The New Stack Podcast How the EU’s Cyber Act Burdens Lone Open Source Developers
20 snips
Sep 11, 2025 Christopher "Crob" Robinson, Head of the Open Source Security Foundation, brings critical insights on the EU's Cyber Resilience Act. He underscores how compliance burdens threaten lone developers who often manage popular open source projects with limited resources. The discussion reveals alarming statistics, such as 97% of commercial software utilizing open source, while compliance could impose penalties in the billions. Robinson emphasizes the urgent need for funding models and collaboration to support these developers in navigating new regulatory landscapes.
AI Snips
Chapters
Transcript
Episode notes
Open Source Permeates Commercial Software
- Open source projects often start as personal solutions and unintentionally become critical parts of commercial products.
- Christopher Robinson notes up to 97% of commercial software includes open source components, creating broad exposure.
Downstream Bears Regulatory Burden
- Downstream manufacturers must meet CRA reporting and security obligations even when they include upstream open source code.
- Robinson highlights that upstream maintainers typically lack visibility into how their code is used and aren't required to comply.
Curl Maintainer Faced Legal Demands
- Daniel (curl) received aggressive requests from commercial lawyers and agencies demanding SBOMs and conformity assessments.
- Robinson recounts Daniel's keynote to show how maintainers face relentless downstream pressure they never expected.