9 ms·

FOSS could be an unintended victim of EU crusade to make software more secure

147 points by JoachimS 4y ago

nivenkos 4y ago
Just to help shore up old institutional corporations like SAP, etc. The EU is basically an association for German business owners and landowners. Happy to impede technological progress if it serves their interests.
- mkl95 4y ago
  The way the remote job market is being flooded by American companies proves your point. EU companies do not even try to compete with them, with a few exceptions.
  - ergonaught 4y ago
    Probably shouldn't oversimplify it. Ex: I'm in the USA and every company I've worked for in the past 20 years was remote work and based in Europe. They opened American offices to make some things easier here, but They Came From Europe (ooohhh spoooooky).
    - deleted 4y ago
      [deleted]
- GTP 4y ago
  > The EU is basically an association for German business owners and landowners. Happy to impede technological progress if it serves their interests. That's not true at all, and I don't see which interest there would be in hampering FOSS development.
  - deleted 4y ago
    [deleted]
  - leonardp 4y ago
    Their interests are money and power, so this should be pretty self explanatory.
- TEP_Kim_Il_Sung 4y ago
  That's not true; The EU is also an association of French, BeNeLux business owners and royalty playing politics.
aheliocentric 4y ago
One of the main guys behind Maven Central guy did a thing on this: https://blog.sonatype.com/eu-cyber-resilience-act-good-for-software-supply-chain-security-bad-for-open-source https://blog.sonatype.com/eu-cyber-resilience-act-good-for-s...
- hodgesrm 4y ago
  This was a very thoughtful article. Thanks for posting.
- nindalf 4y ago
  Great article. TFA this thread is based on is low quality. It’s breathless in its criticism of the legislation but uses hyperbole instead of calmly laying out the issues. The Maven Central guy puts it plainly - the proposed legislation doesn’t penalise OSS developers, unless they distribute software they also get a commercial benefit from. But that describes the operator of Maven Central, who publishes software and has some commercial interests tied to it. However they cannot possibly take on liability for every published package. In that case they would be left with no choice but to block EU users.
  - account42 4y ago
    Having to profit from the software isn't neccessarily that big of a caveat either depending on what precise wording that ends up in the law. Do donations count? What if you accept a bug bounty? How about a one time contract to implement a minor feature? Monetizing OSS is already hard enough that having to deal with compliance even for (money wise) tiny projects will make it impossible for many more.
RobotToaster 4y ago
Calling it "unintended" is making a lot of assumptions.
- GTP 4y ago
  So we should assume that it is intended?
  - rjzzleep 4y ago
    Remember when the CDU politicians celebrated when they successfully lobbied for upload filters for their publisher friends in the EU? Why should not assume that its intended？Plenty of McKinsey consultants around to make sure governments don't use too much FOSS to keep paying those nice license fees to MS.
    - BlueTemplar 4y ago
      Notably, for that there are tiers depending on the number of users or revenue.
    - GTP 4y ago
      >Plenty of McKinsey consultants around to make sure governments don't use too much FOSS to keep paying those nice license fees to MS. Maybe, but remember that Ursula von der Leyen herself has been advocating for a while for EU's "digital sovereignty" (not having to depend on products and services form non-EU countries) and the easiest way to achieve that would be to heavily rely on FOSS.
      - account42 4y ago
        > and the easiest way to achieve that would be to heavily rely on FOSS. But is it also the most profitable way for politicians.
      - rjzzleep 4y ago
        Ursula just like Macron has been involved in McKinsey scandals, the outcome of which was shoveling money to McKinsey and decimating the German military. Iirc her son was a partner or something. Ursula says all sorts of crazy stuff. The last year of Ursula policies have made sure that the EU is everything BUT sovereign. They are now fully dependent on the US MIC and fully dependent on US resource and energy imports at any price or terms the US wishes. Looks like everyone here has forgotten that the EU copyright stance is basically to shovel money to the US. I really wish people here would judge politicians by the outcome of their actions and not by what they say. https://torrentfreak.com/europes-odd-anti-piracy-stance-send-money-to-the-us-110904/ https://torrentfreak.com/europes-odd-anti-piracy-stance-send...
bee_rider 4y ago
> The CRA draft even exempts FOSS from compliance – but only if no commercial use is made of it, including things like technical support and as part of monetized services. This seems sort of reasonable. If you charge for tech support, you have a business. I’m all for not making it harder for people who are actually just sharing their hobby projects, but a project that makes money isn’t a hobby anymore. I mean we wouldn’t want to leave a gap large enough to send Android through, right?
