Meta tags:

Headings (most frequently used words):

the, of, and, for, 2026, you, from, software, is, but, on, your, now, do, to, implementation, bsd, it, friday, yes, later, here, manufacturers, as, an, other, hand, if, why, typing, then, important, build, what, engineers, has, bill, materials, sbom, we, tools, in, future, up, at, 25, posts, internet, rfc1149, that, grumpy, guy, thursday, october, wednesday, july, 22, give, couple, weeks, june, 19, than, think, european, union, sets, standard, stewards, developers, duties, open, source, developer, or, steward, are, manufacturer, historically, just, bit, suddenly, turned, instead, 10, 000, chimps, dependencies, became, thing, upping, engineering, game, learn, those, who, things, libre, package, management, already, introducing, re, real, sparky, have, new, artifact, tool, insight, transparency, suits, gui, dependency, tracking, state, play, projects, bright, engineer, resources, further, study, development, may, 15, old, setup, maintained, with, much, love, care, time, move, wait, finally, course, false, start, task, analysis, actual, saturday, april, about, me, buy, book, pf, upcoming, talks, blog, archive, total, pageviews, popular, links, nice, sites, subscribe, unique, piece, history, packet, auction, christie, how, artificial, intelligence, slowly, drowning, its, own, droppings, can, eu, cyber, resilience, act, done, opensmtpd, mail, server, carrier, pigeon, protocol, years,

Text of the page (most frequently used words):
the (885), and (380), that (229), for (227), with (133), you (107), are (99), was (92), software (83), not (65), but (65), from (62), this (60), #source (59), have (56), some (53), other (52), your (50), more (50), all (47), openbsd (47), any (47), code (47), open (46), will (45), one (44), also (43), mail (43), 2026 (40), cra (40), time (40), would (37), what (36), hansteen (36), which (36), peter (35), internet (34), here (33), their (33), had (33), were (33), has (32), tools (32), only (32), free (30), first (30), april (30), sbom (30), available (29), can (26), there (26), who (26), products (26), system (25), even (25), project (25), pigeon (24), where (24), such (24), been (23), likely (23), its (23), they (23), now (22), resilience (22), carrier (22), opensmtpd (22), after (21), may (21), out (21), rfc1149 (21), than (21), several (21), package (21), materials (21), most (20), linux (20), set (20), part (20), into (20), exim (20), developers (20), about (19), july (19), cyber (19), act (19), well (19), via (19), things (19), product (19), bill (19), work (18), security (18), years (18), those (18), could (17), does (17), people (17), while (17), when (17), information (17), under (17), book (16), full (16), share (16), still (16), dependencies (16), smtpd (16), european (16), filter (15), october (15), before (15), pigeons (15), group (15), new (15), both (15), how (15), quite (15), domains (15), union (15), digital (15), two (14), around (14), use (14), december (14), bsdly (14), implementation (14), development (14), reading (14), bsd (14), find (14), article (14), needed (14), site (14), norwegian (14), then (14), need (14), parts (14), enough (14), large (14), server (14), doas (14), important (14), network (13), packet (13), bergen (13), management (13), freebsd (13), see (13), list (13), own (13), way (13), bit (13), few (13), considered (13), thing (13), name (13), come (13), tool (13), build (13), elements (13), running (12), make (12), good (12), actually (12), know (12), why (12), think (12), web (12), net (12), later (12), least (12), force (12), packets (12), setup (12), base (12), useful (12), rspamd (12), required (12), legislation (12), february (11), day (11), wrote (11), com (11), rfc (11), these (11), made (11), world (11), projects (11), vegard (11), engineering (11), start (11), like (11), take (11), used (11), data (11), spamd (11), rcctl (11), etc (11), conf (11), local (11), engineers (11), quality (11), incidents (11), email (10), too (10), august (10), piece (10), short (10), operating (10), systems (10), went (10), our (10), end (10), kind (10), without (10), hand (10), test (10), various (10), place (10), run (10), during (10), each (10), specification (10), material (10), intended (10), known (10), action (10), users (10), sboms (10), legal (10), foundation (10), based (10), comments (9), ever (9), did (9), november (9), done (9), interested (9), recent (9), early (9), standards (9), next (9), finally (9), actual (9), something (9), just (9), fairly (9), clamav (9), including (9), should (9), relevant (9), packages (8), much (8), off (8), again (8), read (8), june (8), january (8), history (8), classic (8), published (8), resources (8), version (8), note (8), language (8), couple (8), setting (8), networks (8), fact (8), course (8), requirements (8), user (8), level (8), them (8), 2001 (8), over (8), rfcs (8), possible (8), obvious (8), generate (8), best (8), spamassassin (8), configuration (8), specific (8), key (8), yourself (8), move (8), dependency (8), manufacturers (8), components (8), bom (8), intheweights (8), written (7), almost (7), started (7), laptop (7), want (7), march (7), blug (7), labels (7), posted (7), 2005 (7), grumpy (7), guy (7), soon (7), mainly (7), activities (7), found (7), somewhat (7), number (7), paper (7), table (7), three (7), real (7), easy (7), days (7), able (7), among (7), activity (7), already (7), look (7), long (7), taken (7), others (7), another (7), very (7), component (7), filtering (7), disable (7), industry (7), engineer (7), supply (7), compliance (7), proprietary (7), developer (7), let (7), bugs (7), strength (7), manufacturer (7), posts (6), service (6), standard (6), port (6), once (6), edition (6), auction (6), september (6), unique (6), protocol (6), pieces (6), conference (6), looking (6), old (6), notes (6), year (6), future (6), get (6), relay (6), far (6), alan (6), say (6), efforts (6), being (6), within (6), last (6), making (6), top (6), took (6), session (6), traffic (6), scanners (6), remember (6), lists (6), planning (6), idea (6), probably (6), came (6), order (6), document (6), implemented (6), practical (6), dated (6), states (6), sure (6), either (6), greytrapping (6), maintenance (6), enable (6), services (6), longer (6), pki (6), match (6), stop (6), delivery (6), keep (6), support (6), organizations (6), transparency (6), themselves (6), becomes (6), organization (6), specifications (6), whether (6), right (6), hallucinations (6), models (6), says (6), assessment (6), physicist (6), awesome (5), links (5), got (5), yes (5), modern (5), popular (5), 2020 (5), directly (5), complete (5), home (5), pinterest (5), facebook (5), blogthis (5), trackers (5), formatting (5), might (5), selected (5), thought (5), same (5), task (5), ran (5), item (5), file (5), initial (5), rather (5), turned (5), check (5), lead (5), point (5), reasonable (5), testing (5), ping (5), page (5), smtp (5), roughly (5), decided (5), talk (5), together (5), because (5), since (5), formal (5), clear (5), training (5), 1st (5), include (5), secure (5), answer (5), question (5), cases (5), particular (5), purpose (5), process (5), greylisting (5), earlier (5), default (5), simple (5), similar (5), features (5), lines (5), skapet (5), listen (5), outbound (5), back (5), combination (5), trust (5), public (5), results (5), happened (5), episodes (5), second (5), behind (5), fully (5), tracking (5), role (5), overview (5), cyclonedx (5), worth (5), chain (5), proper (5), post (5), along (5), however (5), sets (5), assurance (5), market (5), insight (5), generating (5), possibly (5), output (5), present (5), built (5), became (5), context (5), supplier (5), regulation (5), seems (5), author (5), solar (5), highest (5), website (5), experiment (5), nice (4), don (4), handle (4), high (4), works (4), guide (4), going (4), help (4), learned (4), state (4), tech (4), 2021 (4), norway (4), https (4), tcp (4), networking (4), ietf (4), track (4), slides (4), form (4), oriented (4), story (4), million (4), arrived (4), different (4), scanner (4), main (4), yet (4), printer (4), engen (4), computers (4), times (4), generated (4), appropriate (4), sufficient (4), worked (4), small (4), makes (4), kernel (4), date (4), included (4), late (4), close (4), simply (4), across (4), ended (4), writing (4), myself (4), 1149 (4), major (4), turn (4), mentioned (4), typing (4), search (4), pretty (4), having (4), value (4), mind (4), necessary (4), upon (4), itself (4), lot (4), stuff (4), ready (4), reason (4), seen (4), references (4), practices (4), maintained (4), related (4), lightly (4), kept (4), transition (4), else (4), domain (4), secondary (4), aliases (4), dkimsign (4), tls (4), addition (4), exchanger (4), involved (4), facing (4), third (4), stage (4), provide (4), leave (4), netbsd (4), cybersecurity (4), means (4), individual (4), items (4), island (4), environments (4), owasp (4), curated (4), spdx (4), reference (4), text (4), study (4), expected (4), cdxgen (4), changes (4), largely (4), improving (4), dependencytrack (4), common (4), stewards (4), stakeholders (4), unless (4), hardware (4), trade (4), secret (4), put (4), collection (4), significant (4), commercial (4), reporting (4), libraries (4), deliveries (4), write (4), case (4), incident (4), field (4), whatever (4), profit (4), associated (4), territories (4), droppings (4), artificial (4), living (4), relative (4), geologist (4), grok (4), firewall (4), usd (4), waitzman (4), atom (3), sites (3), problem (3), exchange (3), non (3), password (3), indeed (3), vulnerability (3), currently (3), media (3), focus (3), apparently (3), lessons (3), copy (3), suitable (3), steps (3), bad (3), access (3), total (3), brussels (3), belgium (3), eurobsdcon (3), tutorial (3), night (3), through (3), view (3), programming (3), libre (3), implementations (3), original (3), participate (3), interoperability (3), ten (3), mark (3), carriers (3), events (3), presentation (3), commemorative (3), referenced (3), event (3), aware (3), updated (3), hits (3), stayed (3), left (3), little (3), equipment (3), office (3), plan (3), clean (3), four (3), minutes (3), fourth (3), sent (3), getting (3), tape (3), relaying (3), hour (3), working (3), options (3), man (3), pinged (3), club (3), scheduled (3), given (3), tested (3), printed (3), scanned (3), machine (3), return (3), serious (3), message (3), example (3), printers (3), supported (3), pigeonware (3), technical (3), feature (3), relatively (3), visit (3), thursday (3), meeting (3), become (3), løvstakken (3), meters (3), perhaps (3), down (3), evening (3), meetings (3), seemed (3), surprised (3), usually (3), every (3), datagram (3), 1990 (3), scale (3), usable (3), documents (3), existence (3), gave (3), includes (3), mostly (3), variety (3), bsds (3), dns (3), learn (3), result (3), environment (3), extremely (3), forward (3), safe (3), remove (3), messages (3), log (3), installing (3), readable (3), config (3), entire (3), final (3), minor (3), domains_local (3), relay_for_domains (3), nuug (3), domain_relays (3), relay_from_ips (3), local_mail (3), requires (3), existing (3), formats (3), regime (3), maintaining (3), using (3), inbound (3), sync (3), release (3), ship (3), maintainers (3), content (3), protected (3), play (3), doing (3), developed (3), extent (3), plays (3), enterprise (3), consider (3), documentation (3), signatures (3), further (3), realized (3), international (3), install (3), reach (3), operation (3), syft (3), languages (3), familiar (3), workflow (3), outside (3), readiness (3), emerging (3), starting (3), explore (3), processes (3), interacts (3), command (3), pages (3), suites (3), exist (3), game (3), measure (3), licenses (3), placed (3), bolts (3), interesting (3), manager (3), hms (3), term (3), isolation (3), binary (3), subset (3), suddenly (3), compromise (3), poorly (3), understood (3), designed (3), 000 (3), financial (3), responsibility (3), shortly (3), hope (3), categories (3), qualifying (3), person (3), defined (3), 2027 (3), intelligence (3), confidence (3), academic (3), hallucination (3), entry (3), christie (3), bid (3), david (3), his (3), subscribe (2), isn (2), protection (2), installed (2), life (2), openssh (2), inspection (2), bug (2), wanted (2), really (2), evil (2), knocking (2), easily (2), hail (2), mary (2), cloud (2), succeeded (2), signed (2), yours (2), servers (2), implement (2), nanny (2), civil (2), websites (2), 2009 (2), 2011 (2), 2012 (2), 2014 (2), 2022 (2), 2024 (2), 2025 (2), blog (2), alice (2), sowerby (2), pierre (2), pronchery (2), talks (2), press (2), 4th (2), daemon (2), please (2), www (2), html (2), hacking (2), hacks (2), independent (2), welcome (2), willing (2), tests (2), unable (2), pace (2), auug (2), route (2), adelaide (2), though (2), preferably (2), noted (2), mention (2), pictures (2), received (2), plaque (2), behalf (2), attention (2), favorite (2), odd (2), section (2), description (2), hack (2), afternoon (2), per (2), weeks (2), writeup (2), nothing (2), host (2), headed (2), ourselves (2), scanning (2), hear (2), kjell (2), bird (2), strip (2), character (2), recognition (2), sheet (2), phone (2), calls (2), followed (2), rough (2), house (2), feather (2), lyngbøveien (2), matter (2), satellite (2), saved (2), noon (2), racing (2), filling (2), station (2), meet (2), giving (2), homes (2), explain (2), heard (2), pre (2), except (2), destination (2), moments (2), discussion (2), delivered (2), anything (2), mine (2), exact (2), moment (2), debian (2), tun (2), tap (2), interface (2), luck (2), create (2), flying (2), located (2), kilometers (2), above (2), sea (2), outgoing (2), basically (2), members (2), implementing (2), beers (2), harp (2), cox (2), somebody (2), google (2), contact (2), tended (2), talking (2), irish (2), regular (2), current (2), compliant (2), joke (2), specifies (2), duct (2), scroll (2), separated (2), avian (2), feel (2), ask (2), ranks (2), recommended (2), said (2), publicity (2), statistics (2), issue (2), looked (2), 7th (2), assume (2), created (2), matters (2), org (2), anyone (2), knowledge (2), specified (2), draft (2), called (2), precursor (2), following (2), edited (2), spam (2), thank (2), advice (2), martijn (2), van (2), duren (2), platform (2), low (2), provides (2), numerous (2), reasonably (2), tracked (2), prettified (2), paying (2), wide (2), platforms (2), portable (2), pulls (2), specify (2), showed (2), wider (2), doubt (2), decision (2), configurations (2), especially (2), department (2), relayed (2), follow (2), space (2), pkg_delete (2), var (2), maillog (2), redis (2), previous (2), 