Then let's get started.
Hello and welcome to the Software Freedom Podcast.
This podcast is presented to you by the Free Software Foundation Europe.
We are a charity that empowers users to take control of technology.
I'm Bonnie Mehring and I'm here with my colleague Alex.
Hi Alex, nice to have you here.
Hi Bonnie, nice to be here again.
Hello, hello.
So Alex, this week we will be talking about the CRA and I give up on the word cry if you notice.
And especially focus on the questionnaire there.
Yes.
So can you give us a recap of what the CRA is?
What are the roles in the CRA?
Very, very quickly.
Just to give everybody a quick overview of what we are talking about.
Yes, sure.
I mean, we already had a podcast episode on the Cyber Resilient Act.
You can find it in the show notes as well.
And there we also explained a bit about the Cyber Resilient Act.
However, in short, the Cyber Resilient Act is product regulation and the aim
is to make products more secure.
And we talk about products with digital elements and this could be basically everything.
It could be IoT device.
It could be a piece of code and everything like operating system or operating system on your mobile.
So whatever has a digital elements could be considered as a product.
There are some exemptions for cars, for example,
since they are regulated in other spaces.
However, ultimately, it's about getting a CE label on those digital products.
So it's also not only a product regulation but also a market entry regulation.
So we only talk about products that are about to enter the market.
Those are going to be pre-checked if there are, and so-called, yeah,
let's say, verb flows in order to make the product more secure.
One can say it's security by design.
And once all of these workflows, applications are fulfilled,
you get the CE label and can place the product on the European market.
So that's what we are talking about.
And yeah, since this obviously is regulating software,
we advocated during the legislative process that there should be exemptions but also in detailed
regulations for free software.
Since you free software ecosystem is looking slightly different than normal software
or not normal software, so it's a proprietary software.
And by thus, we also need dedicated rules.
So just imagine we are having those of projects that are not really placed on a market.
They might be on GitHub.
They might be on some websites.
You can just download the code, install it, run it.
You'll have all the freedoms of free software to use, study, share, and improve.
Right? And so this is ultimately not really a product.
Maybe you have sometimes charities around those projects.
But sometimes these projects then ultimately also end up in a product.
And that's why the legislative came up with the idea to also not only regulate the workflows
differently, but also to come up with new roads.
So they introduced the Stuart role and the manufacturer role.
The manufacturer is pretty obviously that's basically the manufacturer that brings a product
on the market. And the Stuart is then basically what could be a project that is then ultimately
ending up in such a product by not being a product by its own.
So and this also brings a couple of questions with it.
For example, what is placing on the market?
To which extent can you still have money in your project,
while you are still not being a manufacturer?
So again, let's imagine you are a charity or you are getting a few donations for your
project. You have let's buy me a coffee button, whatever.
So you don't really make a surplus with your project.
But you just like keep it running or like have it as a hobby as a project,
whatever the structure might be. And here those questions arise and then also some questions arise
on like how the Stuart and the manufacturers shot in the activities each other.
So let's imagine there's a security issue. A patch needs to be placed.
So and how is this patch then finding its way into supply chain?
Is it the Stuart and it's come up with the patch? Is it the manufacturer?
The rules are clear. All applications are with the manufacturer.
However, in order to make sure that the patch is then automatically ending in the project,
you need to have somewhat a relationship with the project or so called Stuart then in this case.
And this is basically what we tried to address with a survey. We came up with a question there.
We is the German Bundesamt für Sicherheit in the Information Station.
So the Asian Federal Agency for IT Security in Germany,
we partnered on a project in order to bring more clarity towards those questions.
And also to identify more questions, basically. So we were also trying to ask so the Stuart
in particular, but also let's take a market on how they read and understand the CIA
or where they have issues to not understand it. So where we need a bit more of like clarity.
And this could be basically ending up in so called guidance.
So this will be a document where the CIA is a bit more explained in detail.
So what is placing on the market, right? So and how all these workflows need to look like,
ultimately there's also standardization for these processes. They might be at the station.
So on and so forth. And this is what we ask, basically, our community,
what we ask other communities out there that tinker around with software and might be a
affected by the cyber resilience act. And yeah, now we want to talk a bit about this questionnaire.
In the last edition, we already talked a bit about the questionnaire itself and first result.
And now we have some final results. And this is what we want to chat about today.
Perfect. Thank you very much. I heard that you got like an amazing number of answers for the
questionnaire. This is true. I mean, the questionnaire was basically available out there for two
months July, August, mid July. We had the, or no, it was end of July, beginning of August.
