Post

In a CRA webinar last week, I commented it is possible that C/C++ are a per se CRA violation, since C/C++ are insecure by design. An attendee replied "but C/C++ is what embedded use" and I said, more or less, "tough". Here's @gregkh.bsky.social on it: www.zdnet.com/article/rust...

I want to ask you and @littledan.dev to duke it out on this one; if I have his view right the CRA doesn't force eg Rust but you also have to have a whole set of mitigations and defences ready to point at in your declaration of conformity

it definitely doesn’t force Rust, but for safety by design of a C-based system, an auditor should absolutely be requiring either (a) “we use Rust to process all untrusted inputs” or (b) a literal phonebook of other mitigations. Which should be a forcing function.

I really want everyone to use memory-safe languages, but for what the CRA requires, we’ll have to see how the phone book of other mitigations works out. Maybe it will be thorough and practical enough, maybe not. It’d be much more inspiring and fun if the CRA didn’t defer to the state of the art!

I think the Brussels folks will tell you that CRA's standards rise as state of the art rises, and if it had been in place 10 or 20 years ago, "secure by design" would have been a very different target. Open question whether that happens in practice or just gets ossified into 2027-era audit docs.

I keep admitting I'm naive for thinking it will change how enterprises engage with open source but honestly, I still think it might

that 'top level SBOM' thing is what makes me most twitchy but having thumbed through a couple of CE mark product booklets over the weekend making vendors do the same for digital products really feels like a shift in how orgs *have* to think about software and OSS even if they don't know it yet

when talking to normies, I explain that the law requires software vendors to have a list of ingredients, and the universal response is "you mean... they don't already have that?"

'you know that grease stained recipe you have pinned to the fridge door that you've changed a lot and you've only written down the first few changes because you remember the other ones and then your kid starts to follow it and it doesn't work AT ALL?'