- Kon-Peki 4y ago
  Exactly. If you want to be useful, help refine the “monetization” definitions. Don’t try to kill the whole legislation. The Register appears to have bought into the FUD being spewed by a bunch of people being paid a lot of money to run “non-profits”.
  - littleraincloud 4y ago
    The main risk I see is that every web host using Apache or Nginx will be required to handle certification on their own. Businesses like Litesspeed can sell their product as a certified one and sell that as a feature.
    - simiones 4y ago
      But isn't this normal? If I am distributing a product based on Linux, it is my job to ensure that I use Linux in a secure way, to the extent required by contracts between me and my customers, and by local regulations. I can either take on this work myself, or pay IBM RedHat or SUSE or whoever else to take on some of the responsibility. How else would this work?
      - dathinab 4y ago
        There is a difference between due diligence and required certification. Using a "standard" kernel, keeping it up to date, etc. is due diligence but WAY cheaper and easier to do then any form of certification. Software certification especially wrt. to security is and always has been a mostly a scam. It also is a _major_ driving factor(1) for insecure software not getting fixed. Because it's "certified" but the security fix is not. (1: in certain industries)
ocdtrekkie 4y ago
This is, as per usual, big companies trying to scare you into believing regulations meant for them will hurt the little guys. Learn to recognize this news pattern and disregard it immediately. The EU is probably the leading body of government trying to drive FOSS adoption.
- msla 4y ago
  > This is, as per usual, big companies trying to scare you into believing regulations meant for them will hurt the little guys. Except those regulations hurt the little guys more than the big companies. Even if the big companies can't buy their way out of compliance, compliance inherently costs less for them and regulatory bodies are more willing to work with a big company than a small group of hobbyists, leading to the big company being able to follow the law with nary a hiccup whereas the hobbyists get destroyed by zealous enforcement.
  - ocdtrekkie 4y ago
    This isn't true for a myriad of reasons. Smaller organizations are usually inherently more compliant, their smaller scale makes it far easier and cheaper for them to become compliant, and enforcement agencies are less interested in investing significantly in enforcement actions against them.
    - jessaustin 4y ago
      ...their smaller scale makes it far easier and cheaper for them to become compliant... This is often somewhat true. However, as I have observed in several USA contexts, large organizations are often exempted (whether explicitly or not) from pesky new regulations, citing this very point. For example, I personally attended a California PUC meeting in which VZN and SBC were exempted from "lifeline" regulations that continued to be imposed (with nonzero costs) on the small CLEC that employed me. Large organizations have to keep lawyers and lobbyists employed, so they might as well keep them busy. Creating regulations and exempting themselves is common practice. Perhaps things work differently in Europe.
pjmlp 4y ago
Well, that is the thing, I am free to offer food on the street, yet I am suject to the same kind of health regulations as any kind of restaurant. Same applies to any kind of business. Why should FOSS be any different? Maybe this is the culmination of the bazaar idea after all, including quickly stuffing the products back into a bag and running away from the law enforcement official between the crowd, by not having either a license or the expected quality.
- DasIch 4y ago
  > Why should FOSS be any different? Because it's not a business. Health regulations for restaurants also don't apply to your kitchen at home, even if you are inviting friends for dinner.
  - pjmlp 4y ago
    They surely apply if they happen to get food poisoning and sue you afterwards.
    - yfr7ryfhh 4y ago
      Shockingly it's actually the fact you gave them food poisoning that decides that one. But I wouldn't be surprised if the Europeans thought that in need of fixing too.
      - pjmlp 4y ago
        It means that you haven't taken the proper care to prevent it from happening in first place.
        account42 4y ago
        There is a difference between being held accountable if your negligence ends up hurting someone vs. proactive audits and reporting requirements - the second has overhead even for those that already have high standards, overhead that is unreasonable outside a business setting.
oaiey 4y ago
