the EU Cyber Resilience Act is going to land on unpaid maintainers. here is why I am still not fully against it.

this is opinion, not reporting, and I am one of the people the EU Cyber Resilience Act is about, so take it with that bias in mind.

the CRA's intent is good and overdue: products with digital parts sold in the EU should not be insecure by default, should get security updates, and someone should be accountable when they ship a backdoor in a car. after XZ and Log4Shell, "the manufacturer is responsible for the security of what they ship" is not a crazy principle. it is the obvious one.

my worry

the fear the whole open source world had, that the obligations would fall directly on individual unpaid maintainers like me, was partly addressed in the final text: there are carve outs for individuals and non commercial open source, and the heavy obligations are meant to sit on the manufacturers who commercialise software, not on the person who wrote a library in their spare time. good. that was the right fix and the open source foundations who fought for it deserve credit.

but I am not relieved, because the cost does not disappear, it flows. a company that ships skerry in a product now has compliance obligations. to meet them they will come to me, the upstream, demanding SBOMs, security attestations, guaranteed response times, documentation, all the things their compliance needs, and they will still not pay me, because the regulation made it my problem by making it their problem. I wrote a whole rant about the "free SLA" email. the CRA risks making that email mandatory.

what would actually help

• if a manufacturer's compliance depends on an upstream project, require, or at least strongly nudge, that they fund it. make "we depend on this and pay nothing" a liability, not a strategy.
• "open source steward" as a lighter category in the text is a decent idea, foundations that coordinate can carry obligations that a solo dev cannot. fund the stewards.
• regulators should assume the maintainer is one tired person, because statistically they are, and design the paperwork for that reality, not for a company with a compliance department.

so: not against it. the principle is right and the individual carve outs matter. but a regulation that makes my code everyone's legal problem, without making my evenings anyone's financial responsibility, will push more maintainers out, not fewer. the law can mandate security. it cannot mandate that I keep volunteering. only funding does that.