Daniel Ehrenberg

At ETSI, we're developing a new European standard about web browser security to support the Cyber Resilience Act. Come read the draft at https://labs.etsi.org/rep/stan4cra/en-304-617/-/blob/main_publish/EN-304-617.md

Be the first to file an issue! No one from outside ETSI administration has done so yet, so this is a prize you can claim. https://labs.etsi.org/rep/stan4cra/en-304-617/-/issues/new

In addition to development in GitLab, we have regular calls. The next one is tomorrow, Feb 3rd at 3 PM (CET). If you want to join this or a future call, please DM me and we can discuss how that works.

I spoke at FOSDEM about the new European web browser security standard, under development in ETSI, as part of the Cyber Resilience Act. Video here: https://mirror.as35701.net/video.fosdem.org/2026/h1309/YMQ3J3-the_cyber_resilience_act_and_web_browsers.mp4

This standard is still in development, at https://labs.etsi.org/rep/stan4cra/en-304-617 , with weekly meetings freely accessible to open source developers, as well as ETSI members. Please get in touch with me if you want to be involved.

At the FOSDEM browser track, I will be giving a talk:

The Cyber Resilience Act and web browsers

The Cyber Resilience Act defines web browsers as an important product requiring special attention to cybersecurity requirements. What does this mean? How can you participate in defining in what it means for a web browser to be secure?

https://fosdem.org/2026/schedule/event/YMQ3J3-the_cyber_resilience_act_and_web_browsers/

I’m really honored by this invitation from @sylvestre@framapiaf.org for my first FOSDEM.

The Cyber Resilience Act mandates that commercial software handle vulnerabilities well. What does that mean exactly? The CRA names sound principles in Annex I Part II, but applying them in practice is another thing. For this reason, there's an ongoing standardization effort translate these principles into more clear requirements to meet, to make it easier to demonstrate compliance.

The draft standard now entering a public review phase, so *we need your opinions, thoughts and analysis to improve it*. This article explains where things are, and how to get involved.

https://www.agoria.be/en/services/expertise/technical-regulations-standardisation/standardisation/public-enquiry-concerning-the-new-draft-standard-pren-40000-1-3-vulnerability-handling-in-support-of-the-cyber-resilience-act

For April Fools, I told the ETSI CYBER EUSR rapporteur group on web browsers that the European Commission was giving us until April 15th to submit our final draft. Got them good! Well, some requests for clarification but actually no laughs… (Real timeline: edit through May, then more review stages)

RESCHEDULED: Please join Daniel Thompson-Yvetot and me on Tuesday the 27th, at 1 PM Central European Time for an interactive deep dive into the draft standard for BROWSERS under the Cyber Resilience Act (CRA). https://www.stan4cra.eu/event-details/cra-standards-unlocked-deep-dive-session-on-browsers-2

RE: @littledan@hachyderm.io

Rescheduled for Tuesday, the 27th at 1 PM. Hope to see you there!

RE: @littledan@hachyderm.io

This event is postponed. I'll post here again when it is rescheduled.

If you were dictator of Europe, what would you require all software developers to do properly?

Ve a aquest esdeveniment gratis aquest dijous a CTTC a Castelldefels per a sentir-me xerrar del Cyber Resilience Act i els navegadors web.

Ven a este evento gratis este jueves en CTTC en Castefa para escucharme charlar del Cyber Resilience Act y los navegadores web.

Come to this free event this Thursday in CTTC in Castelldefels (Barcelona) to hear me talk about the Cyber Resilience Act and web browsers.

Registra't aqui: https://cyberstand.eu/events/cra-standards-unlocked-eu-tour-barcelona

(Background music: Jennifer by Els Catarres)