31 ms·

Open-source software vs. the proposed Cyber Resilience Act

215 points by xk3 4y ago

pelasaco 4y ago
The OSS community thought that Microsoft would destroy OSS, but the real danger is throwing some legislators in the game.. I always thought that the way that we would destroy OSS was making it political, but making it bureaucratic is a easier and cheaper way to destroy OSS.
can16358p 4y ago
[flagged]
creshal 4y ago
Original title: "Open-source software vs. the proposed Cyber Resilience Act" Emphasis on "proposed", the current edited title sounds like it's already in effect.
- UltraViolence 4y ago
  Judging by the DMA and DSA these EU proposals almost always make it into law with only minor changes. So yes, this is something to be concerned about.
  - EMIRELADERO 4y ago
    All the proposals you hear about make it into law except those which you don't hear about.
- NoboruWataya 4y ago
  The edited title also makes it sound like the legislation is specifically aimed at open source projects, which is not the case.
- pvg 4y ago
  Proposed legislation is mostly offtopic on HN to boot: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=author%3Adang%20proposed%20bills&sort=byPopularity&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
  - class4behavior 4y ago
    Drafts are modified or rejected because of expert/public commentary. As such, it's weird for dang to consider proposals offtopic since HN is not supposed to be like Reddit a general audience discussion platform. Parliamentary committees are where the true work is done both in the US and the EU, so there is always value in attracting attention to their work in progress. Finally, many drafts may not go anywhere but they are often used as a foundation for future legislation which does go through.
    - pvg 4y ago
      The argument isn't that these things are somehow intrinsically bad, they're just not good topics for HN. One reason is that they tend to attract a lot of repetitive advocacy which is normal for proposed legislation but is pretty bad for interestingness, especially for a forum with 30 front page slots. It's really easy to make an argument for almost anything being somehow within HN's rubric or important in some way. These arguments are often true! But that also tells you they aren't useful criteria for deciding what works and doesn't on the forum since if you accepted them all, everything is good for the forum. Repetition and repetition-generation is HN-bad. Another example are software release posts. Those are super HN-y by topic but the bulk of them are also not great HN posts and routinely get downweighted because they tend to produce the same generic discussions which are fine in general but not (for HN purposes) at the release cadence of most active software projects.
      - class4behavior 4y ago
        That's both a slippery slope and a strawman argument. No one argued we should allow all links to any legislative work no matter its significance. Not to mention that HN does allow repetition as long as there is a fair period of silence between similar submissions. The criteria has always been that of relevance, impact, and depth. So what mods could demand is a submission statement with a quote/source describing the momentum or the viability of the discussed regulation . In the EU when it's at the public consultation or commission adoption stage it's already serious enough, in the US you want to some evidence the bill won't just die in the next chamber.
occamrazor 4y ago
The regulation looks reasonable: if someone is selling software, or products containing software components, they have to certify the security of their products. OSS developers who don’t charge for the software have no obligations. If their software is used in a commercial product, the seller of that product is responsible.
- pyb 4y ago
  No, CE markings are normally for finished products, not components. (in many cases the software is a component). Most open sourced projects are not user-facing finished software products.
  - pyb 4y ago
    So, I think this new legislation might be bad, as the distinction between a component vs a finished product is a lot less clear in software, and particularly open-source projects. I'm not sure the lawmakers will consider this carefully.
  - throwaway294566 4y ago
    No, the regulation explicitly includes components: > For the purposes of this Regulation, the following definitions apply: (1) ‘product with digital elements’ means any software or hardware product and its remote data processing solutions, including software or hardware components to be placed on the market separately https://ec.europa.eu/newsroom/dae/redirection/document/89543 https://ec.europa.eu/newsroom/dae/redirection/document/89543
    - pyb 4y ago
      Oh my, I need to update my understanding of CE markings if it's like this in this instance. This is going to be complete chaos.
- WesternWind 4y ago
  yep, and accepting donations are not charging for a product, much like my tipping a bartender isn't paying for a drink.
_vbnz 4y ago
It sucks they should just set up a fund for fundamental projects - Linux, LibreSSL, OpenSSL, etc. and then make companies of a certain size contribute. It could even be a way of boosting the European Tech industry by funding FOSS consultancies within Europe. Instead we just get more bureaucratic anti-innovation makework - just like the Link Tax, Cookie law and GDPR, etc.
- deleted 4y ago
  [deleted]
- nomercy400 4y ago
  Or, the foundations could come together and provide a compliancy/audition foundation that does these audits, letsencrypt-style, for (nearly) free. A fund sounds like a great idea as well, but who would decide who gets the money? You don't want overseas companies syphoning the fund because they have 0.01% of their userbase in the EU. Overall, as others have stated: how unreasonable is it if you create a 'critical' product, and you make money off of it, to invest some of that money to show it is secure.
  - mistrial9 4y ago
    google OSS-fuzz
    - throwaway294566 4y ago
      That isn't an audit. Audits are not about actually doing anything about security. Audits are about having documented procedure and properties and reviewing documentation. The typical software you need to google in the context of an audit is "Excel" for the endless fill-me-in lists of compliance b.s. your auditor will make you fill in...
  - UncleEntity 4y ago
    > Overall, as others have stated: how unreasonable is it if you create a 'critical' product, and you make money off of it, to invest some of that money to show it is secure. I suppose it depends on how many hurdles you want to place in front of innovation. I learned after driving a cab for nine years just how little I can live off of and if I cut out the luxuries (like hot water) it was surprisingly little. Now suppose I were able to get people to pay me peanuts (through donations for the sake of the argument) to maintain some critical software because, you know, “someone has to do it and this guy will work for peanuts”, just how many luxuries am I expected to do without to comply with some overbearing regulation?
gwnywg 4y ago
I am not an author of popular OSS project so my view is probably distorted, but as OSS develpper would you give a dime about legislation like this? Edit: It made me thinking, how would legislator ensure legislation is implemented? Would they start requiring escrow so they can check by themselves if software is developed to the correct security standard?
- ISL 4y ago
  If compliance costs and liability were shuffled onto developers working for free, I'm pretty sure you'd see a sudden drop in EU OSS development.
  - Xylakant 4y ago
    Developers working for free are explicitly exempt. The article lays out that the carve-out has issues and those should get resolved, but fundamentally it‘s there.
    - paganel 4y ago
      What happens with EU-based developers that work on OSS projects while on a company’s dime? I.e. said company doesn’t have any direct relation with that project, but wants to support it by paying some of its developers to put in the work. Or to developers that receive Patreon money based on their OSS projects? It can get pretty murky pretty fast.
      - Xylakant 4y ago
        Then they‘re no longer working for free. That‘s exactly the issues this article is discussing - but that‘s not the point the parent poster was alluding to. They specifically mentioned „for free.“ However, if you build security critical software and get paid to do so it‘s not entirely unreasonable to require some sort of certification. You can‘t just build medical devices for money either without some sort of regulation. Or produce food for money. Or repair cars for money.
hulitu 4y ago
It is for your own good. And for insurance companies.
- coldacid 4y ago
  And for KPMG.
tasubotadas 4y ago
Yes! Another German biurocracy-inspired bill to outlaw problems in the society. Why they just don't release a law that forbids people from making bugs?
- nothis 4y ago
  >Why they just don't release a law that forbids people from making bugs? The more I think about it, isn't that literally what the law is about, lol?
- nonethewiser 4y ago
