[{"data":1,"prerenderedAt":436},["ShallowReactive",2],{"site:settings":3,"site:navigation":49,"site:footer":126,"page:\u002Fresources\u002Fvideos":188,"sections:\u002Fresources\u002Fvideos":252,"feed:\u002Fresources\u002Fvideos":255,"breadcrumbs:\u002Fresources\u002Fvideos":256,"youtube:playlist-videos:PLy7t4z5SYNaTnHCiz8ADmGZ_z6YZGd0wI,PLy7t4z5SYNaT-DjqGR0ORSSZGZYW8qmRs,PLy7t4z5SYNaQEyXv253SI6PDdPjbYXcNV":261},{"id":4,"title":5,"callForAction":6,"description":9,"extension":10,"featuredContentPublishTarget":11,"keywords":12,"logo":18,"logoWidth":19,"meta":20,"search":21,"seoTitleSuffix":25,"skipLinkText":26,"socialImage":27,"socials":30,"stem":47,"__hash__":48},"settings\u002Fdata\u002Fsettings.yml","Open Regulatory Compliance Working Group",{"text":7,"href":8},"Get involved","\u002Fparticipate\u002F","The open source community is collaborating to establish common specifications for secure software development based on open source best practices.","yml","orc",[13,14,15,16,17],"regulatory compliance","cybersecurity processes","royalty-free patent licence","open source community collaboration","Eclipse Foundation Specification Process","\u002Fimages\u002Forc-logo.png",120,{},{"label":22,"placeholder":23,"menuLabel":24},"Search","Search the site…","Menu"," | Open Regulatory Compliance Working Group","Skip to main content",{"backgroundImage":28,"eyebrow":29},"\u002Fimages\u002Fog\u002Fbackground.jpg","orcwg.org",[31,35,39,43],{"name":32,"icon":33,"url":34},"LinkedIn","fa6-brands:linkedin-in","https:\u002F\u002Fwww.linkedin.com\u002Fshowcase\u002Fopen-regulatory-compliance\u002F",{"name":36,"icon":37,"url":38},"YouTube","fa6-brands:youtube","https:\u002F\u002Fwww.youtube.com\u002F@ORCWG",{"name":40,"icon":41,"url":42},"Bluesky","fa6-brands:bluesky","https:\u002F\u002Fbsky.app\u002Fprofile\u002Forcwg.org",{"name":44,"icon":45,"url":46},"Mastodon","fa6-brands:mastodon","https:\u002F\u002Ffosstodon.org\u002F@orcwg","data\u002Fsettings","bxtnzYEG4TQ27x8O_VKQIF-gc2dr-DNwF9_OpAZy3LA",{"id":50,"extension":10,"main":51,"meta":123,"stem":124,"__hash__":125},"navigation\u002Fdata\u002Fnavigation.yml",[52,70,82,99],{"text":53,"children":54},"About",[55,58,61,64,67],{"text":56,"href":57},"ORC Working Group","\u002Fabout\u002F",{"text":59,"href":60},"Cyber Resilience SIG","\u002Fspecial-interest-groups\u002Fcyber-resilience\u002F",{"text":62,"href":63},"AI Policy & Compliance SIG","\u002Fspecial-interest-groups\u002Fai-policy-and-compliance\u002F",{"text":65,"href":66},"Steering Committee","\u002Fcommittees\u002Fsteering-committee\u002F",{"text":68,"href":69},"Meeting Minutes","\u002Fcommittees\u002Fminutes\u002F",{"text":71,"children":72},"Membership",[73,76,79],{"text":74,"href":75},"Our Members","\u002Fmembership\u002F",{"text":77,"href":78},"Become a Member","\u002Fmembership\u002Fbecome-a-member\u002F",{"text":80,"href":81},"Participation and Membership FAQ","\u002Fabout\u002Fparticipation-and-membership-faq\u002F",{"id":83,"text":84,"children":85},"cra","Cyber Resilience Act",[86,89,93,96],{"text":87,"href":88},"About CRA","\u002Fcra\u002Fabout",{"text":90,"href":91,"external":92},"CRA FAQ","https:\u002F\u002Fcra.orcwg.org\u002F",true,{"text":94,"href":95},"CRA Resources","\u002Fcra\u002Fresources",{"text":97,"href":98,"external":92},"CRA Hub on GitHub","https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub",{"text":100,"children":101},"Resources",[102,105,108,111,114,117,120],{"text":103,"href":104},"Events","\u002Fevents\u002F",{"text":106,"href":107},"Community Calendar","\u002Fresources\u002Fcalendar\u002F",{"text":109,"href":110},"Blog","\u002Fblog\u002F",{"text":112,"href":113},"Videos","\u002Fresources\u002Fvideos\u002F",{"text":115,"href":116},"Learning Hub","\u002Ftraining\u002F",{"text":118,"href":119},"Marketing Resources","\u002Fresources\u002Fmarketing-resources\u002F",{"text":121,"href":122,"external":92},"ORC Store","https:\u002F\u002Feclipse-foundation.store\u002Fcollections\u002Fopen-regulatory-compliance-orc",{},"data\u002Fnavigation","XYDVypNX67n8V4VQI_JTrw0cI16uV5jtctVXjN-DeKo",{"id":127,"backToTopText":128,"copyright":129,"extension":10,"manageCookiesText":130,"meta":131,"sections":132,"socialsHeading":185,"stem":186,"__hash__":187},"footer\u002Fdata\u002Ffooter.yml","Back to the top","Copyright © Eclipse Foundation AISBL. All Rights Reserved.","Manage Cookies",{},[133,150,169],{"id":134,"heading":135,"links":136},"footer-eclipse-foundation","Eclipse Foundation",[137,139,142,145,147],{"text":53,"href":138},"https:\u002F\u002Fwww.eclipse.org\u002Forg\u002F",{"text":140,"href":141},"Projects","https:\u002F\u002Fprojects.eclipse.org\u002F",{"text":143,"href":144},"Collaborations","https:\u002F\u002Fwww.eclipse.org\u002Fcollaborations\u002F",{"text":71,"href":146},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002F",{"text":148,"href":149},"Sponsor","https:\u002F\u002Fwww.eclipse.org\u002Fsponsor\u002F",{"id":151,"heading":152,"showManageCookies":92,"links":153},"footer-legal","Legal",[154,157,160,163,166],{"text":155,"href":156},"Privacy Policy","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fprivacy\u002F",{"text":158,"href":159},"Terms of Use","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fterms-of-use\u002F",{"text":161,"href":162},"Compliance","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fcompliance\u002F",{"text":164,"href":165},"Code of Conduct","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Fdocuments\u002FCommunity_Code_of_Conduct.php",{"text":167,"href":168},"Legal Resources","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002F",{"id":170,"heading":171,"links":172},"footer-more","More",[173,176,179,182],{"text":174,"href":175},"Report a Vulnerability","https:\u002F\u002Fwww.eclipse.org\u002Fsecurity\u002F",{"text":177,"href":178},"Service Status","https:\u002F\u002Fstatus.eclipse.org\u002F",{"text":180,"href":181},"Contact Us","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Ffoundation\u002Fcontact.php",{"text":183,"href":184},"Support","https:\u002F\u002Fwww.eclipse.org\u002Fprojects\u002Fsupport\u002F","Follow Us:","data\u002Ffooter","C-lpCHl9crwF3iQyRSh8y5g9ez5YgF4pi8aTv4pFLBM",{"id":189,"title":112,"aliases":190,"body":191,"breadcrumbTitle":190,"breadcrumbs":243,"date":190,"description":244,"extension":245,"featuredFooter":190,"header":190,"keywords":190,"meta":246,"navigation":92,"path":247,"redirectUrl":190,"rssFeed":190,"seo":248,"seoTitle":190,"socialImage":190,"stem":249,"typography":190,"visibility":190,"width":250,"__hash__":251},"pages\u002Fresources\u002Fvideos.md",null,{"type":192,"value":193,"toc":240},"minimark",[194,204,223],[195,196,197],"hero",{},[198,199,201],"template",{"v-slot:title":200},"",[202,203,112],"p",{},[205,206,208,220],"page-section",{"spacing-bottom":207,"spacing-top":207},"none",[202,209,210,211,215,216,219],{},"Stay