Not that the talk title on the screen doesn't tell you everything that you need to know,
this talk is about regulation and open source.
What is it and what's to focus on?
Here's Toby Langel.
Thank you, and now I have to wait for a minute, no, I'm joking, all right, I'm very glad
to be here with you all today, and I'm here to talk about something that has been sort
of talked about quite a bit for quite a number of years in this community, the Cyber Resilience
Act, the CRA, and essentially to say that it is not coming out for you, that's not what
the CRA is about, and sort of like, hopefully answer some of your questions and allow you
to look at this with a little bit more calm, and sort of like trying to find the perspective
in your position in this broader change to how software is going to be built in the future.
So just some small credentials to give a bit of context, I'm actually a jazz drummer
turned open source developer turned consultant in this space.
Yes, it's a long story, I'm not going to talk about it today, but I could overbears
or something.
I run a small consulting firm, which is called unlock open, and the reasons I'm putting
those credentials up is I've been very involved with the CRA's rollout.
I help bootstrap the open regulatory compliance working group of the Eclipse Foundation, and
I'm a member through a clip of the EU CRA expert group, which is a group that the European
Commission set up that combines the different countries in the EU, represented at some
of different countries, represented at some industry, and from key open source foundations.
And so as a result, I get to have conversations with the Commission and the market surveillance
authorities, and so I have a better understanding of where this is going than is publicly
available for now.
So we're going to talk about what is actually the CRA, what problem it's really trying
to solve, and whether it's actually coming through you and look at contributors, maintainers,
and also a bit companies, but more from the perspective of your roles in companies, rather
than companies themselves, and then briefly will consider whether they're actually more interesting
things to dig into this CRA that might possibly help sustain open source a bit better
than this today.
So what is this CRA?
Well in a nutshell, it is product legislation, right?
It is meant to improve the cybersecurity of physical products and software products that
are sold on the market in the European market.
It is not for services, right?
It is not targeting what people do or how you build software, how you build open source.
It is targeting the result of what ends up in the hands of businesses and citizens in the EU.
And it is really aimed at those who are building, creating those products, and selling them.
It is not aimed at folks who are developing software in those products.
And the problem it's trying to solve, and sort of like where the law originates from,
is fairly simple, is software is now everywhere, from toys to rovers on other planets,
and the increase of cyber attacks in the last few years is costly and impacts businesses
and people quite strongly and increasingly so.
So that's the problem that the commission is trying to, well the Europe is trying to solve
with the cyber resilience act, and technically what it is really targeting is done things like this,
right?
The classic, you know, conducted toy was a wide open server to the camera that is inside,
that is listening to kids, the very poorly designed security camera that has a password
1, 2, 3, 4, and of course the famous one for those that paid attention to what happened in
the friends at the Louisville, the famous password for the Louisville security system, which was just Louisville.
So that's what is trying to be fixed, right?
It is not like, you know, your specific open source package.
That said, there were very real issues with the earlier versions of the CRA, like it was really bad,
and a lot of people in the community stepped up and had a lot of work to talk to the commission,
to talk to the people that were writing it, to talk to folks in the parliament to amend that draft legislation,
and frankly, it now is like pretty good, I think it really makes sense, and the more you understand it,
and the more you understand sort of like all of the framework of legislation that it spilled upon,
the more actually it's actually quite reasonable.
So key problems have been fixed.
That said, there's still a lot of questions in the final text, especially for open source contributors,
and us, really, that feel like they're unanswered, and the good news is that's getting fixed,
and it's getting fixed in that CRA expert group working directly was the commission.
So that's reassuring.
And the first thing I want you to do, if you haven't looked at the FAQs as grab this,
because that's what we've been doing to essentially answer those questions.
It's ongoing.
There's about expected the size of it will double in the next, I don't know,
two or three months, two months, let's say.
And so those are a combination of community questions that are built on top of the knowledge
that we're acquiring through this area expert group and reading the text and reading other legislation.
