Post

In a CRA webinar last week, I commented it is possible that C/C++ are a per se CRA violation, since C/C++ are insecure by design. An attendee replied "but C/C++ is what embedded use" and I said, more or less, "tough". Here's @gregkh.bsky.social on it: www.zdnet.com/article/rust...

I want to ask you and @littledan.dev to duke it out on this one; if I have his view right the CRA doesn't force eg Rust but you also have to have a whole set of mitigations and defences ready to point at in your declaration of conformity

it definitely doesn’t force Rust, but for safety by design of a C-based system, an auditor should absolutely be requiring either (a) “we use Rust to process all untrusted inputs” or (b) a literal phonebook of other mitigations. Which should be a forcing function.

I really want everyone to use memory-safe languages, but for what the CRA requires, we’ll have to see how the phone book of other mitigations works out. Maybe it will be thorough and practical enough, maybe not. It’d be much more inspiring and fun if the CRA didn’t defer to the state of the art!

I think the Brussels folks will tell you that CRA's standards rise as state of the art rises, and if it had been in place 10 or 20 years ago, "secure by design" would have been a very different target. Open question whether that happens in practice or just gets ossified into 2027-era audit docs.

I feel like the CRA’s Annex I has really good, timeless principles in it, but yeah, they would’ve chosen different timeless principles 10-20 years ago. Luckily there is a calendar for future revision based on experience.

The idea is to revisit this law, like all EU laws, 5-10 years afterwards and see if revision is needed. The plan is that standards development will be almost continuous: once one version of a standard is harmonized, work on the next iteration can begin.

what's the EU equivalent of test262 for legislation revision/standards development? (test262 is such an amazing accomplishment, that model ought to get used more places)

Well, the CRA standards are sort of like conformance test suites, in a way (but in many ways not quite)… no idea how the legislative revision process works though.

test262 is very hard to do for statutes or audit conformance. But a few years ago I would have said utterly impossible. It'd be very interesting (for co's that actually want to comply) to think through what it would look like to systematically evaluate their codebases and docs with spec+LLM.

As with many things LLM, with effort and resources one could build a rich harness that could do audits, probably of decent quality and definitely of more depth and breadth than traditional audits. Or without effort and resources one could half-ass it. Obviously the latter will predominate.

Human in the loop for risk assessment seems important, at least