Post

I want to ask you and @littledan.dev to duke it out on this one; if I have his view right the CRA doesn't force eg Rust but you also have to have a whole set of mitigations and defences ready to point at in your declaration of conformity

it definitely doesn’t force Rust, but for safety by design of a C-based system, an auditor should absolutely be requiring either (a) “we use Rust to process all untrusted inputs” or (b) a literal phonebook of other mitigations. Which should be a forcing function.

I really want everyone to use memory-safe languages, but for what the CRA requires, we’ll have to see how the phone book of other mitigations works out. Maybe it will be thorough and practical enough, maybe not. It’d be much more inspiring and fun if the CRA didn’t defer to the state of the art!

1/6/26, 9:57 pm1 repost1 like

I think the Brussels folks will tell you that CRA's standards rise as state of the art rises, and if it had been in place 10 or 20 years ago, "secure by design" would have been a very different target. Open question whether that happens in practice or just gets ossified into 2027-era audit docs.

I keep admitting I'm naive for thinking it will change how enterprises engage with open source but honestly, I still think it might

It still could. Lots of devil in the details.

that 'top level SBOM' thing is what makes me most twitchy but having thumbed through a couple of CE mark product booklets over the weekend making vendors do the same for digital products really feels like a shift in how orgs *have* to think about software and OSS even if they don't know it yet

I feel like the CRA’s Annex I has really good, timeless principles in it, but yeah, they would’ve chosen different timeless principles 10-20 years ago. Luckily there is a calendar for future revision based on experience.

The idea is to revisit this law, like all EU laws, 5-10 years afterwards and see if revision is needed. The plan is that standards development will be almost continuous: once one version of a standard is harmonized, work on the next iteration can begin.

what's the EU equivalent of test262 for legislation revision/standards development? (test262 is such an amazing accomplishment, that model ought to get used more places)

labs.etsi.orgMemory safety (4f6ddb8b) · Commits · STAN4CRA / EN 304 617 Browser · GitLabWelcome to ETSI Labs

Many of the draft CRA vertical standards have mitigations to risks related to memory safety issues. I really like the set of requirements that Andrew Whalley developed for the we browser draft standard. Might be applicable more broadly. labs.etsi.org/rep/stan4cra...