380 (2), grep (2), 104 (2), reject (2), greylist (2), modifications (2), names (2), addresses (2), brevity (2), rest (2), fictional (2), proc (2), exec (2), dkimsign_rsa (2), dkim (2), _dkimsign (2), pem (2), relay_domain (2), until (2), outlined (2), statements (2), reached (2), conclusion (2), tables (2), pairs (2), receive (2), locally (2), analysis (2), logic (2), records (2), primary (2), favor (2), newer (2), unfortunately (2), majority (2), party (2), syntax (2), consequence (2), useless (2), changed (2), official (2), discussed (2), discovered (2), generally (2), upgrades (2), exposed (2), originally (2), separate (2), care (2), replacement (2), integral (2), 21st (2), onwards (2), friday (2), terms (2), community (2), crucial (2), elsewhere (2), presentations (2), tea (2), browse (2), linked (2), gives (2), focused (2), challenge (2), offer (2), treated (2), potentially (2), analogs (2), technology (2), enters (2), initiatives (2), reasons (2), capable (2), sufficent (2), javascript (2), unlikely (2), traditionally (2), building (2), tree (2), between (2), recommend (2), license (2), comes (2), creating (2), suits (2), request (2), runs (2), colleagues (2), step (2), exploring (2), often (2), instead (2), adding (2), artifact (2), definition (2), standardization (2), progress (2), customers (2), incompatible (2), conforms (2), poke (2), nuts (2), files (2), knows (2), utilities (2), frameworks (2), hit (2), producing (2), bulk (2), circumstances (2), positioned (2), depending (2), additional (2), entirely (2), practice (2), direct (2), typically (2), serves (2), plans (2), design (2), queen (2), elizabeth (2), detailed (2), fields (2), subject (2), anecdote (2), aircraft (2), navy (2), entries (2), nuclear (2), reactor (2), landed (2), contract (2), contexts (2), everything (2), humans (2), depends (2), functionality (2), becoming (2), upping (2), tune (2), pdes (2), xkcd (2), struck (2), secrets (2), lesson (2), defects (2), repair (2), potential (2), production (2), consulting (2), sunburst (2), distribution (2), malware (2), widely (2), unknown (2), eyes (2), age (2), closed (2), exploitable (2), twenty (2), eventually (2), keyboards (2), away (2), infrastructure (2), keeping (2), hidden (2), phenomenon (2), society (2), correctness (2), exploit (2), fair (2), visible (2), selling (2), hands (2), unimportant (2), parameters (2), enforcement (2), responsible (2), category (2), markets (2), maintain (2), authorities (2), general (2), basis (2), recital (2), steward (2), roles (2), ensures (2), natural (2), persons (2), businesses (2), executive (2), 14028 (2), nation (2), area (2), ensure (2), safety (2), probability (2), feedback (2), llm (2), checked (2), give (2), publications (2), slowly (2), drowning (2), confident (2), layer (2), unverified (2), online (2), copyright (2), risen (2), geophysicist (2), qwen3 (2), contributions (2), geophysics (2), earth (2), sciences (2), specializing (2), sun (2), chromosphere (2), region (2), coronal (2), heating (2), gpt (2), technologist (2), advocacy (2), scored (2), update (2), screenshots (2), mastodon (2), vanity (2), five (2), transmitted (2), described (2), inc, theme, powered, blogger, undeadly, journal, takeaway, pretend, appointment, blame, compatibility, issu, microsoft, buys, equivalent, characters, save, trouble, ports, anymore, easier, wee, purported, closer, reports, facts, wrong, rea, wasn, surprising, origins, overlord, cheap, pflow, nfsen, robots, guessable, repurposed, guess, unicode, against, ridiculous, odds, gaining, botnet, dubbed, staying, unde, continuing, tradition, michael, lucas, absolute, 2nd, auctioning, 3rd, firewalls, transform, fell, tories, tory, kinds, civi, porn, blocks, kids, liberties, pageviews, 2006, 2007, 2008, 2010, 2013, 2015, 2016, 2017, 2018, 2019, 2023, archive, city, keynote, totuorial, massimiliano, stucchi, tom, smyth, toolset, cramas, regulations, gift, hva, har, kan, gjort, gjøre, deg, upcoming, bookstores, starch, buy, profile, puffyist, charmer, penguin, wrangler, rants, sanity, lack, contacting, rentageek, blogspot, nostarch, older, implementers, enactments, children, acting, cpip, proceeded, leisurely, avaliable, interoperable, besides, entice, partners, arrange, needs, accompanying, anniversary, flight, developments, interspecies, handoff, protocols, runners, prose, hurry, catch, plane, followup, art, reused, archived, internationally, mainstream, bbc, stories, publication, carried, innovation, salon, eric, raymond, naming, wonderful, millennium, meaning, jargon, sunday, slashdotting, previously, 