6 ms·

We had to recently look at this as we sell our product in the UK. The rules are really quite pissweak. From the article: * that password procedures are more se

We had to recently look at this as we sell our product in the UK. The rules are really quite pissweak. From the article: * that password procedures are more secure, including ensuring any set by the manufacturer are not left blank or using easy-to-guess choices like "12345" or "admin" Reasonable. But that's a _really_ low bar. * that there is clarity around how to report "bugs" or security problems that arise i.e. an email address published on the vendor website. No actual requirement to take action. * that manufacturers and retailers inform customers how long they will receive support, including software updates, for the device they are buying which means nothing if the manufacturer goes bankrupt.

physicsguy 2y ago
I think the third one has no effect on startups but it could have a big effect on for e.g. the Google's of this world who buy small companies then kill their product line or end support after a couple of years.
Beretta_Vexee 2y ago
Many major brands, particularly in the construction industry, rebrand smart locks, meters, house automation and smart relay equipment of unknown origin with their own brand names. Since they're the ones who put the products on the market, they're the ones who will have to provide maintenance and safety updates, regardless of whether they're an OEM or not. People were unhappy to discover that their cloud-connected smart lock was no longer working after 2 years. And states don't want to have a large population of vulnerable equipment that could be used to amplify state-sponsored attacks on their national networks. This is the purpose of the European Cyber Resilience Act.
- chrisjj 2y ago
  > Since they're the ones who put the products on the market, they're the ones who will have to provide maintenance and safety updates But these rules make no such requirement.
deleted 2y ago
[deleted]
graemep 2y ago
> that manufacturers and retailers inform customers how long they will receive support, including software updates, for the device they are buying and importers. This is the usual requirement in UK law for anything like this (e.g. safety, manufacturing defects). Retailers are responsible for what they sell, and importers are responsible for what they import. If you buy it on credit the credit provider (e.g. a credit card provider) is responsible for a lot of things too (not this AFAIK, but for things like faults in what you bought).
- hyperman1 2y ago
  This is what the Brexit contras were warning for. The UK will still have to follow EU law, because they want to sell stuff in the EU. They just lost their voice in the process to write law
  - switch007 2y ago
    It was 95%* about immigration so none of those arguments mattered * number pulled from my behind. But it was surely very high
    - immibis 2y ago
      It was about brown people. Always is. They aren't bothered by white immigrants.
      - irjoe 2y ago
        I'm not sure that's entirely true in the UK. The Polish plumber taking British jobs is a fairly common trope in far-right discourse. I believe this is prevalent across Western Europe in general.
        switch007 2y ago
        How I long for a Polish plumber. Hard workers, better skilled, better value.
mschuster91 2y ago
> Reasonable. But that's a _really_ low bar. ... one that even companies like Cisco routinely fail [1], and completely forget about chinesium "smart" devices where the extra 10 cents to provision a unique local password and print it on a label would ruin the profit margin. > which means nothing if the manufacturer goes bankrupt. Yep but now customers can hold the seller accountable if that is violated, which will lead sellers and importers to either demand a cash escrow from vendors to account for dealing with refunds should the vendor go bankrupt or that there will be some sort of code escrow industry formed, similar to insurance - should the vendor go bankrupt or cease support prior to the communicated date, the code escrow will release the source code to the sellers/importers so that they can do firmware updates on their own. [1] https://www.tomshardware.com/news/cisco-backdoor-hardcoded-accounts-software,37480.html https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a...
gnfargbl 2y ago
> The rules are really quite pissweak. Ah, but you need to look at how the UK government has implemented this [1]. The law itself is the Product Security and Telecommunications Infrastructure Act 2022. That law makes reference to "security requirements" with which manufacturers must comply. Importantly however, the actual security requirements aren't specified in the Act itself. Instead, they're specified as regulations set by the Secretary of State. As I understand it, regulations are easier to update than acts, and here the government is actually obliged to review the suitability of the regulations at least every five years [2]. In theory this allows the government to apply salami tactics: start with some regulations (the 2023 version) which are indeed so weak that no manufacturer could have reasonably objected to them, but then to add more requirements over time, hopefully ending up at a point where we have some more impactful requirements placed on this stuff. Whether the government actually does that, and over what timescales, remains to be seen. [1] https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime https://www.gov.uk/government/publications/the-uk-product-se... [2] https://www.legislation.gov.uk/uksi/2023/1007/regulation/10/made https://www.legislation.gov.uk/uksi/2023/1007/regulation/10/...
matt-p 2y ago
This is V0, the actual requirements are regulations, which can be updated really easily. Much easier to pass a law with very basic requirements and increase them later. This is much better than nothing, which is what most countries have.
- graemep 2y ago
  I would actually prefer a low that (in addition?) required a reasonable standard of care with regard to security, imposed responsibility for consequential loss for negligence, and left the courts to interpret it.
  - matt-p 2y ago
    You can already sue a manufacturer for consequential loss if you can prove negligence?
    - graemep 2y ago
      Yes, but 1) I would like to make it clearer that failing to meet generally accepted good security practice is negligence, and 2) make importers and retailers liable to some extent for negligence with regard to security, not just manufacturers. I would apply this to hardware, not pure software, or separately sold software.
  - tsimionescu 2y ago
    Anything that relies on suing major corporations over unclear standards is doomed to mean nothing.
exe34 2y ago
There should be a requirement to release security updates for $X years or release the code as open-source.

physicsguy 2y ago

I think the third one has no effect on startups but it could have a big effect on for e.g. the Google's of this world who buy small companies then kill their product line or end support after a couple of years.

