So I'm here to talk about the Cyber Resilience Act and web browsers and here we have the
beautiful Etsy slide template I'll tell you soon what what Etsy is and how this relates
but first let's start with the Cyber Resilience Act so this is a law or in European
terms it's a regulation meaning that it's a strong kind of directly applicable law that
regulates products with digital elements. Well if you have commercial software this is
something potentially relevant for you. The Cyber Resilience Act is really good it says
finally software has to be secure and it does this through these requirements that are
written in annex one so you know there's there's a lot of pages to the law a lot of legal
text that's somehow plumbing somehow about who keep things together but annex one is where
it really comes together in terms of the requirements. So one that I really like is data
minimization the requirements are in two sections part one and part two part one is
cyber security properties just what the what the what the product should be like so this
one is data minimization just a little clause no big deal just process the data that's
relevant to what you're doing so this is like the GDPR kind of but without all that consent
stuff without all that you can just opt into being anyway not no legal interpretation
here but it's but it's great this is a property that we care about because if you we know
that if you pass too much data around that's not relevant to what you're doing then it's a
security risk another thing is vulnerability handling requirements in addition to being kind of
secure by design it also has to have an update mechanism there has to be practices for
handling vulnerabilities such as you know update should be by default automatic and just
coming in a timely way so this is all tied together in the notion of having a product security
regulation so you probably saw this logo CE on all kinds of physical products what that means is that
the product meets European regulations it's a European mark and now with this with this regulation
this cyber resilience act the notion of product regulation and product conformity comes to software
so rather than being kind of bottom up that the components that you build something out of are what
demonstrate that conformance it's instead kind of top down the final product has to conform to the
regulation and then you can kind of filter through the dependencies which are you know kind of inevitably
involves in whether it meets the security properties so for many products there's different ways that
products prove that they conform to a regulation one is they just have some document that lists out
certain pieces of of information that's what happens with what we call default products under the
CE array there's this extra class of products important products where either they have to kind
of explain in their technical I mean not just explaining in certain kind of basic ways why they meet
the security requirements but either having an external certification body look and see whether
things form or you conform to a standard and that standard describes what it means to
to meet the cyber security properties in the context of in this case of web browser
so this standard makes it easier to show that you are meeting the the security requirements by
allowing you to describe yourself why so anyway what what does this mean what do we mean when we say
a secure browser well or standardization so the standardization is kicked off by standardization
request you know it was a short you know four four months or so from when the CR was passed to
request was made to the European standards organizations and and then they eventually accepted it
and kicked off this process of starting to standardize I'll talk about the forward-looking timeline
a bit so this request or part part of this request went to to Etsy so you might expect well
the W3C does web browsers right or maybe what way or you know ECMA for certain things
well for European law things go through a European standards organization you know this this
standard is a big deal because it has legal implications whether you would align to the standard
changes what happens with respect to you know what you can put on the market what you can sell
or the rise commercialized so it goes to one of these official standards bodies Etsy is one
send satellite is another one and these are you know sufficiently I mean specifically licensed
to take on this kind of task so now we'll talk about the browser standard in the current context
try the current content and and how we're developing it so
there's several of these requests being made at once several of these standardization requests
made for various different kinds of important products or even more critical products or
there's another you know degree of importance beyond that and so we're we're developing a common
structure for these standards because there's there's commonalities in how to describe the
the security properties anyway we're this is all a new process we're all learning at the same time
how to write a European standard to describe security properties so first we have the scope
the cyber resilience act has alongside of you know committees like this to try to define
standards it also has this expert group consisting of people who know about well represented
there's a very civil society bodies anyway they defined what browsers are software products with
digital elements and enable you know it's all it's all tied to web access we're we're asked to
define this for standalone browsers embedded browsers including with AI elements so this describes
what it is in that nx3 that's in scope so for example out of scope is if you have purely just a web view
that's rendering local content that's not that's not a browser it has to be kind of web related otherwise it's not quite as
high risk so mention the structures we have our scope then we have our references a an unfortunate
thing about these European standards is we cannot make reference to web standards and
the reason is well it takes was cut off a little bit but legal documents require a sound basis so
the way that European law works here is it has you know from its own perspective especially high
standards for what you can put in a standard and this includes the normative references being
only these these official things so we can mention these web standards but we can't make
requirements based on them so basically the document has to be self contained we also have to define
very carefully what sorry the signal's gone okay okay great so we we have to define things but
