The CRA: an Open Source Sustainability law?
summary
Explains that the Cyber Resilience Act (proposed Sept 2022, revised March 2024) exempts non‑commercial open source but creates open source software stewards required to support development, handle vulnerability reporting and set security rules; introduces security attestations that projects can use to prove CRA compliance and potentially sell as revenue; warns of risks—third‑party attestors pocketing fees, high attestation costs pushing manufacturers to rewrite, and free‑riding—and proposes a nonprofit distributor with a minimum funding threshold to unlock public attestations.
AI-written summary · about
chapters (8)
- 0:00Introduction and speaker intro
- 0:41What is the CRA
- 2:51CRA impact on open source
- 3:54Open source software stewards
- 6:21Steward roles and funding models
- 8:47Security attestations explained
- 10:09Attestation funding structures
- 12:17Call to action and next steps
related talks
42mPanel Discussion: The Impact of the CRA on the Open Source Ecosystem
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
42mMaking EU CRA (Cyber Resilience Act) Simplified and Non-scary for OSS Contributors
34mHow Community Collaboration is Fixing the Future of Tech Regulation
14mWill the CRA Break Open Source in IoT — or Make It Stronger?
17mAttestation Framework & Objectives
01mConcerned about the CRA and how it impacts open source?
32mHow to stay compliant with and take benefits from the EU CRA (Cyber Resilience Act)