4 ms·

>"So yes, I get it: we shouldn’t trust companies, or even FOSS projects, to self-report. Unless…what if we made penalties so large for not reporting, and for g

>"So yes, I get it: we shouldn’t trust companies, or even FOSS projects, to self-report. Unless…what if we made penalties so large for not reporting, and for getting it wrong, that they would fall over themselves to do so?" We know this doesn't work, and author admits as much. However, the proposed solution is to add another cert into the mix. But it's not clear how this designation would be applied globally, with agreement across the globe on the requirements, punishments, etc. Not to be rude to the author, but it sort of seems like they forgot that not all software is developed in the US. (Not to mention, I really don't want another cert)

bruce511 1y ago
Yeah, it seemed to jump the shark a bit here. Professional bodies, certified engineers, taking on liability for Open Source code... there's a LOT going on here... Here's what'll really happen; no one cares or wants yo be a certified professional. Companies don't care about it. We carry on as is... This is a classic over-engineered solution that nobody wants to a problem that barely exists. Just add burocracy, what could possibly go wrong...??
- gavinhoward 1y ago
  I do want to be certified. I think it would be a great way to make money building Open Source Software. > Companies don't care about it. We carry on as is... If required by law, companies would care. > This is a classic over-engineered solution that nobody wants to a problem that barely exists. The sorry state of our industry means the opposite: the problem is big, but lack of teeth means companies can ignore it and externalize the costs. > Just add burocracy, what could possibly go wrong...?? I'd prefer to create our own bureaucracy, not have governments push one on us, like the Cyber Resilience Act does in the EU.
  - bruce511 1y ago
    Currently being certified has no value, not to Open Source, not to Closed Source, since companies are clearly doing fine without it. So it's hard to see them paying extra for it. We've had professional certifications for years. Novell, Citrix, Microsoft, SAP, Oracle, they all make money selling certification to naive users. Anyone who's bothered knows they don't really mean much. But hey, if you think there's demand, set up a body and give it a go. Personally I think it's a waste of time, but if you can get enough companies to care, and enough developers to pay, you'll have a nice business. Herding cats sounds easier.
  - daveguy 1y ago
    > I'd prefer to create our own bureaucracy... So, historically the creation of bureaucracy in the US government included industry professionals to guide the requirements and a public comment period before finalization. This is done because most people in government recognize they are not up to date on the latest industry knowledge. Destroying everything and creating a new bureaucracy is in absolutely no way better than fixing the original one on updated information. It seems you may have fallen victim to the very well thought out "government bad!" argument.
gavinhoward 1y ago
> We know this doesn't work, and author admits as much. Where do I admit this? About fines? Yes, fines don't work. The difference with my proposal is that companies wouldn't lose a few days' worth of revenue to a fine, they would lose 100% of revenue. That goes from being a "cost of doing business" to an existential threat. > Not to be rude to the author, but it sort of seems like they forgot that not all software is developed in the US. I didn't forget. In fact, it's because of worldwide things that I keep pushing this here in the US. The EU already passed the Cybersecurity Resilience Act [1]. Sure, we may not have things apply globally, but we don't need agreement on the punishments globally. We just need agreement on the certification globally. We have done global agreements before. ICANN, International Telecommunications Union, etc. ICANN is interesting because it started as US-only and expanded. [1]: https://en.wikipedia.org/wiki/Cyber_Resilience_Act https://en.wikipedia.org/wiki/Cyber_Resilience_Act
- ziddoap 1y ago
  >Where do I admit this? About fines? Yes, fines don't work. Yes, about fines. From your post: "Ah, yes, fines for companies are not enough. I agree." >they would lose 100% of revenue. We can't get the government to enforce this when tens of millions of records are leaked publicly, this absolutely will not happen for failure to report a vulnerability. If you have any idea of how to make it happen, please, lets immediately apply it to breaches and then figure out how to apply it to failure to report vulnerabilities. >We just need agreement on the certification globally. As far as I am aware, there is no certification (one which is legally required to obtain a job) on the planet that is globally recognized. But I would be happy to be proven wrong here. >but we don't need agreement on the punishments globally. Which will end up with some countries not willing to charge 100% loss of revenue, causing a mass exodus of companies from any country which does charge 100%, thus making the solution untenable. ICANN is an interesting example, but it's not a certification. The scale (and thus administration, compliance, etc.) is very different.
- smu 1y ago
  To provide some additional context to OP. In the CRA, there’s (among others): - reporting of actively exploited vulns or severe incidents to a national cert - reporting obligation of vulns to the provider of that vulnerable code - mandatory vulnerability disclosure policy (to receive vuln reports) - obligation to provide security updates and alert customers when a vuln has become known We’ll see how well this is all followed, but from a security perspective these are all good ideas.