  This is trending towards requiring a license to develop software. You will need to ask the government for permission to develop software just like you do for countless other professions.
  - continuational 4y ago
    The beginning of professionalism in software?
- deleted 4y ago
  [deleted]
Aeolun 4y ago
I keep reading bills from the EU that make me feel like someone would be crazy to ever start a (tech) company there.
- that_guy_iain 4y ago
  Considering it's looking very likely that US based companies are going to be locked out of the EU over GDPR and FISA - creating an EU based version of all the major players seems like a very wise move.
  - _vbnz 4y ago
    But they could just do that directly - like Russia and China have done with Yandex, VK, WeChat, TikTok, Baidu, etc. But for some reason the EU is still hooked on neoliberalism and anti-protectionism, even when it has ravaged the continent with the energy crisis and the US monopolising the Tech industry, etc. (remember that the ZX Spectrum, BBC Micro, Acorn, ARM, Linux and Nokia were all European once). Like in this case - it'd be better to just invest directly into support for EU-based FOSS consultancies to contribute and maintain critical libraries like OpenSSL, LibreSSL, Linux, etc. - and then all EU government and industry would benefit with that, whilst keeping the jobs and investment in the EU. They're just so short-sighted and dogmatic about neoliberalism (as well as doing whatever the US asks, regardless of the negative effect on Europe). It's no wonder we're being eclipsed by China. Just look at the GDP per capita and Productivity since 2008 - https://data.worldbank.org/indicator/NY.GDP.PCAP.CD?locations=GB-US-ES-DE-FR-IT https://data.worldbank.org/indicator/NY.GDP.PCAP.CD?location...
    - Foobar8568 4y ago
      So much this. This morning I was thinking about the supposed CIA handbook to ruin companies, at this stage I wonder if it wasn't done for states. My wife asked me why I don't create startup, well it's all due to these bullshits.
      - varispeed 4y ago
AtlasBarfed 4y ago
Once again, we have dictates and rules based security policy and no solutions provided. If the EU is so concerned about cyber security they should: 1) provide A LOT of funding and support for Linux / BSD and other operating systems and flavors for testing, hardening, and rapid patch rollout 2) provide infrastructure to support such activities 3) use open source software actively in government with a focus on providing feedback and patches from government IT back to the mainline projects A founding tenet of security is that open systems and techniques are the ones that will be most battle tested and therefore resilient. Alas open source has terrible lobbying, so the closed source vendors can lobby politicians and policy to go the opposite way: prescribe closed source solutions and additional onus on open source. If first world economies were serious about cyberdefense and hardening, there would be 10 billion dollars annually invested into the foundations of open source software: Linux/BSD, databases, webservers, browsers, programming languages, etc. The militaries alone should be dedicating this level of funding to defend our infrastructure, economies, and whatever technological edge we have over China. And the EU in particular should like Linux: it originated there, and has strong roots throughout the EU, and most importantly isn't controlled by a major US corporation (unlike Apple/Microsoft) and therefore indirectly controlled by the US government.
- throw_m239339 4y ago
  The EU is a bureaucracy and any bureaucracy's goal is to justify its existence by creating more bureaucracy. I'm personally anti-EU. European countries are way too different so that broad legislations can work with 27+ different countries.
  - nivenkos 4y ago
    Do you think the same about the US states?
    - weberer 4y ago
      All 50 states have the same language, the same general culture, have fought the same wars, vote for the same 2 political parties, watch the same media, and more or less have the same economy. But really, just the language thing is enough to make the comparison silly.
seydor 4y ago
I was hoping we could legislate nuclear fusion first. Or at least antigravity
- bjornsing 4y ago
  Don’t know about fusion. But in Sweden it was actually illegal to think about nuclear fission for quite some time [1]. 1. https://sv.m.wikipedia.org/wiki/Tankeförbudet https://sv.m.wikipedia.org/wiki/Tankeförbudet
  - _Algernon_ 4y ago
    "In Bill 2005/2006:76, the Persson Government stated the reasons for abolishing the law when it stated that there *had never been any ban on thought*, but that the "incorrect perception of the meaning of the provision is well established"
    - bjornsing 4y ago
      True. If your thoughts stayed entirely in your head then it probably wasn’t a crime. But if you for instance jotted down some rough cost estimates on a piece of paper you were in trouble. :)
  - unknownsky 4y ago
    "Tänker" sometimes means "think" but it also means "plan". The Wikipedia article states that it was illegal to make formal preparations to build a power plant, but even that was not enforced.
    - bjornsing 4y ago
      Even that… :)
ramtatatam 4y ago
I wonder where would be the boundaries in case such legislation was pushed through. If my software is python-based then would python itself would have to be audited too? If I run my software in Podman containers then should Podman be audited too? What about operating system I execute my software on? Lets say thousand of companies use dependency X - would that dependency have to be audited 1000 times independently? That would be huge waste in my opinion..
- throwaway294566 4y ago
  Usually only the original producer of each component has to do the certification and apply the CE stamp. Any conglomerate doesn't need to reevaluate all the components themselves, only their interactions in the conglomerate. So for your Python software you are fine either just providing the software alone, without an interpreter, having the customer get a Python-standard-compliant (if there were such a thing...) interpreter for themselves. Or you could provide a CE-certified Python interpreter that you got somewhere else along with your software, provided you do not change the interpreter you got and the interaction between your software and the interpreter is standard, run-of-the-mill, unsurprising normal use as intended and certified.
  - ramtatatam 4y ago
    This feels like trying to match physical-world regulations to software products... I'm skeptical about this legislation, it feels like another step for policy makers to conquer software domain which is still very open for anybody to enter... I remember living in London and talking with friend who is electrician, the amount of papers he needed in order to be able to do his job was mind boggling...
    - paulryanrogers 4y ago
      Electrical mistakes can very directly and invisibly lead to deaths. Most software is not life and death.
nonethewiser 4y ago
Government are good at many things, but building towards ideal societies is not one of them.
trh0awayman 4y ago
Would this spell the end of SerenityOS?
pmontra 4y ago
Random thoughts while reading the post: 1) commendable, but 2) the EU shooting in its foot, because 3) large rich American closed source companies will very happy to comply 4) where will they find all the auditors to check the zillion of small open source projects inside node_modules for a commercial project? And who's going to pay them? Again, closed source companies are very happy.
- nonethewiser 4y ago
  Not sure if it's literally regulatory capture, but it certainly has the same effects, as you've mentioned. Except I think it's actually the established, non-tech EU companies that benefit more than big US tech but I could see them benefiting too. edit: apparently there is a similar bill in the US. So that does sound like regulatory capture.
- execveat 4y ago
  HN crowd is completely missing the intent. Nobody wants to chase open source developers. The problem is that right now a person can go buy a smartphone or WiFi router which uses obsolete software components already and will never receive any updates. Hopefully it gets fixed through this legislation.
  - mgraczyk 4y ago
    The "fix" will be that Europeans will only be able to buy from a handful of the largest smartphone manufacturers, and there will never be another European company selling smartphones.
  - throwaway294566 4y ago
    > Nobody wants to chase open source developers. That might be true for the lawmakers. But as it is, there will be unintended consequences: First, what the article criticizes: Open-Source development might be discouraged because the exemption isn't clear and encompassing enough. Compliance is enough of a burden to stop any "halfway commercial" OSS developments in the EU, with a very wide interpretation of "halfway commercial". Second, there will be the ambulance chasing kind of lawyers profiting from any kind of ambiguity by sending expensive warning letters ("Abmahnungen"). Those scumbag lawyers definitely want to chase open source developers and everybody else without a big legal team who provides them with an opportunity... And experience shows that lawmakers have always been unable or unwilling to write laws with the necessary clarity and non-ambiguity.
