly buildable. Only reproducibly buildable artifacts can be deployed on hardware. Document the whole process.
- redman25 3y agoDoesn't mean it's not a step in the right direction. Any transparency is better than zero.
- gryn 3y agothen you just need to bribe the code reviewer(s). open source is still the better answer, good luck bribing every member of the public who could potentially read public code.
- goodpoint 3y agoThat would work only on paper. The financial interests involved are huge.
- tremon 3y agoAll the more reason for governments to insist.
- landemva 3y ago> can still require the manufacturers to privately submit to the government all code I wonder if companies purchasing trains could put code disclosure in the purchase contract? I wonder if, in aggregate, train purchasers or car purchasers could fund an independent code storage vault and pay a small premium to fund that code vault organization? In other words, if purchasers wanted this and valued this, they would demand it in purchase contracts and fund it.