| Re: [open-regulatory-compliance] Minutes from the Vulnerability Handling TF meeting (Working on Due Diligence) |
While “Due diligence” may sound boring, there’s a scary perspective on this. If you are a manufacturer, you’re responsible for all components in your product - both Open Source and commercial. You need to validate that all components are up to date and that the source - the commercial vendor or open source project - upstream is ok and will be a good choice for you, in the light of the EU Cyber Resilience Act. In the worst case, this will lead to lawyers, procurement officers and product owners inventing their own forms and REQUIRE open source maintainers to answers WITHIN XXX DAYS. With a possibility of hundreds or thousands of upstream components for a manufacturer and thousands of downstream manufacturers for a maintainer, this will simply not work. We need to establish a best current practice, a minimum form for doing this. Maybe suggest that maintainers that wants to be used in CRA-compliant products publish this form in an easy to discover place. Or something else - let’s work together to find this out. We need to do everything we can to avoid this potential DoS attack on Open Source maintainers and assist manufactures in this process. Read through the docs and we’ll see you in our next meeting! /O PS. If you need something to distribute internally to create interest, we’ve blogged about this issue here: |