3 ms·

CRA applies to all companies, Fedramp applies to just government. All major governments have policies like this, its an issue when government tries to over reg

CRA applies to all companies, Fedramp applies to just government. All major governments have policies like this, its an issue when government tries to over regulate private matters. What government regulates inside its own workforce, is absolutely upto them. But government shouldnt interfere so much into private matters.

lars_francke 2y ago
But this is not a private matter. The costs of poor cybersecurity are born mostly not by the people producing the "bad" software but by their consumers. In the end we have law enforcement dealing with ransomware attacks, cybercrime etc. and this will never fully go away but some products don't even apply basic security principles and therefore distribute the cost of this amongst everyone. Yay, they get to produce cheap crap but at which cost? I'd rather have securer products to get started with and then take it from there.
- teitoklien 2y ago
  > I'd rather have securer products to get started with and then take it from there. Look forward to great American, Chinese and Korean software and hardware, who’ll invest 100% of their funds into innovation and growth, while EU startups keep paying for Open Source software security and subsidising this security advantage for the whole world. The non-EU companies will grow big and then buy out the EU companies, while EU citizens will be left with wonder why all the major high paying tech and R&D jobs are all outside EU. Laws like these need to be agreed upon, by all major countries together. No one country should pass policies like this which just sabotages their own people’s innovative dreams.
  - lars_francke 2y ago
    You present one possible outcome but it is far from certain. Another possible scenario is that companies investing in these principles will be way ahead when similar regulation will pop up _everywhere_ else. You also present your opinion as a factual statement: "Laws like these need to be..." -> No, they don't as can be seen by GDPR, CRA and others. I am personally affected by the CRA, I have a startup here in Europe and I see this as a great chance for EU, FOSS and Software Development in general.
    - teitoklien 2y ago
      > No, they don't as can be seen by GDPR, CRA and others. You’re optimism is great, tbh I am extremely cynical. But name one Fortune 50 tech company making great profits giving high salaries to EU devs and R&D folks that isnt relying on Government Funding from EU except SAP & ASML. Europe has far higher education outcomes for its young graduates, than both America and India. There is almost no student debt in most major EU countries. Yet why is it that not just America, even India a significantly poorer country, with worse infrastructure, bad quality colleges which forces their brightest minds to come to EU, America and Australia to study in higher education. And YET they do better than Europe when it comes to Tech ? Why ? It’s not just cheap labour, other places have even cheaper labour and more lax regulations. I’m just saying the reality, I love your optimism, but I wish EU bureaucrats were actually that effective. GDPR just allows non-EU companies to grow big in their domestic markets and then they think about regulations more and enter the EU market. While EU companies have to think of laws from the beginning. Security isn’t some black magic science which can be an intellectual secret, or give bleeding edge. It’s grunt work mostly, and gets postponed to invest in more profit generating parts of the business. If non-EU businesses think they are losing money due to lax security, they’ll flip the game, but this law doesnt do that, non-EU companies just first expand in their large domestic markets and then think about the rest later once they have more money to think of it. Consumer will definitely win from CRA, just like they did with GDPR, USB-C just in the short term. It’ll just continue forcing EU pioneers to move to America to start their business. I hope you are right and I am wrong, it would be great if a region like EU can prove that one can be great innovators while also being heavily regulated and pro-consumer in the long term. It just hasn’t happened yet, and continues to go the opposite direction. Now ASML is threatening to move elsewhere too (albeit for different reason).
      - snowpid 2y ago
        " But name one Fortune 50 tech company making great profits giving high salaries to EU devs and R&D folks that isnt relying on Government Funding from EU except SAP & ASML. " You are aware that big corp from Silicon Valley have big offices in Europe ? E. g. Apple in Munich? " even India a significantly poorer country, [..] And YET they do better than Europe when it comes to Tech ? Why " citation needed " GDPR just allows non-EU companies to grow big in their domestic markets " Local business in Germany complain about bureaucratic laws. But no one ever about GDPR. Its just a non-issue outside of AdTech. " Consumer will definitely win from CRA, just like they did with GDPR, USB-C just in the short term. It’ll just continue forcing EU pioneers to move to America to start their business. " Currently according to State of European Tech 2023 more people move from the US to Europe than vice versa.
- transpute 2y ago
  There's a technical existence proof of a secure architecture for problematic IoT hardware, from Microsoft (of all places) Azure Sphere, with a Mediatek MCU based on Pluton (from Xbox and Ryzen). It has hardware separation of security-critical software (Linux Kernel) from IoT application software, allowing each to be updated independently, even if the device vendor goes out of business or cannot afford to invest in security in the first place. If the security properties of the Azure Sphere design could be generalized beyond Microsoft/AMD/Mediatek by Arm or RISC-V, so that OSS software like Debian or Zephyr could be used in the security-critical hardware compartment, we could have a vendor-neutral starting point for sustainable, low-cost, networked devices sold and supportable by multiple vendors. https://www.platformsecuritysummit.com/2019/speaker/seay https://www.platformsecuritysummit.com/2019/speaker/seay Further down the road, CHERI capabilities may be a silver bullet, but we're still years away from affordable hardware.

