3 ms·

Don't forget the third option: don't. Updates are necessary when the customer asks for them. Most customers won't, and if they do, they don't know they need an

Don't forget the third option: don't. Updates are necessary when the customer asks for them. Most customers won't, and if they do, they don't know they need an update if you compile everything statically. Personally, the update story is why I find developing on Windows much easier than developing on Linux. Instead of hundreds of small, independent packages, you can just target the _massive_ Windows API. You can take the "living off the land" approach on Linux too, but it's harder, often relying on magical IOCTLs and magical file paths rather than library function calls. Not that I think the Win32/WinRT API is particularly well-designed, but at least the API is there, guaranteed to be available, and only breaks in extremely rare circumstances.

lars_francke 2y ago
I don't know where you reside and what kind of software you build. With the European Cyber Resilience Act coming into full effect late 2027/early 2028 (depends on when it's finally signed) this will not always be an option anymore for a lot of people. a) You'll have to provide SBOMs so you can't (legally) "hide" stuff in your binary b) Security updates are mandatory for known exploitable vulnerabilities and other things, so you can't wait until a customer asks. This will take a few years before it bites (see GDPR) but the fines can be just as bad.
- repelsteeltje 2y ago
  > [...] "hide" stuff in your binary While legislatively requiring SBOMs is obviously a good idea, it might also unintentionally incentive companies to hide dependencies by rolling their own. Afterall, it's not a "dependency" if it's in the main code base you developed yourself. Not sure how likely this is, but especially in case of network stacks or cryptographic functions that could potentially be disastrous.
  - lars_francke 2y ago
    I agree that there is a chance this could happen. But as a business owner myself it's pretty simple: It's far cheaper for me to take an existing dependency, create SBOMs and patch regularly compared to having to develop and maintain these things myself. But I do get your point that others might make different decisions. But the CRA also has provisions here as you have to do a risk assessment for your product as well and publish the result of that on your documentation and hand rolling crypto should definitely go on there as well. Again... People can just ignore this and probably won't get caught anytime soon....
  - twoodfin 2y ago
    It’s extremely likely, verging on certitude. In some ways, the pressure of requirements like this may be positive: “Do we really need a dependency on ‘leftpad’?” But it will also add pressure to make unsound NIH choices as you suggest.
- Foobar8568 2y ago
  SBOM is already in place I believe for the financial sector, or soon enough. Add DORA going full in Jan 2025, and we have another legislation that no one understands and follows. Respect of the AI cloud act is such a joke.
- jeroenhd 2y ago
  Yeah, the ECRA is going to wreck badly organised businesses and it's high time. I just hope there will be actual fines, even for "small" companies. GDPR enforcement against most companies seem rather lackluster if it happens at all. If the ECRA ends up only applying to companies like Google, it'll be rather useless.
lenkite 2y ago
> Don't forget the third option: don't. Good way to have malpractice lawsuits filed against you and either become bankrupt or go to jail.
- formerly_proven 2y ago
  Source?
  - lenkite 2y ago
    The Evolution of Legal Risks Pertaining to Patch Management and Vulnerability Management and Vulnerability Management https://dsc.duq.edu/cgi/viewcontent.cgi?article=3915&context=dlr https://dsc.duq.edu/cgi/viewcontent.cgi?article=3915&context... Why Are Unpatched Vulnerabilities a Serious Business Risk? https://prowritersins.com/cyber-insurance-blog/unpatched-vulnerability-risks/ https://prowritersins.com/cyber-insurance-blog/unpatched-vul...
deleted 2y ago
[deleted]

lars_francke 2y ago

I don't know where you reside and what kind of software you build. With the European Cyber Resilience Act coming into full effect late 2027/early 2028 (depends on when it's finally signed) this will not always be an option anymore for a lot of people. a) You'll have to provide SBOMs so you can't (legally) "hide" stuff in your binary b) Security updates are mandatory for known exploitable vulnerabilities and other things, so you can't wait until a customer asks. This will take a few years before it bites (see GDPR) but the fines can be just as bad.

repelsteeltje 2y ago
> [...] "hide" stuff in your binary While legislatively requiring SBOMs is obviously a good idea, it might also unintentionally incentive companies to hide dependencies by rolling their own. Afterall, it's not a "dependency" if it's in the main code base you developed yourself. Not sure how likely this is, but especially in case of network stacks or cryptographic functions that could potentially be disastrous.
- lars_francke 2y ago
  I agree that there is a chance this could happen. But as a business owner myself it's pretty simple: It's far cheaper for me to take an existing dependency, create SBOMs and patch regularly compared to having to develop and maintain these things myself. But I do get your point that others might make different decisions. But the CRA also has provisions here as you have to do a risk assessment for your product as well and publish the result of that on your documentation and hand rolling crypto should definitely go on there as well. Again... People can just ignore this and probably won't get caught anytime soon....
- twoodfin 2y ago
  It’s extremely likely, verging on certitude. In some ways, the pressure of requirements like this may be positive: “Do we really need a dependency on ‘leftpad’?” But it will also add pressure to make unsound NIH choices as you suggest.
Foobar8568 2y ago
SBOM is already in place I believe for the financial sector, or soon enough. Add DORA going full in Jan 2025, and we have another legislation that no one understands and follows. Respect of the AI cloud act is such a joke.
jeroenhd 2y ago
Yeah, the ECRA is going to wreck badly organised businesses and it's high time. I just hope there will be actual fines, even for "small" companies. GDPR enforcement against most companies seem rather lackluster if it happens at all. If the ECRA ends up only applying to companies like Google, it'll be rather useless.

lenkite 2y ago

> Don't forget the third option: don't. Good way to have malpractice lawsuits filed against you and either become bankrupt or go to jail.

formerly_proven 2y ago
Source?
- lenkite 2y ago
  The Evolution of Legal Risks Pertaining to Patch Management and Vulnerability Management and Vulnerability Management https://dsc.duq.edu/cgi/viewcontent.cgi?article=3915&context=dlr https://dsc.duq.edu/cgi/viewcontent.cgi?article=3915&context... Why Are Unpatched Vulnerabilities a Serious Business Risk? https://prowritersins.com/cyber-insurance-blog/unpatched-vulnerability-risks/ https://prowritersins.com/cyber-insurance-blog/unpatched-vul...

deleted 2y ago

[deleted]