Hot take (?): No company should be the CNA for their own products.
Uncategorized
22
Posts
8
Posters
0
Views
-
RE: https://infosec.exchange/@boblord/116075393614821884
Hot take (?):
No company should be the CNA for their own products. 
-
RE: https://infosec.exchange/@boblord/116075393614821884
Hot take (?):
No company should be the CNA for their own products. @cR0w for some reason I thought CNA == Camapgin for North Africa not CVE Numbering Authorities.
-
@cR0w for some reason I thought CNA == Camapgin for North Africa not CVE Numbering Authorities.
@winterknight1337 Now it's getting interesting.
-
RE: https://infosec.exchange/@boblord/116075393614821884
Hot take (?):
No company should be the CNA for their own products. @cR0w @boblord one thing I like about self-CNA is that vendors know their own products best and are uniquely positioned to deconflict or perform better merge-split decisions.
One thing I dislike is the system’s capacity to deny issuance if the company captures reporting and doesn’t follow through with providing a CVE.
-
@cR0w @boblord one thing I like about self-CNA is that vendors know their own products best and are uniquely positioned to deconflict or perform better merge-split decisions.
One thing I dislike is the system’s capacity to deny issuance if the company captures reporting and doesn’t follow through with providing a CVE.
-
@cR0w @boblord one thing I like about self-CNA is that vendors know their own products best and are uniquely positioned to deconflict or perform better merge-split decisions.
One thing I dislike is the system’s capacity to deny issuance if the company captures reporting and doesn’t follow through with providing a CVE.
-
-
-
-
-
RE: https://infosec.exchange/@boblord/116075393614821884
Hot take (?):
No company should be the CNA for their own products. @cR0w How do other sectors handle safety-related product defect notifications? I'm thinking about sectors covering planes, trains, automobiles, food, medicine, etc., all of which have achieved dramatic improvements in safety for both their customers, as well as the general public. 🙏
-
@cR0w How do other sectors handle safety-related product defect notifications? I'm thinking about sectors covering planes, trains, automobiles, food, medicine, etc., all of which have achieved dramatic improvements in safety for both their customers, as well as the general public. 🙏
@boblord First and foremost, they hold manufacturers responsible for poor engineering. In tech it's just "LOL patch if you can." Without that, respectfully, the comparison is not valid.
-
@boblord First and foremost, they hold manufacturers responsible for poor engineering. In tech it's just "LOL patch if you can." Without that, respectfully, the comparison is not valid.
@cR0w If we want to improve the safety of software like we have for other sectors, we need to figure out how to build software informed by those truly incredible successes. That road may be long, but we can do hard things! 💪
-
@cR0w If we want to improve the safety of software like we have for other sectors, we need to figure out how to build software informed by those truly incredible successes. That road may be long, but we can do hard things! 💪
@boblord I believe you want to improve things, I really do. But I think in order to get there, computer science needs to be engineering-focused rather than business-focused. And it's not. Especially in academia.
-
@cR0w If we want to improve the safety of software like we have for other sectors, we need to figure out how to build software informed by those truly incredible successes. That road may be long, but we can do hard things! 💪
-
@hotsoup @cR0w It's true that no system is perfect, but we don't let car makers opt out of filing defect reports, for example. We should ask what types of incentives would create more transparency from commercial software makers. As we see from all those other sectors progress is possible. Which tactics would work best in the software?
-
@hotsoup @cR0w It's true that no system is perfect, but we don't let car makers opt out of filing defect reports, for example. We should ask what types of incentives would create more transparency from commercial software makers. As we see from all those other sectors progress is possible. Which tactics would work best in the software?
@boblord @hotsoup Fines. Look at the auto industry. Transmissions fail to park, gas tanks explode, Lancias rust like a trans girl's GitHub history, you get the idea. But they were fined. Publicly traded corporations only care about the feelings of their investors. Kick them in those plums and they'll start trying to improve instead of finding cheap ways to hide their cheap failures.
