Navigating Compliance: What Developers Can Learn From Driving
summary
Manufacturers take the bulk of CRA obligations while individual contributors are explicitly exempt and maintainers are largely out of scope unless monetized; article 24 is only three paragraphs and asks stewards to write a vulnerability-handling policy, cooperate with national CERTs (ANISA) on critical incidents and assist with reporting when required. Use VEX to automate exploitability signals and cut triage time, keep reproducible builds and dependency hygiene, and consider voluntary security attestation under article 13.5 to help downstream vendors.
AI-written summary · about
chapters (9)
- 0:00Welcome
- 1:23Agenda and roles
- 3:30Security standards myths
- 6:42Regulatory obligations by role
- 9:54Open source under CRA
- 12:41Role-specific safety tips
- 15:35Stewards improving security
- 16:58Road ahead and attestation
- 18:26Q&A
related talks
33mNavigating Compliance: What Developers Can Learn From Driving
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
44mPanel Discussion: Prepare for the CRA: Open Source Governance in the Age of Cyber Resilience
32mHow to stay compliant with and take benefits from the EU CRA (Cyber Resilience Act)
32mThe EU Cybersecurity Resilience Act (CRA) - Boring, Scary or Exciting?
01h 09mIntroduction to CRA Attestations and Workshop Read-outs
15mUnderstanding the Stewardship Role in CRA Compliance
44mThey're coming to regulate you!