200, aquainted, feeling, monday, tapering, hundreds, thousands, respond, unplug, packing, ride, thanking, unload, returning, owners, participators, directions, hours, reconvene, håvard, tax, quota, suffice, combined, remaining, managed, escape, fitted, payload, unexpectedly, condition, simultaneously, leading, congestion, queue, startled, intensive, flapping, wings, attempts, den, sticky, rolled, flattened, optical, unreliable, discover, smoothing, ruler, edge, attaching, placing, improved, significantly, mobile, location, largish, flock, joined, land, roof, affair, proceeding, wing, crew, passed, felt, cheating, rung, gsm, told, documenting, exptected, arriving, bråtet, terrasse, nobody, slight, anxiety, waiting, immediately, smaller, indicated, amount, drive, vain, tried, national, conversation, sounded, poor, soul, grew, frustrated, confused, courtesy, preparatory, dry, plugging, disconnected, scripts, initiating, seconds, simulate, conditions, volunteer, helpers, circle, handing, sending, connection, handshakes, responses, calculated, transferring, icmp, prove, technique, wouldn, fiddle, oversize, mtus, toshibas, laserjet, clones, forget, agfa, usb, flawlessly, plugged, dist, upgrade, stock, resolved, stable, gnu, universal, module, gocr, http, jocr, sourceforge, readme, details, kernels, device, applications, handles, userspace, feeding, penguins, aquarium, fjords, sigthseeing, better, factor, racers, lived, range, flies, distance, mountain, peak, 477, elevation, 150, 300, birds, svein, arne, rosendal, suburban, 6th, karl, magnus, kolstø, persuade, great, candidates, uberhacker, lat, attraction, himself, spectacular, attract, morning, engine, brevduer, core, organizers, thursdays, less, speakers, corner, bar, themed, stocking, guinness, stout, ringnes, pilsner, beer, famous, resumed, spring, 2000, month, summer, christmas, break, months, correctly, boast, nowhere, near, whatsoever, transfer, faster, remarkably, appendix, translating, 1993, 1994, grins, thinking, tough, numbingly, clue, gems, 2003, 3514, homed, sounds, doesn, hacker, ingredients, receipt, removed, optically, electronically, transmittable, hexadecimal, octet, whitestuff, blackstuff, wrapped, leg, band, edges, heart, frame, format, dying, join, issued, 28th, blurb, experimental, earliest, implements, proposed, degree, takes, successfully, historian, graph, resolve, today, supersede, cancel, sum, 4234, crocker, entitled, 1969, dang, looks, missed, fool, opportunity, technically, audience, anyway, formally, pass, recommendations, codified, holds, conferences, locations, acts, coordinating, requests, briefly, toshiba, computer, communications, sydney, performed, unix, participating, historical, saturday, migrate, mailserver, covers, topics, extensive, treatment, minimal, experience, efficient, outer, shield, infrequently, eighteen, weirdness, distributions, filters, ones, blocklists, sources, dnsbl, characterized, ability, iterations, radically, approaches, problems, useable, solid, decisions, latecomers, applaud, pleasantly, transistion, proven, prospect, truly, enhancement, friendly, considerably, complicated, satisfied, flows, instructions, tail, 500, monitoring, fails, retrieve, pristine, cvs, restore, mailer, usr, sbin, disabling, par, readability, configure, comment, stripped, length, discard, add_header, null, custom, force_actions, threshold, phishing, flags, no_threshold, actions, logs, observation, nxdomain, plus, elided, mx1, lamasti, 127, 192, 198, 100, 203, 113, db8, private, rsa, cert, certificate, privkey, socket, 465, smtps, submission, mbox, alias, src, rfc3849, rfc5737, copied, delete, packagename, prerequisites, pull, pkg_add, candidate, signing, switched, dkimproxy, windows, functional, dense, sense, alternative, routing, forwarding, rules, limited, easiest, conveniently, allow, exchangers, compatible, converted, certificates, letsencrypt, dmarc, spf, chosen, convert, accommodate, guides, rule, thumb, utterly, overhaul, telling, dug, experimenting, false, holdout, dropping, removing, medium, severe, flaws, codebase, fixes, appear, wait, served, reliable, front, hosts, routine, adjustments, machines, perform, necessarily, filtered, duty, instrumented, hints, sane, mxes, recipe, love, setups, friends, complex, moving, require, preparation, properly, hectic, replaced, completed, drain, energy, sendmail, tempting, prime, convenient, incoming, signal, path, introduced, upgrading, describes, ago, definite, deadline, century, image, credit, eurpean, cves, participants, ecosystem, applies, mean, bjørge, solli, input, insights, olle, johansson, fosdem, buyer, summary, api, brewing, revolutionizing, chains, techies, copious, center, ntia, mother, openssf, video, courses, minute, chunks, regulatory, orc, portal, filled, introduction, registration, badge, lots, nominally, taking, understanding, lfel1001, automating, lfel1007, earned, afforded, rise, burdens, openly, transparently

Text of the page (random words):
