I don't know where you reside and what kind of software you build.
With the European Cyber Resilience Act coming into full effect late 2027/early 2028 (depends on when it's finally signed) this will not always be an option anymore for a lot of people.
a) You'll have to provide SBOMs so you can't (legally) "hide" stuff in your binary
b) Security updates are mandatory for known exploitable vulnerabilities and other things, so you can't wait until a customer asks.
This will take a few years before it bites (see GDPR) but the fines can be just as bad.
While legislatively requiring SBOMs is obviously a good idea, it might also unintentionally incentive companies to hide dependencies by rolling their own. Afterall, it's not a "dependency" if it's in the main code base you developed yourself.
Not sure how likely this is, but especially in case of network stacks or cryptographic functions that could potentially be disastrous.
I agree that there is a chance this could happen. But as a business owner myself it's pretty simple: It's far cheaper for me to take an existing dependency, create SBOMs and patch regularly compared to having to develop and maintain these things myself.
But I do get your point that others might make different decisions.
But the CRA also has provisions here as you have to do a risk assessment for your product as well and publish the result of that on your documentation and hand rolling crypto should definitely go on there as well.
Again... People can just ignore this and probably won't get caught anytime soon....
SBOM is already in place I believe for the financial sector, or soon enough. Add DORA going full in Jan 2025, and we have another legislation that no one understands and follows. Respect of the AI cloud act is such a joke.
Yeah, the ECRA is going to wreck badly organised businesses and it's high time.
I just hope there will be actual fines, even for "small" companies. GDPR enforcement against most companies seem rather lackluster if it happens at all. If the ECRA ends up only applying to companies like Google, it'll be rather useless.
With the European Cyber Resilience Act coming into full effect late 2027/early 2028 (depends on when it's finally signed) this will not always be an option anymore for a lot of people.
a) You'll have to provide SBOMs so you can't (legally) "hide" stuff in your binary
b) Security updates are mandatory for known exploitable vulnerabilities and other things, so you can't wait until a customer asks.
This will take a few years before it bites (see GDPR) but the fines can be just as bad.