Hacker News Reader

Comment by arghwhat | Hacker News Reader

nit: "without undue delay" does not mean "immediately" under any legal interpretation, only that the timeline should not be longer than necessary. This leaves a lot of wiggle-room in favor of the manufacturer, and mainly rules out that they go "eh, we'll look at all these in half a year maybe".

As long as they start the process and it is not absurd from an industry standards perspective, they should be good. They can have slow processes, including being a good bit slower than their peers, without running afoul of "without undue delay".

View on HN

They have literal 24 hour and 72 hour deadlines. Obviously, they might put a blind eye to it if you are reliable but delayed the reporting by a day, but the 24 hour and 72 hour deadlines are a fact. You have to initiate the reporting immediately.

This is impossible to happen.

Security flaws are discovered almost every day (now that they are automating it with AI there are a ton of reports), pretending the manufacturer releases an update in 1 day is nonsense.

Just building the code alone it would take a lot of time, and of course you have to test it at least a bit before giving it out to the end users, you can't pretend to rollout on a global scale a nightly build without first at least some level of QA risking bricking user devices.

And you have to consider that phone manufacturer doesn't work h24 and 7/7 of course to give out patches.

I think that we are fortunate if the whole process takes less than a month, not a day.

You are mixing unrelated requirements together here.

> The CRA requires manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of their product with digital elements. They need to submit an early warning within 24 hours of becoming aware, and a full notification within 72 hours.

These deadlines are entirely unrelated to the availability of security fixes and delays in deliverying them.

You are confusing two different articles. The 24-hour deadline relates to notifying the national Computer Security Incident Response Team in the event of the detection of a confirmed exploited vulnerability of one of the manufacturer’s products (Article 14). Submitting a bug report and opening a ticket does not constitute a confirmed exploitation in the wild. Nor does the publication of an exploit or a PoC constitute a confirmed exploitation of the vuln in the wild.

The part that’s probably bothering Google is this:

> 6. Manufacturers shall, upon identifying a vulnerability in a component, including in an open source-component, which is integrated in the product with digital elements report the vulnerability to the person or entity manufacturing or maintaining the component, and address and remediate the vulnerability in accordance with the vulnerability handling requirements set out in Part II of Annex I. Where manufacturers have developed a software or hardware modification to address the vulnerability in that component, they shall share the relevant code or documentation with the person or entity manufacturing or maintaining the component, where appropriate in a machine-readable format.

To put it very simply, the CRA calls on all stakeholders to cooperate in reporting incidents and vulnerabilities, establishes a national coordination mechanism, and aims to address vulnerabilities swiftly in order to maintain essential services within the European Union.

> nit: "without undue delay" does not mean "immediately" under any legal interpretation, only that the timeline should not be longer than necessary. This leaves a lot of wiggle-room in favor of the manufacturer, and mainly rules out that they go "eh, we'll look at all these in half a year maybe".

Well, the corporate lawyers think otherwise at those corporations, so I'm not sure how much your interpretation counts :)

I do not believe that any corporate lawyer would think that. It does not read like that in neither plain english nor legalese.

Maybe the misunderstanding stems from the related common misuse of "as soon as possible" as "immediately"?

A corporate lawyer would, however, always suggest to minimize/reduce/delay any legal obligations so as to minimize risk of liability, regardless of whether said obligation is easy to comply with or not.

Reply on news.ycombinator.com