[flagged]
Seriously, I think the time has long since passed software needs regulating. It's a major part of modern society, and as far as I'm aware, most people aren't opposed to building standards in principle.
If we want a safer internet, make them carry insurance against data breaches and fine them a fixed amount, say $1500, for each identity they leak, paid immediately upon proof of pwnage.
Complete safety, or actual freedom. Pick one. You can't have both.
False dichotomies aren't helpful and underscore lazy thinking. The real world is full of nuance, and so should our policies. Using a risk-based approach is probably more appropriate than an all-or-nothing policy.
Or, maybe pick a point on a spectrum.
That seems more realistic, because I'd argue you can't really have "Complete Safety" or "Actual Freedom" (by which I am guessing some people would interpret 'actual' as 'complete').
The regulations are to ensure the 10% of bad builders/developers don't ruin peoples lives.
Regulation hinders progress and makes things more expensive. But no regulation raises costs and hinders progress too: it basically creates a situation of very low trust, and low trust is extremely expensive for customers/buyers who are not domain experts. This also makes them overcautious and conservative. One needs a balance and lots of nuance to make a reasonably well functioning market/system.
The case against regulation on software business is not that "regulation is bad". It's that programming and software is very new and rapidly evolving area of human activity. It's not nearly as well understood as building houses. Written and unwritten standards and best practices are constantly changing. The field is subject to very strong fashion-driven "crazes".
(Just look at how many new languages are still being created. Most don't become as widespread as C++ or Java or Python, but many do find their niche, and very many are in use to some extent. This indicates that "language Holy Graal" is nowhere to be seen yet.)
In software, there is very little consensus between domain experts on most issues. This is very unlike construction and house building, where some new materials ant techniques are introduced too, but the basic principles are well understood, calculable, and where agreement among experts is usually quite achievable.
So arguably it's nearly impossible to create good regulation at this stage, at least outside of certain special niches. This is very different from building codes and stuff.
Of course there is also bad regulation. The bureaucracy likes to expand their control indefinitely, wants to regulate things that should not be regulated, thus (if unchecked) creating very bad regulation. Well, that's the case for checks and balances, for the society to fight back. But "this regulation is bad and needs to be changed" is a much more mature position than "we need no f*g regulation!", in my opinion...
Building a building without regulation is easy. Building a city that doesn't burn to the ground every time someone knocks over an oil lamp is not.
The same can be applied to software. An ability to cobble together a "Hello World" does not necessarily mean I want you programming a controls system on a nuclear power plant.
If you don't know, Consumer Reports is paid by groups interested in encouraging the government to apply regulations to certain areas. A bike helmet manufacturer may pay them to create a report, host events, and otherwise lobby on their behalf to e.g. create regulations about people needing to use bike helmets.
It is my understanding that many Rust advocates, security researchers, and members of the Internet Society are effectively advocating/lobbying for partial government mandates of 'memory-safe languages'[0]:
> It’s not yet possible for government procurement to only buy memory-safe software. For example, you can’t say routers must be memory-safe top to bottom because no such products currently exist. But it may be possible for the government to say that newly developed custom components have to be memory-safe to slowly shift the industry forward.
> This would require some type of central coordination and trust in that system. The government could ask for a memory safety road map as part of procurement. The map would explain how the companies plan to eliminate memory-unsafe code in their products over time. The carrot approach for memory safety may include not just decreased future costs in cybersecurity, but also reliability and efficiency.
[0] https://advocacy.consumerreports.org/wp-content/uploads/2023...
I am willing to bet that most of those “Rust advocates” are programmers who code in Rust but I’m fine with not calling them that. I agree that good programmers should be able to work in different languages, operating systems, countries.
For example, if this had already happened we may find today that Java is certified for use but that Rust is simply not allowed, while maybe Swift is because of Apple's backing of it.
If you have some point to make please do so earnestly. Layering in levels of irony makes any point you're trying to make difficult to understand or follow, even if labelled with /s.
This is going off-topic, but there is a style of internet arguing that I have come to seriously dislike. It is one where instead of someone making a point, they make the point they wish to detract and simply flag that they are being ironic. In doing so they don't actually advance the point they're trying to make, they assume that the audience already understands and is sympathetic to that point, so they simply put up a target to scoff at.
I'm not sure if that's what you're doing here, or if you're just struggling to make a point about worrying about government intrusion into private business.
What is a quite real possibility. For example, there are plenty of places out there that can't stop expiring passwords every 1 or 3 months because it's in one of those lists. But I do agree that complaining about the recommendation because of this is completely out of topic, the focus should be on the rule that actually mandates it.
Even that mandate did not appear to fundamentally change the landscape beyond government work.
Worked out well enough with Ada in 1978. https://en.m.wikipedia.org/wiki/Ada_(programming_language)#H...
Time and time again, we see experts make recommendations, then legislation and rules make it mandatory.
A burning example is most of NIST special publications. NIST makes no rules, mandates and such. Yet, mandates (e.g.,DFARS, DEAR) point to the recommendation as the requirement.
Right now there are two of these playing out in the cybersecurity field - zero trust and passwordless authentication.
So those who down this comment, you are right, it is not a mandate. Those who up this comment, you are right, it is likely to become a mandate.
Though at this point, this is a recommendation, not a mandate.