All your code belongs to Policy Makers, Politicians and the Law
summary
Europe enacts the Cyber Resilience Act and updates the Product Liability Directive to make decent security mandatory for software, forcing risk-based triage, SBOMs, documented cybersecurity policies, and formal vulnerability handling; open source qualifies as an Open Source Steward only if sustained, commercial-intended projects meet verification requirements; expect ~30% higher software costs, only ~3% of EU firms currently meet pentest standards, and foundations coordinate tooling and automation (SBOMs, OASP guidance, shared CI) to comply.
AI-written summary · about
chapters (11)
- 0:00Regulation is coming
- 3:42Industry’s self-regulation failure
- 7:13Society prioritizes safety over speed
- 9:18Product liability for software
- 14:13Cyber Resilience Act explained
- 19:08Open source steward exemption
- 25:28New security policy requirements
- 30:02Industry-wide compliance costs
- 33:51Impact on open source foundations
- 36:17Regulation’s inevitable reality
- 37:40Call to action for the community
related talks
45mWhy EU Policy Making matters to everyone in the Open Source Ecosystem
33mEU cybersecurity regulation and Open Source governance
59mMerging Security and Compliance: Perspectives on Emerging Regulations and Best Practices
39mFrom Policy Enthusiast to Legislators' Contact Point
36mSoftware security, trust, and public policy
25mSecure or Sorry: Your software is now a European Product
33mImplementing the EU Cyber Resilience Act (CRA)
54mSpeaking Up For FOSS Now Everyone Uses It