Why is everyone up in arms about this?

The legislation specifically excludes open source software. Has nobody in this discussion actually read the proposed legislation?

From the current proposal legislation text:

In order not to hamper innovation or research, free and open-source software developed or supplied outside the course of a commercial activity should not be covered by this Regulation. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable.

There is also a clause that states those using open source software in commercial products must report any vulnerabilities found to the maintainer.

In words of Dan Geer from his 2014 Black Hat keynote:

Today the relevant legal concept is "product liability" and the
fundamental formula is "If you make money selling something, then
you better do it well, or you will be held responsible for the
trouble it causes." For better or poorer, the only two products
not covered by product liability today are religion and software,
and software should not escape for much longer.

The EU legislation has good intentions. Software should not escape product liability. However, the current proposal is somewhat flawed (unless EU actually intends to finance security testing for FOSS projects!) and it needs some language to protect open-source innovation and distributed development models.

I'm hoping the EU will allow a model where FOSS developers can receive donations/charge for support without having to risk huge penalties.

This should be named the "Attempting to Kill Open Source Software by Imposing Impossible Burdens on the Same Act." I'm not sure that they intended this to destroy open source projects but... it may have that effect regardless.

This article seems poorly written and says the same thing over and over again with slightly different wording. I would have liked some more specifics.

The Cyber Resilience Act (CRA) could have several implications for the open source software sector:

1. Increased legal and financial responsibility
2. Deterrent effect on the development of open source software
3. Lack of consideration for the specificities of open source software
4. Lack of consultation of the open source software community

Only 2 of those are implications of the law. 3 and 4 are redundant and are not caused by the law's wording. They wouldn't even be a problem if not for 1. 2 is also caused by 1 in a fairly obvious way.

Mullvad VPN has a great blog about this:

I didn't read the article but one thing I can say is that open source cannot be killed, by design!