Re:US Cybersecurity: The Urgent Need for Memory Safety in So...
by lolinder on Thursday September 21, 2023 @03:58PM
(#37603371)
> with prescribed "sanctioned" languages and checklists applied with zero understanding of the underlying subject matter
This is always brought up as a boogeyman every time regulation is proposed, but then we have stories about Incorporation by Reference [0], where Congress explicitly encourages agencies to incorporate standards written by industry groups into law. It's not a perfect system (for example, the copyright disputes), but it seems to work a hell of a lot better than the free-for-all we have right now in our industry.
> The real solution is to come up with a framework around data leaks and their disclosure with provisions for mitigations
Agreed. And an agency with teeth to enforce the framework. And the provisions for mitigations should have the force of law.
This is always brought up as a boogeyman every time regulation is proposed, but then we have stories about Incorporation by Reference [0], where Congress explicitly encourages agencies to incorporate standards written by industry groups into law. It's not a perfect system (for example, the copyright disputes), but it seems to work a hell of a lot better than the free-for-all we have right now in our industry.
> The real solution is to come up with a framework around data leaks and their disclosure with provisions for mitigations
Agreed. And an agency with teeth to enforce the framework. And the provisions for mitigations should have the force of law.
In other words: we need regulation!
[0] https://news.ycombinator.com/item?id=37498473