that are not under their responsibility from cra recital 18 as we can see there are three distinct categories each with their specific roles and obligations your duties as an open source developer or steward if you are an individual open source developer i hope by now you are reassured by the quote from cra recital 18 that you are in fact not under any formal obligation to do anything in particular you are free make any changes to your workflow you want as a developer on a completely voluntary basis that said the emerging legal requirements do offer opportunities that may be worth exploring we will come back to those shortly open source stewards under any reasonable interpretation of cra article 3 14 will usually be a not for profit organization or foundation such as the freebsd foundation which operates with a purpose to support the activities of the project such organizations have some measure of responsibility to maintain sufficient infrastructure and organization to support such activites as bug and incident reporting and following up on any security relevant matters raised by manufacturers the reporting authorities or the general public it is useful to look up cra article 24 and recitals 17 18 and 19 for more nuance on the other hand if you are a manufacturer as you would expect the practical and financial responsibility for any product placed on the market lies with the manufacturer that produces and markets the product the manufacturer is responsible for ensuring that the product is suitable for its intended use that it conforms with any requirements specified for its product category in the european union including any required specifications for its intended use the cra somewhat extends the requirements for product information to be made available on request including a software bill of materials sbom that specifies components of the product and their dependencies once a product is on the market the manufacturer is responsible for the continued security of the product in operation including reporting security relevant bugs and incidents to the designated authorty the exact parameters of the enforcement regime are still work in progress but potential sanctions for non compliant products and manufacturers include depending on the severity of the matter mandatory recall of marketed products and fines up to whatever is the greater of 15 million euros or 2 5 per cent of the manufacturer s worldwide annual turnover for the preceding financial year see cra article 64 but why why now so why was this legislation needed at all and why does it come into force now explaining why legislation of the cyber resilience act mold was needed means that we will need to look at some history there is a sequence of events that lead us to where we are and that shaped how we see ourselves in the context of software security and software quality it is worth keeping in mind that during a longish stretch of recent times software has been poorly understood by the public generally disregarded as unimportant or in the cases where it was at least considered not unimportant was considered to be trade secrets by the dominant players in the field and consequently off limits to any real security or quality inspection one very visible consequence is that a large part of what labels itself as it security or cybersecurity centers around selling tools scanning whatever data they can get their hands on for an ever increasing set of malware signatures or in the case of network traffic captures signs of malicious activity such as probing for common misconfigurations or bugs that are known to be exploitable on the other hand in the open source parts of the industry where the source code for your system is available for study it is possible and even encouraged to focus on code quality and code correctness with the source code within reach outside reviews can and will happen if your code is interesting enough to be considered usable in environments that are different from your own with source in hand some projects have even gone to the extra steps of not only improving code quality and correctness but even creating mechanisms that would make even currently unknown bugs and misfeatures in the code harder to exploit it is fair to say that the openbsd project has been particularly innovative in exploit mitigation and prevention the role that code quality plays in making products with digital elements robust and safe has not been lost on the people who have worked to formulate the cra and the best practices that we are expected to adopt we will come back to the best practices but first a quick look at some recent history historically just a bit of typing software is a relatively recent phenomenon for a long time you could credibly say most of its existence software was poorly understood by society and industry at large there was a time and i am old enough to remember that time when software was considered a minor somewhat irritating but necessary component in it deliveries on the more extreme end of things you would occasionally hear that software was not at all important literally just a bit of typing all the while it