<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Robert,<div><br></div><div>We will update the link for the EO to the stable link in the Federal Register. </div><div><br></div><div>The SSAC report is hoping to help shape the technical implementation details of some regulations that are already in flight, including the CRA. It appears very likely that BIND, for example, will have to undergo third party process audits under the CRA, required for products with a critical role in network management. What is unknown is how often these will have to be done, and what the audits will consist of. I am not aware of any proposed regulations that include third party validation of the software.</div><div><br></div><div>The question is whether users think that this type of audit, or the requirements around vulnerability reporting, or encouraging updating, will improve their cybersecurity in practice. We can tell that the CRA, for example, will certainly mean more work for ISC’s software development teams, but we cannot tell whether that is welcomed by our users. It is a serious question - industry places some value on ISO quality certifications, and the CRA is in the same vein. The US Executive Orders, by contrast, seem to mostly use the “carrot” approach, as they are intended to impact US Federal procurement guidelines. </div><div><br></div><div>Vicky<br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On Jan 29, 2025, at 6:57 AM, Robert Wagner <rwagner@tesla.net> wrote:</div><br class="Apple-interchange-newline"><div><meta charset="UTF-8"><div class="elementToProof" style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 14pt;">This is not a good survey... </div><ol start="1" data-editing-info="{"applyListStyleFromLevel":false,"orderedStyleType":3}" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 14pt; list-style-type: "1) ";"><div class="elementToProof">The 2025 US Executive orders point to a dead links. Use the Federal Registrar link as it should be there long-term. <span class="Apple-converted-space"> </span><span style="font-size: 18.6667px; background-color: rgb(255, 255, 255);"><a href="https://public-inspection.federalregister.gov/2025-01470.pdf" target="_blank" id="LPlnk" class="OWAAutoLink" title="https://public-inspection.federalregister.gov/2025-01470.pdf" rel="noopener noreferrer" data-olk-copy-source="MessageBody" data-linkindex="0" data-auth="NotApplicable" style="margin: 0px; background-color: rgb(255, 255, 255); text-align: left;">2025-01470.pdf</a> CISA <a href="https://www.federalregister.gov/documents/2021/05/17/2021-10460/improving-the-nations-cybersecurity" id="LPlnk" class="OWAAutoLink" style="background-color: rgb(255, 255, 255);">Federal Register :: Improving the Nation's Cybersecurity</a></span></div><div class="_Entity _EType_OWALinkPreview _EId_OWALinkPreview_1 _EReadonly_1"><div id="LPBorder_GTaHR0cHM6Ly93d3cuZmVkZXJhbHJlZ2lzdGVyLmdvdi9kb2N1bWVudHMvMjAyMS8wNS8xNy8yMDIxLTEwNDYwL2ltcHJvdmluZy10aGUtbmF0aW9ucy1jeWJlcnNlY3VyaXR5" class="LPBorder318533" style="width: 748px; margin-top: 16px; margin-bottom: 16px; position: relative; max-width: 800px; min-width: 424px;"><table id="LPContainer318533" role="presentation" style="padding: 12px 36px 12px 12px; width: 748px; border-width: 1px; border-style: solid; border-color: rgb(200, 200, 200); border-radius: 2px;"><tbody><tr valign="top" style="border-spacing: 0px;"><td><div id="LPImageContainer318533" style="position: relative; margin-right: 12px; height: 57.6923px; overflow: hidden; width: 240px;"><a target="_blank" id="LPImageAnchor318533" href="https://www.federalregister.gov/documents/2021/05/17/2021-10460/improving-the-nations-cybersecurity"><img id="LPThumbnailImageId318533" alt="" height="57" width="240" src="https://www.federalregister.gov/assets/open_graph_site_banner.png" style="display: block;"></a></div></td><td style="width: 436px;"><div id="LPTitle318533" style="font-size: 21px; font-weight: 300; margin-right: 8px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; margin-bottom: 12px;"><a target="_blank" id="LPUrlAnchor318533" href="https://www.federalregister.gov/documents/2021/05/17/2021-10460/improving-the-nations-cybersecurity" style="text-decoration: none; color: var(--themePrimary);">Federal Register :: Improving the Nation's Cybersecurity</a></div><div id="LPDescription318533" style="font-size: 14px; max-height: 100px; color: rgb(102, 102, 102); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; margin-bottom: 12px; margin-right: 8px; overflow: hidden;">This site displays a prototype of a “Web 2.0” version of the daily Federal Register. It is not an official legal edition of the Federal Register, and does not replace the official print version or the official electronic version on GPO’s<span class="Apple-converted-space"> </span><a href="http://govinfo.gov/">govinfo.gov</a>.</div><div id="LPMetadata318533" style="font-size: 14px; font-weight: 400; color: rgb(166, 166, 166); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif;"><a href="http://www.federalregister.gov/">www.federalregister.gov</a></div></td></tr></tbody></table></div></div><div><br></div><div class="_Entity _EType_OWALinkPreview _EId_OWALinkPreview _EReadonly_1"><div id="LPBorder_GTaHR0cHM6Ly9wdWJsaWMtaW5zcGVjdGlvbi5mZWRlcmFscmVnaXN0ZXIuZ292LzIwMjUtMDE0NzAucGRm" class="LPBorder123120" style="width: 748px; margin-top: 16px; margin-bottom: 16px; position: relative; max-width: 800px; min-width: 424px;"><table id="LPContainer123120" role="presentation" style="padding: 12px 36px 12px 12px; width: 748px; border-width: 1px; border-style: solid; border-color: rgb(200, 200, 200); border-radius: 2px;"><tbody><tr valign="top" style="border-spacing: 0px;"><td style="width: 692px;"><div id="LPTitle123120" style="font-size: 