the EU Cyber Resilience Act is going to land on unpaid maintainers. here is why I am still not fully against it.
this is opinion, not reporting, and I am one of the people the EU Cyber Resilience Act is about, so take it with that bias in mind. the CRA's intent is good and overdue: products with digital parts sold in the EU should not be insecure by default, should get security updates, and someone should be accountable when they ship a backdoor in a car. after XZ and Log4Shell, "the manufacturer is responsible for the…