This did get posted a few weeks ago at the time it was written but didn't get much traction at that point, yet seems like a reasonably important issue. The EU has done worthy things for issues like privacy, but whatever pluses and minuses of regulating personal and business policy I'm a lot more dubious about government sticking its hand directly into how specific software (like browsers) functions. That seems like a serious step beyond merely trying to ensure there is competition and choice in different products, full disclosure about them, level playing fields etc. Dictating implementation details even for open source feels like something with much, much more scope for serious negative side effects getting baked in particularly in fields where best practices move fast.

A negative security example that comes readily to mind are how bad government policies/standards helped cement for a long time the awful practice of complex password requirements including rapid change requirements, "security questions" and so on. These are actively negative for security, people in the field realized pretty fast (and of course many argued from the start) that the only reqs for passwords should be some minimum length, not using previously exposed ones, and having a sufficiently high maximum length that everyone is free to use more comfortable ones like diceware if they wished. While that has been getting revised at last bureaucracy still moves much too slowly there.

Of course this hasn't made it through the gauntlet and hopefully won't, but I'm glad to see it getting some attention.