Re:'Securing Open Source Software Act' introduced to US Senate
by kube-system on Friday September 23, 2022 @10:06PM
(#32959144)
It does when you sell it to the government, which is what this is about.
The federal government has rules regarding the acquisition of software products, and they have various governance and risk management requirements for various scenarios. Many of these were designed with proprietary software in mind.
The point of this bill is to update some of those requirements to make sense with the way OSS works.
Re:'Securing Open Source Software Act' introduced to US Senate
by themitigating on Friday September 23, 2022 @09:06PM
(#32958867)
They could verify the security of the oss, look for vulnerabilities, run scanners. This is possible because log4j is OSS.
except that a lot of proprietary software doesn't has anything like that either
there is nothing in common proprietary dev practices which would have e.g. prevented log4j
the main difference is that you can hold someone financially responsible in one case and not in the other (but in turn you can always fix any problem yourself, good luck fixing any proprietary software after it's support runs out).