heads-up: EU Cyber Resilience Act - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: September 10, 2022, 02:40:47 pm
content: On Tuesday (September 13) the European Commission plans to publish the Cyber Resilience Act (CRA). The CRA will most likely impact anything connected (software, hardware and services). The basic idea is great, but some points are overdoing things and might do more harm than good.

author: Bud
author_rank: Super Contributor
timestamp: September 10, 2022, 04:12:01 pm
content: Quote from: RoGeorge on September 10, 2022, 03:06:18 pmNot only that, I think when chip shortage will subside we will not have access to many of the high end nomenclature anymore. Things like low to mid grade FPGA will be available but the old good times when ADI gave you samples of their latest high speec ADCs and ZigaHerz mixers will be gone. It will be purposeful limitations who is allowed to buy what.

author: pcprogrammer
author_rank: Super Contributor
timestamp: September 10, 2022, 04:18:22 pm
content: Quote from: RoGeorge on September 10, 2022, 03:06:18 pmThat is a contradiction in terms

author: madires
author_rank: Super Contributor
timestamp: September 10, 2022, 04:26:50 pm
content: Quote from: RoGeorge on September 10, 2022, 03:06:18 pmThat's a marketing website of some cybersecurity company.

author: golden_labels
author_rank: Super Contributor
timestamp: September 10, 2022, 05:26:20 pm
content: Thanks for the heads-up. I nearly forgotten about that.Unfortunately, when it hits EUParl, I can do little as a Polish citizen. My EFA candidate did not get her seat, and the choice is basically between ECR and EPP. ECR MEPs will likely ignore any communication. EPP MEPs are of local opposition and are now focused on putting themselves on antipodes of anything PiS says, not very interested in other topics. I suppose local NGOs will try to poke EPP nonetheless, but even their chances are low.

author: SiliconWizard
author_rank: Super Contributor
timestamp: September 11, 2022, 01:05:20 am
content: This has got to fricking stop if you ask me. (I know you didn't.)

author: Ed.Kloonk
author_rank: Super Contributor
timestamp: September 11, 2022, 01:23:08 am
content: Quote from: SiliconWizard on September 11, 2022, 01:05:20 amNeither did the law makers, apparently.

author: golden_labels
author_rank: Super Contributor
timestamp: September 11, 2022, 01:55:50 am
content: Quote from: Ed.Kloonk on September 11, 2022, 01:23:08 amIndeed they did not. They did not, because they could not. They could not, because the legislative procedure did not start yet.However, which may surprise you and despite there is no such requirement, ECasked for input.

author: madires
author_rank: Super Contributor
timestamp: September 15, 2022, 12:55:43 pm
content: Update:- EU Cyber Resilience Acthttps://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act- Proposal for downloading:https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-actEdit: It seems that the proposal has no exemptions for open source, i.e. same rules for companies and open source projects.

author: tszaboo
author_rank: Super Contributor
timestamp: September 15, 2022, 02:16:03 pm
content: The new revision of the RED directive will include encryption of the radio interface as requirement in many (all?) cases.Meaning that you cannot really place a product on the market without those measures in place. At least after if it is harmonized.It's a good change. As a customer, you cannot evaluate cybersecurity. You don't know if some idiot left "admin 1234" as default password on your device. There is just no way to do that.Quote from: madires on September 15, 2022, 12:55:43 pmWhy exactly should we leave exceptions for open source?

author: RoGeorge
author_rank: Super Contributor
timestamp: September 15, 2022, 04:35:02 pm
content: Quote from: madires on September 15, 2022, 12:55:43 pmThanks for the links.There is something about open source at point 10, page 16 of 87 in the "Proposal for a Regulation on cybersecurity requirements for products with digital elements - Cyber resilience Act (.pdf)"Quote

author: madires
author_rank: Super Contributor
timestamp: September 15, 2022, 05:34:52 pm
content: Quote from: tszaboo on September 15, 2022, 02:16:03 pmThe additional resources required to comply with the CRA would discourage open source projects.

author: tszaboo
author_rank: Super Contributor
timestamp: September 15, 2022, 07:27:12 pm
content: Quote from: madires on September 15, 2022, 05:34:52 pmSo if you want to sell open source products to the European market, then all bets are off and everything goes?

author: madires
author_rank: Super Contributor
timestamp: September 15, 2022, 08:10:26 pm
content: Quote from: tszaboo on September 15, 2022, 07:27:12 pmIf was talking about developing/maintaining open source, not selling products containing open source. Selling products is a commercial activity.

author: golden_labels
author_rank: Super Contributor
timestamp: September 16, 2022, 01:02:41 am
content: Quote from: madires on September 15, 2022, 08:10:26 pmBut the proposal excludes software distributed outside of the commercial activity from regulation’s scope — asRoGeorge has noticed. Therefore tszaboo may narrow the discussion to commercial activity involving FOSS. The other option is off-topic in the context of this regulation.In its current form, I see little risk to open source either. The exemption in recital 10 seems to be overly protective or an attempt to avoid the subject altogether. After glimpsing over the proposal, the main concern would be jurisdiction,(1)the 24h vulnerability notification period, red tape in a dynamic and shapeless development environment, and adequacy and enforceability of penalties.But in general I do not oppose the idea itself, even if applies to FOSS products (commercial or not). A random consumer coming to e.g.https://www.libreoffice.org/will assume it’s offering a normal product, will not know about the ideas behind this package, and may have exactly the same expectations as if they use any other office software. From that perspective they should have the same protections. In particular since those are absolute basics: not meeting some of the requirements is not an overlook — it’s gross negligence at least. So the primary reason for my concerns is the very nature of open culture, which makes it an activity different from other kinds of manufacturing. Even if the final outcome may sometimes look similar. But that applies only to FOSS — for example properietary freeware is not sharing the same characteristics.Leaving the FOSS topic, in general the regulation seems fine. A few points:I am not sure if that really had to be a regulation instead of a directive.The 24h vulnerability notification period is unreasonable. That requires having a 24/7 security reponse team, which for most entities is neither possiblenor needed.The regulation misses a clear provision, that would require a manufacturer to allow effective product audits and permit audits in the case of refusal. It is also a missed opportunity to give the right to perform security audits of products and publishing findings.No mention of a mechanism for exchanging, storing and anouncing incidents: neither in the regulation, nor as a delegation to separate acts. Not strictly required, but it was a good place to build EU-wide system for that.(1)FOSS is inherently and overwhelmingly cosmopolitan, compared to most other software.

author: SiliconWizard
author_rank: Super Contributor
timestamp: September 16, 2022, 09:48:44 pm
content: All this is good news for MS.But I'm sure no amount of lobbying was involved in this proposal. It never happens!

author: tszaboo
author_rank: Super Contributor
timestamp: September 16, 2022, 10:38:27 pm
content: Quote from: madires on September 15, 2022, 08:10:26 pmSince when do you require CE marking on a thing, that you are not selling?This is easy. If you sell something here, it needs CE marking, and you need to follow the rules. If you don't sell it, you don't.

author: golden_labels
author_rank: Super Contributor
timestamp: September 17, 2022, 02:04:57 am
content: Quote from: tszaboo on September 16, 2022, 10:38:27 pmThe CE marking is needed if a product is placed on the market. The way it enters the market is irrelevant. The same applies to being obligated to follow the regulation.