Login

Recent searches

No recent searches

Search options

Only available when logged in.
fosstodon.org is one of the many independent Mastodon servers you can use to participate in the fediverse.
Fosstodon is an invite only Mastodon instance that is open to those who are interested in technology; particularly free & open source software. If you wish to join, contact us for an invite.

Administered by:

Server stats:

10K
active users

fosstodon.org: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.6

Public
bert hubert 🇺🇦🇪🇺🇺🇦

The negotiations on the EU Cyber Resilience Act are continuing. 60k people visited my earlier page on this very scary & important act that may make it very hard to market hardware or software in the EU. Here is a followup on how it might work in practice. Spoiler: likely terribly. berthub.eu/articles/posts/eu-c

Bert Hubert's writingsEU Cyber Resilience Act part two: Updates & Impracticalities - Bert Hubert's writingsThis is a living document - I’d normally spend a few days polishing everything, but since CRA talks are ongoing right now, there’s simply no time for that. Check back frequently for updates! Also please let me know urgently on bert@hubertnet.nl if you think I’m reading things incorrectly! As a follow-up to my earlier post on the EU Cyber Resilience Act, here I’d like to address some practicalities: how would it actually work.
bert hubert 🇺🇦🇪🇺🇺🇦

A very worrying development in the latest compromise is that the EU will now demand that products ship "without known vulnerabilities" <period>. The previous draft spoke about "without known *exploitable* vulnerabilities", which was a lot better. berthub.eu/articles/posts/eu-c

Bert Hubert's writingsEU Cyber Resilience Act part two: Updates & Impracticalities - Bert Hubert's writingsThis is a living document - I’d normally spend a few days polishing everything, but since CRA talks are ongoing right now, there’s simply no time for that. Check back frequently for updates! Also please let me know urgently on bert@hubertnet.nl if you think I’m reading things incorrectly! As a follow-up to my earlier post on the EU Cyber Resilience Act, here I’d like to address some practicalities: how would it actually work.
Mar 19, 2023, 11:35 AM·Public
27boosts·19favorites
Public
Ed Davies

@bert_hubert Tree falling in the woods type question, but is a vulnerability which is not exploitable actually a vulnerability?

Public
bert hubert 🇺🇦🇪🇺🇺🇦

@edavies The point of regulations is not that they can charitably be interpreted as being good enough. They must be very clear so even an uncharitable reading comes out ok.

Public *
Ed Davies

@bert_hubert Fair point. I guess even the history of having removed the word “exploitable” would work against somebody arguing that a non-exploitable vulnerability (if that's meaningful) is not a vulnerability. Or the opposite…

Public
bert hubert 🇺🇦🇪🇺🇺🇦

@edavies I updated the post a bit with some discussion on how one might interpret 'vulnerability'.

Public
Zash

@bert_hubert And known by whom? Random employee who stumbled upon a problem while debugging a different problem and forgot to report it? Or like, the release manager/team?

Public *
Greg K-H
@bert_hubert My big problem is, who defines "known"?

With our without "exploitable" the main issue seems to be ignored whereby the EU will have to spin up a European version of what China and the US attempt to do with their vulnerability tracking efforts, despite them failing horribly for open source software.

I think the phrase I'm looking for is, "Ik zie beren op de weg", right?
Public
bert hubert 🇺🇦🇪🇺🇺🇦

@gregkh Soon you'll be able to pass for a native ;-) Updated the post with some words on 'known'. Not yet sure if I can/should write on the vulnerability tracking.

Public
Mattis van 't Schip

@bert_hubert Hi Bert, many thanks for writing your thoughts about this so swiftly and extensively. Where did you find the latest draft of the CRA that you are referring to in this second document? Is this a first Council compromise proposal, as reported by EURACTIV: euractiv.com/section/cybersecu or did you find something else?

EURACTIVEU Council extends product lifetime, clarifies scope in cybersecurity lawBy Luca Bertuzzi
Public
bert hubert 🇺🇦🇪🇺🇺🇦

@mattis A 10th of March Council version is circulating widely, and that is what I am referring to. Will clarify that in the post.

ExploreLive feeds
About