'Securing Open Source Software Act' introduced to US Senate
FWIW, while this specific act may not be enforcing significant regulation, software developers need to understand that there&#x27;s a ticking clock. Modern civic engineers went without any significant regulation, and then that changed. Software is young, it&#x27;s in the phase where people aren&#x27;t dying <i>too</i> often for the public to care. But breaches are leading to massive privacy problems, real wars and conflicts are increasingly leveraging software defects, and the impact and scrutiny will only grow.<p>If you want to avoid having to pass tests, having to maintain insurance, having to do a bunch of bullshit, all just to be a software engineer, get started on fixing things <i>now</i>.<p>It is absurd that anyone can anonymously provide open source code, with no assurances whatsoever, and that can end up in critical software. And you might be saying &quot;well, it&#x27;s up to people to audit their dependencies&quot; - and maybe you&#x27;re right. But I would challenge that <i>everyone</i> has the right to publish code <i>for distribution purposes</i> with zero responsibility.<p>Publishing code to Github? Sure, go for it, anyone can do it. Publishing <i>packages</i> to <i>package distributors</i> ? No, that crosses a line. I don&#x27;t <i>want</i> legal requirements, I don&#x27;t <i>want</i> identification requirements, just to publish and distribute code.<p>If we want to avoid that we&#x27;re going to need to step it up - that means, yeah, <i>basic</i> measures like strong 2FA to distribute packages should be a requirement. Signing packages should be a requirement. Acknowledging and triaging vulnerabilities should be a requirement. If you aren&#x27;t willing to do the above, which is frankly trivial, you shouldn&#x27;t be allowed to publish software <i>for distribution purposes</i>.<p>I think we need to start taking a bit more responsibility for the work we do. &quot;NO WARRANTY&quot; doesn&#x27;t mean &quot;No obligations&quot;, it just means no one has a legal right to pursue damages due to your software, you should <i>still do some things</i>.<p>edit: K I&#x27;m rate limited so I can&#x27;t have this conversation with all of you, thanks again Dang