21px; font-weight: 300; margin-right: 8px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; margin-bottom: 12px;"><a target="_blank" id="LPUrlAnchor123120" href="https://public-inspection.federalregister.gov/2025-01470.pdf" style="text-decoration: none; color: var(--themePrimary);">Federal Register on 01/17/2025 and available online at Nationality Act of 1952 (8 U.S.C. 1182(f)), and section 301 of https://federalregister.gov/d/2025-01470 EXECUTIVE ORDER U.S.C. 1601 et seq. 14144</a></div><div id="LPDescription123120" style="font-size: 14px; max-height: 100px; color: rgb(102, 102, 102); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; margin-bottom: 12px; margin-right: 8px; overflow: hidden;">6 develop and publish a preliminary update to the SSDF. This update shall include practices, procedures, controls, and implementation examples regarding the</div><div id="LPMetadata123120" style="font-size: 14px; font-weight: 400; color: rgb(166, 166, 166); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif;"><a href="http://public-inspection.federalregister.gov/">public-inspection.federalregister.gov</a></div></td></tr></tbody></table></div></div><div><br></div></li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 14pt; list-style-type: "2) ";"><div class="elementToProof">How can one determine the impact of unknown regulations??</div></li></ol><div class="elementToProof" style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 14pt;">FYI - If the EU took it upon themselves to analyze every bit of software and provide a free rating - that may have one outcome. However, if everyone producing open- source software was required to pay some large sum to get their software tested (and face fines if they didn't), that would have a different outcome.</div><div class="elementToProof" style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 14pt;"><br></div><div class="elementToProof" style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 14pt;">Regulations can be a carrot or stick approach.</div><div class="elementToProof" style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 14pt;"><br></div><div class="elementToProof" style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 14pt;">Software can be buggy but still be very useful/helpful. Malicious software can be well written (no obvious bugs). </div><div class="elementToProof" style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 14pt;"><br></div><div class="elementToProof" style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 14pt;">RW<br></div><div class="elementToProof" id="Signature" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div dir="ltr" id="divtagdefaultwrapper" style="font-size: 14pt; font-family: Calibri, Helvetica, sans-serif;"><div style="margin-top: 0px; margin-bottom: 0px;"><br></div></div></div><div id="appendonsend" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"></div><hr tabindex="-1" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; display: inline-block; width: 772.234375px;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;"></span><div id="divRplyFwdMsg" dir="ltr" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><font face="Calibri, sans-serif" style="font-size: 11pt;"><b>From:</b><span class="Apple-converted-space"> </span>bind-users <<a href="mailto:bind-users-bounces@lists.isc.org">bind-users-bounces@lists.isc.org</a>> on behalf of Marc <<a href="mailto:Marc@f1-outsourcing.eu">Marc@f1-outsourcing.eu</a>><br><b>Sent:</b><span class="Apple-converted-space"> </span>Tuesday, January 28, 2025 3:27 PM<br><b>To:</b><span class="Apple-converted-space"> </span>Victoria Risk <<a href="mailto:vicky@isc.org">vicky@isc.org</a>>; BIND Users <<a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a>>; '<a href="mailto:CNECT-F3@ec.europa.eu">CNECT-F3@ec.europa.eu</a>' <<a href="mailto:CNECT-F3@ec.europa.eu">CNECT-F3@ec.europa.eu</a>><br><b>Subject:</b><span class="Apple-converted-space"> </span>RE: Survey on the impact of software regulation on DNS systems</font><div> </div></div><div class="BodyFragment" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><font size="2"><span style="font-size: 11pt;"><div class="PlainText">This email originated from outside of TESLA<br><br>Do not click links or open attachments unless you recognize the sender and know the content is safe.<br><br>><br>> Did you know that there is significant momentum building to regulate<br>> software, including open source, in at least Europe and the US (and<br>> possibly elsewhere as well), in order to improve cybersecurity? Do you<br>> think this regulation will improve cybersecurity for your operations?<br>> What are the opportunities and pitfalls you can envision?<br>><br>><br><br>What about regulating standards? What is the point of regulation open source, when companies like apple and microsoft sabotage third party software/connectivity by not implementing software according to standards. Their upgrades miraculously only break third parties implementations and not their own.<br>Think eg. of auto provisioning.<br><br><br>--<br>Visit<span class="Apple-converted-space"> </span><a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a><span class="Apple-converted-space"> </span>to unsubscribe from this list<br><br>ISC funds the development of this software with paid support subscriptions. Contact us at<span class="Apple-converted-space"> </span><a href="https://www.isc.org/contact/">https://www.isc.org/contact/</a><span class="Apple-converted-space"> </span>for more information.<br><br><br>bind-users mailing list<br><a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br><a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a></div></span></font></div></div></blockquote></div><br></div></body></html>