7 ms·

Open Source Community Unites to Build EU CRA-Compliant Cybersecurity Processes

73 points by transpute 3y ago

eu_rope 3y ago
Suppose that applies to your open source because you are using a commercial split license and / or providing premium support or otherwise clearly commercialising the activity. If you comply with all the CRA requirements (whatever they are) but the (free) USER of your software (user, not customer) gets hacked because of a security hole in one of your dependencies (that was not known) or a security hole in your own code (after all, is it possible to create something bulletproof) - are you liable for damages and what does it mean exactly in practice? How does it differ from a situation where you offer proprietary software free of charge as a commercial activity? Can the right EULA protect you from receiving such damages. In order words, does it make the "THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND..." well-known license even worse from the liability standpoint than a proprietary license agreement? Would it not even invalidate those licenses since the license text cannot comply with the law? This is a big blow to open source. It does not matter whether it's monetised or not, open source is open source. They are messing with the definition. And to achieve what effect? The biggest cybersecurity problem that dwarfs all others combined and one that especially governments should worry about is the fact that memory vulnerabilities are everywhere, everything from the OS, the web browser and most popular GCed language interpreters are built on C++. And someone as determined as the people behind xz could probably bypass this regulation, if it could be of any help (obstacle to the attacker) at all in the first place. It does potentially shut down a project I have considered commercialising (like, I may release, as "hobby open source" and dump it because I otherwise have no incentive to give my free time). If for every paying customer I am to be liable for 100 - 1,000 non-paying users, no thanks. Maybe I would not do it anyway, I have something else in sight, but I was very serious to experiment with it since I have most of it built anyway and it's just this opportunity to try it out as a side gig for a couple years, taken away by some bureaucrats. I have yet to do some more research on this (check my question in the second paragraph) but it does not sound like fun.
mckravchyk 3y ago
Slightly off topic but this is potentially a disaster for desktop apps and anything not SaaS. Correct me if I am wrong, the law requires to provide 5 years of security updates for apps. Some apps can leverage models such as "use it forever, but you only get updates for certain time without renewing". That allows companies *that ship apps where you can own your data* use a yearly subscription model and remain profitable. Now the desktop app vendor will be required to support users 5 years back, possibly shipping multiple builds (legacy versions with security updates and new version with features). Meanwhile the SaaS vendor charges a monthly fee and only has to care about security for the period of the subscription. I wonder how JetBrains is going to deal with that, I am pretty sure that their perpetual fallback is not updated for 5 years. But it's a big company, a small startup wanting to ship a desktop app will cry and despite the best intentions may as well change the direction to ship SaaS... The act provides the incentive to enshittify everything.
teitoklien 3y ago
This just further incentivises over-regulatory EU to keep making burdensome regulation that slows down innovation for everyone. It is better for open source projects to just pass a license claiming, software is not available for free in EU and to make EU companies pay sky high fees to use the software that is freely available for everyone else. That way EU bureaucrats will stop trying to be the World Police without paying the price that USA has to pay to keep its global influence (like funding military of other nations while americans die in hospitals, in homelessness , intentionally making american exports disadvantageous just to keep its global reserve currency status, etc). It is absolutely insane to me how EU thinks it can decide what charging port everyone should use USB-C , cookie banners for everyone, GDPR nightmare for everyone, and now this new government rule on opensource contributors to software being held liable for security breaches. Absolutely crazy. They just want free lunch while trying to control everyone and everything.
- rwmj 3y ago
  I won't bother addressing most of the nonsense you've written. I'll just say that the US has FedRAMP (https://en.wikipedia.org/wiki/FedRAMP https://en.wikipedia.org/wiki/FedRAMP) and EO 14028 (https://www.federalregister.gov/documents/2021/05/17/2021-10460/improving-the-nations-cybersecurity https://www.federalregister.gov/documents/2021/05/17/2021-10...). So if you imagine that this is somehow an EU-specific thing and doesn't affect the US, you're very wrong. Not to mention NIST and FIPS and CISA.