informed about the evolving landscape of open source and cybersecurity regulation with the Open Regulatory Compliance’s video resources. Our curated webinars and series, including ",[212,213,214],"strong",{},"Unpacking the CRA"," and ",[212,217,218],{},"CRA Mondays",", offer expert insights into the European Union’s Cyber Resilience Act (CRA) and its impact on open source.",[202,221,222],{},"Whether you’re an open source contributor, maintainer, project leader, or legal expert, these sessions provide essential knowledge to help you understand regulatory requirements, anticipate challenges, and collaborate on community-driven solutions. Browse our video library to deepen your expertise and stay engaged with the latest developments in open source regulation.",[205,224,226],{"decoration":225},"glow-left",[227,228,229,233,236],"paginated-video-list",{},[230,231],"video-playlist",{"id":232,"title":214},"PLy7t4z5SYNaTnHCiz8ADmGZ_z6YZGd0wI",[230,234],{"id":235,"title":218},"PLy7t4z5SYNaT-DjqGR0ORSSZGZYW8qmRs",[230,237],{"id":238,"title":239},"PLy7t4z5SYNaQEyXv253SI6PDdPjbYXcNV","Webinars and community calls",{"title":200,"searchDepth":241,"depth":241,"links":242},2,[],"shown","Explore our videos featuring insights, updates, and discussions from the Open Regulatory Compliance community.","md",{},"\u002Fresources\u002Fvideos",{"title":112,"description":244},"resources\u002Fvideos","full","tfYItvWm5aStQZeF89jdz1ZSCcU62uWq8R-ZkPbVjo8",[253],{"path":254,"visibility":190},"\u002Fresources",false,[257,260],{"path":258,"text":259},"\u002F","ORC",{"path":254,"text":100},[262,285,363],{"id":232,"title":263,"videos":264},"Unpacking the CRA | Open Regulatory Compliance",[265,270,275,280],{"id":266,"title":267,"published":268,"description":269},"CQAF4zzpOqM","Unpacking the CRA for the Automotive Industry","2026-05-07T15:51:11+00:00","The Cyber Resilience Act (CRA) is set to significantly impact the automotive industry, introducing new obligations around cybersecurity, compliance, and software supply chain transparency. For automotive manufacturers and their technology partners, understanding what’s ahead is critical.\n\nJoin the Open Regulatory Compliance and Eclipse SDV working groups for an in-depth session exploring how the CRA affects the automotive sector.\nWe’ll begin with a practical industry perspective from Nicolas Leroux, CEO of Lunatech, who will outline how the CRA is shaping thinking and strategy within automotive manufacturing. From there, Juan Rico, ORC Program Manager, will provide deeper insight into the CRA framework and explain how the ORC working group is helping organisations prepare, including due diligence processes and the role of voluntary security attestations.\n\nThis session will help automotive stakeholders, suppliers, and open source contributors better understand their responsibilities under the CRA and how collaborative, open source–driven approaches can support compliance readiness.",{"id":271,"title":272,"published":273,"description":274},"WmHI4-6qsNg","Unpacking the CRA - Upcoming Deliverables and Deadlines","2025-10-01T20:15:01+00:00","Time is ticking. The EU’s Cyber Resilience Act (CRA), which entered into force on 11 December 2024, now demands action.  With vulnerability reporting requirements beginning in September 2026, organisations have less than a year to prepare themselves for cyber resilience compliance. Join the Open Regulatory Compliance (ORC) Working Group to review recent progress, explore updated deliverables, and understand what you need to do, and when, to meet CRA obligations.\n\nWhat to expect:\nA clear timeline of forthcoming CRA compliance milestones and what they mean for your project or organisation\nA recap of the ORC Working Group’s deliverables and milestones\nWays to get involved—contribute, collaborate, and shape how the manufacturers and open source projects can work together towards creating a long-lasting relationship.\nWho should attend:\nOpen source contributors, maintainers, project leaders, stewards, and manufacturers of products with digital elements using open source technologies seeking concrete guidance on CRA readiness.\n\nWhy now:\nWith some CRA requirements becoming enforceable as early as September 2026, and others by late 2027, now is the time to prepare. Get the guidance you need to ensure CRA readiness and contribute to the open source community’s response.",{"id":276,"title":277,"published":278,"description":279},"gSonHFkmuyQ","Unpacking the CRA: From Draft to Delivery – ORC Working Group’s first deliverables","2025-06-26T20:00:01+00:00","The European Union’s Cyber Resilience Act (CRA) is reshaping how open source projects approach risk and compliance. As part of its commitment to supporting the community, the Open Regulatory Compliance (ORC) Working Group is hosting the second in a series of webinars designed to help open source stakeholders understand and engage with CRA readiness efforts.\n\nJoin Juan Rico, Program Manager of ORC, as he shares updates on the group’s recent progress. This session will showcase how the working group has organised the development of work, the different stages and how to join the efforts. It will also dig into the first deliverables developed by the working group, reflect on key takeaways, and provide a look ahead at what’s coming next.\n\nWhether you're a contributor, maintainer, or organisational stakeholder – including those from small to medium-sized enterprises (SME) – this webinar is a valuable opportunity to learn how you can participate in shaping the next wave of compliance-focused tools and frameworks for the open source ecosystem.",{"id":281,"title":282,"published":283,"description":284},"Gz6T9Ycxo7I","Unpacking the CRA: How the open source community is collaborating in the ORC to address the CRA","2025-04-29T16:41:19+00:00","The European Union’s Cyber Resilience Act (CRA) is set to have a sweeping impact on the open source ecosystem—and the Eclipse Foundation community will be among those affected. Tobie Langel provides an overview of how the open source community is responding to the CRA.