EFF And Other Experts Join in Pointing Out Pitfalls of Proposed
EU Cyber-Resilience Act.
--
The letter suggests to either remove this requirement entirely
or change the reporting obligation to be a 72-hour window after
patches are made and deployed. It also calls on European law-
and policy-makers to prohibit use of reported vulnerabilities
“for intelligence, surveillance, or offensive purposes.”
These changes would go a long way in ensuring security
vulnerabilities discovered by software publishers don’t wind
up being further exploited by falling into the wrong hands.

Separately, EFF (and others) have pointed out the dangers
the CRA presents to open-source software developers by making
them liable for vulnerabilities in their software if they so
much as solicit donations for their efforts.
The obligatory reporting mechanism and open-source liability
clauses of the CRA must be changed or removed. Otherwise,
software publishers and open-source developers who are doing
a public service will fall under a burdensome and undue liability.

For more information:
https://www.eff.org/deeplinks/2023/10/eff-and-other-experts-join-pointing-out-pitfalls-proposed-eu-cyber-resilience-act

Happy Hacking
ReK2
--
- {gemini,https}://{,rek2.}hispagatos.org - mastodon: @rek2@hispagatos.space
- [https|gemini]://2600.Madrid - https://hispagatos.space/@rek2
- https://keyoxide.org/A31C7CE19D9C58084EA42BA26C0B0D11E9303EC5

rek2 hispagatos wrote:

> EFF And Other Experts Join in Pointing Out Pitfalls of Proposed
> EU Cyber-Resilience Act.

> patches are made and deployed. It also calls on European law-
> and policy-makers to prohibit use of reported vulnerabilities
> “for intelligence, surveillance, or offensive purposes.”

So if they're not allowed to use these vulnerabilities themselves,
we can assume they would never do such a thing.

Thinking as an American, I just assume they want to be notified
right away for the very reason that they could then take advantage
of them.

--
Retro Guy

On Tue, 3 Oct 2023 20:21:21 +0000, retro.guy@rocksolidbbs.com (Retro Guy) wrote:
>rek2 hispagatos wrote:
>> EFF And Other Experts Join in Pointing Out Pitfalls of Proposed
>> EU Cyber-Resilience Act.
>> patches are made and deployed. It also calls on European law-
>> and policy-makers to prohibit use of reported vulnerabilities
>> "for intelligence, surveillance, or offensive purposes."
>
>So if they're not allowed to use these vulnerabilities themselves,
>we can assume they would never do such a thing.
>Thinking as an American, I just assume they want to be notified
>right away for the very reason that they could then take advantage
>of them.

pacifists are powerless against activists

On Tue, 3 Oct 2023 20:08:11 -0000 (UTC), rek2 hispagatos <rek2@hispagatos.org.invalid> wrote:
snip
>For more information:
>https://www.eff.org/deeplinks/2023/10/eff-and-other-experts-join-pointing-out-pitfalls-proposed-eu-cyber-resilience-act

(using Tor Browser 12.5.6 <https://www.torproject.org/> to open this link):
https://www.eff.org/deeplinks/2023/10/eff-and-other-experts-join-pointing-out-pitfalls-proposed-eu-cyber-resilience-act
>EFF And Other Experts Join in Pointing Out Pitfalls of Proposed EU Cyber-
>Resilience Act
>By Bill Budington and Eva Galperin
>October 3, 2023
>Today we join a set of 56 experts from organizations such as Google,
>Panasonic, Citizen Lab, Trend Micro and many others in an open letter calling
>on the European Commission, European Parliament, and Spain's Ministry of
>Economic Affairs and Digital Transformation to reconsider the obligatory
>vulnerability reporting mechanisms built into Article 11 of the EU's proposed
>Cyber-Resilience Act (CRA). As we've pointed out before, this reporting
>obligation raises major cybersecurity concerns. Broadening the knowledge of
>unpatched vulnerabilities to a larger audience will increase the risk of
>exploitation, and software publishers being forced to report these
>vulnerabilities to government regulators introduces the possibility of
>governments adding it to their offensive arsenals. These aren't just
>theoretical threats: vulnerabilities stored on Intelligence Community
>infrastructure have been breached by hackers before.
>Technology companies and others who create, distribute, and patch software
>are in a tough position. The intention of the CRA is to protect the public
>from companies who shirk their responsibilities by leaving vulnerabilities
>unpatched and their customers open to attack. But companies and software
>publishers who do the right thing by treating security vulnerabilities as
>well-guarded secrets until a proper fix can be applied and deployed now face
>an obligation to disclose vulnerabilities to regulators within 24 hours of
>exploitation. This significantly increases the danger these vulnerabilities
>present to the public. As the letter points out, the CRA "already requires
>software publishers to mitigate vulnerabilities without delay" separate from
>the reporting obligation. The letter also points out that this reporting
>mechanism may interfere with the collaboration and trusted relationship
>between companies and security researchers who work with companies to produce
>a fix.
>The letter suggests to either remove this requirement entirely or change the
>reporting obligation to be a 72-hour window after patches are made and
>deployed. It also calls on European law- and policy-makers to prohibit use of
>reported vulnerabilities "for intelligence, surveillance, or offensive
>purposes." These changes would go a long way in ensuring security
>vulnerabilities discovered by software publishers don't wind up being further
>exploited by falling into the wrong hands.
>Separately, EFF (and others) have pointed out the dangers the CRA presents to
>open-source software developers by making them liable for vulnerabilities in
>their software if they so much as solicit donations for their efforts. The
>obligatory reporting mechanism and open-source liability clauses of the CRA
>must be changed or removed. Otherwise, software publishers and open-source
>developers who are doing a public service will fall under a burdensome and
>undue liability.
[end quote]

"experts from organizations such as Google" . . . so how are they communicating
with specters of this titanic ghost ship, holding a seance using a ouija board?
("Google Groups" is the no.1 biggest spammer of Usenet newsgroups in the world)