  - teitoklien 3y ago
    CRA applies to all companies, Fedramp applies to just government. All major governments have policies like this, its an issue when government tries to over regulate private matters. What government regulates inside its own workforce, is absolutely upto them. But government shouldnt interfere so much into private matters.
    - lars_francke 3y ago
      But this is not a private matter. The costs of poor cybersecurity are born mostly not by the people producing the "bad" software but by their consumers. In the end we have law enforcement dealing with ransomware attacks, cybercrime etc. and this will never fully go away but some products don't even apply basic security principles and therefore distribute the cost of this amongst everyone. Yay, they get to produce cheap crap but at which cost? I'd rather have securer products to get started with and then take it from there.
snowpid 3y ago
I guess the foundations are hyped because CRA basically forces companies to pay for security of OS projects (which the foundations try to be the main receiver of the money) But in the end the OS ecosystem becomes much more secure. Otherwise all the SV dudes complaining about the over burocratics: How to improve Software security? Only alternative I can think of, is the goverment pays for the security. For me thats a worser solution.
- lars_francke 3y ago
  "Hyped" is not the word I'd use. Most of us are or were concerned and it took a lot of long meetings to even move "us" out of the category of "software manufacturer" and into a new category of "steward" which is currently not well defined. Also not hyped because the required standards are written at the EU level and there is no established process for foundations to participate in these standards. So it's more like: Trying to do the best with the cards we've been dealt. I agree wtih everything else you're saying.
hyperman1 3y ago
I'm thinking about Maw Gergel's Isopropyl book, and how in the 1960'sthey basically threw dangerous chemical waste out the window or buried it after a fire, scarring a kid. That's the state of our industry today. In some ways, Open source seems among the better students of the class. In other ways, Open source is like a million people each contributing a few parts to a society critical factory, nobody noticing how big we grew. Of course that makes people uneasy. I think something like this is unavoidable. How to get the max impact with minimal overhead is the most important discussion now, so I applaud apache's initiative.
nonrandomstring 3y ago
Since this regulation is happening, necessary and welcome, it's good to see some of the most respected FOSS groups taking the lead. Hopefully many others representing smaller development communities will join the Eclipse initiative. I would characterise "Apache Software Foundation, Blender Foundation, OpenSSL Software Foundation, PHP Foundation, Python Software Foundation, Rust Foundation, and Eclipse Foundation" as BigFOSS. :) Joe Hacker also needs a seat at this table. > establishment of common specifications for secure software > development based on existing open source best practices. The problem with "best practices" is that there are always better practices. Hopefully this group don't ossify around "best practices" that are already out of date but become research focused. To be blunt, a problem is not that "best practices" are never followed, but that we have about 30 years of technical security debt to catch up with. This foundation is also going to be a money pit, because it needs to help other developers. It cannot rule, dictate or enforce anything. Since most European devs are going to want to join in, it's going to be paying out for conferences, education, development grants and T-shirts. It'll need a pipeline of money from EU and commerce - and there's the danger of corruption.
- transpute 3y ago
  > Joe Hacker also needs a seat at this table. Any suggestions on organizations? These come to mind, but there must be others. Free Software Foundation, https://www.fsf.org/ https://www.fsf.org/ NLnet, https://nlnet.nl/project https://nlnet.nl/project SPI, https://www.spi-inc.org/projects https://www.spi-inc.org/projects Software Conservancy, https://sfconservancy.org https://sfconservancy.org
  - input_sh 3y ago
    There's no shortage of EU-based NGOs focusing on tech advocacy. Any of these would fit right in: https://edri.org/about-us/our-network/?organisations-status=member https://edri.org/about-us/our-network/?organisations-status=... Whether they'd have something to contribute with their resources is a completely different question. A bit of a tangent: FSF has a separate legal entity within the EU (https://fsfe.org/ https://fsfe.org/) which is (IMHO) way better at advocating than its American counterpart. There's also FSFI (India) and FSFLA (Latin America), but I'm unfamiliar with their work.
