Skip to content
Upper line: if an existing product is subject to a substantial modification, the CRA fully applies. Lower line: If an existing product never sees a substantial modification, the CRA never applies.

How Pre-2028 Products Might Avoid the Cyber Resilience Act

If a product is placed on the EU market before 11 December 2027 and is subject to a substantial modification after that date, it must satisfy all the rules of the Cyber Resilience Act (CRA) from the modification date onwards (Article 69.2). If we scrutinise this article, we detect its vulnerabilities. The definition of substantial modification is circular and hence largely void. Article 69.2 might even violate our constitutional right that law must not be applied retroactively.

Read More »How Pre-2028 Products Might Avoid the Cyber Resilience Act

Overview: Risk Assessment of the Essential Product Requirements

The risk assessment of the essential product requirements is the most important, most time-consuming and least understood of CRA compliance. It answers a crucial question: Can you upgrade your embedded system to a current version, free it from exploitable vulnerabilities and keep it that way – with reasonable effort?

Read More »Overview: Risk Assessment of the Essential Product Requirements

Running Wayland Clients as Non-Root Users

Many embedded Linux systems use a Wayland compositor like Weston for window management. Qt applications act as Wayland clients. Weston composes the windows of the Qt applications into a single window and displays it on a screen. I still have to find a Yocto layer that does not start Qt applications as root. This violates the cybersecurity principle that every application should only run with the least privileges possible. Let us figure out how to run Qt applications as non-root users and make our system more secure.

Read More »Running Wayland Clients as Non-Root Users

DISTRO_FEATURES:append After DISTRO_FEATURES:remove Has No Effect

Once we have removed an item from a BitBake variable, we cannot re-append it. The evaluation of the following three assignments of the variable BB_VAR yields the same result, no matter in which order the assignments are executed.

# Code under someone else's control
BB_VAR ?= "x z"
BB_VAR:remove = "a y"

# Code under our control
BB_VAR:append = " y"

### Result: BB_VAR = "x z" instead of "x y z"
Read More »DISTRO_FEATURES:append After DISTRO_FEATURES:remove Has No Effect

EU CRA: Start, Length and End of Support Period

When we look closer at the support period, we’ll find more and more interesting questions.

  • Does the support period start, when the end user buys a product or when a product is released, manufactured or sold for the first time?
  • Can manufacturers set the length of the support period as they see fit?
  • Can manufacturers terminate the support period as they see fit?
  • What obligations do manufacturers have to satisfy during the support period? What after the support period?
  • Are there special rules for products released in the transitional period from 11 December 2024 to 10 December 2027?
  • Does the EU CRA apply to products released before 11 December 2024?
Read More »EU CRA: Start, Length and End of Support Period