33 ms·

You didn't read the article, right? Go check it out, it brings up some good points. There's definitely stuff in that Act that's more than "absolute minimum lega

by s1k3s 4y ago

You didn't read the article, right? Go check it out, it brings up some good points. There's definitely stuff in that Act that's more than "absolute minimum legal standards", some even impossible to achieve.

DyslexicAtheist 4y ago
can you paste one that you feel goes beyond minimum or even "impossible"? otherwise this comment is just he said she said.
- s1k3s 4y ago
  Yeah, literally the entire 2nd half of the article. Go read it, I'm not your tldr bot.
  - DyslexicAtheist 4y ago
    I'm deeply familiar with the actual draft proposal of the law and no person working in security would consider these outrageous. this shit really is just best practice and good security hygiene. refusing to quote what you mean is bad faith. and you're not really contributing to the conversation
    - s1k3s 4y ago
      So you didn't read the article, you have no idea what you're talking about and you call me "being in bad faith". Is this Reddit now?
- kneebonian 4y ago
  > The CRA describes ’essential cybersecurity requirements’ which are well intended, and mostly ok, but leave a lot of room for interpretation. These requirements tell us to implement adequate denial of service & exploit mitigation techniques, for example, and no one can be certain what that means Service exploit mitigation techniques? Really why didn't I just think about not writing bugs, and vulnerable code.
  - DyslexicAtheist 4y ago
    a shame that he is unfamiliar with RED. It's meaning is literally just system hardening as it is also defined in RED (CRA is just an expansion of RED to the rest of the ecosystem), which is in this contexts outgoing firewalls rules on devices, system hardening, anomaly detection, ... It is not a definitiv list of things because this would change based on what makes sense on a system. Instead you need to demonstrate that you've considered a threat model when applying the mitigation. And the mitigation is sufficient for the intended purpose. One example could be limit what the system can and can't do. And don't allow it to communicate with the whole world when your only required endpoints are api.samsung.com, an ntp server, DNS and MQTT. A shame that he had to write this hit-piece when he could have asked what notified bodies are testing _today_ to meetx requirements for RED.
kristiandupont 4y ago
Here's one part: >(f) protect the availability of essential functions, including the resilience against and mitigation of denial of service attacks; >Did the EU just require me to make software that can withstand (unspecified) denial of service attacks? Something that is mathematically proven impossible? That does not seem like the intent of the paragraph. My first thought is that it's a poorly worded (though legalese oftentimes needs to be) way of saying that devices should not easily be turned into DDOS nodes. But it might also just say that even if it's under DDOS attack, there should be a way to operate essential functions still, which is very much possible with some compartmentalization.
- mkmk3 4y ago
  Would be nice, but I think since (a-e) weren't in that line and that (g) is directly addressing that, that would be incredibly bad wording. Regardless, I can imagine there are some products with 'essential functions' which require the channel that could be DDOSd, no? My stance here is that it's very broad, and I think it's easy to create an exploitable system from these directives. But unfortunately the problem is real and the mitigations complex. I was buying into this initially because of that, it seems reasonable without much thought on what the exact solutions look like, which I think makes it more dangerous. If other engineering fields have seen this process, and the involved regulatory bodies have stayed independent of large corporate interests, I guess we should have a good shot. But with my lack of knowledge on that topic, I hold some trepidation for the future of smaller software shops and individual developers. > (g) minimise their own negative impact on the availability of services provided by other devices or networks;

by s1k3s 4y ago

DyslexicAtheist 4y ago

can you paste one that you feel goes beyond minimum or even "impossible"? otherwise this comment is just he said she said.

s1k3s 4y ago
Yeah, literally the entire 2nd half of the article. Go read it, I'm not your tldr bot.
- DyslexicAtheist 4y ago
  I'm deeply familiar with the actual draft proposal of the law and no person working in security would consider these outrageous. this shit really is just best practice and good security hygiene. refusing to quote what you mean is bad faith. and you're not really contributing to the conversation
  - s1k3s 4y ago
    So you didn't read the article, you have no idea what you're talking about and you call me "being in bad faith". Is this Reddit now?
kneebonian 4y ago
> The CRA describes ’essential cybersecurity requirements’ which are well intended, and mostly ok, but leave a lot of room for interpretation. These requirements tell us to implement adequate denial of service & exploit mitigation techniques, for example, and no one can be certain what that means Service exploit mitigation techniques? Really why didn't I just think about not writing bugs, and vulnerable code.
- DyslexicAtheist 4y ago
  a shame that he is unfamiliar with RED. It's meaning is literally just system hardening as it is also defined in RED (CRA is just an expansion of RED to the rest of the ecosystem), which is in this contexts outgoing firewalls rules on devices, system hardening, anomaly detection, ... It is not a definitiv list of things because this would change based on what makes sense on a system. Instead you need to demonstrate that you've considered a threat model when applying the mitigation. And the mitigation is sufficient for the intended purpose. One example could be limit what the system can and can't do. And don't allow it to communicate with the whole world when your only required endpoints are api.samsung.com, an ntp server, DNS and MQTT. A shame that he had to write this hit-piece when he could have asked what notified bodies are testing _today_ to meetx requirements for RED.

kristiandupont 4y ago

Here's one part: >(f) protect the availability of essential functions, including the resilience against and mitigation of denial of service attacks; >Did the EU just require me to make software that can withstand (unspecified) denial of service attacks? Something that is mathematically proven impossible? That does not seem like the intent of the paragraph. My first thought is that it's a poorly worded (though legalese oftentimes needs to be) way of saying that devices should not easily be turned into DDOS nodes. But it might also just say that even if it's under DDOS attack, there should be a way to operate essential functions still, which is very much possible with some compartmentalization.

mkmk3 4y ago
Would be nice, but I think since (a-e) weren't in that line and that (g) is directly addressing that, that would be incredibly bad wording. Regardless, I can imagine there are some products with 'essential functions' which require the channel that could be DDOSd, no? My stance here is that it's very broad, and I think it's easy to create an exploitable system from these directives. But unfortunately the problem is real and the mitigations complex. I was buying into this initially because of that, it seems reasonable without much thought on what the exact solutions look like, which I think makes it more dangerous. If other engineering fields have seen this process, and the involved regulatory bodies have stayed independent of large corporate interests, I guess we should have a good shot. But with my lack of knowledge on that topic, I hold some trepidation for the future of smaller software shops and individual developers. > (g) minimise their own negative impact on the availability of services provided by other devices or networks;