transpute 3y ago
Meanwhile, US reduced funding for the NVD database that the software world depends upon for vulnerability analysis, https://nvd.nist.gov/general/news/nvd-program-transition-announcement https://nvd.nist.gov/general/news/nvd-program-transition-ann... NIST maintains the National Vulnerability Database (NVD), a repository of information on software and hardware flaws that can compromise computer security. This is a key piece of the nation’s cybersecurity infrastructure. There is a growing backlog of vulnerabilities submitted to the NVD and requiring analysis. This is based on a variety of factors, including an increase in software and, therefore, vulnerabilities, as well as a change in interagency support. March 8th analysis by Linux Foundation's OpenSSF, https://www.securityweek.com/cve-and-nvd-a-weak-and-fractured-source-of-vulnerability-truth/ https://www.securityweek.com/cve-and-nvd-a-weak-and-fracture... & https://www.linkedin.com/posts/netriseinc_cve-vulnerabilitymanagement-cybersecurity-activity-7172030138476388353-mTif https://www.linkedin.com/posts/netriseinc_cve-vulnerabilitym... (graph) > Starting February 12th, thousands of CVE IDs have been published without any record of analysis by NVD. Since the start of 2024 there have been a total of 6,171 total CVE IDs with only 3,625 being enriched by NVD. That leaves a gap of 2,546 (42%!) IDs. Private/paid offerings? https://www.darkreading.com/vulnerabilities-threats/nist-needs-help-digging-out-of-its-vulnerability-backlog https://www.darkreading.com/vulnerabilities-threats/nist-nee... > NIST is going to open up the program to a consortia of vetted organizations from the industry in order to deal with the backlog of vulnerabilities that need to be analyzed.. Budget cuts happening for the first time in a decade.. hopefully a pivot to a private-public sector partnership can be reached quickly to scale up the program OSS alternative to paid offerings? April 2024 open letter from Yocto, https://github.com/yoctoproject/cve-cna-open-letter/blob/main/cve-cna-open-letter.txt https://github.com/yoctoproject/cve-cna-open-letter/blob/mai... Processes/tooling to easily allow CNAs to adopt enhancements to CVEs would also encourage improving the data, ideally as easy as something like a GitHub pull request. We, as projects that need to respond to security issues, could all do things in our own ways. Many of us have open source backgrounds and realise the power of collaboration and would much prefer to work together and build something none of us alone could achieve. We need the tools, processes and core support from the CVE project to make it happen.
- kruador 3y ago
  Part of the problem is people who write up CVEs simply to get them on their resume. ("Curriculum Vitae Enhancement"?) The SQLite maintainers refuse to engage with the CVE process, partially for this reason: "While the original idea being CVEs is sound, the current processes for creating and managing CVEs are inadequate. There are countless grey-hat hackers running fuzzers against a wide-variety of open-source software products (SQLite as well as many others) and writing up CVEs against any problems they find. The grey-hats are rewarded, sometimes with prestige and sometimes financially, by the number and severity of the CVEs they write. This incentive results in a proliferation of CVEs which are often not well-vetted and which can have exaggerated impact claims. The quality-control procedures for CVEs are unable to cope with this flood of inputs, making it difficult to correct exaggerated, misleading, omitted, or inaccurate claims." - https://www.sqlite.org/cves.html https://www.sqlite.org/cves.html
jamesholden 3y ago
Am I getting older? On a modern display... reading that text is awful. Had to zoom it to 150%. At 'default' it's damn near 'fuzzy' looking. Apache, omg, use a readable font and size for goodness sake.
- robin_reala 3y ago
  That’s what reader mode is for (I had the same reaction).
  - Kim_Bruning 3y ago
    At this stage there's only a few websites where I'd like reader mode off, really. It removes a lot of advertising, bypasses cookie modals, doesn't execute a lot of javascript, etc etc. I wonder how long before we get browsers that run in readability mode first and foremost? O:-)
- dathinab 3y ago
  It's text size 14px + a relative thin font + font with "serifs" + #404040; instead of black. Which is a gray which looks black but is 25% white. I.e. thin small text of a font type which is well known to yield less good results on screens with unnecessary low contrast == bad UX. Sadly way to many people today assume in their choices (sometimes without realizing it) everyone has mac book level HiRes OLED display and good eye sight where this should still looks quite fine (the contrast is better due to the screen, the font might lock wider due not using traditional sub pixel anti-aliasing, and the serifs aspect is less "bad" on high resolution displays). But if you display it on a 1080p ISP display (assuming it's a decent 1080p ISP display) it will not be a very pleasant experience in a very subtle way due to lower contrast potentially thinner text and serifs in generally leading to decreased readability on non HiRes screens (hence why for years the general recommendation was not to use them for digital content).
