<div dir="ltr">From what I can see from the proposal, there are a couple of things to note: 1. As soon as you go "commercial" in whatever way, your FOSS project must be bound by the Cyber Resilience Act. So, you can take a FOSS project, but as soon as you ask for "paid" support, your whole project (including the FOSS part) suddenly becomes part of that Cyber Resilience Act. 2. Hacking a product will violate the Cyber Resilience Act. It clearly states that you must do anything to "prevent" your product from being tampered with (as in do something it was not intended to do). 3. You also need to supply a "bill of software", which means you need to give a lengthy file with ALL the software used in your product. Knowing how good the python "rabbit hole" can be, I am wondering what rabbit holes this can bring since this can blow up significantly (I want to know EVERY package that is being used, not just "yeah, we're running this framework from this supplier")... 4. It looks like the hardware and the software running on it need to have a CE marking. Just stating that the hardware is CE certified is not good anymore, also the application needs to be CE-certified. Knowing how stuff sometimes goes, I am waiting for the time when we have a recall of consumer fridges because the "software might pose a security risk to consumers". Greetings, Julius</div> <div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Oct 31, 2022 at 11:15 AM Alessandro Vesely <<a href="mailto:vesely@tana.it">vesely@tana.it</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi all, I just browsed the ISOC article linked below and it sounds wrong to me. While it is correct to note that "certification will not eradicate bugs even when a manufacturer is fully compliant", trying to exempt FOSS is not the right approach. What software would you use, a fully certified, professional OS, or a run-at-your-risk product by hobbyists who are exempted from security regulations by a compassionate exception to the Cyber Resilience Act? If the point is certification costs, I'd recommend that certification agencies be required to work for a percentage of the cover price of the product they're certifying, which is 0 for most FOSS packages. No exceptions. Best Ale On Tue 25/Oct/2022 10:53:39 +0200 Johan Helsingius wrote: > Hi Maarten, > > Thank you for the heads-up - it is definitely a proposal that > needs to be followed. > > Julf > > On 24-10-2022 14:58, Maarten Aertsen wrote: >> Dear cooperation working group, >> >> I'd like to call your attention to my talk on the draft agenda of the >> open source wg this Wednesday, because I believe it may be of interest to >> members of this group: >> >> On 10/10/2022 18:47, Marcos Sanz wrote: >>> Agenda RIPE 85 Open Source WG Session >>> Wednesday, October 26, 10:30 - 11:30 (CEST) >>> [..] >>> B. "Cyber Resilience Act effects on OSS", Maarten Aertsen, NLnet >>> Labs >>> >>> NLnet Labs is closely following a legislative proposal by the European >>> Commission affecting almost all hardware and software on the >>> European market. The Cyber Resilience Act intends to ensure cybersecurity of >>> products with digital elements by laying down requirements and obligation >>> for economic operators. >>> >>> In this short talk you'll learn what to expect in the Cyber Resilience Act >>> and why this proposal may matter to you as a developer >>> or user of open source software. If so, let's make sure that policy >>> makers take into account its effects on open source development by >>> professional organisations and volunteers alike. >>> >>> Do get in touch with Maarten when you have similar concerns, want to team up >>> or can help us to provide technical expertise in the right places. >> >> If you would like to read a little more on the topic, Olaf Kolkman has just >> published a blog post on the same topic at the Internet Society blog [1]. >> >> I'm new to this community: don't be shy and talk to me :-) >> >> kind regards, Maarten >> >> [1] >> <a href="https://www.internetsociety.org/blog/2022/10/the-eus-proposed-cyber-resilience-act-will-damage-the-open-source-ecosystem/" rel="noreferrer" target="_blank">https://www.internetsociety.org/blog/2022/10/the-eus-proposed-cyber-resilience-act-will-damage-the-open-source-ecosystem/</a> >> > > -- To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: <a href="https://mailman.ripe.net/" rel="noreferrer" target="_blank">https://mailman.ripe.net/</a> </blockquote></div>