Fwd: Board report for this month (draft)

[Dirk-Willem van Gulik <di...@webweaving.org>]

As there is some overlap - see below for my draft report to the board on public policy. 

Any and all comments welcome:

> - XZ event triggers questions from policy makers and `what if the CRA would already have been in force' speculation.  Sofar all informal. 

...

> As for now - our headline reading on CRA & XZ is that these are orthogonal issues at best. And that while SBOMs would have been great and good (ENISA) contact/reporting can be helpful - this is also a case where the remit of industry stops and that of the authorities and intelligence agencies start. 
> 
> The analogy I've been experimenting with is that of a civil/chartered engineer signing off on a dead-normal bridge; and being liable for that bridge collapsing. But universally understood that if it collapses because of a terrorist detonating a truck of explosives - that it is then largely out of his realm. And with this XZ question we seem to be muddling this.

With kind regards,

Dw


---------------------------------------------------------------------
To unsubscribe, e-mail: security-discuss-unsubscribe@community.apache.org
For additional commands, e-mail: security-discuss-help@community.apache.org