This seems like a good explanation to me, thanks! One question though - why have the EU texts themselves not been updated since 2008?
Trying to keep lawyers in business it sounds like. “Intent” is one of the trickiest things in the world when you want it to be.
Putting on my govt contractor hat, there may be a business opportunity here to set up VMs running Win95/Netscape Communicator for use by all the civil servants looking to comply with the law. Could charge a pretty penny too - it’ll all get budgeted as “Brexit compliance” costs.
The text quoted in the linked article in no way mandates the use of Netscape Navigator or Mozilla Mail - it merely references them as being widely distributed software capable of using RSA 1024 and SHA-1 (which it does appear to mandate).
That reminds me of FIPS for some reason...
Sometimes they don't exist - who maintains a sufficiently reputable list of safe email clients and web browsers?
Sometimes they exist but they carry some baggage - the FIPS standards for cryptography are probably fine, certainly better than hardcoding a couple of algorithm names, but they're also controlled by a foreign government.
The secondary legislation is the bit that can be updated without requiring a new Act. If EU law is set up in the same manner, (and no doubt it will be similar as not only is this method good when meeting the ideal but useful for corrupt politicians to write law with less scrutiny) then the copy and paste is from secondary legislation. It may well need an update but that doesn't mean it can't be updated in the manner you advocate.
https://en.wikipedia.org/wiki/Delegated_legislation_in_the_U...