When I introduce a product to users I have to take care of its post-market cybersecurity. This is healthcare reality for years and now comes to all products. The interesting here is: What is a product? Most open source is not. The millions of libraries are not products. A product accumulates the various aspects (cybersecurity, license, ....) into a package. If I buy the software from a vendor I will make him responsible for it. If I hack it together on my self, this duty is on me. Open Source will survive that. But open source owners will get tons of questions and should be better be prepared to answer questions. GitLab and GitHub are already working on the consumer side with their security analysis features.
- tensor 4y ago
  But the rub is that open source owners have no actual obligation to you. So while you might want them to be "prepared with answers" they don't actually need to be. Some will want to be because they want their software to be used and up-to-date. But others have likely shelved their software, or just don't care to solve your security problems for you but will accept a patch if you provide one.
  - karmicthreat 4y ago
    And its literally what developers that are taking open source software and using it to sell something need to understand. The sellers are adding that value and taking that risk. If I go to the store, buy some wood, build a shelf from the wood and sell the shelf. Then it burns my customers house down, its on me not Home Depot.
  - est31 4y ago
    That's where OSS companies like Suse or RedHat come in: they do provide support for their distributions. And, unlike Amazon, they also employ many maintainers and if they don't employ them, they sometimes submit patches to upstream so are good OSS citizens.
  - oaiey 4y ago
    That is all fair. The premise is the article headline that open source or Foss is dead. An open source software no one can use is a dead software. So the success of a Foss software might not only depend on functional aspects in Future but also on non functional aspects like the Cybersecurity management. And do not think that this influence will not happen. There are reason why the non functional requirement licensing has switched to MIT from previously more LGPL constructs. Having said all that... Yes, no one is obligated to answer.
jakeogh 4y ago
"Unintended"? No... it's the whole point.
christkv 4y ago
Will we have to change licenses to exclude use in the EU?
cm2187 4y ago
> The European Union has a commendable love for the safety of its citizens. Armed with the keys to a market of 300 million of the world's richest consumers More like 450m
jcarrano 4y ago
A lot of of questions... It is whether, for companies that offer paid support for FOSS, the obligations are towards the paying customers or all. The same with FOSS which is used as a basis for commercial products. E.g. Google makes money off Android, but is AOSP with no Google stuff also covered by this law? And how does it affect companies providing support for software they do not own? (e.g. consultancies).
davidgrenier 4y ago
How is this take? Free and Open Source Software isn't owned by anyone. Being a contributor, even to my own pet project, cannot compel me to contribute my valuable time to the project in ways that I do not so chose. And you can't compel me either to spend my money to hire some third party security firm to audit this code that isn't owned by me or anyone. If some third party wants to compile this un-owned piece of code and sell it to another, the onus is on them to comply with security regulations.
vaylian 4y ago
What I find interesting in this context: Most FOSS licenses have a no-warranty and no fitness for any purpose clause: GPL 3: there is no warranty for the program, to the extent permitted by applicable law. except when otherwise stated in writing the copyright holders and/or other parties provide the program “as is” without warranty of any kind, ... BSD-3-Clause: this software is provided by the author ``as is'' and any express or implied warranties, including, but not limited to, ... Apache 1.1: this software is provided ``as is'' and any expressed or implied * warranties, ... Which means that the liability lies entirely with the user if they use the software for something critical.
- bee_rider 4y ago
  Depending on the jurisdiction, courts might strike down or ignore parts of a license. On the other hand, you might not care what a court says, depending on your travel plans.
mikewarot 4y ago
Security is the job of the operating system, not applications. The seK4 kernel makes it possible to build operating systems that actually enforce security, rather than hope applications do the right thing. If this push isn't stopped... we'll all be taking a crash course on microkernels and the principle of least privilege. (A long overdue crash course, but that's my opinion, and not widely shared)
eternityforest 4y ago
So far, world cybersecurity has been good enough. In an average year, if you ask 100 people what problems they experienced, data breach related issues are not going to dominate the list. While I'm generally a big fan of heavy regulation, there's just so much tech that doesn't matter, that we just use to make other things that don't matter easier. I would much rather see the regulation confined to domain specific things, stuff that directly deals with finances, life safety, industrial, etc.
GRACE44 4y ago
[dead]

