It is worth reading this in the context of the wider discussion around the EU CRA and free software, and the previous joint response by ISC, NLnet Labs, CZ.NIC,

It is worth reading this in the context of the wider discussion around the EU CRA and free software, and the previous joint response by ISC, NLnet Labs, CZ.NIC, netDEF: https://www.isc.org/blogs/2023-cyber-resilience-act-comment/ https://www.isc.org/blogs/2023-cyber-resilience-act-comment/ There is much more detailed analysis in that earlier post. I work for ISC but I have not been involved in the work on this issue and I have not read all the material linked from the earlier blog post.