We also had the podcast episode on this where we also promoted the questionnaire. Again,
we also had to talk at the German free software conference, the Frostconn, where we also presented
the questionnaire and asked people to take part. Ultimately, we got 345 answers, which is
really impressive. Since we also only asked for feedback from people that are more or less
familiar with the cyber resilience act. So we didn't ask fully into the blue. We only asked people
or, but we were addressing people and asking in particular for feedback from people that are
familiar with the cyber resilience act that know about the legal rules, because this would then
help us to identify basically the gaps where we need more clarity. So it doesn't make too much sense
to ask, sort of, a random people on what do you know about the CIA and then they tell you
nothing. So this is not really helpful. And for this, it was really impressive to get this
amount of questions, although we had, and this is in particular important for this questionnaire,
a lot of free fields. So where people could, yeah, basically try to explain in their own words
what they are fearing, what they are seeing, what they are missing. And this in particular, I helped
for us to better understand the ecosystem, to better understand fears and needs. And we had some
gut feelings beforehand. Most of them have been also addressed by any response in the questionnaire,
but they have been also some answers that we let's say didn't expect it to have it at least in
that clarity. So this questionnaire definitely helped to get a better understanding of the knowledge
around the cyber resilience act, but also around like ideas on how the market might react on
cyber resilience act, as well as ultimately, yeah, the still open questions that many of the
participants of this survey still have. And that we are, yeah, it's obviously that they need to be
addressed. And this will mostly happen in guidance. And this is also something which we are going
to look on in the next weeks and months. And based on this survey.
Okay, before we dive into the questions and the answers we got there, just very quickly,
very surprised by the amount of answers we got that were obviously there's some needs to be
some knowledge about the CRA and there's some expert knowledge then there as well. Very surprised
by the quality and the quantity or what, how, what was your feeling there? Yeah, both both,
so it's like, as we asked for quality, basically, I didn't expect it to get that many high quality
answers. And that's basically what we can see as at 345 answers, we had ultimately six questionnaires
in German, as well as in English, basically three questionnaires then that have been translated,
one for the manufacturers, one for the stewards, and one for the project to get a better understanding,
first of all, where market participants see themselves. So if they are more or less like,
yeah, understanding in which role they will end up with and or which role they might think of
that they might end up with. And then as said, in particular, the three fields helped a lot
for us to better understand the arguments, but also the reasoning of thinking of people
why they do believe that they have a certain role or why do they believe they don't have
Okay, then let's dive into this or I will take a first project. What was your key findings
for the projects and what was so amazing there and what really stuck out to you?
I mean, for the project and this is pretty much I think we can combine it with the stewards
already together is that most of them still don't fully understand if they are in scope or not
and if they are in scope which role precisely they will have and then what they have to do
as in Italy. So we can see that many many answers we're going into the direction that like if
we are covered somehow by the cyber resilience act. So if we for example, in this steward role,
then projects want to be the stewards for their own project. So that's something which is very
important to learn. So they do not want to have external stakeholders players around that do
fulfill the steward roles for them. So if they are covered by the CIA in which role and in which
doesn't matter too much then they all said more or less that they want to be the stewards for their
own project. However, they all still struggle in order to better understand to which extent they
are covered and also what the applications they have to fulfill. So this means many do not fully
see the threshold of like how much money could be in a project in order to not be a manufacturer
or in order to be for example fully out of the cyber resilience act. And this is also something
we addressed in our sort of statements towards the commission but also to market surveillance
authorities that we need more clarity here. The idea could be for example and this is also
something which we have seen in the tax and European Parliament during the legislative process.