- Brian_K_White 3y ago
  Fine on android firefox.
lars_francke 3y ago
In case anyone is interested: The EU did publish the draft "standardization request" recently https://ec.europa.eu/docsroom/documents/58974 https://ec.europa.eu/docsroom/documents/58974 This is the request which will allow the three european standardization organizations (CEN, CENELEC, ETSI) to draft the required 41 standards for the Cyber Resilience Act (CRA). See page 17 and following for the list. To participate in the standardization you have to be part of a "national body" and they will "send" you to participate in EU standardization. I know no one from my FOSS circles who has any experience there, as most relevant standards for us are written outside of these organizations (W3C, IETF etc.) So we're currently trying to get an official seat at the table via the established ways (e.g. DIN in Germany, https://standards.cencenelec.eu/dyn/www/f?p=CEN:5 https://standards.cencenelec.eu/dyn/www/f?p=CEN:5 see this for your own country). If you are interested in this please send me an email, we're trying to put together a guide on how to engage in "official" standardization efforts as Open Source people. The effort from this blog post is (amongst other things) trying to establish a whole new way of engaging with the EU. We need both approaches.
- dvdkon 3y ago
  I'd like to give my comments on the new standards, but I'm never going to be chosen to be part of an elite squad of standards-writers. Is there any chance of the standards developing more in the open, with a community in addition to the committee?
  - lars_francke 3y ago
    It is not so much an elite squad as more a bunch of people willing to spend the entrance fee and to commit their time. The exact requirements depend on the country you're in though. So if that is your only concern but you are willing to spend time feel free to reach out. About your actual question: The answer is "not really" no. ETSI has a way to adopt existing standards: https://www.etsi.org/images/files/ETSI_PAS_Process_Guide.pdf https://www.etsi.org/images/files/ETSI_PAS_Process_Guide.pdf But CEN and CENELEC (which are probably relevant here) do not. The effort from the blog post is partially about a long term plan to get the EU to change this. But in the short term it'll be hard to change the rules in time for the CRA standards.
chme 3y ago
My only fear is that every vendor will now have to implement secure boot and other mechanisms in order to make sure that only signed software runs on their devices, while providing no way for the customer to take ownership of the device back, so that they can run their own software. I really hope that we eventually get a mandate so that every device, that requires an internet connection for any and all features, will also have to allow the customer to overwrite and use their own software in case they have to make any software/security repairs themselves.
- Borg3 3y ago
  Panic NOT :) There is still retro computing move...
  - transpute 3y ago
    Why not both? Build an open future on the expensive lessons of past hardware.
  - chme 3y ago
    Yeah, I plan on trying to keep my existing stuff, that allows me to put my own software on it, alive as long as possible. But it would be sad if I could no longer just buy a new off-the-shelf router and install OpenWrt on it.
    - Borg3 3y ago
      Yeah, I hope it wont happen like this. Unfortunately, Im kinda pesymistic on this one :(
- transpute 3y ago
  Strict launch integrity (unlike "secure boot") depends on a customer-defined root of trust. OpenCompute (OCP) Caliptra is an effort by hyperscalers to enforce a platform root of trust with OSS firmware, mandating dual signature by server OEM and hyperscaler customer. The platform RoT is responsible for validating device firmware and OS boot. https://www.youtube.com/watch?v=p9PlCm4tLb8&t=2764s https://www.youtube.com/watch?v=p9PlCm4tLb8&t=2764s > Often we see.. great security.. compromised by other great ideas for mgmt and other things.. starts to weaken its security posture.. want to keep Caliptra very clean [via OSS firmware transparency] Separately, AMD has promised OpenSIL open firmware by 2026, https://www.phoronix.com/news/AMD-openSIL-Detailed https://www.phoronix.com/news/AMD-openSIL-Detailed Isolation architectures like pKVM on Android can run banking or wallet applications in a security-controlled VM, alongside arbitrary user-defined VMs. In contested environments, both security and the freedom to innovate are necessary to survive an arms race with a competent adversary.
deleted 3y ago
[deleted]

