Author implicitly raises a question, but fails to articulate it and then answer it clearly. The question is whether open source software is to be considered a p

Author implicitly raises a question, but fails to articulate it and then answer it clearly. The question is whether open source software is to be considered a product and somewhat related whether downloading/using open source software creates a transaction. I can safely say that I don't now the answer to the question and therefore I cannot draw conclusions as far reaching as the article author does. Effectively, the CRA is going to impose certain security standard on software products. People in medical, automotive, aviation, military fields were already subject to certain security standards, so GitHub's claim regarding unobtainability is demonstrably misleading if not outright false, depending on definitions of safety/security standards. As it pertains to open source, it all depends on whether mere publication of open source software would be considered product release. I can agree with the author here that clarification may be needed. An important note here is that such regulation (OS is not affected) would have tremendous effect on open source. The companies using open source software in products would essentially be forced to either take open source under their belt with proper controls in place or be effectively forced to properly support open source development by at least providing security oversight. Sincerely, I have no idea what effect that would have as a whole.