Key Concepts
- Cyber Resilience Act (CRA): EU legislation focused on protecting citizens from cybersecurity incidents.
- Open Source Software (OSS): Software with publicly accessible source code.
- SBOM (Software Bill of Materials): A list of ingredients or components that make up a software product.
- Open Source Steward: An entity (like a foundation) that supports open-source developers and projects.
- Digital Sovereignty: A nation's ability to control its digital infrastructure and data.
- Secure by Design/Default: Incorporating security considerations from the initial design phase.
- Open Source Project Security Baseline: A catalog of global compliance requirements and application security practices.
The Existential Crisis Facing Open Source
The open-source community faces a potential crisis due to increasing regulations like the EU's Cyber Resilience Act (CRA). While open-source developers contribute to solve problems and gain recognition, commercial entities heavily leverage their work (80-97% of commercial offerings contain OSS). The CRA aims to protect EU citizens from cyber threats by imposing cybersecurity requirements on manufacturers who use OSS in their products.
The Cyber Resilience Act (CRA)
The CRA, set to take effect in phases (reporting obligations by October 11, 2026, full effect by December 11, 2027), places significant burdens on commercial enterprises. These include reporting obligations, adherence to secure-by-design principles, and potential fines reaching billions of euros for negligence.
Example: A turbine company using OSS in its technology development and customer-facing applications (e.g., monitoring power consumption) must comply with the CRA. This includes documenting the software "ingredients list" (SBOM) of the turbine and related applications.
The responsibility for compliance falls on the manufacturer, not the upstream open-source maintainer. The average open-source project has around 160 dependencies, making compliance a complex task for downstream users.
The Disconnect Between Upstream and Downstream
Upstream maintainers often lack understanding of how their software is used commercially. They focus on solving specific problems, while commercial entities integrate OSS to reduce costs. This creates a disconnect, as downstream customers demand documentation, security policies, and support lifecycles that upstream developers are not equipped or obligated to provide.
Example: Dan Felman, creator of curl, receives demands from commercial lawyers and governmental agencies for "esbombs" and market surveillance conformity assessments, which are outside the scope of his typical responsibilities.
Responsibilities and Burdens of Upstream Engineers
Upstream engineers already bear significant responsibilities, including:
- Managing mailing lists
- Reviewing contributions
- Approving pull requests
- Writing blog posts
- Feature development
The CRA doesn't legally obligate most upstream maintainers (except those receiving donations/grants beyond operating expenses). However, downstream customers, facing potential penalties, pressure developers for documentation and security assurances. This creates a communication breakdown, as businesses expect processes and documentation that are uncommon in the open-source world.
The Funding Gap
A significant gap exists in funding and support for open-source developers, particularly individuals. Businesses often misperceive open-source projects as corporations, failing to recognize the individual efforts behind them.
Solution: The CRA introduces the concept of an "open-source steward" (e.g., Linux Foundation, Apache) to encourage industry and non-profit foundations to support developers through funding, infrastructure, and tools.
While grants and donations are helpful, support can also include cloud credits, test harness development, and other resources. Some initiatives, like Germany's Tech Sovereign Agency and GitHub Sponsors, are addressing this gap.
Digital Sovereignty
The rise of digital sovereignty, where nations seek to control their digital infrastructure, impacts the open-source community. While promoting local development and competitiveness is valuable, creating isolated "stacks" (e.g., an "Australia stack") can hinder collaboration and innovation.
Argument: Open source thrives on global collaboration and open standards. Siloing efforts leads to incompatible standards and inefficiencies reminiscent of pre-open-source eras.
Recommendation: Maintain open standards, protocols, and models while allowing for regional "special sauce" on top of a shared foundation.
Three Recommendations for Open-Source Engineers
- Educate Yourself: Take the OpenSSF's free 90-minute class on the CRA (developers only need to watch 5 minutes).
- Utilize the Open Source Project Security Baseline: Implement the recommended application security practices to provide downstream users with the information they need (e.g., SBOMs).
- Consider Working with a Steward: If concerned about regulations, align with a foundation that can provide funding, enterprise-level support, and a larger community.
Conclusion
The open-source community faces challenges due to increasing regulations and the disconnect between upstream developers and downstream commercial users. The CRA and similar legislation in other countries (China, India, Korea) necessitate a shift in how open-source projects are supported and managed. By educating themselves, adopting security best practices, and partnering with stewards, open-source engineers can navigate these changes and ensure the continued success of open-source innovation.
AI summaries can miss context or contain errors. Check important details against the original video.
