What Godot devs need to know about this new EU law (Cyber Resilience Act)

The Cyber Resilience Act, or CRA, is a new legislation that aims to establish new cybersecurity requirements for devices and software marketed in the European Union. In this video, I'll try to explain the effect it could have both on the Godot game engine and on the games themselves.

📚 *Recommended products:*

One way to help the channel is to purchase any of the following products since I receive a small commission from them. Thank you very much for your support!

(Disclosure: As an Amazon Associate I earn from qualifying purchases.)

☺ *Support the channel:*

Any donation is gratefully received, thank you!

- Via YouTube's Super Thanks (⬆ Button labeled THANKS above ⬆)

🔔 *Subscribe:*

Subscribe to my channel to see more videos like this:

📖 *Useful resources:*

- Draft of the law:
- Cyber Resilience Act: it’s time to act to #FixTheCRA!

🔤 *Text version of the video:*

🔵 *Follow me:*

Find out about my latest videos and publications:

⏳ *Timecodes:*

00:00 - Introduction
01:15 - What is the Cyber Resilience Act, or CRA?
04:05 - How will the CRA impact Godot and games published in the EU?
06:38 - Conclusion

---

Music credits:

Cinematic Documentary | Majestic by Alex-Productions |

[forestrf]

I sent an email to Nicola Danti to try do my part and avoid damage from uninformed politicians. Thank you.

[linuxrant]

It's hard to evaluate the nature of this CRA, because I don't understand exactly what is their strategy, what are it's definitions of security, and how exactly they plan to enforce this so called security. EU many times harmed us when wetting their dirty hands into peoples businesses. I say, leave us alone. We do not need bullies taking care of our security.

[RenceAsANoob]

I'll just wait for FOSS channels that do provide a bigger view and perspective of what's going on. There are already few videos of this EU law already, and from what I've seen so far, it's going to be a detriment to the FOSS community.

[elsolem]

Can't speak on FOSS as a whole, but for Game Devs this only really effects you if you are running online games, or games with ads(which often requires internet). Systems that are easily exploitable and therefore a risk to the whole thing. Godot doesn't "need" internet access to work so the biggest risk would be download vectors and IMO enforcing that kind of security is a good thing, cause its kind of bare minimum, "making sure ppl don't download malware when downloading your software"

[Not_Even_Wrong]

Thanks for this video. This had not been on my radar before.
It seems like this could be really bad. Will keep an eye out for future development.

[wulfrickwille]

Hey David, do you know if there are signature collections going on?
It might be too early for that since everything can still change (hopefully)..

I am really worried for Linux and a bit about the devs responsibilities when selling a game.

[Desvelar]

I will likely just block EU and and leave a note for people from the EU not to buy. Then site the law.

[linuxrant]

EU is 50 years too late, Richard Stallman already solved the most of security issues by introducing the GP License. EU can shove somewhere their dirty hands and leave us alone in freedom and peace.

[omiorahman]

Don’t worry there is the cave game engine and upge engine if godot fails there are still others

[ethanwasme]

it's a good law in my books, but I'm not smart enough to see the good and bad 😢

[forasago]

Nothingburger. Self-assessment, lmao. Okay, I've assessed my game. It's safe. Done.