was ever more clear to developers and practitioners that the software was what made all that expensive hardware useful but software was all ephemereal to most and in almost all cases the source code was secret and the customer was expected to just accept whatever came you way as is that perception changed over time and during recent decades it is no longer in doubt that the software industry is just that an industry in its own right still in the pre internet age keeping your source code hidden from the world as a trade secret was seen by large parts of the industry as the key to generating revenue and necessary and even sufficent for an acceptable level of security but then suddenly software turned important then as some of us still remember the internet happened few people realized it at the time but this was the time in history when two important things happened at roughly the same time for one it became obvious to developers at least that the infrastructure we all have come to rely upon owes its strength and resilience to the fact that it consists mainly of software that was built on standards built on rough consensus and working code code that was open source instead of 10 000 chimps typing the other thing that happened was that software products became exposed to the internet those products found themselves facing the full force of the entire world banging away at their keyboards some of those keyboards were operated by people who intended to do bad things a significant subset of the devices that appeared on the internet ran software that was clearly not designed for secure operation in a connected environment eventually bad things started happening over the years eventually enough episodes piled up that software security sometimes discussed under other labels started becoming an issue during the twenty tens and teens we had several incidents where software bugs were tickled enough to lead to costly and embarrasing episodes some of these episodes were grave enough that the powers that be the kind wearing suits discovered that software was indeed something they needed to care about at the time there were commentators from both camps who seemed surprised to learn that open source and closed source software both demonstrably had exploitable bugs dependencies became a thing in the early days of the internet age and to some extent still we have often been faced with claims that open source software could either never be as secure as proprietary software or that open source software was inherently more secure than the closed source kind because given enough eyes all bugs are shallow both assertions fail because even without access to source code it is possible to probe running software for vulnerabilities and on the other hand the shallowness of bugs depends critically on the eyes looking being attached to people with sufficient competence in the field the public reactions to a couple of security incidents during recent years that generated a flurry of largely uninformed punditry are worth revisiting for the lessons that can be learned some incidents of note are the solarwinds supply chain incident also known as sunburst 2020 one of the most widely publicized yet mostly quite poorly understood security incidents in recent years emerged when it was revealed that adversaries unknown had been able to compromise the build computers where the binaries for their widely used network management software was built for distribution the sans institute has produced a fairly thorough writeup of the incident which breaks down as follows the first stage of a multi stage compromise kit was included in binary distribution packages complete with authentic signatures from the build system that were largely put directly into production environments by network admins everywhere the malware then went on to explore the networks they landed in and through a process that made heavy use of crafted dns queries and other non obvious techniques the miscreants were able to compromise several high security government and enterprise networks several open source component supply chain incidents 2020 onwards soon after the sunburst incident several incidents occured where popular open source components that other systems pulled in as dependencies started malfunctioning or were suddenly unavailable causing complete malfunctions or loss of functionality such as a web service suddenly refusing to interact with specific networks the sudden breakage in open source components caused quite a bit of uproar and predictably the chattering subset of the consulting class set about churning out dire warnings about the risk of using open source of any kind watching from the sidelines it struck many open source oriented professionals myself included that the combination of these incidents carry an important lesson it is obvious in a modern environment we suck in upgrades