Panel Discussion: The Impact of the CRA on the Open Source Ecosystem
Panelat Open Source Summit Europe 2023 · on Thursday, 2023-09-21· at 11:55· Room 3A (Floor 3), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
The Cyber Resilience Act draft makes entities who “make software available” liable, requires 24-hour reporting of active exploits to ENISA, mandates software bill of materials and staggered compliance with third-party assessments for high‑risk components, and treats upstream open source releases the same as commercial products. That creates impossible timelines, audit costs for foundations, risk of companies stopping upstream contributions or geofencing code, and practical clashes with chaotic open development; proposed fixes shift obligations to product deployers and funnel fines into upstream security.
AI-written summary · about
chapters (9)
- 0:00CRA panel introduction
- 1:03Panelist introductions
- 3:38CRA provisions overview
- 14:10CRA cyber security impact
- 25:12CRA and open source impact
- 32:23CRA and vulnerability management
- 35:36CRA implementation risks
- 40:29CRA improvement suggestions
- 42:17Closing remarks & Q&A
related talks
14mThe CRA: an Open Source Sustainability law?
34mHow Community Collaboration is Fixing the Future of Tech Regulation
42mMaking EU CRA (Cyber Resilience Act) Simplified and Non-scary for OSS Contributors
14mWill the CRA Break Open Source in IoT — or Make It Stronger?
24mThe CRA Challenge: Can Open Source and IoT Stay Agile Under Regulation?
01mConcerned about the CRA and how it impacts open source?
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
27mBeyond Open Source Risks With the CRA and NIS2