readsadhours 4y ago
Given that a similar thing was introduced to the US senate[1] I will have to wonder who is behind this. [1] https://news.ycombinator.com/item?id=32956218 https://news.ycombinator.com/item?id=32956218
- throwaway294566 4y ago
  I'd guess large producers of commercial software. BigCo doesn't have any problem having an entire compliance & audit b.s. department. However, all the smaller companies, independent developers and OSS software will be regulated out of the market.
- binkHN 4y ago
  Similar? The US law focuses on how federal agencies acquire and review OSS software—the EU law throws bureaucracy across the entire OSS landscape.
varispeed 4y ago
It's interesting that EC is not looking at addressing the obvious loophole big corporations are using - that is they are saving on R&D and tax by using open source software without paying the developers for their time. If these big corporations were paying up the fair share of profit generated by the open source software they use, I am sure the developers behind it would have funds essential to ensure the security of the software they make. That being said, even if above was not feasible (shame!), then it should be up to corporation using the software to ensure it is secure (and possibly contributing any fixes back to the software).
- continuational 4y ago
  Perhaps require that certifying commercial software as CE entails publicly certifying all the individual OSS components as CE as well.
- UncleEntity 4y ago
  If someone intentionally releases their software under a free license how is another someone taking them up on their offer a loophole?
pella 4y ago
from the proposal: "(13) In order not to hamper innovation or research, this Directive should not apply to free and open-source software developed or supplied outside the course of a commercial activity. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. However where software is supplied in exchange for a price or personal data is used other than exclusively for improving the security, compatibility or interoperability of the software, and is therefore supplied in the course of a commercial activity, the Directive should apply."
- oytis 4y ago
  Thank you for providing the whole quote. If indeed all software that is not directly supplied in exchange for a price is excluded, that would be a huge relief for the community. The fear is that they will proceed with extended definition of "commercial activity" though, out of fear of loopholes.
  - nonethewiser 4y ago
    In what sense is that "the whole quote?" Here is an excerpt from the article that puts into context why this is concerning. But honestly, just read the article. > Now, what is a commercial activity? The CRA does not define this term. However, conversations with people more knowledgeable on product legislation pointed me to the EU Blue guide to the implementation of EU product rules: > Commercial activity is understood as providing goods in a business related context. Non-profit organisations may be considered as carrying out commercial activities if they operate in such a context. This can only be appreciated on a case by case basis taking into account the regularity of the supplies, the characteristics of the product, the intentions of the supplier, etc. In principle, occasional supplies by charities or hobbyists should not be considered as taking place in a business related context.
    - oytis 4y ago
      I mean this part > This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. However where software is supplied in exchange for a price... This says that publicly available open-source software that is not supplied in exchange of a price (as in, say, customised versions of software that are not available to general public) is exempt. It doesn't cite any other commercial activity (technical support, donations etc.) from EU Blue guide.
binkHN 4y ago
This kind of reminds me of when encryption became a munition in some countries—development moved to countries where encryption wasn’t outlawed. Something tells me a bit of a brain drain will happen if this comes to fruition as groups will go out of their way to develop software outside of the EU. Either that or the EU will be full of undesirable software that has been audited, but is still vulnerable.
kazinator 4y ago
This generally smells like the work of deep pockets vested in proprietary software.
- deleted 4y ago
  [deleted]
generalizations 4y ago
This reminds me of an aphorism: "When you owe the bank a million dollars, that's your problem. When you owe the bank a billion dollars, it's the bank's problem." What happens when/if core technologies like SSL, BIND, and even the Linux kernel fail to meet these requirements? Will EU entities have to stop using noncompliant open source software? As someone who is not a fan of bureaucracy, the consequences of this could be almost hilarious. Edit: TFA is writing about this as legislation to be concerned about. I'd wonder if the best response to this is malicious compliance: "sorry $EU_ENTITY, we never certified, so you can't use our tech that happens to be fundamental to the security/networking/OS stack."
- insanitybit 4y ago
  There are lots of alternatives for SSL libraries, and there are also indeed increasing alternatives to Linux. But in reality, Linux tends to get patches for compliance purposes, or forks for meeting various obligations.
  - Beltalowda 4y ago
    These smaller projects are probably even less likely to be compliant. If anything, it will create a situation where e.g. OpenSSL is audited and compliant, but other newer solutions aren't so you can't use them. If "has been audited and approved" would be a good assurance the project is of good quality then that might be okay, but overall I find it's a rather weak signal.
    - insanitybit 4y ago
      Smaller projects? There are tons of very mature TLS libraries.
      - Beltalowda 4y ago
        "Smaller" does not imply "not mature", or "not used". It just means ... "smaller". For example Go has a boringssl build because boringssl is FIPS certified whereas the default Go crypto stuff isn't, and this matters for some people.
Animats 4y ago
It seems to be time for this. There's a war on. We're now seeing regular attempts to sneak backdoors into open source code.[1][2] And those are the ones that have been found. There was a Linux kernel bug where someone put a test for root in as "if (uid = 0)" instead of "if (uid == 0)", so that when a rarely used system call was made, the process became root.[3] The EU is most concerned about "Class II software". The stuff that runs industry. [1] https://acronisscs.com/blog-open-source-backdoors-in-the-wild https://acronisscs.com/blog-open-source-backdoors-in-the-wil... [2] https://www.zdnet.com/article/open-source-software-how-many-bugs-are-hidden-there-on-purpose/ https://www.zdnet.com/article/open-source-software-how-many-... [3] https://www.infoq.com/news/2013/10/Linux-Backdoor/ https://www.infoq.com/news/2013/10/Linux-Backdoor/
- deleted 4y ago
  [deleted]
- light_hue_1 4y ago
  > There was a Linux kernel bug where someone put a test for root in as "if (uid = 0)" instead of "if (uid == 0)", so that when a rarely used system call was made, the process became root.[3] No there was not! Someone in 2003 submitted a patch. To the wrong repo. The patch was looked at anyway and rejected for this reason. It was never merged. No machine ever had this bug.
- djbebs 4y ago
  The main culprits of those things are the governments making these laws. Make no mistake this will just be used to implement those backdoors.
Barrin92 4y ago
I think this is long overdue and virtually all posts in this thread seem to be generic, entirely contentless 'EU bureaucracy' rants. From the article: (i) it is designed to run with elevated privilege or manage privileges; (ii) it has direct or privileged access to networking or computing resources; (iii) it is designed to control access to data or operational technology; (iv) it performs a function critical to trust, in particular security functions such as network control, endpoint security, and network protection. (b) the intended use in sensitive environments, including in industrial settings[...] There's a clear distinction here between what the EU labels 'critical products' and non-critical software. Seeing the increasingly insecure global situation, the importance of software in infrastructure and the potential threats I think it's wild that something like this hasn't passed a decade ago. Digital infrastructure needs to be as secure as physical infrastructure. I wonder what would happen if some Heartbleed-esque bug that went undiscovered for years took out a huge chunk of a nation's electricity grid in a military conflict. What the EU needs in addition is if course also more funding for software security, but they're already doing a halfway decent job. If you didn't know, if you fix open source bugs in the EU you can get paid for doing just that: https://ec.europa.eu/info/news/european-commissions-open-source-programme-office-starts-bug-bounties-2022-jan-19_en https://ec.europa.eu/info/news/european-commissions-open-sou...
- UncleEntity 4y ago
