No. 74: Learnings from My First CRA Survival Bootcamps
I have run my first CRA Survival Bootcamps and learned a lot: manufacturers of white-labelled products, manual updates, opt-outs from automatic updates, taming the CVE flood with CVSS metrics and how to get the end date of the support period on the device or its packaging.
Read next
Removing CVEs of Kernel Modules Not Installed on the Device
With some Yocto magic, we can reduce the number of unpatched CVEs in a Linux image by 50-70% and the number of unpatched kernel CVEs by 60-90%. Addressing and remediating vulnerabilities as mandated by the CRA becomes a lot more manageable.