\n\nThis webinar explores how the open source community—through the Open Regulatory Compliance (ORC) Working Group—is responding to the challenges posed by the Cyber Resilience Act (CRA). You'll learn about the resources already developed, how the community is shaping the implementation of the CRA, and what’s planned for the year ahead. Whether you’ve already begun your CRA compliance journey or are still unsure how it will impact your projects, this session will help you understand what’s coming and how to get involved.\n\nLearn more about ORC and the CRA: https:\u002F\u002Forcwg.org\u002F\n\nTIMESTAMPS\n0:00 Welcome and Introduction\n2:34 Understanding the CRA: What and Why\n15:20 CRA and Open Source Supply Chain\n26:55 The Role of the Open Regulatory Compliance Working Group (ORC)\n36:14 CRA Collaboration: Regulators and Standards Bodies\n47:06 2025 ORC Deliverables\n48:06 How to Get Involved in ORC\n53:44 Q&A Session",{"id":235,"title":286,"videos":287},"CRA Mondays | Open Regulatory Compliance",[288,293,298,303,308,313,318,323,328,333,338,343,348,353,358],{"id":289,"title":290,"published":291,"description":292},"qGzLaMCLuk8","Implementing Decentralized Digital Technical Product Documentation: CRA meets Machinery Regulation","2026-09-29T15:21:16+00:00","This talk presents the challenges to providing decentralized digital product documentation in accordance with the Machinery Regulation Art. 10 & 11 (both (6),(7),(10)) as well as CRA Art 13 (16). In 2027 the documentation of products with digital elements is subject to two game changers. As of 20.01.2027 Articles 10 & 11 of the Machinery Regulation (2023\u002F1230) allow to provide information for use and information set out in Annex III (Art. 10) as well as the assembly instructions (Art. 11) in a digital format. Akin as of 11.12.2027 the CRA mandates to provide information and instructions to the user set out in Annex II, with regard to operating and setting up products with digital elements.\n\nThis presentation outlines a practical, technology-driven approach for bridging technical documentation and CRA compliance obligations. We demonstrate how structured metadata in RDF formats, REST APIs, and the iiRDS standard can be combined to publish standardized product archives directly from product websites. Additionally, we explore the role of decentralized infrastructure like IPFS in maintaining long-term data ownership, resilience, and accessibility across complex industrial supply chains and open-source ecosystems. This aims to convert technical product assets, such as maintenance guides, component manuals, and operational specifications into verifiable compliance evidence, employing the required common standards and allowing for seamless inter-departmental communication.\n\nSpeaker: Merzough Münker, Enduradocs\n\nABOUT ORC\nLearn more & join the conversation:   orcwg.org",{"id":294,"title":295,"published":296,"description":297},"yXb2k8hbQ5M","Solving copyright & licensing information in client-side JavaScript, CSS etc. | CRA Mondays","2026-09-15T15:42:30+00:00","In modern web, typically when a user visits a webpage or webapp, their browser downloads a bunch of JavaScript and CSS. This, so-called client-side (or browser-side) code is distributed to the user and runs on their machines, so both licensing – and arguably cyber security – compliance is needed.\n\nFor decades everyone was ignoring the problem, hoping it would go away – now we have a solution!\n\nSpeaker: Matija Šuklje, Liferay\n\nABOUT ORC\nLearn more & join the conversation:   orcwg.org",{"id":299,"title":300,"published":301,"description":302},"KN3dKD38S9U","Automating CRA Compliance at Scale | #CRAMonday","2026-07-08T13:33:29+00:00","Automating CRA Compliance at Scale: ORT Server Results from OCCTET and the Eclipse Foundation Project Analysis\n\nSébastien Heurtematte (Eclipse Foundation) and Martin von Willerbrand (Double Open)\n\nThis CRA Monday session presents the latest results from OCCTET, with a specific focus on ORT Server as a core platform for open source SCA, vulnerability monitoring, SBOM generation, and CRA-oriented compliance evidence.\n\nWe will share key findings based on the analysis of top open source projects across ten technology ecosystems, and compare ORT Server results with GitHub advisory data to highlight differences in coverage and vulnerability detection.\n\nThe session will then present ORT Server at scale through the analysis of Eclipse Foundation projects, covering more than 350 organisations and over 3,600 repositories (GitHub\u002FGitLab). This will show how dependencies and vulnerabilities can be identified across a large open source organisation.\n\n#OCCTET #CyberResilienceAct #Compliance \n\n⚙️ . ⚙️ . ⚙️ . ⚙️ . ⚙️\n\nSubscribe for the latest updates on open source compliance, the CRA, AI Act, and practical implementation guidance: https:\u002F\u002Fwww.youtube.com\u002F@ORCWG \n\n🌐 Visit our website: https:\u002F\u002Forcwg.org\u002Ftraining\u002F?utm_source=youtube&utm_medium=organic-social&utm_campaign=ORC-learning-hub&utm_content=video  \n\n🔗 Connect with us on our socials: \nLinkedIn: https:\u002F\u002Fwww.linkedin.com\u002Fshowcase\u002Fopen-regulatory-compliance \nBluesky: https:\u002F\u002Fbsky.app\u002Fprofile\u002Forcwg.org \nMastodon: https:\u002F\u002Ffosstodon.org\u002F@orcwg",{"id":304,"title":305,"published":306,"description":307},"i8LOUXMDk1k","Using the CRA to understand systems in practice | CRA Mondays","2026-05-11T23:51:18+00:00","The Cyber Resilience Act (CRA) requires organisations to generate a significant amount of information about the systems they build and maintain. However, that work can be approached in a way that not only supports compliance but also benefits the teams working with those systems.\n\nPaula Mesa Macias, through this talk, looks at what we can learn about our systems from the information required by the CRA, particularly in areas such as dependencies, infrastructure and maintenance.\n\nThe session also introduces the Ethical Software Framework, a developing approach based on legal frameworks, standards and technical guidelines. It focuses on areas where technical decisions intersect with ethical considerations, providing a structured way to support technical decision-making. The information gathered through the CRA contributes to this analysis, helping to identify and understand trade-offs between these areas and enabling more effective decision-making in practice.