it's a little bit funny in this context we also try to categorize what we're requiring for
browsers based on use cases so there are a few different things that you could consider for example
consumer you know individual useful web browser versus institutional context you know with
critical infrastructure you'll prep you may have some enterprise policy that governs use and so this
changes a little bit the nature of what you need after the web browser for example a lot of browsers
have a policy that you can enable which is disable HTTP authentication which is you know it
insecure technology still left in browsers these days out of out of web compatibility and if you have
a certain you know institution where you're trying to make sure that especially secure technologies
use that's why many browsers expose this flag I'm not sure if we want to require that flag to
exist but it's the kind of thing that's made available for for institutions to have higher
security so this is this is part of why we list out different use cases it doesn't necessarily mean
that they're you know different browsers we also have tried to identify relevant risks we're
looking at an overview of the product architecture but the really important sections of this document
are the normative ones which are causes five and six so for example we would specify things like
different parts of the browser should be isolated from each other through sandboxing or process isolation
and we have a number of these categories this is still all up for editing I'll explain in a minute
why I mean how you can get involved we really need more involvement in this then we have section
or clause six which is the ways to assess whether you're meeting the requirements so in this
case to check whether GPUs are process isolated one way is you can launch the browser and
look at you know look at processes and look at fallbacks so these are all supposed to be objective
this is this is a requirement in European law that we have an assessment method which can be somehow
reproducible so I would really like to encourage everyone to collaborate together on this but we do
have a timeline to keep in mind and it's unfortunate that the time is a little bit tight but that's
kind of the current situation so in a month or two we need to have the draft ready for what's
called public inquiry so we're going to share this with I mean the thing is it's already public it's
already put on Etsy's website I'll I'll have links for that next but there's another public inquiry phase
which is happening starting at is it March 31st or you know March 15 April 15th yeah but we
have to have the draft ready before that so that then it can be you know shipped off to this public inquiry
where many different parties will read it and give comments I think already we've seen more reviews
among the industry but if we can you know take the feedback people have now incorporated into the
document then the next round of feedback will be able to you know make more progress so
over the next several months we'll get more rounds review and eventually by October 30th we should
according to the timeline set by the European Commission have our have our version fully kind of
standardized within with in Etsy standardizing in Etsy is then just kind of the second to last step
because then the European Union the European Commission needs to decide to fully publish it
as an official standard and then the reason that we want to have this also upfront is because
December 11th in 2027 the Cyber Resilience Act takes effect in the sense that all products with digital
elements that are especially the commercial ones need to have their CE marking the the CE
marking it's not like you're going to print it on the software it's you know you have a website with
the documentation that that's required and you have the technical documentation stored away somewhere
that that describes why it conforms to the CRA so this is going to apply to to web browsers
I think any any browser vendor who who makes money off of it should be thinking about how this
applies to them but it really applies it's really relevant for everybody because the browser is
the basis for for web security you know this should be reinforcing that that security this gives us all
a secure basis to build applications off of and yep we want to have it there in advance so that
in principle manufacturers have time to adjust to the the requirements and to demonstrate that they
implement this so all of the different products specific standards are intended to have their standard
written in advance like this so I really want to encourage people to get involved we have the
issues available on this this repository I forgot to put the link to the actual PDF there's
there I guess it's probably linked from this from this read me yeah it is so this will this will
link you to the PDF where you can find the current draft and reading it filing issues you could
also just email me or any of these different contact methods I want to shout out to Chrome
Mozilla and especially Vivaldi browser for giving very detailed constructive criticism of this which is
which is what we'll need in order to you know making his move forward so you can suggest changes to
the text or you can just say what's wrong at a high level low level all of this feedback would be
extremely welcome you can also join the committee where we discuss it we have meetings currently
every two weeks this might move to every week but anyway you can just come to one of them these are
open to involvement from open source you know from from Etsy's perspective this is kind of
especially open this process you know like involving open source like publishing these early
intermediate drafts on the on the website and taking issues you know people can file issues
so you know even if the process can seem weird compared to other standards you know well
well trying to figure out a way to work together so yeah I would really like to be in contact with
people and I also want to note even though this timeline is very tight we can also have
an initial version of the standard that's published and then a later version which
corrects issues whether that's to make things you know whether it's to correct
errors but also to make things more secure or more implementable we we can keep going as a committee
after publishing an initial standard and make a make a next version this is just completely normal
for further European process just like with any other kind of standard so whatever happens will impact
browsers and so this is relevant to everyone who who cares about browsers