  > it has direct or privileged access to networking or computing resources Sure, but what does “direct” mean in this context? My little IRC client library or a device driver in the kernel? Either one could be used in an exploit chain to take down the EU power grid. Theoretically, of course, because I don’t actually have an IRC lib and I don’t think it would be used to control a power grid if I did…at least I would hope so.
- oytis 4y ago
  It would be totally reasonable to require special certification for software running on critical infrastructure (is it not the case already by the way?). They are trying to blanket cover the whole market though which looks like another attempt to fight the market reality frankly, with predictable outcome.
- 4y ago
rad_gruchalski 4y ago
Seems like the most lucrative part of this proposal is to become the auditor. /s This reminds me of the Gaia-X / IDSA certification and approval framework blanketing the whole software industry in the EU. I am not sure yet what to think about it. On one side, it looks a bit like proprietary software vendors trying to cut out SMEs who can match the quality with the same open-source software the big players use, but have no funds to go through the certification. The really funny part of this legislation is: the big players who can afford certification will be able to use ANY open-source component for free but the people who built it will have a tough time to go to the market because they will require the funds they don't necessarily have. Crazy situation. On the other hand, if this is applied to everyone, well, it will get rolled into the cost of providing a service. You want to buy this from me? Sure, I'll charge you for compliance report. The really funny part of the "Call for evidence for an impact assessment - Ares(2022)1955751" document (section C.) from https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/13410-Cyber-resilience-act-new-cybersecurity-rules-for-digital-products-and-ancillary-services_en https://ec.europa.eu/info/law/better-regulation/have-your-sa... reads: > The initiative is expected to have positive economic impacts. That section completely misses to mention that increased compliance cost will inevitably lead to increased software and services pricing, thus will lead to decreased competitiveness of European SMEs on the international market. Hot take: I can see two options to cripple this: 1) Drown the legislator in compliance requests for minor code. 2) Dual-licensing: AGPLv3 + commercial license.
- stefanfisk 4y ago
  The cost does not scale with the business' size though, so large players can easily eat it while small ones can't even play :/
  - pelasaco 4y ago
    still everyone will have to go through the auditing process.
  - deleted 4y ago
    [deleted]
- 4y ago
binarynate 4y ago
I'm an American that sells software to clients in the EU that this legislation considers a Class I critical product (https://vuplex.com https://vuplex.com). If this law is passed, what would be the consequence of not hiring an auditor to comply with it? Depending on the cost of an auditor, compliance may cost more than the revenue generated from the EU. If that's the case, it may no longer be economical for me to sell to clients in the EU.
- Archelaos 4y ago
  I think the situation would not be different if you were an EU citizen.
- nonethewiser 4y ago
  > I'm an American that sells software to clients in the EU that this legislation considers a Class I critical product (https://vuplex.com https://vuplex.com). For more context, a "critical" product cannot be self-assessed. He would have to hire the auditor.
  - Iv 4y ago
    CE is typically obligation of result, not obligation of effort. Do you have source on products that can't be self-assessed?
    - pimterry 4y ago
      The article, directly referencing the proposed legislation, says: > developers of critical products may not perform self-assessment and need to involve third-party auditors
- baggy_trough 4y ago
  Certainly; that's the idea. Regulation is usually designed to favor large incumbents with some fig leaf of justification, in this case hand waving about security.
- EnKopVand 4y ago
sebow 4y ago
Another garbage idea out of Brussels. Given the fact that we're lacking in the system engineering space for more than a decade, this will only curb some of the decent innovations people have began expanding upon in the last couple of years. (See the various talks & ideas from usenix for example, amongst other events) On the "bright side", this will realistically be impossible to enforce. Any national court who deems such industry important will probably use a local constitutional amendment to reinforce that CODE easily falls under freedom of expression, just like any other craft. EU showing once again how desperate it is for money. Let's strangle out all our industries until nobody can make anything anymore: See agriculture, energy, manufacturing, and "now" even a bigger range of the IT spectrum.
- blibble 4y ago
  > Any national court who deems such industry important will probably use a local constitutional amendment to reinforce that CODE easily falls under freedom of expression, just like any other craft. if you're in the EU then EU legislation overrides any local law
diego_sandoval 4y ago
> the legislation and its (unintended) negative effects on developers of open-source software. The negative effects seem pretty intended to me. The legislators are aware of open source software and have an exception for non-commercial activities, but intentionally penalize OSS related to commercial activities, by leaving them out of that exception. And, at this point, I don't believe that these legislators are so stupid that they can't see the consequences of their proposals. They probably just don't care about the negative consequences, or the "negative consequences" (negative for us) are actually what they're striving for.
- Kenji 4y ago
nickdothutton 4y ago
“Governments of the Industrial World, you weary giants of flesh and steel…”
stonemetal12 4y ago
Red Hat has been providing indemnification for patents for RHEL. This seems like another regulatory bag they will have to carry. Everybody will just use Red Hat, because it is already certified so they can just pass the certification along. "outside the course of a commercial activity should not be covered by this Regulation" Is this kind of wording normal In EU laws? Why use "Should" in the law, since we are in the middle of defining what is going to happen shouldn't it be "is"?
PoignardAzur 4y ago
The level of vitriol from the commenters here is honestly frightening. If the Commission was proposing a law mandating that cars have seat-belts, people would be jumping in to shout "Europe is destroying free enterprise, they're trying to destroy small car-makers!" Seriously, when you look at the list of concerned software, you have password managers, operating systems, certificate infrastructure, remote access software, industrial IoT, etc. For any software in these categories, it's not completely insane to think that "This software is provided as-is with no warranty whatsoever, good luck!" doesn't quite cut it. And yes, open-source is concerned as well, when it's part of a commercial activity. Again, if you're being paid to provide software, it seems fair to say you're leaving the "lobbyist" category and entering the "paid professional" category and you have to worry about security requirements. Especially given that, outside of the critical projects mentioned above, you're allowed to display the CE mark if you self-audit. Are there deeper discussions to be had here, concerns to be addressed, etc? Absolutely. I think a critical point is how "commercial activity" is defined. A threshold of gross revenue could be an interesting solution. Are these deeper discussion happening in this thread? No. It's all "Europe hates innovation" and "I hate the EC and cookie banners so much!" Most commenters seem to automatically assume that any level of regulation is automatically going to drown small businesses and favor FAANG-scale corporations, which is more extreme than even the article calling out the regulation.
- boxed 4y ago
  I think the fundamental problem here is that it's all about avoiding mistakes, not about doing good things. This attitude in general is a pox on humanity. Once you start to see the pattern it's everywhere. Schools, science funding, hospitals, building codes, policing, banking, aerospace, and on and on. No one cares if you improve anything. They just care if you make a mistake. This attitude is a disaster.
- ExoticPearTree 4y ago
  As an european I do believe that the European Comission really hates innovation and they believe everyting should be regulated as if only the politicians know what's best for every one. Like they're trying to regulate what kind of chargers we can use, the maximum speed cars can reach, what you can say on the internet and so on. All in the name of safety, terrorism and all other buzzwords politicians throw around to make it sound important. If we'd had the EC 30-40 years ago, most probably would all still be using dial-up for internet or maybe DSL at best and still have BBSs. And PoignardAzure, yes, I do believe seatbelts and motorcycle helmets should be optional. If you die because you're too cool for them, you die - simple as that.

