<story><title>The EU&apos;s new Cyber Resilience Act is about to tell us how to code</title><url>https://berthub.eu/articles/posts/eu-cra-secure-coding-solution/</url></story><parent_chain><item><author>Quanttek</author><text>I honestly think this is good. Almost every other engineering profession needs to adhere to a variety of standards and is subject to certifications and review, except for software engineers. it is kinda weird that a ventilator needs to go through a wide variety of regulatory checks but the software systems that control power in the hospital do not, even if they would allow hackers to shut down electricity to all ventilators.&lt;p&gt;A lot of the author&amp;#x27;s criticism is centered on the lack of a designated standards body and software standards. That seems slightly unfair, given the fact that this is still a draft law, so obviously it is still waiting to be implemented and further specified through a standardization process. In general, it should be seen as a positive when a law doesn&amp;#x27;t set out specific requirements - which might be out of date - a few years later - but rather leaves it up to a body filled with industry representatives and experts to figure out the exact standards.</text></item></parent_chain><comment><author>Idiot_in_Vain</author><text>The problem is certifications, standards, reviews are strong barriers to entry and destroy competition and startup opportunities. EU already lacks big tech compared to US, China and Russia. EU can easily regulate that to write software one needs to have a masters degree in CS.</text></comment>
<story><title>The EU&apos;s new Cyber Resilience Act is about to tell us how to code</title><url>https://berthub.eu/articles/posts/eu-cra-secure-coding-solution/</url></story><parent_chain><item><author>Quanttek</author><text>I honestly think this is good. Almost every other engineering profession needs to adhere to a variety of standards and is subject to certifications and review, except for software engineers. it is kinda weird that a ventilator needs to go through a wide variety of regulatory checks but the software systems that control power in the hospital do not, even if they would allow hackers to shut down electricity to all ventilators.&lt;p&gt;A lot of the author&amp;#x27;s criticism is centered on the lack of a designated standards body and software standards. That seems slightly unfair, given the fact that this is still a draft law, so obviously it is still waiting to be implemented and further specified through a standardization process. In general, it should be seen as a positive when a law doesn&amp;#x27;t set out specific requirements - which might be out of date - a few years later - but rather leaves it up to a body filled with industry representatives and experts to figure out the exact standards.</text></item></parent_chain><comment><author>rollcat</author><text>The problem is the runaway complexity of modern computing. If you want review and certification, you have to wade through millions of lines of code, even for projects with a well defined &amp;quot;contact surface&amp;quot;, like an OS kernel.&lt;p&gt;&amp;quot;Traditional&amp;quot; engineering never had to deal with this much complexity. We make do, because our tooling (which itself suffers from said complexity) is somewhat decent at catching many classes of problems before they cause IRL harm: a compiler is somewhat likely to yell at you before you push the broken code to production, CI makes sure you actually ran the tests, etc. Working *on* these tools also requires a broadly similar skillset as working *with* them, whereas e.g. an architect needs an incredibly different skillset from someone building CAD software. So the tools get &amp;quot;better&amp;quot;, so the software can continue growing more complex.&lt;p&gt;So all of this (and much more) effectively lets us get away with much more complexity, and I think it&amp;#x27;s the crucial bit that people calling for more regulation miss. I am a software development professional, 15 years in the industry. I am &lt;i&gt;scared shitless&lt;/i&gt; with how all of my tools, libraries, &amp;quot;supply chain&amp;quot; - are so complex, indecipherable, opaque, impossible to understand. I&amp;#x27;ve been working on this one project for over 4 years now, and I&amp;#x27;m yet finding bugs that were introduced 3 years ago. How can *you*, as an independent outside reviewer, help me in any capacity, if it takes several months just to onboard someone, and additional domain expert knowledge (video delivery) to fully understand? If you can do it, well, I&amp;#x27;m gonna hire you to work for me instead.&lt;p&gt;But if you can&amp;#x27;t understand it - what are you certifying? That it didn&amp;#x27;t break in your lab? We already run a staging system - thanks for double-checking, I guess?</text></comment>