73 points by transpute 3y ago

Suppose that applies to your open source because you are using a commercial split license and / or providing premium support or otherwise clearly commercialising the activity. If you comply with all the CRA requirements (whatever they are) but the (free) USER of your software (user, not customer) gets hacked because of a security hole in one of your dependencies (that was not known) or a security hole in your own code (after all, is it possible to create something bulletproof) - are you liable for damages and what does it mean exactly in practice? How does it differ from a situation where you offer proprietary software free of charge as a commercial activity? Can the right EULA protect you from receiving such damages. In order words, does it make the "THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND..." well-known license even worse from the liability standpoint than a proprietary license agreement? Would it not even invalidate those licenses since the license text cannot comply with the law? This is a big blow to open source. It does not matter whether it's monetised or not, open source is open source. They are messing with the definition. And to achieve what effect? The biggest cybersecurity problem that dwarfs all others combined and one that especially governments should worry about is the fact that memory vulnerabilities are everywhere, everything from the OS, the web browser and most popular GCed language interpreters are built on C++. And someone as determined as the people behind xz could probably bypass this regulation, if it could be of any help (obstacle to the attacker) at all in the first place. It does potentially shut down a project I have considered commercialising (like, I may release, as "hobby open source" and dump it because I otherwise have no incentive to give my free time). If for every paying customer I am to be liable for 100 - 1,000 non-paying users, no thanks. Maybe I would not do it anyway, I have something else in sight, but I was very serious to experiment with it since I have most of it built anyway and it's just this opportunity to try it out as a side gig for a couple years, taken away by some bureaucrats. I have yet to do some more research on this (check my question in the second paragraph) but it does not sound like fun.

mckravchyk 3y ago

Slightly off topic but this is potentially a disaster for desktop apps and anything not SaaS. Correct me if I am wrong, the law requires to provide 5 years of security updates for apps. Some apps can leverage models such as "use it forever, but you only get updates for certain time without renewing". That allows companies *that ship apps where you can own your data* use a yearly subscription model and remain profitable. Now the desktop app vendor will be required to support users 5 years back, possibly shipping multiple builds (legacy versions with security updates and new version with features). Meanwhile the SaaS vendor charges a monthly fee and only has to care about security for the period of the subscription. I wonder how JetBrains is going to deal with that, I am pretty sure that their perpetual fallback is not updated for 5 years. But it's a big company, a small startup wanting to ship a desktop app will cry and despite the best intentions may as well change the direction to ship SaaS... The act provides the incentive to enshittify everything.

teitoklien 3y ago

This just further incentivises over-regulatory EU to keep making burdensome regulation that slows down innovation for everyone. It is better for open source projects to just pass a license claiming, software is not available for free in EU and to make EU companies pay sky high fees to use the software that is freely available for everyone else. That way EU bureaucrats will stop trying to be the World Police without paying the price that USA has to pay to keep its global influence (like funding military of other nations while americans die in hospitals, in homelessness , intentionally making american exports disadvantageous just to keep its global reserve currency status, etc). It is absolutely insane to me how EU thinks it can decide what charging port everyone should use USB-C , cookie banners for everyone, GDPR nightmare for everyone, and now this new government rule on opensource contributors to software being held liable for security breaches. Absolutely crazy. They just want free lunch while trying to control everyone and everything.

rwmj 3y ago
I won't bother addressing most of the nonsense you've written. I'll just say that the US has FedRAMP (https://en.wikipedia.org/wiki/FedRAMP https://en.wikipedia.org/wiki/FedRAMP) and EO 14028 (https://www.federalregister.gov/documents/2021/05/17/2021-10460/improving-the-nations-cybersecurity https://www.federalregister.gov/documents/2021/05/17/2021-10...). So if you imagine that this is somehow an EU-specific thing and doesn't affect the US, you're very wrong. Not to mention NIST and FIPS and CISA.
- teitoklien 3y ago
  CRA applies to all companies, Fedramp applies to just government. All major governments have policies like this, its an issue when government tries to over regulate private matters. What government regulates inside its own workforce, is absolutely upto them. But government shouldnt interfere so much into private matters.
  - lars_francke 3y ago
    But this is not a private matter. The costs of poor cybersecurity are born mostly not by the people producing the "bad" software but by their consumers. In the end we have law enforcement dealing with ransomware attacks, cybercrime etc. and this will never fully go away but some products don't even apply basic security principles and therefore distribute the cost of this amongst everyone. Yay, they get to produce cheap crap but at which cost? I'd rather have securer products to get started with and then take it from there.