\n\nLearn more about the Open Regulatory Compliance working group: www.orcwg.org\n\nTime stamps:\n\n00:35 Introduction Paula \n02:41 Fragmented information and its associated consequences\n05:45 particularities of open source knowledge and information distribution\n10:00 Operational consequences derived from information fragmentation\n11:45 CRA and operational visibility\n13:45 CRA requirements and its importance\n23:07 Why connecting the data is key\n26:00 Trade-offs\n28:26 Ethical Software framework\n31:33 Q&A",{"id":309,"title":310,"published":311,"description":312},"ZHAYLdGtDYo","Fair-Share Cost Tokens: Supporting Financial Flows in Open Source Supply Chains","2026-04-17T13:27:23+00:00","The Cyber Resilience Act (CRA) will require FOSS projects to enhance their security measures and, in line with the logic of FOSS ecosystems, allow for voluntary security attestations.\n\nThis talk introduces fair-share cost tokens - a protocol which supports financial flows along open source software supply chains, and allow to enable a vulnerability tracing system. (Neither blockchain, nor AI)\n\nTIMESTAMPS\n00:00:00 – Introduction & Session Overview\n00:01:02 – Motivation: Funding Gaps in Open Source\n00:02:04 – The Core Problem: Sustainability & Trust in FOSS\n00:03:57 – CRA Explained: Supply Chains & Product Liability\n00:07:42 – Scale of the Challenge: Dependency Graph Complexity\n00:07:47 – Economic Operators: Manufacturers vs. Stewards\n00:10:14 – Why Current Models Don’t Scale (Contributions & Memberships)\n00:12:23 – Due Diligence, Risk, and Financial Incentives\n00:16:55 – Introducing Fair Share Cost Tokens\n00:22:02 – Benefits for Manufacturers and Open Source Projects\n00:26:08 – Open Questions & Future Considerations\n00:27:50 – Audience Discussion: Insurance, Risk & Market Dynamics\n00:42:39 – Contrarian View: Can Open Source Reduce Risk?\n00:54:02 – Closing Remarks & Next Steps\n\nABOUT ORC\nLearn more & join the conversation:   orcwg.org",{"id":314,"title":315,"published":316,"description":317},"ns9RBhEsz_U","Lessons from Log4Shell: building a CRA-ready Log4j","2026-03-17T18:04:53+00:00","The discovery of Log4Shell (CVE-2021-44228) triggered one of the most far-reaching security incidents in the history of open source software. As organizations rushed to assess their exposure, many discovered they could not answer a seemingly simple question: Do our products depend on Log4j?\n\nThe incident exposed deep challenges in software supply-chain visibility and vulnerability response, drawing the attention of regulators and helping inspire initiatives such as the European Cyber Resilience Act (CRA).\n\nIn the years since Log4Shell, the Log4j project has worked to remain at the forefront of emerging security practices in the open source ecosystem. Despite being maintained by a relatively small team, the project has experimented with new approaches to improve transparency, vulnerability handling, and downstream assurance.\n\nIn this talk we will revisit the changes introduced in Log4j after Log4Shell and examine how they align with the emerging expectations of the CRA, including attestation and due-diligence requirements. The presentation will highlight practical lessons from running a widely used open source project and explore what it takes to make open source components more trustworthy for downstream adopters in a regulated world.\n\nSpeaker: Piotr P. Karwasz, Apache Software Foundation\n\nTIMESTAMPS\n0:00:11 Welcome and session introduction\n\n0:00:47 Log4j and the Log4Shell incident: what went wrong\n\n0:05:54 CRA-readiness roadmap: five improvement areas\n\n0:07:04 Documentation overhaul, safer guidance, and version support policy\n\n0:11:45 Release process modernisation: automation, reproducibility, and trusted releases\n\n0:16:03 SBOMs, machine-readable security metadata, lifecycle data, and VEX plans\n\n0:20:56 Vulnerability handling: threat model, bug bounty experience, and modularisation\n\n0:25:44 Sustainability challenges, CRA attestations, and maintainer incentives\n\n0:31:30 Q&A on ASF release voting, attestations, and manufacturer-maintainer relationships\n\nABOUT ORC\nLearn more & join the conversation:   orcwg.org",{"id":319,"title":320,"published":321,"description":322},"5B6VXZwZa-c","Software Hash Identifier introduction and applications to in-development standards | CRA Mondays","2026-03-10T13:21:16+00:00","It will not be possible to scale up the identification of software based on software packages names. The usage of extrinsic identifiers requires an external, trusted, entity to host the references table. Intrinsic identifiers solve this issue, indemnifying software unequivocally, even supporting external references. Out of the existing intrinsic identifiers, SWHID is the standard one with open governance as well as a implementation example of a big enough scale, Software Heritage.\n\nThe existence of such identifiers is essential for regulators and standardization bodies, since they enables a level of trust in evidences you cannot reach in any other way, at big enough scale.\n\nTIMESTAMPS\n0:00:00 — Welcome and agenda overview: intrinsic vs. extrinsic identifiers, syntax, CRA use case, and takeaways\n0:02:02 — What intrinsic identifiers are, with comparison to extrinsic identifiers\n0:05:40 — Core characteristics of Software Hash ID: integrity, decentralization, provenance, and speed\n0:06:22 — What Software Hash ID can identify: snippets, files, directories, commits, releases, and snapshots\n0:09:16 — Software Hash ID syntax explained: core identifier and qualifiers\n0:16:31 — Standardization and ecosystem: ISO standard, open governance, and reference implementations\n0:21:00 — Software Heritage as the primary use case and large-scale implementation\n0:31:34 — Relationship between Software Hash ID and purl, including complementary use\n0:34:11 — SBOM and vulnerability use cases, including granularity and traceability benefits\n0:48:01 — Why Software Hash ID matters for CRA: key characteristics and compliance relevance\n0:55:29 — Final five takeaways and closing thoughts\n\nABOUT ORC\nLearn more & join the conversation:   orcwg.org",{"id":324,"title":325,"published":326,"description":327},"RWG-5oFO9cY","Open Source Governance in the Global South: Challenges, Opportunities & Compliance in Africa","2026-02-23T14:30:46+00:00","Open source is a global movement, but the practices, pressures, and compliance realities vary dramatically across regions. In Africa and the broader Global South, developers are building critical digital infrastructure, maintaining widely used libraries, and contributing to major ecosystems yet often without the governance structures, compliance tooling, or regulatory awareness common in Europe and North America. As the global software supply chain becomes more regulated, particularly with frameworks like the EU Cyber Resilience Act (CRA), this regional disparity becomes a supply-chain risk and a missed opportunity.