automatically and frequently and that no untested code should ever be deployed directly to production blind trust versus the right to read and educate yourself and the right to repair in the case of proprietary binary only software you have no choice but to trust your supplier and that they will address any defects in a timely manner the upshot is that with proprietary binary only you do not have access to two important features of open source software the right to read and study the code and the right to repair any defects you find potentially saving yourself potential service shutdowns or workarounds while the secret parts of your system get fixed elsewhere the lesson to be learned is that you need to run quality assurance on your supply chain you may choose to trust but you still need to verify that goes for open source and proprietary software both these episodes spurred several things one being memes like xkcd 2347 please also read the explainer which lead to the common belief that supply chain management and the subtopic dependency management is mainly a problem that concerns open source software as we will see that assertion does not hold even with products that are made up of proprietary parts that their manufacturers want to treat as much as possible as trade secrets we know that no project is an island whether you let others see the code you wrote or not the software does not exist in isolation the xkcd comic struck a chord with open source developers who at the time were a lot more in tune with the world of software dependencies than most other people by the way this slightly modernized version is likely more in tune with the day to day experiences of developers and maintainers of products with digital elements pdes or you may feel this is more appropriate with all this as the backdrop now let us return to the base starting point of it all our source code we will see how this all fits together to make an ideal setting open source as proper engineering upping your engineering game for individual developers the question becomes something more along the lines of do you know what your code does or even do you know everything your code does to put it bluntly whether you answer to either of these is a clear yes or no determines whether you are just a coder or an engineer who codes the purpose of this session is to help you move towards becoming the latter to start you upping your engineering game to set the stage for what real engineers should do and to keep focus on the importance of doing things right the anecdote of the canadian engineers iron ring is a useful reference so let s ask the question dear developer do you know what your code does your answer is likely to be along the lines of sure i wrote it all i know what it does unless you vibe coded the thing that is but let s leave that particular set of circumstances for another time the answer i wrote it all i know what it does is however unlikely to be totally accurate unless you are doing extremely low level stuff and your code speaks directly to the hardware your code more likely than not also pulls in and utilizes dependencies such as system calls and library functions that provide the foundation of functionality that makes the code you wrote work knowing your dependencies and what role they plain in making your code work is a significant part of delivering proper quality as i mentioned earlier no project is an island whether you let others see the code you wrote or not the software does not exist in isolation summing up so far we write software which depends on other software which interacts with other software which again interacts with other components hardware humans to run important stuff nothing exists in actual isolation no project is an island so what we do is important what do we do about that learn from those who build important things one way to handle the situation is to look at what other people who build important things do in other fields the term bill of materials or bom for short is a familiar term the bill of materials is a document or set of documents that lists all component parts of a delivery this is the kind of document that becomes crucial in contexts where the procuring organization is geared toward accounting for everything and auditing when the supplier least expects it one such context could be when your organization has landed a contract to supply a backhoe an armored personnel carrier or even a ship and the contract requires you to specify component materials used down to the nuts and bolts level for an example of the scale of things we are talking about consider this ultra high level view of an item that was delivered to the uk royal navy one aircraft carrier hms queen elizabeth your delivery would not be considered complete without the bill of materials or manifest even for a thing this size in practice the bom for the hms q...