And they're also, they also contain official frequently asked questions from the commission itself,
that's baked into the whole system.
And so that provides a lot more answers and sort of like answers that have a bit more weight than when just a community works on it.
So, is this area coming for you or your open source community?
Well, no, you're not the target at all, right?
The target is all of those really egregious cases of like bad software or bad post that we're talking about before.
Our contributors subject to the CIA know they're not.
Is a company whose employees are contributing to open source subject to the CIA?
No, absolutely not.
Is a maintainer of subject to the CIA?
So, the answer to this is essentially no, right?
Unless you're making a lot of money doing so, right?
So, who's here making a lot of money doing on source maintenance?
Are you for real?
Like so, for the video like one person actually raised their hand and now I'm completely confused in my whole sort of like talk is going to go sideways.
Thank you.
You and I can talk afterwards.
I might consulting fees are like very low.
How much money is a lot of money?
I'm going to address this, but that's a good question.
I have a slide for this, so I'm not going to let my, that get the real.
But I'll get to it, absolutely, that's a good question.
So, is the maintainer subject to the CIA if the receiving donations, right?
If you have any kind of donation mechanism, well again, no, and again unless you're making a ton of money out of it, right?
If you're receiving grants to develop the project to increase its security whatnot, like not at all, like regardless of like how much those grants are paying you.
If you're getting paid to build open source, right?
No.
This is this gets better, right?
If you're getting paid to help integrate your own open source project in clients software,
you're still not subject to the CIA.
Again, unless you're making a killing was it, and I'll get to what that means now.
So, what exactly does it make a killing mean?
Well, I mean, it means like essentially sustainably, so for a long period of time, not just like one month,
making more money that is necessary to cover all of your professional costs, right?
And you're reasonable living expenses.
And sure, that is subject to interpretation, et cetera, obviously.
But I think, you know, I mean, it's a reasonable clarification of the law.
Is it still a person?
Sorry, what?
So, the question is whether that translates to minimum wage.
No, it says reasonable living expenses.
You don't know how much time it took to get that level of clarification.
This is really precise and specific.
Let me tell you.
No, I mean, look, I am not an lawyer, and I'm not your lawyer, right?
And it just heads off.
But I think like if you're making the same kind of money that you would do,
if you were having the same job as a full-time employee somewhere,
plus covering your cost and, you know, all of like them, self-employment aspects,
I think that fits that description, right?
If you're living in a country where a developer is making, I don't know,
let's say, 60,000 euros a year, and you're making 200.
It's going to be hard to make the case, right?
But also, I mean, if you're making that kind of money, you know, good for you, right?
So now moving to what it actually means for companies.
So if you're providing as a company, integration services for open-source, right?
Let's say you're installing WordPress for your clients or something like this, right?
Then you're out of scope.
You're doing a service, right?
You're not shipping a product in the market.
So you're not impacted, but there is here something to watch out for.
A lot of folks who aren't involved in the service business and the integration of open-source components
look at way to diversify the income by creating adjacent products,
and those are in scope, right?
And it can be very, very small things, but like a WordPress theme is probably in scope of the CRA.
So you have to be careful about those.
If you're releasing software, if any of your employers are releasing open-source software,
does that make them in scope?
Well, it actually depends.
Are you releasing software that's intended for commercial use,
like as your company using that software itself to like sell products?
Well, in that case, right, your company is probably the steward of that software.
Right?
And that is a role that is sort of like in-between, not being in scope,
and being considered as a manufacturer in fully in scope.
It has a very limited set of requirements.
You can look up and they're in the FAQs that I give you the QR code for earlier.
And essentially, that's the case.
What's really interesting is if your company is actually selling open-source software,
right?
It is going to be considered the manufacture when there is a transaction,
which is making money off of the software.
But the community edition, right, even if it's a bit equivalent to the enterprise one,
that is that the company will be a steward of that.