215 points by xk3 4y ago

The OSS community thought that Microsoft would destroy OSS, but the real danger is throwing some legislators in the game.. I always thought that the way that we would destroy OSS was making it political, but making it bureaucratic is a easier and cheaper way to destroy OSS.

can16358p 4y ago

[flagged]

creshal 4y ago

Original title: "Open-source software vs. the proposed Cyber Resilience Act" Emphasis on "proposed", the current edited title sounds like it's already in effect.

UltraViolence 4y ago
Judging by the DMA and DSA these EU proposals almost always make it into law with only minor changes. So yes, this is something to be concerned about.
- EMIRELADERO 4y ago
  All the proposals you hear about make it into law except those which you don't hear about.
NoboruWataya 4y ago
The edited title also makes it sound like the legislation is specifically aimed at open source projects, which is not the case.
pvg 4y ago
Proposed legislation is mostly offtopic on HN to boot: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=author%3Adang%20proposed%20bills&sort=byPopularity&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
- class4behavior 4y ago
  Drafts are modified or rejected because of expert/public commentary. As such, it's weird for dang to consider proposals offtopic since HN is not supposed to be like Reddit a general audience discussion platform. Parliamentary committees are where the true work is done both in the US and the EU, so there is always value in attracting attention to their work in progress. Finally, many drafts may not go anywhere but they are often used as a foundation for future legislation which does go through.
  - pvg 4y ago
    The argument isn't that these things are somehow intrinsically bad, they're just not good topics for HN. One reason is that they tend to attract a lot of repetitive advocacy which is normal for proposed legislation but is pretty bad for interestingness, especially for a forum with 30 front page slots. It's really easy to make an argument for almost anything being somehow within HN's rubric or important in some way. These arguments are often true! But that also tells you they aren't useful criteria for deciding what works and doesn't on the forum since if you accepted them all, everything is good for the forum. Repetition and repetition-generation is HN-bad. Another example are software release posts. Those are super HN-y by topic but the bulk of them are also not great HN posts and routinely get downweighted because they tend to produce the same generic discussions which are fine in general but not (for HN purposes) at the release cadence of most active software projects.
    - class4behavior 4y ago
      That's both a slippery slope and a strawman argument. No one argued we should allow all links to any legislative work no matter its significance. Not to mention that HN does allow repetition as long as there is a fair period of silence between similar submissions. The criteria has always been that of relevance, impact, and depth. So what mods could demand is a submission statement with a quote/source describing the momentum or the viability of the discussed regulation . In the EU when it's at the public consultation or commission adoption stage it's already serious enough, in the US you want to some evidence the bill won't just die in the next chamber.

occamrazor 4y ago

The regulation looks reasonable: if someone is selling software, or products containing software components, they have to certify the security of their products. OSS developers who don’t charge for the software have no obligations. If their software is used in a commercial product, the seller of that product is responsible.

pyb 4y ago
No, CE markings are normally for finished products, not components. (in many cases the software is a component). Most open sourced projects are not user-facing finished software products.
- pyb 4y ago
  So, I think this new legislation might be bad, as the distinction between a component vs a finished product is a lot less clear in software, and particularly open-source projects. I'm not sure the lawmakers will consider this carefully.
- throwaway294566 4y ago
  No, the regulation explicitly includes components: > For the purposes of this Regulation, the following definitions apply: (1) ‘product with digital elements’ means any software or hardware product and its remote data processing solutions, including software or hardware components to be placed on the market separately https://ec.europa.eu/newsroom/dae/redirection/document/89543 https://ec.europa.eu/newsroom/dae/redirection/document/89543
  - pyb 4y ago
    Oh my, I need to update my understanding of CE markings if it's like this in this instance. This is going to be complete chaos.
WesternWind 4y ago
yep, and accepting donations are not charging for a product, much like my tipping a bartender isn't paying for a drink.

_vbnz 4y ago

It sucks they should just set up a fund for fundamental projects - Linux, LibreSSL, OpenSSL, etc. and then make companies of a certain size contribute. It could even be a way of boosting the European Tech industry by funding FOSS consultancies within Europe. Instead we just get more bureaucratic anti-innovation makework - just like the Link Tax, Cookie law and GDPR, etc.

deleted 4y ago
[deleted]
nomercy400 4y ago
Or, the foundations could come together and provide a compliancy/audition foundation that does these audits, letsencrypt-style, for (nearly) free. A fund sounds like a great idea as well, but who would decide who gets the money? You don't want overseas companies syphoning the fund because they have 0.01% of their userbase in the EU. Overall, as others have stated: how unreasonable is it if you create a 'critical' product, and you make money off of it, to invest some of that money to show it is secure.
- mistrial9 4y ago
  google OSS-fuzz
  - throwaway294566 4y ago
    That isn't an audit. Audits are not about actually doing anything about security. Audits are about having documented procedure and properties and reviewing documentation. The typical software you need to google in the context of an audit is "Excel" for the endless fill-me-in lists of compliance b.s. your auditor will make you fill in...
- UncleEntity 4y ago
  > Overall, as others have stated: how unreasonable is it if you create a 'critical' product, and you make money off of it, to invest some of that money to show it is secure. I suppose it depends on how many hurdles you want to place in front of innovation. I learned after driving a cab for nine years just how little I can live off of and if I cut out the luxuries (like hot water) it was surprisingly little. Now suppose I were able to get people to pay me peanuts (through donations for the sake of the argument) to maintain some critical software because, you know, “someone has to do it and this guy will work for peanuts”, just how many luxuries am I expected to do without to comply with some overbearing regulation?

gwnywg 4y ago

I am not an author of popular OSS project so my view is probably distorted, but as OSS develpper would you give a dime about legislation like this? Edit: It made me thinking, how would legislator ensure legislation is implemented? Would they start requiring escrow so they can check by themselves if software is developed to the correct security standard?

ISL 4y ago
If compliance costs and liability were shuffled onto developers working for free, I'm pretty sure you'd see a sudden drop in EU OSS development.
- Xylakant 4y ago
  Developers working for free are explicitly exempt. The article lays out that the carve-out has issues and those should get resolved, but fundamentally it‘s there.
  - paganel 4y ago
    What happens with EU-based developers that work on OSS projects while on a company’s dime? I.e. said company doesn’t have any direct relation with that project, but wants to support it by paying some of its developers to put in the work. Or to developers that receive Patreon money based on their OSS projects? It can get pretty murky pretty fast.
    - Xylakant 4y ago
      Then they‘re no longer working for free. That‘s exactly the issues this article is discussing - but that‘s not the point the parent poster was alluding to. They specifically mentioned „for free.“ However, if you build security critical software and get paid to do so it‘s not entirely unreasonable to require some sort of certification. You can‘t just build medical devices for money either without some sort of regulation. Or produce food for money. Or repair cars for money.

hulitu 4y ago

It is for your own good. And for insurance companies.

coldacid 4y ago
And for KPMG.

tasubotadas 4y ago

Yes! Another German biurocracy-inspired bill to outlaw problems in the society. Why they just don't release a law that forbids people from making bugs?

