Apache News

As context, the ASF summarized current legislative efforts in

https://news.apache.org/foundation/entry/save-open-source-the-impending-tragedy-of-the-cyber-resilience-act

- EU Cyber-Resilience Act (CRA)

- EU product liability

- US executive orders, legislation...

The CRA committee's March draft showing changes is

https://www.europarl.europa.eu/doceo/document/ITRE-PR-745538_EN.pdf

Most concerning would be language enabling authorities to inspect secure enclaves, which I believe China and Russia will likely adopt. I couldn't find that.

Some other notable provisions:

The new draft says "only free and open-source software supplied in the course of a commercial activity should be covered by this Regulation" and puts the onus entirely on the manufacturer adopting it (i.e., off the developer or the sponsoring agency like ASF or eclipse.org): [10] "...manufacturers that incorporate such software in their products with digital elements should take all the necessary steps..."

[12a] It excludes national security and military electronics.

[14b] It excludes "leasing companies" from being considered as distributors.

[18a] It requires governments to prioritize vendors in compliance and to drive vendors to fix holes urgently.

[32a] Security updates must be automatic, but users can disable them. Once unsupported, users must be notified, and [32b] the source code should be given to companies seeking to offer ongoing support.

[34] Mandatory notification of vulnerabilities does…

A bit off-topic, but: I am somewhat confused by the claim “Subversion was created by Jim Blandy”. I was around back then, and the names I think of when it comes to “who created Subversion” are Ken Fogel, Ben Collins-Sussman, and Mike Pilato. And certainly many other people, including Jim Blandy. My recollection seems to be supported by e.g. https://news.apache.org/foundation/entry/the-apache-software-foundation-announces58 and also by looking at the early subversion repository history and mailing list posts.

But I was only a bystander (and early adopter), so maybe something went on "behind the scenes" that warrants this attribution? Or maybe it is a just a bit careless and was meant to be more like "... he was one of the creators", which one probably could justify.

Coincidentally, I just checked the Wikipedia page for Subversion and was surprised that there is basically nothing on the history of Subversion and who created it, which I find sad.

This post by the The Apache Software Foundation is fairly complete:

> And what makes matters worse is that the type of open source organizations most affected are also exactly those that, today, tend to have very mature security processes, with vulnerabilities getting triaged, fixed, and disclosed responsibly with CVEs to match. While it generally is further downstream; with the companies that place the product on the market — that the CRA needs to drive significant improvement. It now risks doing the reverse.

But all organizations (ECLIPSE, LINUX, ...) raised alarms

https://news.apache.org/foundation/entry/save-open-source-the-impending-tragedy-of-the-cyber-resilience-act

Edit: https://nitter.kavin.rocks/search?f=tweets&q=cyber+Resilience+act&since=&until=&near=