Also, nothing about compliance is actually about "consolidating security debt" or "quick decisions". It's about paying someone to go through checklists and, like a reviewer of a scientific paper, find something, anything, no matter how inane, to criticize, before handing you a certification. Any slightly unconventional new idea to improve security in your product will be suffocated beneath the blanket of compliance.
> I'm totally rooting for this because its the only thing that will improve security.
So does the author. Well, they strongly endorse a sensible version without the vague phrases and open-source-killing blanket statements, and without brain-dead sentences like "your product must be un-DDoS-able". I do wonder, though, why you're rooting for legislation that would kill any open source project that might, conceivably, be used in a commercial setting?
from where I sit being a start-up, or SME that can make quick decisions and consolidate their security debt is a lot easier on them and worse for us big guys.
I don't want to use a phrase as "level the playing field" but the upcoming expectations of RED and CRA means most of us are praying this isn't enforced as quickly as it is written into law.
I'm totally rooting for this because its the only thing that will improve security.