\n\nThis session explores the intersection of open-source governance, compliance, and developer experience in Africa, drawing from real-world observations within local developer communities, university ecosystems, and open-source contributor networks. It highlights key structural challenges from limited access to tooling and training, to unclear licensing knowledge, inconsistent documentation culture, and lack of exposure to compliance-driven workflows such as SBOM generation, vulnerability reporting, and maintenance obligations.\nBut the session is not only about challenges. It also showcases emerging strengths and opportunities, including community-driven governance models, lightweight compliance workflows adapted for low-resource environments, and successful examples of African projects contributing to secure and compliant open-source ecosystems.\n\nAttendees will learn:\n\n- How compliance expectations (e.g., CRA, SBOM requirements, supply-chain attestations) impact open-source maintainers and contributors in the Global South.\n\n- Practical ways organizations can support global contributors to reduce compliance friction in distributed open-source development.\n\n- Governance strategies that help maintainers improve transparency, code quality, licensing clarity, and long-term sustainability.\n\n- Why strengthening compliance awareness in Africa enhances the trustworthiness and resilience of the entire global open-source supply chain.\n\nThis talk offers a perspective rarely highlighted in open-source governance discussions, bridging geographic, cultural, and infrastructural gaps. Participants will leave with actionable insights, potential collaboration pathways, and a deeper understanding of how to build more equitable and compliant global open-source ecosystems.\n\nTIMESTAMPS\n0:00:00— Welcome + framing (CRA, accountability, supply chain transparency)\n\n0:03:37 — “Open source isn’t just code” → people\u002Fleadership\u002Ftrust\u002Fsustainability\n\n0:06:18 — Why governance matters in practice (GitHub hosts code, not communities)\n\n0:08:35 — Why governance looks different in the Global South\n\n0:12:39 — Challenges in African open source\n\n0:18:05 — Opportunities \u002F positive side\n\n0:21:40— Open source compliance explained + what it includes\n\n0:28:03 — Q&A\n\nABOUT ORC\nLearn more & join the conversation:   orcwg.org",{"id":329,"title":330,"published":331,"description":332},"diBqxCtBraI","Anyone who still puts AI-generated code into circulation has conditional intent to infringe the law","2026-02-05T19:14:23+00:00","AI tools such as GitHub Copilot are not creative geniuses – they copy! And they do so more frequently and more demonstrably than many people believe. Anyone who incorporates AI-generated code into their software today is often already acting with conditional intent – and making themselves vulnerable to claims for damages, injunctions, and even criminal consequences.\n\nWe present current developments, figures on the frequency of plagiarism, and other prominent cases, shed light on the legal situation, and explain why companies urgently need to protect themselves. We provide clear answers to burning questions:\n\nWhy does AI code become a liability risk?\nHow can software manufacturers and purchasers still protect themselves?\nWhat technical and legal measures can prevent a ticking time bomb in your own product? Anyone who uses AI code carelessly in the future will be left to deal with the damage. We show you how to save yourself—before it's too late.\nSpeakers: Dr. Andreas Kotulla and Florian Hackel\n\nTIMESTAMPS\n00:00 – Welcome & Session Context\n01:40 – What Is “Conditional Intent”\n02:08 – Why AI Code Is a Legal Risk\n04:43 – Audience Poll: How Is Code Written Today?\n07:03 – AI in Software Development: Reality Check\n10:41 – Live Demo: AI Code Generation (Copilot \u002F OpenAI)\n12:35 – Case Study: AI Copying Open Source Code\n17:10 – Second Example: Bad AI Code from Books\n23:45 – Hallucinated Licenses & the GPL Problem\n34:25 – How Companies Can Protect Themselves\n\nABOUT ORC\nLearn more & join the conversation:   orcwg.org",{"id":334,"title":335,"published":336,"description":337},"_fGOgByN08c","CRA Mondays | OSS provenance and code signing","2025-12-04T18:26:44+00:00","Some OSS projects are maintained by a foundation like Eclipse, Apache, or Mozilla with often rigorous governance over the release process. However, this approach doesn’t scale, so most OSS projects ship unverified and often unsigned releases. This breaks the trust model of Linus’s Law, which is based on source code. Also, OSS releases are often unsigned, leading to a major security degradation and often usability issues. Unverified signing can lead to issues like the 2024 XZ Utils incident.\n\nSignPath Foundation provides free and secure code signing for 250 OSS projects. To achieve this, we had to go beyond key security: how can we guarantee that releases are safe to use?\n\nTIMESTAMPS\n0:00:00 – Welcome to CRA Mondays & Session Overview\n\n0:04:39 – The Problem: Secure Distribution & Code Signing for OSS\n\n0:09:08 – Project Eligibility: Admission Criteria for Signpath Foundation\n\n0:13:16 – Build Requirements: Hosted Development, Branch Protection & SLSA-Style Controls\n\n0:15:12 – Example Project: From GitHub Release to Signing Request\n\n0:17:39 – The XZ Utils Supply Chain Attack Case Study\n\n0:20:25 – Nested Signing: MSIs, EXEs, JARs & Runtime Components\n\n0:24:12 – Code Signing Challenges & Signpath’s Certificate \u002F CA Model (GlobalSign)\n\n0:30:19 – Looking Ahead: Dependencies, Attestations & CRA Implications\n\n0:34:43 – Q&A: Attestations, Interoperability & Working Group Next Steps\n\nABOUT ORC\nLearn more & join the conversation:   orcwg.org",{"id":339,"title":340,"published":341,"description":342},"G37gXO0KG6I","CRA Mondays | When Disclosure Fails: Europe’s Struggle with CVD","2025-11-27T13:00:35+00:00","Coordinated Vulnerability Disclosure (CVD) is written into NIS2 and the Cyber Resilience Act as a cornerstone of Europe’s cybersecurity policy. In practice, though, the system is failing. When Piet De Vaere, Product Cybersecurity Consultant, reported a vulnerability in a major Belgian bank through the official channels, he was met with bureaucracy, legal threats, and a total lack of technical engagement; both from both the bank and Belgium’s national cybersecurity authority. What should have been a routine disclosure turned into a long standoff that perfectly illustrates how Europe’s CVD framework is broken.