As of today, a manufacturer who puts software or hardware on the EU market under its own name is obliged to report actively exploited vulnerabilities and severe security incidents.
Here is a quick explainer if you want the details: https://youtu.be/IQkzg7quc58
There is quite a lot of ambiguity over CRA and how it's going to apply to open source. Regulations keep changing. The line between a commercial manufacturer and an OSS steward is blurry, as well as the terms used in the regulations.
But genuinely curious. Is your company aware of CRA? Is there any talk about it, or is it just not on the radar yet?
[link] [留言]
