4 ms·

The regulation looks reasonable: if someone is selling software, or products containing software components, they have to certify the security of their product

The regulation looks reasonable: if someone is selling software, or products containing software components, they have to certify the security of their products. OSS developers who don’t charge for the software have no obligations. If their software is used in a commercial product, the seller of that product is responsible.

pyb 4y ago
No, CE markings are normally for finished products, not components. (in many cases the software is a component). Most open sourced projects are not user-facing finished software products.
- pyb 4y ago
  So, I think this new legislation might be bad, as the distinction between a component vs a finished product is a lot less clear in software, and particularly open-source projects. I'm not sure the lawmakers will consider this carefully.
- throwaway294566 4y ago
  No, the regulation explicitly includes components: > For the purposes of this Regulation, the following definitions apply: (1) ‘product with digital elements’ means any software or hardware product and its remote data processing solutions, including software or hardware components to be placed on the market separately https://ec.europa.eu/newsroom/dae/redirection/document/89543 https://ec.europa.eu/newsroom/dae/redirection/document/89543
  - pyb 4y ago
    Oh my, I need to update my understanding of CE markings if it's like this in this instance. This is going to be complete chaos.
WesternWind 4y ago
yep, and accepting donations are not charging for a product, much like my tipping a bartender isn't paying for a drink.
deleted 4y ago
[deleted]
Aeolun 4y ago
Yeah, but me going from making $0/month to $20/month changes it to commercial, and suddenly introduces a heavy compliance burden. I’m not getting an auditor over to audit my $20 program.
- nonethewiser 4y ago
  Technically you have to do it at $0/month because once it changes to $20/month you're not in compliance. It's a minor distinction - your point is the important one. You have to do it way before you have the means.
- adql 4y ago
  > I’m not getting an auditor over to audit my $20 program. Self-assesment is an option. The problem is that now you're responsible for the bugs, no matter whether the user uses it for securing his cafe or bank...
  - trh0awayman 4y ago
    Self-assessment is not an option if your program is on the "critical" list.
    - stefanfisk 4y ago
      a list which you have now have to keep up-to-date on at all times because suddenly your project might be included even if it initially wasn't.

pyb 4y ago

No, CE markings are normally for finished products, not components. (in many cases the software is a component). Most open sourced projects are not user-facing finished software products.

pyb 4y ago
So, I think this new legislation might be bad, as the distinction between a component vs a finished product is a lot less clear in software, and particularly open-source projects. I'm not sure the lawmakers will consider this carefully.
throwaway294566 4y ago
No, the regulation explicitly includes components: > For the purposes of this Regulation, the following definitions apply: (1) ‘product with digital elements’ means any software or hardware product and its remote data processing solutions, including software or hardware components to be placed on the market separately https://ec.europa.eu/newsroom/dae/redirection/document/89543 https://ec.europa.eu/newsroom/dae/redirection/document/89543
- pyb 4y ago
  Oh my, I need to update my understanding of CE markings if it's like this in this instance. This is going to be complete chaos.

WesternWind 4y ago

yep, and accepting donations are not charging for a product, much like my tipping a bartender isn't paying for a drink.

deleted 4y ago

[deleted]

Aeolun 4y ago

Yeah, but me going from making $0/month to $20/month changes it to commercial, and suddenly introduces a heavy compliance burden. I’m not getting an auditor over to audit my $20 program.

nonethewiser 4y ago
Technically you have to do it at $0/month because once it changes to $20/month you're not in compliance. It's a minor distinction - your point is the important one. You have to do it way before you have the means.
adql 4y ago
> I’m not getting an auditor over to audit my $20 program. Self-assesment is an option. The problem is that now you're responsible for the bugs, no matter whether the user uses it for securing his cafe or bank...
- trh0awayman 4y ago
  Self-assessment is not an option if your program is on the "critical" list.
  - stefanfisk 4y ago
    a list which you have now have to keep up-to-date on at all times because suddenly your project might be included even if it initially wasn't.