\n\nIn this talk, Piet shows how these problems aren’t just Belgian, but systemic. Across the EU, policymakers treat CVD as a means to impose requirements on reporters instead of a commitment by organisations to receive and fix vulnerabilities. They confuse disclosure with bug bounties, enforce pointless formalities, and discourage the very people trying to help. Piet explains what went wrong, why it matters for NIS2 and the CRA, and how we can fix CVD before it collapses under its own red tape.\n\nTIMESTAMPS\n0:00 – Welcome & introduction of Piet De Vaere\n1:10 – Banking login flow & vulnerability explained\n4:12 – Attack scenario: abusing concurrent login requests\n6:54 – Design flaws: missing binding & weak user signals\n7:55 – Trying to report: CVD policies, CERTs, and roadblocks\n16:57 – Belgian NIS2 implementation & legal safe harbour\n22:59 – EU perspective: NIS2, CRA & flawed CVD policy model\n32:50 – Rethinking CVD & open source community role (Q&A)\n\nABOUT ORC\nLearn more & join the conversation:   orcwg.org",{"id":344,"title":345,"published":346,"description":347},"lCGBoNm0G08","CRA Mondays | From closed rooms to open dialogue: how to participate in CRA vertical standards","2025-10-30T12:01:39+00:00","The development of vertical standards under the Cyber Resilience Act (CRA) is a critical step toward implementation, yet these processes are often opaque and difficult for stakeholders that are not members of the standardization bodies to engage with. This presentation introduces a new open platform designed to make participation accessible to the wider community. It enables developers, manufacturers, and open source contributors to review, comment, and share feedback, creating a bridge between technical expertise and regulatory work.\n\nThis session will cover:\n- CRA vertical standards development under ETSI\n- Open participation in a traditional closed process\n- Tooling for participating\n\nTIMESTAMPS\n0:00:00 – Introduction and Welcome\n0:04:00 – Understanding the Standardization Process\n0:08:00 – Challenges Around Membership and Expertise\n0:12:00 – The Closed Nature of Current Processes\n0:16:00 – stan4cra.eu and Related Resources\n0:20:00 – Engaging and Contacting the Team\n0:25:00 – On Vertical Standards and Sector Coverage\n0:30:00 – Uncertainty Around Commission’s Position\n0:34:00 – Future Availability of Standards (Q2 2026)\n0:39:00 – Encouraging Broader Participation\n\nABOUT ORC\nLearn more & join the conversation:   orcwg.org",{"id":349,"title":350,"published":351,"description":352},"2JfterY07j8","CRA Mondays | Demystifying \"simplified CC for CRA\"","2025-10-17T13:39:53+00:00","Let's unpack the sCC4CRA methodology, specially designed to facilitate early compliance for default products, based on EUCC, fully self-assessed and simplified for CRA.\n\nThis session covers:\n- What is sCC4CRA and why it matters\n- EUCC vs sCC4CRA: key differences\n- sCC4CRA alignment with standardisation work\n- how to use sCC4CRA\n- Future and next steps\n\nTIMESTAMPS\n0:00 – Introduction\n0:47 – Speaker Background\n2:46 – What Is Simplified Common Criteria for CRA\n5:21 – Methodology Overview and Structure\n7:13 – Guidance, Development, and SBOM\n10:39 – Why the Methodology Matters\n12:52 – Common Criteria Strategy and Adaptation\n20:49 – Simplified Assurance Levels\n25:15 – Using the Methodology\n35:10 – Q&A and Closing Remarks\n\nABOUT ORC\nLearn more & join the conversation:   orcwg.org",{"id":354,"title":355,"published":356,"description":357},"Jnk_I2mI5xQ","Why Do You Trust Software? Operationalizing CRA with the Eclipse Trustable Software Framework","2025-09-25T15:39:47+00:00","Modern products—from cars and planes to medical devices and consumer gadgets—depend on millions of lines of software hidden deep inside. The EU Cyber Resilience Act (CRA) now requires manufacturers and suppliers to prove that this software is secure, maintained, and resilient over the long term. But while the CRA defines what must be achieved, the industry is still asking how.\n\nThe Eclipse Trustable Software Framework (TSF) may provide part of the answer. Built around six trustable tenets and exploring a FICO-style Trustable Score, TSF suggests a path for making software trust more measurable and auditable. In this session, we’ll discuss how TSF could complement CRA obligations, where it may help engineers, executives, and regulators, and why open collaboration is essential to shaping the future of trustable software.\n\nJoin us to learn, question, and contribute to this conversation.\n\nABOUT ORC\nLearn more & join the conversation: https:\u002F\u002Fwww.orcwg.org\n\nTIMESTAMPS\n00:00 – Welcome and introduction to John Ellis\n\n02:56 – Why do you trust software?\n\n04:38 – Tested does not equal trustable\n\n10:49 – Bigger picture: risk metrics and insurance implications\n\n12:08 – Applying the trustable software framework to real cases\n\n15:45 – Embedded systems and regulatory perspectives\n\n21:29 – Audience Q&A\n\n25:13 – Executive buy-in and communicating CRA concerns internally\n\n28:19 – Lessons from customer experiences and multi-part responses\n\n38:14 – Final questions and wrap-up",{"id":359,"title":360,"published":361,"description":362},"NglPCEu4pok","CRA Mondays | Unlocking Software Supply Chain Security: Updates from Ecma TC54 and OWASP","2025-09-08T14:03:16+00:00","At the heart of the EU Cyber Resilience Act (CRA) and other emerging EU regulations lies a critical focus on supply chain security and Software Bill of Materials (SBOM). Ecma TC54, in collaboration with OWASP, is advancing this agenda through its work on “Software and system transparency.”\n\nIn this session, you will gain insights into key initiatives shaping the future of software transparency—from OWASP CycloneDX to new efforts around software identifiers (PURL), Common Lifecycle Enumeration (CLE), and the Transparency Exchange API (TEA) for automating the delivery of transparency artefacts across the supply chain.\n\nThe session will also provide an overview of Ecma International’s role as a global standards organisation. A Q&A segment will give you the chance to engage directly with experts on these critical CRA-related standards.