bruce511 1y ago

Yeah, it seemed to jump the shark a bit here. Professional bodies, certified engineers, taking on liability for Open Source code... there's a LOT going on here... Here's what'll really happen; no one cares or wants yo be a certified professional. Companies don't care about it. We carry on as is... This is a classic over-engineered solution that nobody wants to a problem that barely exists. Just add burocracy, what could possibly go wrong...??

gavinhoward 1y ago
I do want to be certified. I think it would be a great way to make money building Open Source Software. > Companies don't care about it. We carry on as is... If required by law, companies would care. > This is a classic over-engineered solution that nobody wants to a problem that barely exists. The sorry state of our industry means the opposite: the problem is big, but lack of teeth means companies can ignore it and externalize the costs. > Just add burocracy, what could possibly go wrong...?? I'd prefer to create our own bureaucracy, not have governments push one on us, like the Cyber Resilience Act does in the EU.
- bruce511 1y ago
  Currently being certified has no value, not to Open Source, not to Closed Source, since companies are clearly doing fine without it. So it's hard to see them paying extra for it. We've had professional certifications for years. Novell, Citrix, Microsoft, SAP, Oracle, they all make money selling certification to naive users. Anyone who's bothered knows they don't really mean much. But hey, if you think there's demand, set up a body and give it a go. Personally I think it's a waste of time, but if you can get enough companies to care, and enough developers to pay, you'll have a nice business. Herding cats sounds easier.
- daveguy 1y ago
  > I'd prefer to create our own bureaucracy... So, historically the creation of bureaucracy in the US government included industry professionals to guide the requirements and a public comment period before finalization. This is done because most people in government recognize they are not up to date on the latest industry knowledge. Destroying everything and creating a new bureaucracy is in absolutely no way better than fixing the original one on updated information. It seems you may have fallen victim to the very well thought out "government bad!" argument.

gavinhoward 1y ago

> We know this doesn't work, and author admits as much. Where do I admit this? About fines? Yes, fines don't work. The difference with my proposal is that companies wouldn't lose a few days' worth of revenue to a fine, they would lose 100% of revenue. That goes from being a "cost of doing business" to an existential threat. > Not to be rude to the author, but it sort of seems like they forgot that not all software is developed in the US. I didn't forget. In fact, it's because of worldwide things that I keep pushing this here in the US. The EU already passed the Cybersecurity Resilience Act [1]. Sure, we may not have things apply globally, but we don't need agreement on the punishments globally. We just need agreement on the certification globally. We have done global agreements before. ICANN, International Telecommunications Union, etc. ICANN is interesting because it started as US-only and expanded. [1]: https://en.wikipedia.org/wiki/Cyber_Resilience_Act https://en.wikipedia.org/wiki/Cyber_Resilience_Act

ziddoap 1y ago
>Where do I admit this? About fines? Yes, fines don't work. Yes, about fines. From your post: "Ah, yes, fines for companies are not enough. I agree." >they would lose 100% of revenue. We can't get the government to enforce this when tens of millions of records are leaked publicly, this absolutely will not happen for failure to report a vulnerability. If you have any idea of how to make it happen, please, lets immediately apply it to breaches and then figure out how to apply it to failure to report vulnerabilities. >We just need agreement on the certification globally. As far as I am aware, there is no certification (one which is legally required to obtain a job) on the planet that is globally recognized. But I would be happy to be proven wrong here. >but we don't need agreement on the punishments globally. Which will end up with some countries not willing to charge 100% loss of revenue, causing a mass exodus of companies from any country which does charge 100%, thus making the solution untenable. ICANN is an interesting example, but it's not a certification. The scale (and thus administration, compliance, etc.) is very different.
smu 1y ago
To provide some additional context to OP. In the CRA, there’s (among others): - reporting of actively exploited vulns or severe incidents to a national cert - reporting obligation of vulns to the provider of that vulnerable code - mandatory vulnerability disclosure policy (to receive vuln reports) - obligation to provide security updates and alert customers when a vuln has become known We’ll see how well this is all followed, but from a security perspective these are all good ideas.