Henri Sivonen (@hsivonen.mastodon.social.ap.brid.gy)

Cybersecurity Risk Assessment Request With the new EU legislation Cyber Resiliency Act (CRA), there are new responsibilities and requirements put on _manufacturers_ of digital products and services in Europe. Going forward these manufacturers must be able to know and report the exact contents of their software, called a Software Bill of Material (SBOM) and they have requirements to check for vulnerabilities in those components etc. This implies that they need to have full control and knowledge about all of their Open Source components in their stack. (See the CRA Hub for a good resource on CRA for Open Source people.) As a maintainer of a software component that is widely used, I have been curious to see how this will materialize for us. Today I got a first glimpse of what I can only guess will happen more going forward. This multi-billion-dollar Fortune-500 company that I have no contract with and with which I have had no previous communication, sent me this email asking for a lot of curl information. A slightly redacted version is shown below. Now that my curiosity has been satisfied a little bit I instead await the future and long to see how many more of these that will come. And how they will respond to my replies. CRA_request_counter = 1; ## The request > Hello, > > I hope this message finds you well. > > As part of our ongoing efforts to comply with the EU Cyber Resilience Act (CRA), we are currently conducting a cybersecurity risk assessment of third-party software vendors whose products or components are integrated into our systems. > > To support this initiative, we kindly request your input on the following questions related to your software product “libcurl” with version 7.87.0. Please provide your responses directly in the table below and do reply to all added in this email, > > Additional Information: > > * Purpose: This security assessment is part of our due diligence and regulatory compliance obligations under the EU CRA. > * Confidentiality: All information shared will be treated as confidential and used solely for the purpose of this assessment. > * Contact: Should you have any questions or need further clarification, please feel free to reach out by replying directly to this email. > > > We kindly request your response by Friday, July 25, 2025, to ensure timely completion of our assessment process. Thank you for your cooperation and continued partnership in maintaining a secure and resilient digital environment. ## My reaction and response I am not their _vendor_ without having a more formal relationship established and I am certainly not going to spend a few hours of my spare time gathering a lot of information for them for free for their commercial benefit. They “kindly” want me to respond within two weeks. Their use of double quotes around “libcurl” feels odd, and they claim to be using a version that is now more than 2.5 years old. Most if not all of the information they are asking for is already publicly and openly accessible and readable. I suspect they want the information in this more formal way to make it appear more reliable or trustworthy perhaps. Or maybe it just follows their processes better. (It also reminded me of the NASA emails.) I responded like this > Hello, > > I will be happy to answer all curl and libcurl related questions and assist you with this inquiry as soon as we have a support contract setup. You can get the process started immediately by emailing [email protected]. > > Thanks, I’m looking forward to future cooperation. > > / Daniel I will let you know if they take me up on my offer . ## The screenshot This snapshot of how it looked also shows the actual nine-question form table. Email screenshot ## Why the company name is redacted I’m looking forward to eventually do business with this company, I don’t want them to feel targeted or “ridiculed”. I also suspect that there will be many more emails like this going forward. The company name is not the interesting part of this story. https://daniel.haxx.se/blog/2025/07/11/cybersecurity-risk-assessment-request/