Can Open Source be Secure by Design?
summary
Argues that the Cyber Resilience Act creates a new legal role for projects to offer voluntary security attestation so manufacturers can reduce due diligence, proposes two tiers—lightweight vs heavyweight attestations—and notes the law already forces companies to report and upstream patches and threatens a 3% global revenue fine. Cites concrete incidents (Log4j, XZ utils, “11 lines of JavaScript” outages), points to German BSI and working groups building a practical attestation theory, and reports a $1B MySQL sale and a 2,000× ROI study as context.
AI-written summary · about
chapters (9)
- 0:00The history of open source
- 3:06Key historical milestones
- 6:32Growth and institutionalization
- 8:12Success and its crises
- 10:51Policy reactions to security
- 14:18The Cyber Resilience Act
- 19:28Proposed attestation framework
- 22:26Generative AI and the future
- 27:31Closing thoughts and Q&A
related talks
44mNavigating Open Source and Open Standards for Better Cybersecurity
26mCo-host Sponsor Session: Making Open Source More Secure by Moving Upstream
40mSecurity: Why It _has_to Be Open Source
45mRegulated and Sovereign : Impact to the Open Source Developer
42mPanel Discussion: The Impact of the CRA on the Open Source Ecosystem
17mA New Era for Open Source Security
29mNavigating the Open Source Policy Labyrinth: Unraveling Global Policy Efforts for a Secure Future
35mOpen source security: Opportunity or oxymoron?