Jeffrey Yasskinjyasskin@hachyderm.io
Oct 13, 2026, 12:48 AMRE: https://cyberplace.social/@GossiTheDog/117429502412235079
Please tell me the #CRA makes (or would have made) the fridge company liable for this.
Replies
Billy O'Nealmalwareminigun@infosec.exchangeOct 13, 2026, 1:45 AM@jyasskin to my limited understanding, as long as they submitted the right paperwork, it does not
- Jeffrey Yasskinjyasskin@hachyderm.ioOct 13, 2026, 2:29 AM
@malwareminigun 😭😭😭😭😭
- Billy O'Nealmalwareminigun@infosec.exchangeOct 13, 2026, 2:58 AM
@jyasskin it is unfortunately hard to legislate competence.
Peter SommerladPeterSommerlad@mastodon.socialOct 13, 2026, 3:59 AM@malwareminigun @jyasskin
actually, safety norms like iso 65108 require competent and qualified engineers and continuing education. unfortunately those features are often ignored/undervalued in favor of tooling and certification.- Billy O'Nealmalwareminigun@infosec.exchangeOct 13, 2026, 2:34 PM
@PeterSommerlad @jyasskin 1. That’s not really practical though. If that was the standard EU folks would wake up the next day finding they couldn’t use media for instance because the FFmpeg maintainers super do not care. Very few important components like that even try to do the SBOM stuff CRA requires. Requiring everything like that to be reimplemented would likely be a net security decrease because no matter how competent, people still write bugs.
2. Even if (1) is solved, a LOT of real world issues like this are operational. e.g. “we issued the patch for MS08-067 8 years ago but you won’t reboot that server to take the patch so you still get exploited” and that likely devolves into a bunch of finger pointing - Peter SommerladPeterSommerlad@mastodon.socialOct 13, 2026, 10:20 PM
iso 61508 is about safety critical systems controlled by electronics and software. not software systems in general. So i don't understand what you are referring to. using a library in a critical system as a vendor of such a system, you need to ensure that a library doesn't cause harm.
otoh, things come to light only after an incident (or a review) requires root-cause analysis. as long a nothing happens... 
Peter Eisentrautpetereisentraut@mastodon.socialOct 13, 2026, 5:25 PM@jyasskin The CRA doesn’t cause liability (except in a manner of speaking for fines), but the updated Product Liability Directive would (possibly) make the manufacturer liable for damages for the spoiled goods. Where the CRA comes in is that if you can make the case that the fridges violated the cybersecurity requirements of the CRA then they are presumed defective and so it would be easier to make this case in court.