Post #4416464

@DaveMWilburn@infosec.exchange @Viss@mastodon.social @jfslowik@infosec.exchange uh oh. we agree. that's not supposed to happen, is it? this reminds me of the Grover Shoe Factory again and how states led the way. "No statute puts safety standards on software firms with liability attached" is now only true of the US federal code. EU Cyber Resilience Act is exactly that statute, security requirements as the condition of market access, with their revised Product Liability Directive making software defects strict liability. California and New York already put safety-framework and incident-reporting duties on frontier labs, penalties attached. ye'old steam boilers were same: Massachusetts first, industry code second, federal never. now Meta making it three labs with the same dumb "test" incident means accident has become industry practice, which is exactly what supervision law regulates.