nothis 4y ago
>Why they just don't release a law that forbids people from making bugs? The more I think about it, isn't that literally what the law is about, lol?
nonethewiser 4y ago
This is trending towards requiring a license to develop software. You will need to ask the government for permission to develop software just like you do for countless other professions.
- continuational 4y ago
  The beginning of professionalism in software?
deleted 4y ago
[deleted]

Aeolun 4y ago

I keep reading bills from the EU that make me feel like someone would be crazy to ever start a (tech) company there.

that_guy_iain 4y ago
Considering it's looking very likely that US based companies are going to be locked out of the EU over GDPR and FISA - creating an EU based version of all the major players seems like a very wise move.
- _vbnz 4y ago
  But they could just do that directly - like Russia and China have done with Yandex, VK, WeChat, TikTok, Baidu, etc. But for some reason the EU is still hooked on neoliberalism and anti-protectionism, even when it has ravaged the continent with the energy crisis and the US monopolising the Tech industry, etc. (remember that the ZX Spectrum, BBC Micro, Acorn, ARM, Linux and Nokia were all European once). Like in this case - it'd be better to just invest directly into support for EU-based FOSS consultancies to contribute and maintain critical libraries like OpenSSL, LibreSSL, Linux, etc. - and then all EU government and industry would benefit with that, whilst keeping the jobs and investment in the EU. They're just so short-sighted and dogmatic about neoliberalism (as well as doing whatever the US asks, regardless of the negative effect on Europe). It's no wonder we're being eclipsed by China. Just look at the GDP per capita and Productivity since 2008 - https://data.worldbank.org/indicator/NY.GDP.PCAP.CD?locations=GB-US-ES-DE-FR-IT https://data.worldbank.org/indicator/NY.GDP.PCAP.CD?location...
  - Foobar8568 4y ago
    So much this. This morning I was thinking about the supposed CIA handbook to ruin companies, at this stage I wonder if it wasn't done for states. My wife asked me why I don't create startup, well it's all due to these bullshits.
    - varispeed 4y ago

AtlasBarfed 4y ago

Once again, we have dictates and rules based security policy and no solutions provided. If the EU is so concerned about cyber security they should: 1) provide A LOT of funding and support for Linux / BSD and other operating systems and flavors for testing, hardening, and rapid patch rollout 2) provide infrastructure to support such activities 3) use open source software actively in government with a focus on providing feedback and patches from government IT back to the mainline projects A founding tenet of security is that open systems and techniques are the ones that will be most battle tested and therefore resilient. Alas open source has terrible lobbying, so the closed source vendors can lobby politicians and policy to go the opposite way: prescribe closed source solutions and additional onus on open source. If first world economies were serious about cyberdefense and hardening, there would be 10 billion dollars annually invested into the foundations of open source software: Linux/BSD, databases, webservers, browsers, programming languages, etc. The militaries alone should be dedicating this level of funding to defend our infrastructure, economies, and whatever technological edge we have over China. And the EU in particular should like Linux: it originated there, and has strong roots throughout the EU, and most importantly isn't controlled by a major US corporation (unlike Apple/Microsoft) and therefore indirectly controlled by the US government.

throw_m239339 4y ago
The EU is a bureaucracy and any bureaucracy's goal is to justify its existence by creating more bureaucracy. I'm personally anti-EU. European countries are way too different so that broad legislations can work with 27+ different countries.
- nivenkos 4y ago
  Do you think the same about the US states?
  - weberer 4y ago
    All 50 states have the same language, the same general culture, have fought the same wars, vote for the same 2 political parties, watch the same media, and more or less have the same economy. But really, just the language thing is enough to make the comparison silly.

seydor 4y ago

I was hoping we could legislate nuclear fusion first. Or at least antigravity

bjornsing 4y ago
Don’t know about fusion. But in Sweden it was actually illegal to think about nuclear fission for quite some time [1]. 1. https://sv.m.wikipedia.org/wiki/Tankeförbudet https://sv.m.wikipedia.org/wiki/Tankeförbudet
- _Algernon_ 4y ago
  "In Bill 2005/2006:76, the Persson Government stated the reasons for abolishing the law when it stated that there *had never been any ban on thought*, but that the "incorrect perception of the meaning of the provision is well established"
  - bjornsing 4y ago
    True. If your thoughts stayed entirely in your head then it probably wasn’t a crime. But if you for instance jotted down some rough cost estimates on a piece of paper you were in trouble. :)
- unknownsky 4y ago
  "Tänker" sometimes means "think" but it also means "plan". The Wikipedia article states that it was illegal to make formal preparations to build a power plant, but even that was not enforced.
  - bjornsing 4y ago
    Even that… :)

ramtatatam 4y ago

I wonder where would be the boundaries in case such legislation was pushed through. If my software is python-based then would python itself would have to be audited too? If I run my software in Podman containers then should Podman be audited too? What about operating system I execute my software on? Lets say thousand of companies use dependency X - would that dependency have to be audited 1000 times independently? That would be huge waste in my opinion..

throwaway294566 4y ago
Usually only the original producer of each component has to do the certification and apply the CE stamp. Any conglomerate doesn't need to reevaluate all the components themselves, only their interactions in the conglomerate. So for your Python software you are fine either just providing the software alone, without an interpreter, having the customer get a Python-standard-compliant (if there were such a thing...) interpreter for themselves. Or you could provide a CE-certified Python interpreter that you got somewhere else along with your software, provided you do not change the interpreter you got and the interaction between your software and the interpreter is standard, run-of-the-mill, unsurprising normal use as intended and certified.
- ramtatatam 4y ago
  This feels like trying to match physical-world regulations to software products... I'm skeptical about this legislation, it feels like another step for policy makers to conquer software domain which is still very open for anybody to enter... I remember living in London and talking with friend who is electrician, the amount of papers he needed in order to be able to do his job was mind boggling...
  - paulryanrogers 4y ago
    Electrical mistakes can very directly and invisibly lead to deaths. Most software is not life and death.

nonethewiser 4y ago

Government are good at many things, but building towards ideal societies is not one of them.

trh0awayman 4y ago

Would this spell the end of SerenityOS?

pmontra 4y ago

Random thoughts while reading the post: 1) commendable, but 2) the EU shooting in its foot, because 3) large rich American closed source companies will very happy to comply 4) where will they find all the auditors to check the zillion of small open source projects inside node_modules for a commercial project? And who's going to pay them? Again, closed source companies are very happy.

nonethewiser 4y ago
Not sure if it's literally regulatory capture, but it certainly has the same effects, as you've mentioned. Except I think it's actually the established, non-tech EU companies that benefit more than big US tech but I could see them benefiting too. edit: apparently there is a similar bill in the US. So that does sound like regulatory capture.
execveat 4y ago
HN crowd is completely missing the intent. Nobody wants to chase open source developers. The problem is that right now a person can go buy a smartphone or WiFi router which uses obsolete software components already and will never receive any updates. Hopefully it gets fixed through this legislation.
- mgraczyk 4y ago
  The "fix" will be that Europeans will only be able to buy from a handful of the largest smartphone manufacturers, and there will never be another European company selling smartphones.
- throwaway294566 4y ago
  > Nobody wants to chase open source developers. That might be true for the lawmakers. But as it is, there will be unintended consequences: First, what the article criticizes: Open-Source development might be discouraged because the exemption isn't clear and encompassing enough. Compliance is enough of a burden to stop any "halfway commercial" OSS developments in the EU, with a very wide interpretation of "halfway commercial". Second, there will be the ambulance chasing kind of lawyers profiting from any kind of ambiguity by sending expensive warning letters ("Abmahnungen"). Those scumbag lawyers definitely want to chase open source developers and everybody else without a big legal team who provides them with an opportunity... And experience shows that lawmakers have always been unable or unwilling to write laws with the necessary clarity and non-ambiguity.

