alt Hacker NewsI think it's mostly the "you need to monitor CVEs and write report within 24/72 hours" that causes OEMs pain and they prefer to have less work than more.
Also - the reality of what you think is ok and what a corporate legal department think its ok is... rarely the same -_-
Replies
themagic80 • yesterday at 10:53 AM
Law: please do the minimum to protect users. Corps: screaming
This. CRA only means that you need to assess with 24/72h that you are affected or not by a published CVE.
Then there is no time limit to provide a mitigation. It should just be worked out without unnecessary delays. Once a mitigation is published, a report should be submitted with 14 days.