alt Hacker News26262 is a process standard (a voluntary one at that), not a software standard. It barely even talks about software outside a couple specialized sections. You can also think of the CA program as a process standard that comes with active enforcement.
26262 is a process standard (a voluntary one at that), not a software standard. It barely even talks about software outside a couple specialized sections. You can also think of the CA program as a process standard that comes with active enforcement.
The process of developing software has an impact on the outcome, especially if the software is tied in with physical systems. If you’re looking for software that meets specific criteria, built to an engineering standard, you need a formal process around it.
Also, a purely software-focused standard doesn’t make sense for CAs, as they also operate and maintain infrastructure. The failure with this CA was a process failure.
I probably emphasized software too much in my reply, but that’s usually where I see people call for standards to be forced on the “tech” industry.