NIS2 Technical Implementation: A Practical Guide to the Governance Layer

Whether in business, technology or everyday life, abbreviations are ubiquitous. However, I personally think they are overused, spelled out too rarely, and inconsistent even within a given domain. Admittedly, abbreviations have their use cases like keeping complex tables concise. When reading ENISA’s NIS2 Technical Implementation Guidance, however, I became convinced that it might make sense to create an inventory of the most important abbreviations within the given security context.

To improve my own understanding, and perhaps yours, I will not only list the abbreviations but provide a bit of context, and explain how the concepts relate.

What is Safety Of The Intended Functionality (SOTIF)?

When working with embedded software or hardware, you might have come in contact with functional safety. Functional safety deals with getting the risk of malfunctioning behaviour of your systems to a level that you can accept. In essence, malfunctioning behaviour means that your system does not work as intended, and when this happens in a safety-critical system like a car, it can threaten lifes. Unfortunately, getting the risk of malfunctioning behaviour to acceptable levels is tough. This is why international standards govern how safety-critical systems are developed. Instead of vibe coding driver assistance systems, the ISO 26262 standard series “Road vehicles – Functional safety” describes how road vehicles (say car, bus, truck, …) and their subsystems are expected to be built. On over 800 pages in 12 parts, ISO 26262 details expected processes that car manufacturers and suppliers are required to have in place like risk assessments, traceability in their requirements or verification and validation activities.

Practical Local Email Backups With Dovecot and imapsync

Digital resilience is mentioned a lot these days, and while I thought I was well-prepared I realized that I had a blind spot: my emails. The problem is that I have lots of them (> 50.000) and neither do I want to stop hoarding or pay an enterprise-tier service at a provider that I trust (I do pay the private-tier, though 🙂). For me, this meant to create a local backup but I still want it to behave like a standard email server which you can connect to with your favorite client. What behaves like an email server? An email server!

Meshtastic – Testing the Mesh Network on the Swedish Countryside

I have been curious about Meshtastic for a while. Now that c’t Magazin (a popular German computer magazine) had a good cover story on it, it was finally time to test it. In the following, I will briefly introduce Meshtastic, present ready-to-go node alternatives, and report on my off-grid node including unexpected messenges from an airplane.

Meshtastic

Meshtastic is “An open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices”. It can be used for messaging – including outdoor, emergency, or blackout preparedness use cases – as well as remote monitoring or sensing applications.

Managing Rust Dependencies for Supply Chain Security

As this post got a bit dense, these are my main takeaways for reducing supply chain risks:

• Reduce dependencies by adding only essential features and exploring lighter alternatives.
• Use lib.rs including cargo audit, cargo crev and cargo vet results to vet trustworthiness.
• Implement CI checks using cargo deny to automate policy enforcement.
• For high-risk projects, consider vendoring dependencies with cargo vendor.

Managing dependencies is hard in any software project: Which dependencies should you choose, and when is it worth pulling in an external crate? How to keep track of updates, vulnerabilities, or a dependency ending up unmaintained? When building a product, this is not only a quality issue but with EU regulation like NIS 2 or CRA this even becomes a liability issue. This is not only about vulnerabilities that need to be fixed, but dependencies have become a direct cybersecurity target where malicious code is somehow injected into the software “supply chain”. This is a known problem, especially for languages with thriving package ecosystems.

Rust Progress, if let and simple-ssg-rs

I am slowly but consistently learning Rust, reserving approximately an hour each day since my last post almost six weeks ago, and I think I am progressing OK. What follows is a recap of my learning path which might help, especially if you are experienced in C++ and contemplating learning Rust. I will also briefly talk about if let and introduce simple-ssg-rs, a static site generator (like Jekyll, Hugo or Zola) but much simpler and which I created for the sole purpose of exercising Rust.

Learning Rust

I have always had an interest in programming languages and concepts, mostly related to systems programming. That’s pretty much why I studied computer science. Even if I have never been employed as a programmer, I have created and contributed to several bigger projects during my time as a researcher (e.g., WayWise is a more recent open one). My goto language is C++ (11 or later), often paired with the Qt framework. Having worked with safety-critical systems during the last years, I have often thought that it is far too easy to introduce hard-to-debug bugs in C++ if you do not enforce certain rules (say MISRA C++) and wondered about alternatives.