snowpid 3y ago

I guess the foundations are hyped because CRA basically forces companies to pay for security of OS projects (which the foundations try to be the main receiver of the money) But in the end the OS ecosystem becomes much more secure. Otherwise all the SV dudes complaining about the over burocratics: How to improve Software security? Only alternative I can think of, is the goverment pays for the security. For me thats a worser solution.

lars_francke 3y ago
"Hyped" is not the word I'd use. Most of us are or were concerned and it took a lot of long meetings to even move "us" out of the category of "software manufacturer" and into a new category of "steward" which is currently not well defined. Also not hyped because the required standards are written at the EU level and there is no established process for foundations to participate in these standards. So it's more like: Trying to do the best with the cards we've been dealt. I agree wtih everything else you're saying.

hyperman1 3y ago

I'm thinking about Maw Gergel's Isopropyl book, and how in the 1960'sthey basically threw dangerous chemical waste out the window or buried it after a fire, scarring a kid. That's the state of our industry today. In some ways, Open source seems among the better students of the class. In other ways, Open source is like a million people each contributing a few parts to a society critical factory, nobody noticing how big we grew. Of course that makes people uneasy. I think something like this is unavoidable. How to get the max impact with minimal overhead is the most important discussion now, so I applaud apache's initiative.

nonrandomstring 3y ago

Since this regulation is happening, necessary and welcome, it's good to see some of the most respected FOSS groups taking the lead. Hopefully many others representing smaller development communities will join the Eclipse initiative. I would characterise "Apache Software Foundation, Blender Foundation, OpenSSL Software Foundation, PHP Foundation, Python Software Foundation, Rust Foundation, and Eclipse Foundation" as BigFOSS. :) Joe Hacker also needs a seat at this table. > establishment of common specifications for secure software > development based on existing open source best practices. The problem with "best practices" is that there are always better practices. Hopefully this group don't ossify around "best practices" that are already out of date but become research focused. To be blunt, a problem is not that "best practices" are never followed, but that we have about 30 years of technical security debt to catch up with. This foundation is also going to be a money pit, because it needs to help other developers. It cannot rule, dictate or enforce anything. Since most European devs are going to want to join in, it's going to be paying out for conferences, education, development grants and T-shirts. It'll need a pipeline of money from EU and commerce - and there's the danger of corruption.

transpute 3y ago
> Joe Hacker also needs a seat at this table. Any suggestions on organizations? These come to mind, but there must be others. Free Software Foundation, https://www.fsf.org/ https://www.fsf.org/ NLnet, https://nlnet.nl/project https://nlnet.nl/project SPI, https://www.spi-inc.org/projects https://www.spi-inc.org/projects Software Conservancy, https://sfconservancy.org https://sfconservancy.org
- input_sh 3y ago
  There's no shortage of EU-based NGOs focusing on tech advocacy. Any of these would fit right in: https://edri.org/about-us/our-network/?organisations-status=member https://edri.org/about-us/our-network/?organisations-status=... Whether they'd have something to contribute with their resources is a completely different question. A bit of a tangent: FSF has a separate legal entity within the EU (https://fsfe.org/ https://fsfe.org/) which is (IMHO) way better at advocating than its American counterpart. There's also FSFI (India) and FSFLA (Latin America), but I'm unfamiliar with their work.