Beretta_Vexee 2y ago

Many major brands, particularly in the construction industry, rebrand smart locks, meters, house automation and smart relay equipment of unknown origin with their own brand names. Since they're the ones who put the products on the market, they're the ones who will have to provide maintenance and safety updates, regardless of whether they're an OEM or not. People were unhappy to discover that their cloud-connected smart lock was no longer working after 2 years. And states don't want to have a large population of vulnerable equipment that could be used to amplify state-sponsored attacks on their national networks. This is the purpose of the European Cyber Resilience Act.

chrisjj 2y ago
> Since they're the ones who put the products on the market, they're the ones who will have to provide maintenance and safety updates But these rules make no such requirement.

deleted 2y ago

[deleted]

graemep 2y ago

> that manufacturers and retailers inform customers how long they will receive support, including software updates, for the device they are buying and importers. This is the usual requirement in UK law for anything like this (e.g. safety, manufacturing defects). Retailers are responsible for what they sell, and importers are responsible for what they import. If you buy it on credit the credit provider (e.g. a credit card provider) is responsible for a lot of things too (not this AFAIK, but for things like faults in what you bought).

hyperman1 2y ago
This is what the Brexit contras were warning for. The UK will still have to follow EU law, because they want to sell stuff in the EU. They just lost their voice in the process to write law
- switch007 2y ago
  It was 95%* about immigration so none of those arguments mattered * number pulled from my behind. But it was surely very high
  - immibis 2y ago
    It was about brown people. Always is. They aren't bothered by white immigrants.
    - irjoe 2y ago
      I'm not sure that's entirely true in the UK. The Polish plumber taking British jobs is a fairly common trope in far-right discourse. I believe this is prevalent across Western Europe in general.
      - switch007 2y ago
        How I long for a Polish plumber. Hard workers, better skilled, better value.

mschuster91 2y ago

> Reasonable. But that's a _really_ low bar. ... one that even companies like Cisco routinely fail [1], and completely forget about chinesium "smart" devices where the extra 10 cents to provision a unique local password and print it on a label would ruin the profit margin. > which means nothing if the manufacturer goes bankrupt. Yep but now customers can hold the seller accountable if that is violated, which will lead sellers and importers to either demand a cash escrow from vendors to account for dealing with refunds should the vendor go bankrupt or that there will be some sort of code escrow industry formed, similar to insurance - should the vendor go bankrupt or cease support prior to the communicated date, the code escrow will release the source code to the sellers/importers so that they can do firmware updates on their own. [1] https://www.tomshardware.com/news/cisco-backdoor-hardcoded-accounts-software,37480.html https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a...

gnfargbl 2y ago

> The rules are really quite pissweak. Ah, but you need to look at how the UK government has implemented this [1]. The law itself is the Product Security and Telecommunications Infrastructure Act 2022. That law makes reference to "security requirements" with which manufacturers must comply. Importantly however, the actual security requirements aren't specified in the Act itself. Instead, they're specified as regulations set by the Secretary of State. As I understand it, regulations are easier to update than acts, and here the government is actually obliged to review the suitability of the regulations at least every five years [2]. In theory this allows the government to apply salami tactics: start with some regulations (the 2023 version) which are indeed so weak that no manufacturer could have reasonably objected to them, but then to add more requirements over time, hopefully ending up at a point where we have some more impactful requirements placed on this stuff. Whether the government actually does that, and over what timescales, remains to be seen. [1] https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime https://www.gov.uk/government/publications/the-uk-product-se... [2] https://www.legislation.gov.uk/uksi/2023/1007/regulation/10/made https://www.legislation.gov.uk/uksi/2023/1007/regulation/10/...

matt-p 2y ago

This is V0, the actual requirements are regulations, which can be updated really easily. Much easier to pass a law with very basic requirements and increase them later. This is much better than nothing, which is what most countries have.

graemep 2y ago
I would actually prefer a low that (in addition?) required a reasonable standard of care with regard to security, imposed responsibility for consequential loss for negligence, and left the courts to interpret it.
- matt-p 2y ago
  You can already sue a manufacturer for consequential loss if you can prove negligence?
  - graemep 2y ago
    Yes, but 1) I would like to make it clearer that failing to meet generally accepted good security practice is negligence, and 2) make importers and retailers liable to some extent for negligence with regard to security, not just manufacturers. I would apply this to hardware, not pure software, or separately sold software.
- tsimionescu 2y ago
  Anything that relies on suing major corporations over unclear standards is doomed to mean nothing.

exe34 2y ago

There should be a requirement to release security updates for $X years or release the code as open-source.