So that amount of money that keeps the service running yeah that should be basically the
threshold in order to say look you are not doing this for a commercial interest so to say you are
just doing this you have to keep the service running and as soon as you or as long as you are
not paying basically doing this to earn money with this but just to keep the service running
then you should be out or you can decide on to be in the Stuart world. The question is like for
example what do we do with charities. One solution could be you say like whatever the charity
earns this this project it doesn't matter they can just like move the money then into other
charitable work what they are doing since like for example we have to
yeah charity status in Germany which doesn't allow you basically to earn money right so you have
to basically invest it then in other courses you might have but then the question is again so
is this fair or can we can we be a bit more precise here also what do we do with other countries
that don't have such charity laws what do we do with countries that are not even European right so
how do we evaluate this and for this I think it would be very good to have some very clear rules
for example I'd say it's more or less clear to say like as much money as you need in order to keep
the service running is fine but as soon as you are starting yeah to commercialize it in a way
right so that you have surplus then it's clearly not a Stuart project anymore but you might
be a manufacturer however what we see from the responses is that there needs to be clarity
so people are fearing that it's basically zero euros that you that you can have in your
in your pocket then when you have a project and this will definitely not be the case however
the question is how much money can you have in your case so right and here we clearly see that
we need answers and I do believe the commission is already aware of this however we will also then
provide the commission with our feedback on this so that we need here definitely more clarity in
order like how does the money game works out so that you can have for example support contracts
in order to help manufacturers to be CIA compliant without the fear of becoming a manufacturer
by yourself also I do believe that many still do not fully understand the idea of a product
regulation so ultimately that the idea is to regulate F product that means you have F rich
which is then getting FCE label the same manufacturer can come up with another fridge which is
another product so this means if you have a project and yeah your your your code base is part
of a product you're only the Stuart for this one product so you're not a Stuart for your project
nor for a manufacturer at its whole right so you're only the Stuart for one product that means
you can be I don't know 20 times the Stuart for 20 projects towards one manufacturer
but you are never basically the Stuart for your project so to say right so you're always the Stuart
for a product so let's assume you have a code that ends up in a fridge and then you are the
Stuart for this code in this fridge right and this is also something I do believe we have
no clarity I hope that these kinds of podcasts we are doing here is helping in this direction but
also I said we were giving talks on this so this is also what we are trying to explain why so it's
a product regulation and every product every single product and it's going to be regulated so
and it's not about your project but ultimately always the singing of a product regulation so that's
also something and what we have seen in the answers and where we need maybe that's more of a
communication thingy but where we need more clarity but also guidance again could help here and
ultimately what we have also seen and this is also true for the manufacturers as that they basically
are asking for tools so we see that project Stuart's and manufacturers alike I want to have
easy check boxes so to say and best in an automated process and for this they want tools right so
and this is also something I think which is a key of feedback for the the whole implementation
process that we also should think about that we are talking towards a technical community
right so and they want all the tech solutions to fix the problem and to come up with workflows
right so and this is also something which we should keep in mind so that we don't come up with
paperwork too much but that we also think of tools this is a short break for our own cause thank
you for listening to the software freedom podcast working for software freedom and producing
podcasts costs money please consider supporting us with a donation on the fsfe.org slash donate
and then the show notes okay I've had this very fascinating especially since there's this
dismissing clarity but you also mentioned there's a fear of becoming manufacturers I think this
is also related a bit to the clarity part right because there is uncertainty about what does
all would mean exactly so people fear a lot so that as soon as there is somehow money involved
then they they end up as a manufacturer so assuming you have a project and then the
manufacturer drops by telling you all you have to fulfill these and these and these applications
the project is saying nah no we don't want we don't have the resources to do so then the
manufacturer say oh I understand I'm going to support you and for this I'm going to pay you money
and then projects are fearing that as soon as they take this money they will end up in the
manufacturer vote this is in particular not true however it's also addressing another problem
that we see and that's the the lack of resources right so and that's also an answer we often got
is that yeah project stewards fear that they will have more applications or even if it's not
applications there's more work to do since they have to interact with the manufacturer right they
need to prepare or provide resources basically a possibility for contact and maybe some more
and for this they need resources and the question is there do these resources are going to be
pulled from and the most obvious answer to this is the manufacturer should pay but the question is
then if this is always working out in that way what we do hope for and what do we do if it's not
going to work out and this is then basically a question so since again we also see that many
projects are willing to contribute to IT security they are willing to help in the cyber resilience
act but at the same time they are lacking resources we we know the funding issue of free software is
it's a huge topic we also address this in another podcast episode but we also see it again here
in the cyber resilience act all of these problems that we have on the one hand I'm strong manufacturers
that maybe sometimes just pick the code don't contribute back in any way and on the other hand we
