Comment by mmooss
21 hours ago
Or the law makes the problem smaller, by making the routers secure, and makes outcomes just, by penalizing the responsible companies.
21 hours ago
Or the law makes the problem smaller, by making the routers secure, and makes outcomes just, by penalizing the responsible companies.
ok, let's redo this: instead of routers it's an IoT device. The router protects the IoT device from direct access so it is secure from majority of attack vectors - now an IoT device provider gets their server compromised and hundreds of thousands of IoT devices are now bots in a botnet due to the ability to forcefully push a security update.
I understand the risk, but the existance of risks doesn't mean they outweigh the benefits. Everything has risks.
I don't think it does outweigh the benefits, the real benefits would be punishing or/and banning vendors that do not secure their devices since using laws such as "timely updates" just promotes them to include sloppy (insecure) implementations for pushing said updates just to do bare minimum to comply with the law.
relevant law here: EU Cyber Resilience Act (CRA).
1 reply →