transpute 3y ago

Meanwhile, US reduced funding for the NVD database that the software world depends upon for vulnerability analysis, https://nvd.nist.gov/general/news/nvd-program-transition-announcement https://nvd.nist.gov/general/news/nvd-program-transition-ann... NIST maintains the National Vulnerability Database (NVD), a repository of information on software and hardware flaws that can compromise computer security. This is a key piece of the nation’s cybersecurity infrastructure. There is a growing backlog of vulnerabilities submitted to the NVD and requiring analysis. This is based on a variety of factors, including an increase in software and, therefore, vulnerabilities, as well as a change in interagency support. March 8th analysis by Linux Foundation's OpenSSF, https://www.securityweek.com/cve-and-nvd-a-weak-and-fractured-source-of-vulnerability-truth/ https://www.securityweek.com/cve-and-nvd-a-weak-and-fracture... & https://www.linkedin.com/posts/netriseinc_cve-vulnerabilitymanagement-cybersecurity-activity-7172030138476388353-mTif https://www.linkedin.com/posts/netriseinc_cve-vulnerabilitym... (graph) > Starting February 12th, thousands of CVE IDs have been published without any record of analysis by NVD. Since the start of 2024 there have been a total of 6,171 total CVE IDs with only 3,625 being enriched by NVD. That leaves a gap of 2,546 (42%!) IDs. Private/paid offerings? https://www.darkreading.com/vulnerabilities-threats/nist-needs-help-digging-out-of-its-vulnerability-backlog https://www.darkreading.com/vulnerabilities-threats/nist-nee... > NIST is going to open up the program to a consortia of vetted organizations from the industry in order to deal with the backlog of vulnerabilities that need to be analyzed.. Budget cuts happening for the first time in a decade.. hopefully a pivot to a private-public sector partnership can be reached quickly to scale up the program OSS alternative to paid offerings? April 2024 open letter from Yocto, https://github.com/yoctoproject/cve-cna-open-letter/blob/main/cve-cna-open-letter.txt https://github.com/yoctoproject/cve-cna-open-letter/blob/mai... Processes/tooling to easily allow CNAs to adopt enhancements to CVEs would also encourage improving the data, ideally as easy as something like a GitHub pull request. We, as projects that need to respond to security issues, could all do things in our own ways. Many of us have open source backgrounds and realise the power of collaboration and would much prefer to work together and build something none of us alone could achieve. We need the tools, processes and core support from the CVE project to make it happen.

kruador 3y ago
Part of the problem is people who write up CVEs simply to get them on their resume. ("Curriculum Vitae Enhancement"?) The SQLite maintainers refuse to engage with the CVE process, partially for this reason: "While the original idea being CVEs is sound, the current processes for creating and managing CVEs are inadequate. There are countless grey-hat hackers running fuzzers against a wide-variety of open-source software products (SQLite as well as many others) and writing up CVEs against any problems they find. The grey-hats are rewarded, sometimes with prestige and sometimes financially, by the number and severity of the CVEs they write. This incentive results in a proliferation of CVEs which are often not well-vetted and which can have exaggerated impact claims. The quality-control procedures for CVEs are unable to cope with this flood of inputs, making it difficult to correct exaggerated, misleading, omitted, or inaccurate claims." - https://www.sqlite.org/cves.html https://www.sqlite.org/cves.html

jamesholden 3y ago

Am I getting older? On a modern display... reading that text is awful. Had to zoom it to 150%. At 'default' it's damn near 'fuzzy' looking. Apache, omg, use a readable font and size for goodness sake.

robin_reala 3y ago
That’s what reader mode is for (I had the same reaction).
- Kim_Bruning 3y ago
  At this stage there's only a few websites where I'd like reader mode off, really. It removes a lot of advertising, bypasses cookie modals, doesn't execute a lot of javascript, etc etc. I wonder how long before we get browsers that run in readability mode first and foremost? O:-)
dathinab 3y ago
It's text size 14px + a relative thin font + font with "serifs" + #404040; instead of black. Which is a gray which looks black but is 25% white. I.e. thin small text of a font type which is well known to yield less good results on screens with unnecessary low contrast == bad UX. Sadly way to many people today assume in their choices (sometimes without realizing it) everyone has mac book level HiRes OLED display and good eye sight where this should still looks quite fine (the contrast is better due to the screen, the font might lock wider due not using traditional sub pixel anti-aliasing, and the serifs aspect is less "bad" on high resolution displays). But if you display it on a 1080p ISP display (assuming it's a decent 1080p ISP display) it will not be a very pleasant experience in a very subtle way due to lower contrast potentially thinner text and serifs in generally leading to decreased readability on non HiRes screens (hence why for years the general recommendation was not to use them for digital content).
Brian_K_White 3y ago
Fine on android firefox.