Right?
So there's this distinction between, is it open-source?
Right?
And always there are contracts, a tie to it, and a service agreement,
and your company is making money out of it.
Yeah, and that's the last one, and that's, I think, one of the most interesting aspect of the law.
It's if you use open-source in your products, right, as a company,
and you sell those products on the market,
are you subjected to this array?
Well, yes, absolutely, because you're selling a product, right?
But what's most important is your responsible for all of your open-source,
and all of its dependencies and transitive dependencies, right?
So the company, making money out of placing the software in the market,
is the one that is responsible for the security of all of the software that integrates.
And that's one of the reasons I believe this legislation is a really good one.
Oh, doing very good with time.
And I'm going to be able to take questions.
This is going to be great.
Lastly, and I think this is an interesting point,
and there's a lot of work going on in this space right now.
There's kind of a question as to whether the survey could help sustain open-source, right?
And that ties to the question, or we're just talking about before,
which is manufacturers placing products on the market,
they're in the ones responsible for the security of all of the open-source they ingest.
So you can imagine that it doesn't really scale,
it's not very effective and efficient if every manufacturer,
sort of like forks stuff and like fixes security bugs and their own things,
and then like sort of like maintains those, like we know how that goes, right?
It's terrible.
So the idea is kind of like wouldn't it be nice if we could shift security upstream to the maintainers,
where it's a lot more efficient, and they know where they're talking about a lot more, right?
And of course there's attention because the maintainers can just go,
what I don't care, this is not mind problem, right?
And so the CRA includes this mechanisms called security attestations
that are currently being defined, right?
The article that defines them is very, very hand-wavey.
But the commission can write specific legislation just for this,
and it's being discussed.
It's being discussed in the orc working group in collaboration with commission.
So if you're interested, hit that link at the bottom,
and the slides will be available.
And the idea is essentially, can we provide a mechanism by which,
maintainers who would want to, right, could essentially sell attestations,
remain maintainers, right, not become manufacturers,
in order to fund the maintenance and securization of the open source projects that they maintain.
So that's very much an open question at this point.
Can it work when the manufacturers want to pay for this?
So, you know, it's an interesting topic.
And I think that's it.
I will be able to take questions.
And again, if you want to know more and have more questions,
you can check this, and you can also follow GitHub issues
to ask more questions if you want to.
Thank you very much.
Easy, one, what one?
Hi, Tony. Thank you for the talk.
On that last screen, one, do you think that we'll have some more clarity on whether or not security
annotations can be a model for funding that manufacturers are willing to pay for?
Like, what do you think the timeline roughly will?
So that's a great question.
I think more clarity will get quite soon.
I think throughout the year we'll have an increasing sense of what they could look like.
Whether that is an economically viable model is going to take a long,
like, obviously longer to figure out.
And it also depends on another sort of like hand-wavering thing in the CRA.
And that is exactly how much due diligence manufacturers have to do.
So, how much do they have to understand the code that they're adjusting?
The higher the bar, the more they'll be inclined to pay for it,
the higher the bar, the less they'll be inclined to use open source.
So, it's an interesting tension.
And I can't answer whether we'll be able to, you know, collectively get any of this right or not.
But I think it's worth trying.
Thank you, thank you very much for those slides.
I have one question, though.
Let's say I'm a manufacturer.
I sell hardware and with that hardware.
So, provide open source software from any community and rebuild those stuff.
And maybe tweak a little bit and offer this as a service to our clients.
What is the status for the manufacturer providing these software now?
So, that is a more involved question that I would like to address in this setting.
Because there's many sort of additional questions I would have to ask.
Okay.
Because it depends on whether it's complex, it depends on how data moves from the product to those services.
It really depends.
Okay, let's have a chat later.
Absolutely.
I'm sure others are affected as well.
Thank you very much.
We're on time.
So, thank you once again.
So, thank you.