have burned out maintainers in projects that yeah working like hell and don't get any resources
focused and this is also something which we have seen a widely addressed in new responses to our
questionnaire that there is a lack of resources a lack of funding and this is also something which
we definitely need to address in order to make sure that not only free software projects survive
but that they also get a reasonable funding and reasonable resources and here again this is
something which nobody of you should fear if you are a project and again you get the resources in
order to keep the service running this is definitely not the threshold of becoming a manufacturer
however there will be more clarity on where the thresholds are but this is I'd say more or less
for sure that this will definitely be a threshold so as soon as you get as much money in order to
fulfill this road right which is given to you by the by the legislator and in order to keep your
service running then you definitely won't end up in the manufacturer role however as said we need
clarity here in order to say look it's bitten here you can be sure yeah and you have already
mentioned that the manufacturers are also somehow involved in this whole CR-8 debate and we had
actually see we had a questionnaire for them as well I'm doing a very very slow circle here two
arts of manufacturers if you notice so are they what are the key findings there are they still
considering to keep using free software or are they now more in fear of using free software and do
they want to switch to some proprietary software but proprietary software will also be regulated by
the CR-8 so what is their key findings yeah so maybe before we start with this since you address
the role right so I think this is also very important to know for everyone all the applications
in the cyber resilience and are with the manufacturer so and that's very important to learn and
very important to know so also as a student if you should fail they're not even fines for you
right so marked surveillance authority then will drop by and might guide you and help you out of
this but they can't find you on the other hand manufacturers have all the applications so they
must not need to make sure that their code is fine that it fulfills all the applications in the
cyber resilience act and they could also be fine if it's going into a wrong direction and this
is important to learn so since this means the manufacturer needs to have a relationship to
the Stuart in order to say I am sure that I can fulfill the applications in the cyber resilience
act meaning that for example you have the security incident and then you are able to bring the
patch to the project right so and you it's it's basically impossible to do this if you don't
have a relationship with the project or if you can't assure right so that the patch is handled
and that it is then ultimately ending up in your product so and if you can't guarantee this
then you might be fined by market's reigness authority and this then also means for manufacturers
as you said there are a couple of ways in order to handle this situation so first and this would be
I guess pretty much the best case and this is also what we are looking for the manufacturer is
identifying the Stuart is providing the Stuart with resources in order to help the Stuart that
the Stuart can help the manufacturer to fulfill the applications and then also there are workflows
established that there is basically that the applications can be fulfilled there are a couple
of them like notification patches handling blah blah blah let's don't go into the details but however
it's all this the manufacturer so then assuming the manufacturer is not
willing or capable to set up a relationship with Stuart so let's say you as a project you'll feel
you don't want to work together with this specific company on this specific product for I don't
know ethical reasons for example then what has the manufacturer for options right so and then he can
say look I'm going to fork the project because then yeah you have basically the possibility to
to to work on the code and fulfill the applications so you can basically also explain towards the
market's reigness authority right so this is this I have power over the code so to say or and this
is also what you already mentioned as an example you can scout for a proprietary alternative which
already is a product in itself and has a CE label already and by thus you can yeah shift
basically the applications towards the other supplier and you have a business to business relationship
and ultimately so these are the options you will have as a manufacturer or you let the product
by so that's all you just like remove this bit of the code and don't have this functionality for
so these are the options as a as a manufacturer right so you have a good relationship to the
Stuart best one I'd say you fork it second best one worst one is proprietary replacement or yeah
you don't have the product only you pin bark at it anymore so and then and this is in particular
interesting since we see this in the answers so most of the manufacturers do want to have a
relationship with the Stuart and that's also I think a reasonable approach since imagine you
are flocking at the project so this means you need to have the knowledge about the code you need
to have the knowledge about the project and it's basically experienced people from this community
in the best case that can work on this code right so I think it's not that easy to just say like
so I'm just going to take I don't know Debian and now I fork it and then all is good right so I mean
you also need to handle it and patches right so you need to improve the code you want innovation
yari yari so it's it's not so easy to just simply fork it and then continue and take it from there
so for this it's it's a pretty good idea to to to be connected to the project and basically work
together with them so and this is also what most manufacturers are willing to do nearly none of them
thinking about replacing this this proprietary alternatives so basically there are two ways for them
the first one is and that's what they what they are trying to do is to go to the Stuart or to
the project and by thus the potential Stuart trying to set up a relationship and also they are
willing and to provide resources this is also interesting if you think about the fund debate but
however and this is also learning if I can just site record here we also learned that projects that
already do have a good relationship with manufacturers and do get resources it's still not
sufficient so we should also be aware that if manufacturers say they are willing to support a
project that doesn't mean that it's then fully financed it's just that they are willing to give
something we don't know how much and we also don't know if the project will survive from
