Upstream Collaboration for the Win (of the CRA)!
summary
Argues that strong upstream collaboration materially eases CRA obligations by building developer networks, improving project health visibility, and speeding fixes; a team upstreams all security fixes and ends internal forks, produces 214 PRs addressing first‑level security issues and 1,400+ dependency‑bump PRs, implements automated dependabot flows, TLS hardening and public scanning integrations, and sees community review for fixes, reduced patching overhead, and lower risk and cost for products.
AI-written summary · about
chapters (8)
- 0:00CRA and upstream collaboration
- 2:30CRA obligations for manufacturers
- 6:01Risks to open source adoption
- 10:12Sustainable open source reinvention
- 12:59Engineering benefits of upstreaming
- 17:40Ericsson security fixes case study
- 22:34Call to action for open source security
- 24:23Q&A
related talks
59mCrossing the Streams - How Downstream Can Understand Upstream Vulns
14mWill the CRA Break Open Source in IoT — or Make It Stronger?
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
28mFrom Manufacturer to Steward Red Hat’s Approach to CRA Readiness
42mMaking EU CRA (Cyber Resilience Act) Simplified and Non-scary for OSS Contributors
17mBuilding Secure Open Source Communities From the Ground Up
52mScaling the Security Researcher to Eliminate OSS Vulnerabilities Once and for...
44mPanel Discussion: Prepare for the CRA: Open Source Governance in the Age of Cyber Resilience