readsadhours 4y ago

Given that a similar thing was introduced to the US senate[1] I will have to wonder who is behind this. [1] https://news.ycombinator.com/item?id=32956218 https://news.ycombinator.com/item?id=32956218

throwaway294566 4y ago
I'd guess large producers of commercial software. BigCo doesn't have any problem having an entire compliance & audit b.s. department. However, all the smaller companies, independent developers and OSS software will be regulated out of the market.
binkHN 4y ago
Similar? The US law focuses on how federal agencies acquire and review OSS software—the EU law throws bureaucracy across the entire OSS landscape.

varispeed 4y ago

It's interesting that EC is not looking at addressing the obvious loophole big corporations are using - that is they are saving on R&D and tax by using open source software without paying the developers for their time. If these big corporations were paying up the fair share of profit generated by the open source software they use, I am sure the developers behind it would have funds essential to ensure the security of the software they make. That being said, even if above was not feasible (shame!), then it should be up to corporation using the software to ensure it is secure (and possibly contributing any fixes back to the software).

continuational 4y ago
Perhaps require that certifying commercial software as CE entails publicly certifying all the individual OSS components as CE as well.
UncleEntity 4y ago
If someone intentionally releases their software under a free license how is another someone taking them up on their offer a loophole?

pella 4y ago

from the proposal: "(13) In order not to hamper innovation or research, this Directive should not apply to free and open-source software developed or supplied outside the course of a commercial activity. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. However where software is supplied in exchange for a price or personal data is used other than exclusively for improving the security, compatibility or interoperability of the software, and is therefore supplied in the course of a commercial activity, the Directive should apply."

oytis 4y ago
Thank you for providing the whole quote. If indeed all software that is not directly supplied in exchange for a price is excluded, that would be a huge relief for the community. The fear is that they will proceed with extended definition of "commercial activity" though, out of fear of loopholes.
- nonethewiser 4y ago
  In what sense is that "the whole quote?" Here is an excerpt from the article that puts into context why this is concerning. But honestly, just read the article. > Now, what is a commercial activity? The CRA does not define this term. However, conversations with people more knowledgeable on product legislation pointed me to the EU Blue guide to the implementation of EU product rules: > Commercial activity is understood as providing goods in a business related context. Non-profit organisations may be considered as carrying out commercial activities if they operate in such a context. This can only be appreciated on a case by case basis taking into account the regularity of the supplies, the characteristics of the product, the intentions of the supplier, etc. In principle, occasional supplies by charities or hobbyists should not be considered as taking place in a business related context.
  - oytis 4y ago
    I mean this part > This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. However where software is supplied in exchange for a price... This says that publicly available open-source software that is not supplied in exchange of a price (as in, say, customised versions of software that are not available to general public) is exempt. It doesn't cite any other commercial activity (technical support, donations etc.) from EU Blue guide.

binkHN 4y ago

This kind of reminds me of when encryption became a munition in some countries—development moved to countries where encryption wasn’t outlawed. Something tells me a bit of a brain drain will happen if this comes to fruition as groups will go out of their way to develop software outside of the EU. Either that or the EU will be full of undesirable software that has been audited, but is still vulnerable.

kazinator 4y ago

This generally smells like the work of deep pockets vested in proprietary software.

deleted 4y ago
[deleted]

generalizations 4y ago

This reminds me of an aphorism: "When you owe the bank a million dollars, that's your problem. When you owe the bank a billion dollars, it's the bank's problem." What happens when/if core technologies like SSL, BIND, and even the Linux kernel fail to meet these requirements? Will EU entities have to stop using noncompliant open source software? As someone who is not a fan of bureaucracy, the consequences of this could be almost hilarious. Edit: TFA is writing about this as legislation to be concerned about. I'd wonder if the best response to this is malicious compliance: "sorry $EU_ENTITY, we never certified, so you can't use our tech that happens to be fundamental to the security/networking/OS stack."

insanitybit 4y ago
There are lots of alternatives for SSL libraries, and there are also indeed increasing alternatives to Linux. But in reality, Linux tends to get patches for compliance purposes, or forks for meeting various obligations.
- Beltalowda 4y ago
  These smaller projects are probably even less likely to be compliant. If anything, it will create a situation where e.g. OpenSSL is audited and compliant, but other newer solutions aren't so you can't use them. If "has been audited and approved" would be a good assurance the project is of good quality then that might be okay, but overall I find it's a rather weak signal.
  - insanitybit 4y ago
    Smaller projects? There are tons of very mature TLS libraries.
    - Beltalowda 4y ago
      "Smaller" does not imply "not mature", or "not used". It just means ... "smaller". For example Go has a boringssl build because boringssl is FIPS certified whereas the default Go crypto stuff isn't, and this matters for some people.

Animats 4y ago

It seems to be time for this. There's a war on. We're now seeing regular attempts to sneak backdoors into open source code.[1][2] And those are the ones that have been found. There was a Linux kernel bug where someone put a test for root in as "if (uid = 0)" instead of "if (uid == 0)", so that when a rarely used system call was made, the process became root.[3] The EU is most concerned about "Class II software". The stuff that runs industry. [1] https://acronisscs.com/blog-open-source-backdoors-in-the-wild https://acronisscs.com/blog-open-source-backdoors-in-the-wil... [2] https://www.zdnet.com/article/open-source-software-how-many-bugs-are-hidden-there-on-purpose/ https://www.zdnet.com/article/open-source-software-how-many-... [3] https://www.infoq.com/news/2013/10/Linux-Backdoor/ https://www.infoq.com/news/2013/10/Linux-Backdoor/

deleted 4y ago
[deleted]
light_hue_1 4y ago
> There was a Linux kernel bug where someone put a test for root in as "if (uid = 0)" instead of "if (uid == 0)", so that when a rarely used system call was made, the process became root.[3] No there was not! Someone in 2003 submitted a patch. To the wrong repo. The patch was looked at anyway and rejected for this reason. It was never merged. No machine ever had this bug.
djbebs 4y ago
The main culprits of those things are the governments making these laws. Make no mistake this will just be used to implement those backdoors.

Barrin92 4y ago

I think this is long overdue and virtually all posts in this thread seem to be generic, entirely contentless 'EU bureaucracy' rants. From the article: (i) it is designed to run with elevated privilege or manage privileges; (ii) it has direct or privileged access to networking or computing resources; (iii) it is designed to control access to data or operational technology; (iv) it performs a function critical to trust, in particular security functions such as network control, endpoint security, and network protection. (b) the intended use in sensitive environments, including in industrial settings[...] There's a clear distinction here between what the EU labels 'critical products' and non-critical software. Seeing the increasingly insecure global situation, the importance of software in infrastructure and the potential threats I think it's wild that something like this hasn't passed a decade ago. Digital infrastructure needs to be as secure as physical infrastructure. I wonder what would happen if some Heartbleed-esque bug that went undiscovered for years took out a huge chunk of a nation's electricity grid in a military conflict. What the EU needs in addition is if course also more funding for software security, but they're already doing a halfway decent job. If you didn't know, if you fix open source bugs in the EU you can get paid for doing just that: https://ec.europa.eu/info/news/european-commissions-open-source-programme-office-starts-bug-bounties-2022-jan-19_en https://ec.europa.eu/info/news/european-commissions-open-sou...

