3 ms·

I'm interested in the actual details here -- 1) What are the requirements for the mark? E.g. no passwords stored in plaintext on servers, no blank/default pass

I'm interested in the actual details here -- 1) What are the requirements for the mark? E.g. no passwords stored in plaintext on servers, no blank/default passwords on devices for SSH or anything else, a process for security updates, etc.? 2) Who is inspecting the code, both server-side and device-side? 3) What are the processes for inspecting the code? How do we know it's actually being done and not just being rubber-stamped? After all, discovering that there's an accidental open port with a default password isn't easy.

kube-system 2y ago
https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8425.pdf https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8425.pdf Yep, pretty basic stuff, like 'require authentication', 'support software updates', etc > 2) Who is inspecting the code, both server-side and device-side? UL is administering the program and they're going to come up with the requirements > UL Solutions will work with stakeholders to make recommendations to the FCC on a number of important program details, like applicable technical standards and testing procedures, post-market surveillance requirements, the product registry, and a consumer education campaign. https://www.ul.com/insights/us-cyber-trust-mark https://www.ul.com/insights/us-cyber-trust-mark
simne 2y ago
Good questions. As I understand, they spent months to decide who will be responsible and who will pay (and how much). Announce happen after budget passed Parliament, so now could make manning table and hire people for next steps.
- simne 2y ago
  Some questions already answered in article - from gov't responsible NIST and FCC and from industry agreed to participate deputies from large companies, so now they will gather meetings and will create some documents. So now, any interested subject (any human or entity, even "group of hackers") could ask to responsible. Or could talk with deputies, as their contacts should appear soon.
bloomingkales 2y ago
Here are requirements if you follow the China-bad politics: 1) Don’t be select Chinese products 2) Be select American products It’s not reaaaally 3d chess, but a relatively crude misnomer for the “Made in America” stamp or “Its American and definitely not Chinese”. The security practices are probably the same across products, it’s just the wrong time wrong presidency for China.

kube-system 2y ago

https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8425.pdf https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8425.pdf Yep, pretty basic stuff, like 'require authentication', 'support software updates', etc > 2) Who is inspecting the code, both server-side and device-side? UL is administering the program and they're going to come up with the requirements > UL Solutions will work with stakeholders to make recommendations to the FCC on a number of important program details, like applicable technical standards and testing procedures, post-market surveillance requirements, the product registry, and a consumer education campaign. https://www.ul.com/insights/us-cyber-trust-mark https://www.ul.com/insights/us-cyber-trust-mark

simne 2y ago

Good questions. As I understand, they spent months to decide who will be responsible and who will pay (and how much). Announce happen after budget passed Parliament, so now could make manning table and hire people for next steps.

simne 2y ago
Some questions already answered in article - from gov't responsible NIST and FCC and from industry agreed to participate deputies from large companies, so now they will gather meetings and will create some documents. So now, any interested subject (any human or entity, even "group of hackers") could ask to responsible. Or could talk with deputies, as their contacts should appear soon.

bloomingkales 2y ago

Here are requirements if you follow the China-bad politics: 1) Don’t be select Chinese products 2) Be select American products It’s not reaaaally 3d chess, but a relatively crude misnomer for the “Made in America” stamp or “Its American and definitely not Chinese”. The security practices are probably the same across products, it’s just the wrong time wrong presidency for China.