5 ms·

I am not an author of popular OSS project so my view is probably distorted, but as OSS develpper would you give a dime about legislation like this? Edit: It ma

by gwnywg 4y ago

I am not an author of popular OSS project so my view is probably distorted, but as OSS develpper would you give a dime about legislation like this? Edit: It made me thinking, how would legislator ensure legislation is implemented? Would they start requiring escrow so they can check by themselves if software is developed to the correct security standard?

ISL 4y ago
If compliance costs and liability were shuffled onto developers working for free, I'm pretty sure you'd see a sudden drop in EU OSS development.
- Xylakant 4y ago
  Developers working for free are explicitly exempt. The article lays out that the carve-out has issues and those should get resolved, but fundamentally it‘s there.
  - paganel 4y ago
    What happens with EU-based developers that work on OSS projects while on a company’s dime? I.e. said company doesn’t have any direct relation with that project, but wants to support it by paying some of its developers to put in the work. Or to developers that receive Patreon money based on their OSS projects? It can get pretty murky pretty fast.
    - Xylakant 4y ago
      Then they‘re no longer working for free. That‘s exactly the issues this article is discussing - but that‘s not the point the parent poster was alluding to. They specifically mentioned „for free.“ However, if you build security critical software and get paid to do so it‘s not entirely unreasonable to require some sort of certification. You can‘t just build medical devices for money either without some sort of regulation. Or produce food for money. Or repair cars for money.
      - ISL 4y ago
        OSS contributions aren't ever explicitly security-critical software: "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, ...... " It is on the user (or a third party certification authority) to accept any liability for the quality of the software.
        throwaway294566 4y ago
        That law would override any such disclaimer by the seller (or other kind of "commercial producer") of OSS software. What is "critical" is determined by the catalogue of critical software categories.
        UncleEntity 4y ago
        Which would move up the chain to all dependencies of a critical project. Libc, clang/gcc, whatever. Needs to be audited. Perhaps they require the “integrator” to perform the audit or maybe the fact someone provides software which can be useful in critical environments is enough to signal an implied warranty and they are on the hook for compliance. Nobody knows until it all goes through costly legal procedures where everyone is trying to cover their asses and pass the buck. I’m waiting for the day where FLOSS devs are greeted at EU airports by process servers because they released some software while in college and it got used in some critical software.
        throwaway294566 4y ago
        No, the draft requires the purpose of a software to be declared. So if you declare Linux to be a terminal emulator, not an operating system, and only sell/import/distribute it as such, you only need to comply with the somewhat easier self-certification requirements for non-critical software. However, that declaration of purpose of course binds all other users/distributors of Linux, if they should dare to use or bundle it as a desktop, server or mobile operating system, they are doing so outside the original certification and need to have the required audit for critical software performed. That, as far as I read it, also means that something like GCC, which is unambiguously a compiler, isn't critical and need not be audited, only self-certified, even if used to compile a critical software component.
    - pmontra 4y ago