lars_francke 3y ago

In case anyone is interested: The EU did publish the draft "standardization request" recently https://ec.europa.eu/docsroom/documents/58974 https://ec.europa.eu/docsroom/documents/58974 This is the request which will allow the three european standardization organizations (CEN, CENELEC, ETSI) to draft the required 41 standards for the Cyber Resilience Act (CRA). See page 17 and following for the list. To participate in the standardization you have to be part of a "national body" and they will "send" you to participate in EU standardization. I know no one from my FOSS circles who has any experience there, as most relevant standards for us are written outside of these organizations (W3C, IETF etc.) So we're currently trying to get an official seat at the table via the established ways (e.g. DIN in Germany, https://standards.cencenelec.eu/dyn/www/f?p=CEN:5 https://standards.cencenelec.eu/dyn/www/f?p=CEN:5 see this for your own country). If you are interested in this please send me an email, we're trying to put together a guide on how to engage in "official" standardization efforts as Open Source people. The effort from this blog post is (amongst other things) trying to establish a whole new way of engaging with the EU. We need both approaches.

dvdkon 3y ago
I'd like to give my comments on the new standards, but I'm never going to be chosen to be part of an elite squad of standards-writers. Is there any chance of the standards developing more in the open, with a community in addition to the committee?
- lars_francke 3y ago
  It is not so much an elite squad as more a bunch of people willing to spend the entrance fee and to commit their time. The exact requirements depend on the country you're in though. So if that is your only concern but you are willing to spend time feel free to reach out. About your actual question: The answer is "not really" no. ETSI has a way to adopt existing standards: https://www.etsi.org/images/files/ETSI_PAS_Process_Guide.pdf https://www.etsi.org/images/files/ETSI_PAS_Process_Guide.pdf But CEN and CENELEC (which are probably relevant here) do not. The effort from the blog post is partially about a long term plan to get the EU to change this. But in the short term it'll be hard to change the rules in time for the CRA standards.

chme 3y ago

My only fear is that every vendor will now have to implement secure boot and other mechanisms in order to make sure that only signed software runs on their devices, while providing no way for the customer to take ownership of the device back, so that they can run their own software. I really hope that we eventually get a mandate so that every device, that requires an internet connection for any and all features, will also have to allow the customer to overwrite and use their own software in case they have to make any software/security repairs themselves.

Borg3 3y ago
Panic NOT :) There is still retro computing move...
- transpute 3y ago
  Why not both? Build an open future on the expensive lessons of past hardware.
- chme 3y ago
  Yeah, I plan on trying to keep my existing stuff, that allows me to put my own software on it, alive as long as possible. But it would be sad if I could no longer just buy a new off-the-shelf router and install OpenWrt on it.
  - Borg3 3y ago
    Yeah, I hope it wont happen like this. Unfortunately, Im kinda pesymistic on this one :(
transpute 3y ago
Strict launch integrity (unlike "secure boot") depends on a customer-defined root of trust. OpenCompute (OCP) Caliptra is an effort by hyperscalers to enforce a platform root of trust with OSS firmware, mandating dual signature by server OEM and hyperscaler customer. The platform RoT is responsible for validating device firmware and OS boot. https://www.youtube.com/watch?v=p9PlCm4tLb8&t=2764s https://www.youtube.com/watch?v=p9PlCm4tLb8&t=2764s > Often we see.. great security.. compromised by other great ideas for mgmt and other things.. starts to weaken its security posture.. want to keep Caliptra very clean [via OSS firmware transparency] Separately, AMD has promised OpenSIL open firmware by 2026, https://www.phoronix.com/news/AMD-openSIL-Detailed https://www.phoronix.com/news/AMD-openSIL-Detailed Isolation architectures like pKVM on Android can run banking or wallet applications in a security-controlled VM, alongside arbitrary user-defined VMs. In contested environments, both security and the freedom to innovate are necessary to survive an arms race with a competent adversary.

deleted 3y ago

[deleted]