We are now at t+26h. Please compare how much we knew about the xz-attack after less than a day with what we know about the chain of events of giant outage yesterday.
If something similar had been caused by an OSS component, we would see congress discussing a ban on open software in critical infrastructure already.
No we won’t. I refer to HeartBleed, Log4J, and Eternal Blue, and Solar winds. None of those affected applications have been banned and never will. Congress bans are based on political aspects not technical ones.
Huawei ban is because of the ties to China, kaspersky was banned because of Russian ties.
Security vulnerabilities are a big deal in the tech world, but no one really cares outside of that. The CrowdStrike bug was big because it was user-facing and shut down systems. The truth is we haven’t seen any user-facing bugs from open source software to compare CrowdStrike to.
But… if I don’t propose a ban, everyone will think I don’t know what i’m doing
None of those took down half of world. “something similar” in context of cyberstrike means something like cyberstrike.
You realize that any policy is political by its nature? Including any bans?
Solar winds was a pretty big deal and I would say bigger than the current thing. Although that just strengthens your argument given orion was not open source and they were hacked and the malevolent code was injected into their system essentially internally and had been tested for a bit by the hackers which if their code had been viewable might have allowed it to be caught before becoming such a big deal.
Do you remember Wanacry?
And? We are not talking about malware here.
Although I guess congress probably did ban Wannacry.