RISC-V: an ISA you are allowed to read
The Server SoC, Boot and Server Platform specifications are ratified. What makes it interesting is the specification being nobody's property, rather than the instruction set itself.
open-source
Digital sovereignty is a dependency question
Mostly discussed as flag-planting, which is a shame, because underneath it sits a specific engineering question: which capabilities could somebody outside your jurisdiction switch off, and what do you do then?
A licence is a term of trade
Seven years of relicensing, three forks with foundations behind them, two walk-backs and one proprietary vendor ending perpetual licences outright. Read as supply chain rather than as community drama, the pattern is consistent: the licence on a dependency is a commercial term, and commercial terms change.
The backdoor a second build can see
The backdoor sat in the release tarball and not in the git tree. Closing that gap is what reproducibility is for, and it's the highest-value control to come out of the whole incident.
Repair ends at the signing key
The legislation deals with parts and manuals. The practical barrier has moved on to signed firmware, parts pairing and who gets to say a component is genuine.
The xz backdoor found the human dependency
Mitigation code available
A backdoor in xz-utils 5.6.0 and 5.6.1, planted over a multi-year social engineering campaign against a burnt-out maintainer, and caught by one engineer who wondered why SSH was half a second slow.
Government procurement is an architectural decision
Why public-sector IT keeps producing the same outcomes: the failure sits upstream of any engineering, in a procurement model that selects for the appearance of risk transfer.
Dual use is the default, not the exception
Almost every useful security tool is also an attack tool. The question was never whether to build dual-use technology; it is what you owe the people downstream of it.
Interoperability is the feature
Every platform eventually works out that the boundary it controls is worth more than the product inside it. Which is the very reason the boundary should be the thing you specify.
