Post

In a CRA webinar last week, I commented it is possible that C/C++ are a per se CRA violation, since C/C++ are insecure by design. An attendee replied "but C/C++ is what embedded use" and I said, more or less, "tough". Here's @gregkh.bsky.social on it: www.zdnet.com/article/rust...

I want to ask you and @littledan.dev to duke it out on this one; if I have his view right the CRA doesn't force eg Rust but you also have to have a whole set of mitigations and defences ready to point at in your declaration of conformity

it definitely doesn’t force Rust, but for safety by design of a C-based system, an auditor should absolutely be requiring either (a) “we use Rust to process all untrusted inputs” or (b) a literal phonebook of other mitigations. Which should be a forcing function.

I really want everyone to use memory-safe languages, but for what the CRA requires, we’ll have to see how the phone book of other mitigations works out. Maybe it will be thorough and practical enough, maybe not. It’d be much more inspiring and fun if the CRA didn’t defer to the state of the art!

I think the Brussels folks will tell you that CRA's standards rise as state of the art rises, and if it had been in place 10 or 20 years ago, "secure by design" would have been a very different target. Open question whether that happens in practice or just gets ossified into 2027-era audit docs.

The idea is to revisit this law, like all EU laws, 5-10 years afterwards and see if revision is needed. The plan is that standards development will be almost continuous: once one version of a standard is harmonized, work on the next iteration can begin.

what's the EU equivalent of test262 for legislation revision/standards development? (test262 is such an amazing accomplishment, that model ought to get used more places)

Well, the CRA standards are sort of like conformance test suites, in a way (but in many ways not quite)… no idea how the legislative revision process works though.