>"So yes, I get it: we shouldn’t trust companies, or even FOSS projects, to self-report.
Unless…what if we made penalties so large for not reporting, and for getting it wrong, that they would fall over themselves to do so?"
We know this doesn't work, and author admits as much.
However, the proposed solution is to add another cert into the mix. But it's not clear how this designation would be applied globally, with agreement across the globe on the requirements, punishments, etc. Not to be rude to the author, but it sort of seems like they forgot that not all software is developed in the US. (Not to mention, I really don't want another cert)
Unless…what if we made penalties so large for not reporting, and for getting it wrong, that they would fall over themselves to do so?"
We know this doesn't work, and author admits as much.
However, the proposed solution is to add another cert into the mix. But it's not clear how this designation would be applied globally, with agreement across the globe on the requirements, punishments, etc. Not to be rude to the author, but it sort of seems like they forgot that not all software is developed in the US. (Not to mention, I really don't want another cert)