Unix forever!

DSR enhanced security and "formal verification" course

Thoughts on the EU Cyber Resilience Act

Source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52022PC0454

My first thought was: W*** *h* **c* *s **i*?

The status of open source software is being split up now. You're either a hobbyist producing free software in the sense of free speech - or you're a fully professional programmer and then you will have to follow a complicated "legally supervised" process of software development - for a decade at minimum - where you have to be able to do updates, fix your own security bugs, guided by "stewards" who also need to be paid. There is nothing in between any longer: "Tertium non datur!"

On the other hand, if some company includes some of your code, it will carry full responsibility as if it was self written and not by you or your company. Means: Many hobby contributers to open source will either have to sell their code base or hand it over to some (US controlled) consortium or (Europe controlled) LFE or FSFE (Linux Foundation Europe or Free Software Foundation Europe) for free to get that neccessary "stewardship supervision" for free, which otherwise would be probably quite expensive.

That "in betweeness" by throwing code onto github, doing some business with it and then finally no longer caring (that "use at your own risk" mentality), will soon come to an end by being severely fined by the EU or some EU government or even many EU governments at the same time even. They will come after you badly and not only cause lots of legal paperwork, but will immediately force you into bankruptcy or private insolvency. You not only get charged, you get criminalized. No business or software insurance will ever cover this.

What does that mean for CEOs?

As CEO or CTO having taken the decision to include some hobbyist's library, you will be made financially fully responsible for security bugs that might occur in the whole software stack upwards beginning with your own or that included foreign malicious unmaintained and unpatched library. For the full time that bug is open and exploitable you're responsible. Being in holidays for 6 weeks then can cost you a fortune.

Means: As CEO then you then will have to provide kind of "emergency response team" being fully qualified to handle all kinds of problems - either with your own or that included library - that might occur, being a hobbyist's library or a professionally supported library. Your choice.

"Qualified" here means: You as CEO have to proof, that your "emergency response team" not only is able to hunt down all kinds of bugs, but also is able to "recognize" / identify security bugs when they appear.

Means: Finished with self taught programmers and even finished with company XY certified professionals. As CEO you will have to hire programmers with an university degree in computer sciences to do that 24/7 emergency response team job.

If you e.g. have an degree in physics, chemistry, biology or law and you have been successful in IT in the past, that doesn't qualifiy you any longer. Neither as CEO nor CTO nor as reserve to fix security bugs case of somebody of your "properly qualified" team being in holidays.

Next problem is strict separation of new features / bug fixes / security fixes, that now is enforced. These are 3 totally different things, from the legal perspective.

Security bugs are no longer considered as normal bugs. You're going to jail, if you don't register them at MITRE and fix them ASAP:

Who the fuck is: https://www.cvedetails.com/vulnerability-list/vendor_id-1341/Pascal-Michaud.html ???

Normal bugs are considered as dysfunctional libraries, if not exploitable. But it's now on you to proof that. In german: "Beweislastumkehr", in engl. "Reversal of the burden of proof".

New features are considered as 'high risk' new code. You will have to structure your code in a way, that it easily can be reviewed. Your programming language thus must provide all those fancy new 'state of the art' features that allow you to extend functionality in a way, that that your extension code can be kept separately. I'm thinking of "observer / decorator / facade / inversion of control patterns" here, that might apply: https://en.wikipedia.org/wiki/Design_Patterns

If your 'programming language of choice' here isn't highly developed enough to provide all that highly sophisticated ways of structuring your code, you're in serious trouble. And you probably won't find any person to play that "steward" role for you. Means: C is dead, Lisp is dead, even Go might be dead, because it's based on Hoare's CSP, Communicating Serial Processes. Griesemer, Pike, Thompson created Go because CSP was old enough to no longer standing under dubious patents. Even the i4i XML patent was circumvemted: https://en.wikipedia.org/wiki/I4i

In Go libraries, you won't find any algorithm that is still patented, making it a truly "free" to use programming language. Google did a good job, selecting them out for not falling into a new lawsuit, compare Oracle vs. Google case.

But unluckily Golang is missing some these new, patented structural patterns which makes Go code easy to maintain. Microsoft and Oracle, in fact, own almost all of those patented highly sophosticated features for structuring your code in a readable, verifyable and reproduceable way. Python decorators elegantly manipulate the famous "Abstract Syntax Tree", but not in reproduceable way. Why? Well, it depends on the Python implementation! And there are many of them now, with LPython and Chris Lattner's MOJO being the latest:

LPython: https://lpython.org/blog/2023/07/lpython-novel-fast-retargetable-python-compiler/

Mojo: https://www.modular.com/max/mojo

Means: It's not only the programming language that counts, it's also the implementation that counts. Rust/LLVM here might be "certified" and Rust/GCC might fall through. See e.g. Rust compiler "-release" mode where it removes all kinds of overflow checks: https://stackoverflow.com/questions/34054669/how-to-compile-and-run-an-optimized-rust-program-with-overflow-checking-enabled

Means: Depending on Compiler options in your Makefile you might be in serious legal troubles!!

I could go on for a while giving deeper insights into the hidden implications of that new "EU Cyber Resilience Act" ... That should give you enough headaches for now! ;-)

Linux Foundation Webinar: The EU Cyber Resilience Act: A New Era for Business Engagement in Open Source Software

"The EU Cyber Resilience Act (CRA) establishes essential cybersecurity requirements that all businesses and open source communities operating in the EU will have to implement. As the first EU-wide cybersecurity regulation that explicitly defines the separate roles of manufacturers and open source software stewards, it changes the playing field for the collaborative development of open source software and reshapes the relationship between open source foundations and their member companies. Key topics covered by this presentation include who is responsible for being CRA compliant, what the essential requirements and obligations are, and what support the Linux Foundation will provide in the redefined open source software steward role."

https://youtube.com/watch?v=OuwoAY4z_SM

Have fun!

Back to last lesson - https://rentry.co/DSRsecuritycoursepart9 Next lesson: https://rentry.co/DSRsecuritycoursepart11

Edit
Pub: 27 Jun 2024 09:25 UTC
Edit: 03 Jul 2024 14:11 UTC
Views: 239