We already do this. My prior uni got hacked, everyone's IDs/drivers licenses/passports, mails, data got leaked. The vendor was a 4-person third party cloud provider who had all of the necessary security certifications for the uni to avoid gross negligence. No-one paid anything as the 4-man firm went bankrupt and the uni got a new provider who is fully licensed to avoid gross negligence.
With software, you can stack these shells of proxies almost for free.
Even given this, the industrial exemption is not getting rid of currently with status quo. So the worldview is not really valid until it is.
[–] bumby 2 days ago
[–] augment_me 2 days ago
I worked in HW before for home electronics that had to be certified. There was no responsibility for the engineers, the cert house had to take on this responsibility, and they had a shell certification company hired who would conduct the tests and take on the responsibility. At one point there was a litigation due to an RF leakage from a LATAM-bound device causing signaling issues to public infra and causing an accident, but it went nowhere because of the layering of responsibility made by the cert houses. No engineer was responsible.
Which licensed engineer stamped the software? The answer is probably “none”, because licensed engineers are liable even if their company is bankrupt. The person holds the license, not the company so it sounds like we’re talking past one another.