Conservancy/website
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

usethesource: add link to blog post on CCIRT page

Browse source
This commit is contained in:
Denver Gingerich 2024-02-02 22:57:01 -08:00
parent 5656bd3062
commit 27740b1dd2
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
conservancy/usethesource/templates/usethesource/ccirt_process.html
View file

@ -9,7 +9,7 @@
<p>We at SFC are providing an opportunity for companies who want to be notified of source candidates of theirs that we plan to post to <a href="..">Use The Source</a> to provide us with the email address of their Copyleft Compliance Incident Response Team (CCIRT), which we will email when we receive a new source candidate for the company that we plan to post. If we have a CCIRT email address on a file for a given company, we will email this address if we receive a source candidate from that company, and then wait at least 7 days for a reply - if an updated candidate is received, we will post that, otherwise we will post the candidate that we notified the CCIRT team about as-is.</p>
<p>As discussed in our [FIXME: link] blog post, the CCIRT is an important part of an organization's <abbr title="Open Source Program Office">OSPO</abbr> or cybersecurity team. SFC hopes that companies will treat any reports from SFC with the same urgency as any security vulnerabilities they are made aware of, since failure to provide complete source code severely impedes users' and third party repair companies' ability to fix them.</p>
<p>As discussed in <a href="/blog/2024/feb/03/ccirt-security-and-software-right-to-repair/">our blog post</a>, the CCIRT is an important part of an organization's <abbr title="Open Source Program Office">OSPO</abbr> or cybersecurity team. SFC hopes that companies will treat any reports from SFC with the same urgency as any security vulnerabilities they are made aware of, since failure to provide complete source code severely impedes users' and third party repair companies' ability to fix them.</p>
<p>Based on our decades of GPL compliance experience, we expect that many of the source code candidates we receive from the public will be incomplete. SFC cannot immediately validate nor invalidate any of those claims due to the vast number of devices on the market. But we are willing to engage with companies' CCIRTs so they have a chance to (re-)review these candidates if they wish, before SFC publishes them.</p>