      Example: I contributed to the Elixir version of faker years ago. My customer allowed me to issue a PR with the Italian translations and it was accepted. This is clearly commercial because my customer was paying me and I was working at a commercial service. With this legislation I think they wouldn't let me send the PR (because maybe they would have had to pay for the certification) and/or it wouldn't be accepted (because the costs could be on the project.)
  - BeefWellington 4y ago
    What happens if say, an employee of Amazon, Google, or Netflix, contributes changes to my OSS app?
  - Archelaos 4y ago
    > Developers working for free are explicitly exempt. The problem lies, among other things, in the fact that a business activity might be assumed even if one does not explicitly receive money for the software directly, but indirectly. For example via donations, ads on the download Web-site, using it for self-promotion, paid consultancy, selling tutorials, ...
    - mqus 4y ago
      "[inside] the course of a commercial activity" "Commercial activity is understood as providing goods in a business related context." secondary self-promotion, donations and ads are imho not "providing goods in a business-related context". Paid consultancy and selling tutorials might be though, But I assume that judges will rule on that if it comes to it and I assume that they will set some monetary boundary to which this still counts as "outside the course of commercial activity".
      - Archelaos 4y ago
        If "business-related" means: "what contributes to earn you money", then they are. The boundary is typically not the amount of money, but whether there is an intention to make a profit over a longer period of time. So if you have a permanent Website of your open-source product to promote some other product or service, or ask for donations or put ads on the site, you intent to make a profit out of your open-source product. (Almost?) every possible answer to the question: "How can I generate revenue with my open source project?" describes a business related context.
Xylakant 4y ago
As long as you‘re not financially profiting from the project, the legislation does not affect you. The moment you do financially profit of it (for example, if you have a business around it, or the software is developed by a business), then things get a little more complicated - if you have no clients in the EU and don‘t market or sell to the EU, you can mostly just ignore this. If you do, then you probably have to care about this.
- gwnywg 4y ago
  OK, so to my untrained eye it looks like putting a road block for small software startups..
  - nivenkos 4y ago
    Yeah, and you can bet the audits will just be some box-ticking nonsense like always.
  - can16358p 4y ago
    As if GDPR hasn't put enough already.
    - gwnywg 4y ago
      I thought about that after writing my comment...
    - kwhitefoot 4y ago
      FUD. Unless you are asking for personal data that is not necessary to provide the service the GDPR doesn't affect you or require you to do anything.
      - can16358p 4y ago
        False. In many cases you might be collecting it in the first place without realizing it (e.g. Analytics). Also it's a problem for developing anything to spend a lot of thinking "would this violate GDPR" instead of actual creative thinking and development. I don't remember how many DAYS we've collectively lost in all the apps we're making, to make sure we comply with GDPR instead of focusing on productivity.
paganel 4y ago
Supposedely, if this legislation passes then the EU will be in its rights to ask GitHub or any such platform to remove completely or to block OS projects that do not meet EU’s new security criteria. Take what I’m saying with a huge grain of salt, cause I’m also not a OSS contributor nor do I work with tech-related legislation.
- gwnywg 4y ago
  This sounds like future I'm not sure I would like to live in... Would Linux be developed if such legislation existed..?