UncleEntity 4y ago
> it has direct or privileged access to networking or computing resources Sure, but what does “direct” mean in this context? My little IRC client library or a device driver in the kernel? Either one could be used in an exploit chain to take down the EU power grid. Theoretically, of course, because I don’t actually have an IRC lib and I don’t think it would be used to control a power grid if I did…at least I would hope so.
oytis 4y ago
It would be totally reasonable to require special certification for software running on critical infrastructure (is it not the case already by the way?). They are trying to blanket cover the whole market though which looks like another attempt to fight the market reality frankly, with predictable outcome.
4y ago

rad_gruchalski 4y ago

Seems like the most lucrative part of this proposal is to become the auditor. /s This reminds me of the Gaia-X / IDSA certification and approval framework blanketing the whole software industry in the EU. I am not sure yet what to think about it. On one side, it looks a bit like proprietary software vendors trying to cut out SMEs who can match the quality with the same open-source software the big players use, but have no funds to go through the certification. The really funny part of this legislation is: the big players who can afford certification will be able to use ANY open-source component for free but the people who built it will have a tough time to go to the market because they will require the funds they don't necessarily have. Crazy situation. On the other hand, if this is applied to everyone, well, it will get rolled into the cost of providing a service. You want to buy this from me? Sure, I'll charge you for compliance report. The really funny part of the "Call for evidence for an impact assessment - Ares(2022)1955751" document (section C.) from https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/13410-Cyber-resilience-act-new-cybersecurity-rules-for-digital-products-and-ancillary-services_en https://ec.europa.eu/info/law/better-regulation/have-your-sa... reads: > The initiative is expected to have positive economic impacts. That section completely misses to mention that increased compliance cost will inevitably lead to increased software and services pricing, thus will lead to decreased competitiveness of European SMEs on the international market. Hot take: I can see two options to cripple this: 1) Drown the legislator in compliance requests for minor code. 2) Dual-licensing: AGPLv3 + commercial license.

stefanfisk 4y ago
The cost does not scale with the business' size though, so large players can easily eat it while small ones can't even play :/
- pelasaco 4y ago
  still everyone will have to go through the auditing process.
- deleted 4y ago
  [deleted]
4y ago

binarynate 4y ago

I'm an American that sells software to clients in the EU that this legislation considers a Class I critical product (https://vuplex.com https://vuplex.com). If this law is passed, what would be the consequence of not hiring an auditor to comply with it? Depending on the cost of an auditor, compliance may cost more than the revenue generated from the EU. If that's the case, it may no longer be economical for me to sell to clients in the EU.

Archelaos 4y ago
I think the situation would not be different if you were an EU citizen.
nonethewiser 4y ago
> I'm an American that sells software to clients in the EU that this legislation considers a Class I critical product (https://vuplex.com https://vuplex.com). For more context, a "critical" product cannot be self-assessed. He would have to hire the auditor.
- Iv 4y ago
  CE is typically obligation of result, not obligation of effort. Do you have source on products that can't be self-assessed?
  - pimterry 4y ago
    The article, directly referencing the proposed legislation, says: > developers of critical products may not perform self-assessment and need to involve third-party auditors
baggy_trough 4y ago
Certainly; that's the idea. Regulation is usually designed to favor large incumbents with some fig leaf of justification, in this case hand waving about security.
EnKopVand 4y ago

sebow 4y ago

Another garbage idea out of Brussels. Given the fact that we're lacking in the system engineering space for more than a decade, this will only curb some of the decent innovations people have began expanding upon in the last couple of years. (See the various talks & ideas from usenix for example, amongst other events) On the "bright side", this will realistically be impossible to enforce. Any national court who deems such industry important will probably use a local constitutional amendment to reinforce that CODE easily falls under freedom of expression, just like any other craft. EU showing once again how desperate it is for money. Let's strangle out all our industries until nobody can make anything anymore: See agriculture, energy, manufacturing, and "now" even a bigger range of the IT spectrum.

blibble 4y ago
> Any national court who deems such industry important will probably use a local constitutional amendment to reinforce that CODE easily falls under freedom of expression, just like any other craft. if you're in the EU then EU legislation overrides any local law

diego_sandoval 4y ago

> the legislation and its (unintended) negative effects on developers of open-source software. The negative effects seem pretty intended to me. The legislators are aware of open source software and have an exception for non-commercial activities, but intentionally penalize OSS related to commercial activities, by leaving them out of that exception. And, at this point, I don't believe that these legislators are so stupid that they can't see the consequences of their proposals. They probably just don't care about the negative consequences, or the "negative consequences" (negative for us) are actually what they're striving for.

Kenji 4y ago

nickdothutton 4y ago

“Governments of the Industrial World, you weary giants of flesh and steel…”

stonemetal12 4y ago

Red Hat has been providing indemnification for patents for RHEL. This seems like another regulatory bag they will have to carry. Everybody will just use Red Hat, because it is already certified so they can just pass the certification along. "outside the course of a commercial activity should not be covered by this Regulation" Is this kind of wording normal In EU laws? Why use "Should" in the law, since we are in the middle of defining what is going to happen shouldn't it be "is"?

PoignardAzur 4y ago

The level of vitriol from the commenters here is honestly frightening. If the Commission was proposing a law mandating that cars have seat-belts, people would be jumping in to shout "Europe is destroying free enterprise, they're trying to destroy small car-makers!" Seriously, when you look at the list of concerned software, you have password managers, operating systems, certificate infrastructure, remote access software, industrial IoT, etc. For any software in these categories, it's not completely insane to think that "This software is provided as-is with no warranty whatsoever, good luck!" doesn't quite cut it. And yes, open-source is concerned as well, when it's part of a commercial activity. Again, if you're being paid to provide software, it seems fair to say you're leaving the "lobbyist" category and entering the "paid professional" category and you have to worry about security requirements. Especially given that, outside of the critical projects mentioned above, you're allowed to display the CE mark if you self-audit. Are there deeper discussions to be had here, concerns to be addressed, etc? Absolutely. I think a critical point is how "commercial activity" is defined. A threshold of gross revenue could be an interesting solution. Are these deeper discussion happening in this thread? No. It's all "Europe hates innovation" and "I hate the EC and cookie banners so much!" Most commenters seem to automatically assume that any level of regulation is automatically going to drown small businesses and favor FAANG-scale corporations, which is more extreme than even the article calling out the regulation.

boxed 4y ago
I think the fundamental problem here is that it's all about avoiding mistakes, not about doing good things. This attitude in general is a pox on humanity. Once you start to see the pattern it's everywhere. Schools, science funding, hospitals, building codes, policing, banking, aerospace, and on and on. No one cares if you improve anything. They just care if you make a mistake. This attitude is a disaster.
ExoticPearTree 4y ago
As an european I do believe that the European Comission really hates innovation and they believe everyting should be regulated as if only the politicians know what's best for every one. Like they're trying to regulate what kind of chargers we can use, the maximum speed cars can reach, what you can say on the internet and so on. All in the name of safety, terrorism and all other buzzwords politicians throw around to make it sound important. If we'd had the EC 30-40 years ago, most probably would all still be using dial-up for internet or maybe DSL at best and still have BBSs. And PoignardAzure, yes, I do believe seatbelts and motorcycle helmets should be optional. If you die because you're too cool for them, you die - simple as that.