Europe’s cyber security strategy must be clear about open source | Computer Weekly
Summary
Compared to the US, the UK and Europe have been playing catch-up on national security strategy for resiliency of open source software supply chains against malicious actors. Commercial consumers of open source should be required to have the ability to do a targeted recall of known bad bits, just as we expect physical goods manufacturers such as the auto industry to do. • Open source security initiatives might prevent large-scale vulnerabilities such as Log4j, but smaller projects pose risks without more maintainer support, industry experts say. If the CRA becomes EU law without clarification, the effect on OSS could bring devastatingly unintended consequences, including the balkanisation of open source that makes collaboration hard or impossible. Introducing policy where none exists will cause significant effort, but if it means avoiding a catastrophe for open source and the European software industry, it’s worth it.