by gwnywg 4y ago

ISL 4y ago

If compliance costs and liability were shuffled onto developers working for free, I'm pretty sure you'd see a sudden drop in EU OSS development.

Xylakant 4y ago
Developers working for free are explicitly exempt. The article lays out that the carve-out has issues and those should get resolved, but fundamentally it‘s there.
- paganel 4y ago
  What happens with EU-based developers that work on OSS projects while on a company’s dime? I.e. said company doesn’t have any direct relation with that project, but wants to support it by paying some of its developers to put in the work. Or to developers that receive Patreon money based on their OSS projects? It can get pretty murky pretty fast.
  - Xylakant 4y ago
    Then they‘re no longer working for free. That‘s exactly the issues this article is discussing - but that‘s not the point the parent poster was alluding to. They specifically mentioned „for free.“ However, if you build security critical software and get paid to do so it‘s not entirely unreasonable to require some sort of certification. You can‘t just build medical devices for money either without some sort of regulation. Or produce food for money. Or repair cars for money.
    - ISL 4y ago
      OSS contributions aren't ever explicitly security-critical software: "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, ...... " It is on the user (or a third party certification authority) to accept any liability for the quality of the software.
      - throwaway294566 4y ago
        That law would override any such disclaimer by the seller (or other kind of "commercial producer") of OSS software. What is "critical" is determined by the catalogue of critical software categories.
        UncleEntity 4y ago
        Which would move up the chain to all dependencies of a critical project. Libc, clang/gcc, whatever. Needs to be audited. Perhaps they require the “integrator” to perform the audit or maybe the fact someone provides software which can be useful in critical environments is enough to signal an implied warranty and they are on the hook for compliance. Nobody knows until it all goes through costly legal procedures where everyone is trying to cover their asses and pass the buck. I’m waiting for the day where FLOSS devs are greeted at EU airports by process servers because they released some software while in college and it got used in some critical software.
        throwaway294566 4y ago
        No, the draft requires the purpose of a software to be declared. So if you declare Linux to be a terminal emulator, not an operating system, and only sell/import/distribute it as such, you only need to comply with the somewhat easier self-certification requirements for non-critical software. However, that declaration of purpose of course binds all other users/distributors of Linux, if they should dare to use or bundle it as a desktop, server or mobile operating system, they are doing so outside the original certification and need to have the required audit for critical software performed. That, as far as I read it, also means that something like GCC, which is unambiguously a compiler, isn't critical and need not be audited, only self-certified, even if used to compile a critical software component.
  - pmontra 4y ago
    Example: I contributed to the Elixir version of faker years ago. My customer allowed me to issue a PR with the Italian translations and it was accepted. This is clearly commercial because my customer was paying me and I was working at a commercial service. With this legislation I think they wouldn't let me send the PR (because maybe they would have had to pay for the certification) and/or it wouldn't be accepted (because the costs could be on the project.)
- BeefWellington 4y ago
  What happens if say, an employee of Amazon, Google, or Netflix, contributes changes to my OSS app?
- Archelaos 4y ago
  > Developers working for free are explicitly exempt. The problem lies, among other things, in the fact that a business activity might be assumed even if one does not explicitly receive money for the software directly, but indirectly. For example via donations, ads on the download Web-site, using it for self-promotion, paid consultancy, selling tutorials, ...
  - mqus 4y ago
    "[inside] the course of a commercial activity" "Commercial activity is understood as providing goods in a business related context." secondary self-promotion, donations and ads are imho not "providing goods in a business-related context". Paid consultancy and selling tutorials might be though, But I assume that judges will rule on that if it comes to it and I assume that they will set some monetary boundary to which this still counts as "outside the course of commercial activity".
    - Archelaos 4y ago
      If "business-related" means: "what contributes to earn you money", then they are. The boundary is typically not the amount of money, but whether there is an intention to make a profit over a longer period of time. So if you have a permanent Website of your open-source product to promote some other product or service, or ask for donations or put ads on the site, you intent to make a profit out of your open-source product. (Almost?) every possible answer to the question: "How can I generate revenue with my open source project?" describes a business related context.

Xylakant 4y ago

As long as you‘re not financially profiting from the project, the legislation does not affect you. The moment you do financially profit of it (for example, if you have a business around it, or the software is developed by a business), then things get a little more complicated - if you have no clients in the EU and don‘t market or sell to the EU, you can mostly just ignore this. If you do, then you probably have to care about this.

gwnywg 4y ago
OK, so to my untrained eye it looks like putting a road block for small software startups..
- nivenkos 4y ago
  Yeah, and you can bet the audits will just be some box-ticking nonsense like always.
- can16358p 4y ago
  As if GDPR hasn't put enough already.
  - gwnywg 4y ago
    I thought about that after writing my comment...
  - kwhitefoot 4y ago
    FUD. Unless you are asking for personal data that is not necessary to provide the service the GDPR doesn't affect you or require you to do anything.
    - can16358p 4y ago
      False. In many cases you might be collecting it in the first place without realizing it (e.g. Analytics). Also it's a problem for developing anything to spend a lot of thinking "would this violate GDPR" instead of actual creative thinking and development. I don't remember how many DAYS we've collectively lost in all the apps we're making, to make sure we comply with GDPR instead of focusing on productivity.

paganel 4y ago

Supposedely, if this legislation passes then the EU will be in its rights to ask GitHub or any such platform to remove completely or to block OS projects that do not meet EU’s new security criteria. Take what I’m saying with a huge grain of salt, cause I’m also not a OSS contributor nor do I work with tech-related legislation.

gwnywg 4y ago
This sounds like future I'm not sure I would like to live in... Would Linux be developed if such legislation existed..?