Review? [LWN.net]

Review?

Posted Apr 27, 2026 9:23 UTC (Mon) by tchernobog (subscriber, #73595)
In reply to: Review? by pabs
Parent article: Dependency-cooldown discussions warm up

> What do you mean by attestation process for FOSS?

Some kind of way of reliably checking the author of a change, e.g. via proper code signing and on-boarding of developers. But with AI taking more and more the helm, this is getting to be a fuzzy concept anyway. There are some attempts with e.g. https://slsa.dev/

> Have we seen any early effects of the EU CRA on companies yet? Are they talking about internally yet?

I can only speak for my company, a EU mid-sized manufacturer (around 1'000 employees, ~ half a billion yearly revenue).

I can tell that:

* we are well aware of the requirements and are currently (and slowly: we are a hardware company too) working towards compliance
* this led to the creation of internal processes and structures that weren't there to respond requirements; this means also the establishment of an independent security team which was not there before, which is good
* we have now a (not huge, but not tiny) budget to spend on external contractors for fixing important open-source bugs, e.g. in u-boot, hashicorp vault, and more
* we have now full SBoM scanning for all dependencies and are taking timely action to reduce risks around unmaintained or buggy dependencies. So well maintained projects will get more attention, poorly maintained FOSS projects will get the kick

But I cannot speak of course for all companies; this is only anecdotal evidence that something is happening.

to post comments

Review?

Posted Apr 27, 2026 13:01 UTC (Mon) by pabs (subscriber, #43278) [Link]

> Some kind of way of reliably checking the author of a change

What would be the point of that? As we saw with xz it isn't the author (or any aspect of their identity) that matters, its the code that matters. The many many times devs got hacked and their credentials were used to push malware. Or they sold their maintainership of their program (possibly including credentials), and spyware got added. Or that time an upstream released with a backdoor that would only activate on a particular Debian person's machine.

> via proper code signing and on-boarding of developers

Distros like Debian have both of those, but they don't have enough code review that they would always block any of the above.

Review?

Posted Apr 27, 2026 13:14 UTC (Mon) by pabs (subscriber, #43278) [Link] (1 responses)

A few suggestions for your FOSS processes:

Hope your license compliance is up to scratch too :)

Have a budget for contributing back financially with direct donations and or sponsorship.

Have a team working on contributing back code and otherwise participating in FOSS communities, joining forums, mailing lists, conferences etc.

The unmaintained/undermaintained projects are the ones that need you to assist them *more* *instead* of ditching them.

Since you are a hardware company, please consider making it simple to replace your software/firmware with open equivalents.

Review?

Posted Apr 27, 2026 13:36 UTC (Mon) by pizza (subscriber, #46) [Link]

> The unmaintained/undermaintained projects are the ones that need you to assist them *more* *instead* of ditching them.

...I wish more folks understood this.

(Not to mention that "undermaintained" being the overwhelming norm -- If you ditch those [sub-[sub-]] dependencies you're left with... doing all of the work yourself, I guess?)