[Jonathan Gardner]
Let's say I am the general contractor responsible for building a new
apartment building. I hire a carpenter and he and his team builds the
structure. I am still responsible for the structure being up to code and
if
it fails in any way, I will be held responsible. I can't tell the city
inspector, "Well, it's not my fault. It's the carpenter. Why don't you
blame him and leave me alone?"
You can bet that if I choose incompetent carpenters, that my reputation as
a
GC will suffer. Would you hire me if I always choose bad carpenters and
always fail inspection?
In addition to inspection you have a contract with carpenter.
There can a terms like "Carpenter will not get payment for _his_job_ if it
does not meet required quality level".
Here is a problem. There is no clear way to determine in SPF if it's ISP or
your fault.
If you will fail inspection because of carpenters, you will be possibly able
to not pay them or even recover damages.
But if it will be impossible to clearly find our if its carpenters or your
fault - you cannot do this.
Compromised DK is clearly your fault.
Compromised ISP is not your fault, but SPF makes it your fault too.
--
Andriy G. Tereshchenko
TAG Software
Odessa, Ukraine
http://www.24.odessa.ua