No. 74: Learnings from My First CRA Survival Bootcamps
I have run my first CRA Survival Bootcamps and learned a lot: manufacturers of white-labelled products, manual updates, opt-outs from automatic updates, taming the CVE flood with CVSS metrics and how to get the end date of the support period on the device or its packaging.
Read next
Understanding the CVSS Metrics for Exploitability
Instead of fixing hundreds of CVEs, manufacturers can provide enough security measures to make the exploitation unlikely. The decrease of the CVSS metrics is a useful indicator how effective the security measures are. This post is about understanding the CVSS metrics.
Running Example for CRA: Heat Pumps in Private Homes
From now on, I'll use heat pumps in private homes as the running example for my CRA articles.
Real and Imagined Consequences of Substantial Modifications
WRONG: substantial modification => new placing on the market. Logical somersaults needed to avoid infinite support periods and full conformity assessment for all legacy products. --- RIGHT: substantial modification => update conformity assessment. No trickery needed.