lars_francke 2y ago

But this is not a private matter. The costs of poor cybersecurity are born mostly not by the people producing the "bad" software but by their consumers. In the end we have law enforcement dealing with ransomware attacks, cybercrime etc. and this will never fully go away but some products don't even apply basic security principles and therefore distribute the cost of this amongst everyone. Yay, they get to produce cheap crap but at which cost? I'd rather have securer products to get started with and then take it from there.

teitoklien 2y ago
> I'd rather have securer products to get started with and then take it from there. Look forward to great American, Chinese and Korean software and hardware, who’ll invest 100% of their funds into innovation and growth, while EU startups keep paying for Open Source software security and subsidising this security advantage for the whole world. The non-EU companies will grow big and then buy out the EU companies, while EU citizens will be left with wonder why all the major high paying tech and R&D jobs are all outside EU. Laws like these need to be agreed upon, by all major countries together. No one country should pass policies like this which just sabotages their own people’s innovative dreams.
- lars_francke 2y ago
  You present one possible outcome but it is far from certain. Another possible scenario is that companies investing in these principles will be way ahead when similar regulation will pop up _everywhere_ else. You also present your opinion as a factual statement: "Laws like these need to be..." -> No, they don't as can be seen by GDPR, CRA and others. I am personally affected by the CRA, I have a startup here in Europe and I see this as a great chance for EU, FOSS and Software Development in general.
  - teitoklien 2y ago
    > No, they don't as can be seen by GDPR, CRA and others. You’re optimism is great, tbh I am extremely cynical. But name one Fortune 50 tech company making great profits giving high salaries to EU devs and R&D folks that isnt relying on Government Funding from EU except SAP & ASML. Europe has far higher education outcomes for its young graduates, than both America and India. There is almost no student debt in most major EU countries. Yet why is it that not just America, even India a significantly poorer country, with worse infrastructure, bad quality colleges which forces their brightest minds to come to EU, America and Australia to study in higher education. And YET they do better than Europe when it comes to Tech ? Why ? It’s not just cheap labour, other places have even cheaper labour and more lax regulations. I’m just saying the reality, I love your optimism, but I wish EU bureaucrats were actually that effective. GDPR just allows non-EU companies to grow big in their domestic markets and then they think about regulations more and enter the EU market. While EU companies have to think of laws from the beginning. Security isn’t some black magic science which can be an intellectual secret, or give bleeding edge. It’s grunt work mostly, and gets postponed to invest in more profit generating parts of the business. If non-EU businesses think they are losing money due to lax security, they’ll flip the game, but this law doesnt do that, non-EU companies just first expand in their large domestic markets and then think about the rest later once they have more money to think of it. Consumer will definitely win from CRA, just like they did with GDPR, USB-C just in the short term. It’ll just continue forcing EU pioneers to move to America to start their business. I hope you are right and I am wrong, it would be great if a region like EU can prove that one can be great innovators while also being heavily regulated and pro-consumer in the long term. It just hasn’t happened yet, and continues to go the opposite direction. Now ASML is threatening to move elsewhere too (albeit for different reason).
    - snowpid 2y ago
      " But name one Fortune 50 tech company making great profits giving high salaries to EU devs and R&D folks that isnt relying on Government Funding from EU except SAP & ASML. " You are aware that big corp from Silicon Valley have big offices in Europe ? E. g. Apple in Munich? " even India a significantly poorer country, [..] And YET they do better than Europe when it comes to Tech ? Why " citation needed " GDPR just allows non-EU companies to grow big in their domestic markets " Local business in Germany complain about bureaucratic laws. But no one ever about GDPR. Its just a non-issue outside of AdTech. " Consumer will definitely win from CRA, just like they did with GDPR, USB-C just in the short term. It’ll just continue forcing EU pioneers to move to America to start their business. " Currently according to State of European Tech 2023 more people move from the US to Europe than vice versa.
transpute 2y ago
There's a technical existence proof of a secure architecture for problematic IoT hardware, from Microsoft (of all places) Azure Sphere, with a Mediatek MCU based on Pluton (from Xbox and Ryzen). It has hardware separation of security-critical software (Linux Kernel) from IoT application software, allowing each to be updated independently, even if the device vendor goes out of business or cannot afford to invest in security in the first place. If the security properties of the Azure Sphere design could be generalized beyond Microsoft/AMD/Mediatek by Arm or RISC-V, so that OSS software like Debian or Zephyr could be used in the security-critical hardware compartment, we could have a vendor-neutral starting point for sustainable, low-cost, networked devices sold and supportable by multiple vendors. https://www.platformsecuritysummit.com/2019/speaker/seay https://www.platformsecuritysummit.com/2019/speaker/seay Further down the road, CHERI capabilities may be a silver bullet, but we're still years away from affordable hardware.