\n\nABOUT ORC\nLearn more & join the conversation: https:\u002F\u002Fwww.orcwg.org\n\nTIMESTAMPS\n00:05 – Introduction and welcome back to CRA Mondays\n02:16 – ECMA perspective and standards work\n08:33 – Introduction to Ecma TC54\n11:03 – Task groups for TC54\n15:34 – Smart cities use cases and sector perspectives\n17:16 – Upcoming features\n23:58 – Common Lifecycle Enumeration \n28:48 – CL ratification process and future timeline\n32:32 – Applying standards to software and systems\n36:37 – Vulnerabilities, CVEs, and risk ranges\n40:47 – Standardization discussions and clarifications\n44:51 – Collaboration, acknowledgements, and wrap-up",{"id":238,"title":5,"videos":364},[365,370,375,380,385,390,395,400,405,410,415,420,425,426,431],{"id":366,"title":367,"published":368,"description":369},"DLxZdU8kzxM","The Cyber Resilience Act and Open Source: What Maintainers Really Need to Know","2025-05-28T05:08:11+00:00","Many open source maintainers are concerned about their obligations under the EU Cyber Resilience Act. This webinar, organized by the Eclipse Foundation’s Open Regulatory Compliance Working Group, will clarify who is actually affected, what obligations apply, and how to determine if your project falls within the scope of the CRA. We'll cut through the uncertainty and provide practical guidance to help maintainers understand their position. This webinar is streamed by GitHub as part of Maintainer Month.\n\nKey questions this webinar will address:\n- Does the CRA apply to my open source project?\n- What's the difference between a \"manufacturer,\" \"steward,\" and regular contributor?\n- How does accepting donations or sponsorships affect CRA obligations?\n- What minimal requirements apply to open source stewards?\n- How should maintainers respond to compliance requests from companies?\n\nPanelists:\n- Tobie Langel, Technical Lead, Open Regulatory Compliance Working Group\n- Felix Reda, Director of Policy, GitHub\n- Daniel Stenberg, Founder and lead developer, the cURL project\n- Maarten Aertsen, Senior internet technologist, NLnet Labs\n\nLearn more with our CRA FAQ: https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fblob\u002Fmain\u002Ffaq.md",{"id":371,"title":372,"published":373,"description":374},"IAjHBpwEE_s","How to Read the CRA: Identifying Key Parts of the CRA for Effective Compliance","2024-07-24T00:57:03+00:00","Enzo Ribagnac, Eclipse Foundation associate director of European policy, discusses the open source community's obligations in the Cyber Resilience Act, CRA standards, and other key aspects of the EU regulation.\n\nLearn about the Open Regulatory Compliance Working Group: https:\u002F\u002Foutreach.eclipse.foundation\u002Fopen-regulatory-compliance",{"id":376,"title":377,"published":378,"description":379},"a_Cl85OPTag","CRA Standards Making: Understanding Key Standards and Their Production Timeline","2024-10-23T14:53:54+00:00","Learn about the Open Regulatory Compliance Working Group: https:\u002F\u002Forcwg.org\u002F",{"id":381,"title":382,"published":383,"description":384},"oVTO6s7eMLk","The CRA Obligations: Identifying the Relevant Obligations for the OSS Community","2024-09-04T20:22:54+00:00","Watch our webinar recording to learn about the obligations for open source manufacturers and stewards as outlined in the EU's Cyber Resilience Act.\n\nLearn about the Open Regulatory Compliance Working Group: https:\u002F\u002Forcwg.org\u002F",{"id":386,"title":387,"published":388,"description":389},"yYA2Gny7-io","Security Audits Panel - OCX 2024","2024-11-17T20:59:16+00:00","A number of Eclipse Foundation projects have undergone a security audit during the recent months. They differ in programming language and scope, so the findings differ too. This panel is going to assemble representatives from projects that have had that experience to share their conclusions, tips and the general experience.   The complete list of panelists will be given at a later date.",{"id":391,"title":392,"published":393,"description":394},"Eb-P6GgphXs","The future of cybersecurity, today: Free and open source tools for CRA compliance for SMEs - OCX 24","2024-12-02T19:46:20+00:00","Better software supply chain integrity and security for organizations of all sizes is increasingly important for cybersecurity, especially with the ever-expanding edge computing environment and upcoming regulatory requirements.  Small and medium enterprises (SMEs) must improve their security posture, but they do not have the budget to install and operate complex, expensive software systems for vulnerability management, report and ultimately regulatory compliance. SMEs also do not have the bandwidth or access to a dedicated security team, CISO, or CERT to assist their software supply chain management efforts. Instead, SMEs (and open source projects) need the help of accessible, free, and open source software solutions (FOSS) to inventory the components used in their products, create and share SBOMs, continuously monitor and triage potential vulnerabilities, and communicate with their stakeholders about vulnerability exploitability (VEX) and remediation actions. SMEs need all this, with minimal friction and costs, to improve their security posture and ensure CRA compliance.   In this talk, Mikaël Barbero from the Eclipse Foundation and Philippe Ombredanne from AboutCode will share how free and open source software (including projects funded by the EU) can reduce the possibility of serious cybersecurity incidents and emergencies from distributed software and devices. With free and open source tools, any organization - and especially SMEs - can more efficiently comply with the emerging CRA regulatory requirements, improve their software supply chain integrity, and strengthen their software supply chain security.",{"id":396,"title":397,"published":398,"description":399},"BGOi9JUJRMI","Le CRA est là. Et maintenant ?","2024-12-31T14:08:47+00:00","Par Tobie Langel - Principal & Managing Partner - UnlockOpen\nLicence CC-by-SA\nCreative Commons By SA 4.0\nhttps:\u002F\u002Fcreativecommons.org\u002Flicenses\u002Fby-sa\u002F4.0\u002Fdeed.fr",{"id":401,"title":402,"published":403,"description":404},"34AOBG9TqiE","Open Source Facing European Regulation: What's the Plan? - OCX 2024","2024-12-11T15:12:56+00:00","Moderator:  Enzo Ribagnac, Eclipse Foundation Panelists:  Cédric Brun, OBEO Marta Rybczynska, Eclipse Foundation Detlef Zerfowski, ETAS European Regulations such as the Cyber Resilience Act or others (e.g. AI Act, Data Act) include open source in their scope and will enter into force in the coming years or even months. For the very first time, the open source ecosystem will have to clearly comply with European law, or face legal consequences that could threaten projects and supply chains of all companies. Many questions remain open for maintainers, OSPOs, compliance or legal departments and: Is my project concerned? What should be done to comply? How should companies anticipate compliance of their products using open source?In Europe? In the world? How do foundations plan to ensure their projects can be used safely? How should foundations get support from industry and the public sector? This panel intends to give answers, helping our community to ensure certainty and sustainability of its supply chain in front of recent European laws.",{"id":406,"title":407,"published":408,"description":409},"DHp9SxpxIss","Anticipating the Cyber Resilience Act: The CCNL's practical guide","2025-03-19T17:42:37+00:00","Camille Moulin from Inno³ presents insights from the CNLL report, \"Be Ready to Integrate the Cyber Resilience Act into Your Open Source Practice.