-
@boblord @hotsoup Fines. Look at the auto industry. Transmissions fail to park, gas tanks explode, Lancias rust like a trans girl's GitHub history, you get the idea. But they were fined. Publicly traded corporations only care about the feelings of their investors. Kick them in those plums and they'll start trying to improve instead of finding cheap ways to hide their cheap failures.
@cR0w @boblord those industries have actual, real, Big E, Engineers. With Standards. And stamps. And liability. And consequences.
They are held personally responsible for their mistakes, and are thus incentivized not to make mistakes. (And like you implied, maybe not intentionally, they are also incentivized to hide their mistakes. Which is why inspections need to be done by unbiased third parties).
That is what software needs. Standards, Regulation, enforcement, consequences. And third party inspections. Real Engineering.Edit: part to party
-
@cR0w @boblord those industries have actual, real, Big E, Engineers. With Standards. And stamps. And liability. And consequences.
They are held personally responsible for their mistakes, and are thus incentivized not to make mistakes. (And like you implied, maybe not intentionally, they are also incentivized to hide their mistakes. Which is why inspections need to be done by unbiased third parties).
That is what software needs. Standards, Regulation, enforcement, consequences. And third party inspections. Real Engineering.Edit: part to party
-
Exactly. So much in tech says it's engineering but it's not. Engineering requires an understanding of how things work. But tech is about how to make money the fastest.Gli ultimi otto messaggi ricevuti dalla Federazione
-
Link al documentario: https://www.arte.tv/fr/videos/116007-000-A/sardaigne-la-mysterieuse-civilisation-des-nuraghes/
-
È arrivata la "bibbia" di Giovanni Lilliu.
Questo perché neanche tanto tempo fa @zabow (che ringrazio) aveva postato il link ad un interessantissimo documentario (in francese) sulla civiltà nuragica, con bellissime immagini e ricostruzioni virtuali. Da cui il dubbio: stai a vedere che l'organizzazione socio-economica dei nuragici era molto più avanzata di quella degli isolani attuali! 😄
Per togliermi ogni dubbio è tempo di studiare questa miniera di informazioni.
-
la X in XMPP sta per estensibile, XMPP era stato creato con in testa il caso d'uso delle chat testuali degli anni 90, ma si è adattato facilmente alle chat testuali con allegati, videochiamate (1:1), connettività mobile e quant'altro degli anni 20, così come a molti altri casi d'uso di nicchia
farlo in modo che sia compatibile (per quello che riguarda le funzionalità comuni) con gli altri client potrebbe funzionare bene oppure no, non è obbligatorio, ma se fattibile darebbe dare dei vantaggi alla soluzione. oppure no, dipende dal caso d'uso specifico, e onestamente con discord non ho mai avuto a che fare per cui non posso sbilanciarmi sulla cosa.
-
@tk honestly, ironing clothes is less of a chore than vacuuming :D (we usually do it a bit at a time with a rechargeable vacuum)
(and baking, considering a number of food restrictions, would have required too much prep time, ending up happening after the peak of electricity production)
(heat pumps for water heating have been postponed to “when we can save a bit more money for it, and hopefully the prices will have gone down a bit, because right now all of the quotes we're getting are (probably oversized but) extortionate”)
-
⬇️⬇️⬇️⬇️
Annuncio 📣Cerco lavoro alle Maldive in cambio di vitto e alloggio, se non c’è il lavoro va benissimo anche solo vitto e alloggio.
-
Bacchetta? #RaiSport
-
@valhalla i can recommend vacuuming the house or baking cake/casserole?
For the advanced users: Charging the EV or Water heating via heatpump
-
@palin eh, okay Pidgin, ma pure quando arriva quello mica risolvi.
Cioè, XMPP è stato creato in un certo modo con un certo caso d'uso in testa e quello è perfetto. Non ha senso che venga "storpiato" per assomigliare ad altro, ecco.Il punto è che Discord era qualcosa di unico nel suo genere e per ora -a parte questo Fluxer che non so come faccia a non aver ricevuto delle note dai legali di Discord- non vedo cose sensate a colmare l'eventuale vuoto.
(Enfasi su eventuale, non credo succeda.)