curing market activities we see that it's rather not okay however manufacturers are up to do
they are willing to work together with the Stuart that would be their first choice second choice
is to fork the project and that's also I think very important to learn so we see on the one hand
projects that want to be the Stuart for their own project and on the other side we see manufacturers
that do not want to have a fork or that do not want to replace it but keep the project and also
collaborate with the potential Stuart so we see that basically the two important entities
roles in the cyber resilience act do want to collaborate so and now the question is how do we kick
off this collaboration how do we make sure it doesn't harm the ecosystem and how do we make sure
that those who benefit on the market also pay those who contribute so those are some of the outcomes
and you already gave some yeah fewer hat of what is a hat what is lying ahead of us
is there anything else you would outline now for the last question as the time is already running
so fast again Alex yeah so what is important so I mean first of all what we are going to do is
to take the results and put it in a report and present it towards the commission and try to make
sure that all of these questions are going to be addressed in guidance or in the delegated
implementing acts standardization attestation so in all of the implementing activities without
going too much into details there are a couple of them so that all of these questions are going to
be addressed also we have seen in the questionnaire that there are some other questions that we might
need to work on spawn supply chain license issues so also in particular attestation might be a very
interesting part to work on this is also something which I do believe is something we will pick up
very soon and so there are there are some more questions next to the ones we just addressed here
that need to be clarified maybe we come up with another survey something like this let's see how
we and yeah how we how we channel through this however we will make sure in the implementation to
again safeguard in particular project maintainers and I think individual developers that are
something which we achieve but that we bring also clarity towards the projects and that everyone
knows clearly what is going to happen and yeah if it's a good idea to become a steward or not and if so
what do you need to do and what does mean for you and so on and so forth also we try to reflect
the different players in the ecosystem why it's not like that there is a one fits all solutions so
we will try to work with examples and guidance and to to yeah make this easily understandable
yeah for you out there to channel through this so this will be our activity however it's
even if discretion is closed we are still searching for input so if you feel that your project or
even if you are I don't know a micro enterprise a small medium enterprise man medium enterprise
depending on what you do but also here we do not want to harm micro enterprises right so all these
one women armies that are out there sitting on their tiny project which then ends up in I don't
know hundreds of products why this is also something we do care of if you see any problems there if
you have any questions feel free to reach out to us even as the question is closed if you have feedback
on this or if you have a specific problem which might be a gray area try to address this
because now it's still the time to make those fixes and the more we see the more we can
bring in the process in order to make sure we can safeguard as a specific project in specific gray
areas this is also something which we learned during the questionnaires or I think we have seen
already a lot but yeah during during the time we also had several meetings with project with
foundations so on and so forth where there have been also some new niches that were unexplored for us
so we can't see everything these come to us tell us about your specific issue might you might
have and we will try to clarify and address this so this is also very much helping and yeah so
this is also always a good idea so if you have anything that is like needs to be addressed
tell us about it because then we still have the chance to address this towards markets railings
authorities and the European Commission and make sure in the implementation process to bring in
more clarity and this is also basically what we are now trying to do with this questionnaire
right so like making this a bit more elaborated for the implementation process so that it can be
addressed in the related documents all right thank you so much Alex so you will pull up there
yes yes and we do and by that we will do so I guess that won't be the final episode of the
server resilience aid but rather yeah as you can see more less serious so maybe we will talk about
the server resilience act yeah and soon is again and yeah we will definitely keep you updated
about the progress hopefully with good news then yes I do hope so as well but I am already very
impressed by the numbers of answers we got and the quality as you have mentioned so yeah I find
this is really fascinating and really really nice that there are so many people who care about
free software and who want to keep free software safe guarded yeah and with this I'm saying goodbye
thank you so much Alex for being here thank you so much for talking with us about the CRA
yeah always a pleasure and yeah also for me thank you for everyone who not only listens but also
then to part in the survey or share this survey so it's obvious that you helped you listeners and so
thanks for this and yeah also thanks for listening and to all of our episodes yes thank you very
much all right this was the software freedom podcast if you liked this episode please
recommend it to your friends and rated it stay tuned for more inspiring conversations that
explore the importance of software freedom and its impact on our digital lives this podcast is
presented to you by the Free Software Foundation Europe and VR charity so we need your help please
consider supporting us with our donation if you like our work you can do so under fsfe.org slash
donate and if this is financially not possible for you you can share the podcast on social media
rate it or contribute to our work as a volunteer thank you so much bye bye.
yeah I'm Albert I've been volunteering for the Free Software Foundation Europe for like 13 years
now something like that I do that because I think it's it's important to have also the political
point because I mean yes lots of people in my environment see the technical advantages of having
free licenses and being able to reuse stuff but somebody also has to think about the the the political
implications of that and I do try to help out with Free Software Foundation Europe to actually be able
to do anything in that area