\"\n\nExplore the resources:\n🔗 Guide to the CRA: https:\u002F\u002Fcode.inno3.eu\u002Fouvert\u002Fguide-cra\n📄 Download the full report (PDF): https:\u002F\u002Fcode.inno3.eu\u002Fouvert\u002Fguide-cra\u002F-\u002Fblob\u002Fmain\u002FCNLL_inno3_Guide-CRA_VE_1.0.pdf",{"id":411,"title":412,"published":413,"description":414},"jcaU3AX7llk","CRA Implementation for Open Source & How ORC Contributes to the Landscape","2025-03-19T17:42:40+00:00","Tobie Langel sets the stage for the ORC workshop exploring key aspects of the Cyber Resilience Act (CRA), including:\n- CRA Fundamentals – Why, who, what, how, and when?\n- CRA Innovations – Full supply chain compliance\n- ORC Working Group – How it contributes to the CRA landscape\n\nWatch now to gain insights into the evolving regulatory framework and the role of the ORC WG.",{"id":416,"title":417,"published":418,"description":419},"1CWy55AhEnc","CRA Mondays | Sébastien Heurtematte on OCCTET Project - Tooling for CRA Compliance","2025-04-29T16:41:47+00:00","Welcome to the first episode of CRA Mondays, a series of insightful conversations hosted by the Open Regulatory Compliance (ORC) Working Group, focused on exploring the real-world impact and implementation of the EU’s Cyber Resilience Act (CRA) and related regulatory frameworks in open source and digital innovation.\n\nIn this session Sébastien Heurtematte, the coordinator of the OCCTET project, an EU-funded initiative designed to help SMEs navigate the challenges of cybersecurity compliance under the EU’s Cyber Resilience Act (CRA), will discuss:\n - The key implications of the CRA for SMEs and open source software\n - The challenges and opportunities in open source security and compliance\n - How the OCCTET Project Supports CRA Compliance Through Self-Assessment and Tooling\n- How SMEs and Open Source Communities can work together and get involved in the OCCTET project?\n\n🔗 LINKS\nLearn more about ORC & join the conversation: https:\u002F\u002Fwww.orcwg.org \nMore about OCCTET: https:\u002F\u002Focctet.eu \nNeeds Analysis workshop results: https:\u002F\u002Focctet.eu\u002Fresources\u002Fworkshop\u002Fneeds-analysis\u002Fneeds-analysis-workshop-report.pdf \n\n\nTIMESTAMPS\n00:00:00 Intro to the CRA Mondays and Sébastien\n03:35 OCCTET overview\n07:20 OCCTET consortium\n09:35 OCCTET Objectives\n13:58 OCCTET Tooling\n17:45 OCCTET KPIs\n19:54 OCCTET First Deliverables\n22:52 OCCTET Channels\n24:13 Q&A Session",{"id":421,"title":422,"published":423,"description":424},"zSsGLJTgWvU","CRA Mondays | Olle E. Johansson - The path to a global vulnerability management platform","2025-05-05T17:12:03+00:00","In this special  CRA Mondays episode, Olle E. Johansson joins the ORC Working Group to discuss the urgent need for a resilient, globally coordinated vulnerability reporting system, in light of recent disruptions to the NVD and the growing demands of the Cyber Resilience Act (CRA).\nOlle shares lessons from the CVE\u002FNVD funding crisis, outlines the risks of centralised control, and presents a vision for a multi-stakeholder, federated vulnerability ecosystem that puts trust, interoperability, and global participation at the centre.\n\nTopics Covered:\n – What's behind the NVD slowdown and why it matters\n – The limitations of today’s vulnerability reporting infrastructure\n – How the CRA mandates a robust vulnerability management system\n – A roadmap for building a federated, global alternative\n – The role of open source, CNAs, and government collaboration\n\nRESOURCES & LINKS\n –  📂 Olle’s presentation: https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fevents\u002Fcra-mondays\u002F2025-04-28-olle-e-johnansson.pdf\n –  📆 Join CRA Mondays & other ORC events: https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Ftree\u002Fmain\u002Fevents \n \nABOUT ORC\nLearn more & join the conversation: https:\u002F\u002Fwww.orcwg.org \n\nTIMESTAMPS\n0:00 Intro to the episode and Olle E Johansson\n1:05 Background to Olle's work on CVEs\n2:10 Evidence that represents challenges to the current CVE structure\n3:53 Technology for CVE programs or long-term planning first?\n5:27 The “why” behind the need for a long-term plan\n06:35 Concurrent challenges - Short-term needs and long-term planning\n07:22 The global platform\n08:27 Suggestions for the requirements of the Global Vulnerability platform\n12:30 Proposal for next steps\n16:14 Interested parties in the discussion\n17:00 Q&A - Funding mechanisms for the CVE system\n23:55 Q&A - Software identifiers\n29:00 Q&A - Traction in the space and who are the critical actors to make the long-term CVE plans successful\n33:35 Q&A - Interoperability of vulnerability reporting\n35:30 Q&A - Patch vs CVE - is a single ID type enough for the industry?\n41:30 Q&A - CVE Foundation vision\n43:00 Olle's closing statements\n45:40 Next #CRAMondays Session - Maxim Baële",{"id":281,"title":282,"published":283,"description":284},{"id":427,"title":428,"published":429,"description":430},"WSiarwqq7x4","What is the CRA? Why should open source maintainers care?","2025-07-10T14:32:51+00:00","The CRA is set to transform digital product security in the EU. We're uncovering why open source maintainers need to be in the know.\n\nCheck this video from the Maintainers Month webinar to learn how it affects open source software and the importance for those monetising it. \n\nParticipate in this conversation: https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fblob\u002Fmain\u002Ffaq.md#maintainers",{"id":432,"title":433,"published":434,"description":435},"lsHag1_r-5U","Will all types of open source contributors have to comply with the CRA?","2025-07-10T14:34:15+00:00","The CRA is redefining the landscape of open source involvement. \n\nDiscover who is responsible for cybersecurity, how the open source software steward plays a new role, and why contributors might be unaffected. \n\nCheck out this video from the Mainteiners Month to learn more about it.",1792684538000]