147 points by JoachimS 4y ago

Just to help shore up old institutional corporations like SAP, etc. The EU is basically an association for German business owners and landowners. Happy to impede technological progress if it serves their interests.

mkl95 4y ago
The way the remote job market is being flooded by American companies proves your point. EU companies do not even try to compete with them, with a few exceptions.
- ergonaught 4y ago
  Probably shouldn't oversimplify it. Ex: I'm in the USA and every company I've worked for in the past 20 years was remote work and based in Europe. They opened American offices to make some things easier here, but They Came From Europe (ooohhh spoooooky).
  - deleted 4y ago
    [deleted]
GTP 4y ago
> The EU is basically an association for German business owners and landowners. Happy to impede technological progress if it serves their interests. That's not true at all, and I don't see which interest there would be in hampering FOSS development.
- deleted 4y ago
  [deleted]
- leonardp 4y ago
  Their interests are money and power, so this should be pretty self explanatory.
TEP_Kim_Il_Sung 4y ago
That's not true; The EU is also an association of French, BeNeLux business owners and royalty playing politics.

aheliocentric 4y ago

One of the main guys behind Maven Central guy did a thing on this: https://blog.sonatype.com/eu-cyber-resilience-act-good-for-software-supply-chain-security-bad-for-open-source https://blog.sonatype.com/eu-cyber-resilience-act-good-for-s...

hodgesrm 4y ago
This was a very thoughtful article. Thanks for posting.
nindalf 4y ago
Great article. TFA this thread is based on is low quality. It’s breathless in its criticism of the legislation but uses hyperbole instead of calmly laying out the issues. The Maven Central guy puts it plainly - the proposed legislation doesn’t penalise OSS developers, unless they distribute software they also get a commercial benefit from. But that describes the operator of Maven Central, who publishes software and has some commercial interests tied to it. However they cannot possibly take on liability for every published package. In that case they would be left with no choice but to block EU users.
- account42 4y ago
  Having to profit from the software isn't neccessarily that big of a caveat either depending on what precise wording that ends up in the law. Do donations count? What if you accept a bug bounty? How about a one time contract to implement a minor feature? Monetizing OSS is already hard enough that having to deal with compliance even for (money wise) tiny projects will make it impossible for many more.

RobotToaster 4y ago

Calling it "unintended" is making a lot of assumptions.

GTP 4y ago
So we should assume that it is intended?
- rjzzleep 4y ago
  Remember when the CDU politicians celebrated when they successfully lobbied for upload filters for their publisher friends in the EU? Why should not assume that its intended？Plenty of McKinsey consultants around to make sure governments don't use too much FOSS to keep paying those nice license fees to MS.
  - BlueTemplar 4y ago
    Notably, for that there are tiers depending on the number of users or revenue.
  - GTP 4y ago
    >Plenty of McKinsey consultants around to make sure governments don't use too much FOSS to keep paying those nice license fees to MS. Maybe, but remember that Ursula von der Leyen herself has been advocating for a while for EU's "digital sovereignty" (not having to depend on products and services form non-EU countries) and the easiest way to achieve that would be to heavily rely on FOSS.
    - account42 4y ago
      > and the easiest way to achieve that would be to heavily rely on FOSS. But is it also the most profitable way for politicians.
    - rjzzleep 4y ago
      Ursula just like Macron has been involved in McKinsey scandals, the outcome of which was shoveling money to McKinsey and decimating the German military. Iirc her son was a partner or something. Ursula says all sorts of crazy stuff. The last year of Ursula policies have made sure that the EU is everything BUT sovereign. They are now fully dependent on the US MIC and fully dependent on US resource and energy imports at any price or terms the US wishes. Looks like everyone here has forgotten that the EU copyright stance is basically to shovel money to the US. I really wish people here would judge politicians by the outcome of their actions and not by what they say. https://torrentfreak.com/europes-odd-anti-piracy-stance-send-money-to-the-us-110904/ https://torrentfreak.com/europes-odd-anti-piracy-stance-send...

bee_rider 4y ago

> The CRA draft even exempts FOSS from compliance – but only if no commercial use is made of it, including things like technical support and as part of monetized services. This seems sort of reasonable. If you charge for tech support, you have a business. I’m all for not making it harder for people who are actually just sharing their hobby projects, but a project that makes money isn’t a hobby anymore. I mean we wouldn’t want to leave a gap large enough to send Android through, right?

Kon-Peki 4y ago
Exactly. If you want to be useful, help refine the “monetization” definitions. Don’t try to kill the whole legislation. The Register appears to have bought into the FUD being spewed by a bunch of people being paid a lot of money to run “non-profits”.
- littleraincloud 4y ago
  The main risk I see is that every web host using Apache or Nginx will be required to handle certification on their own. Businesses like Litesspeed can sell their product as a certified one and sell that as a feature.
  - simiones 4y ago
    But isn't this normal? If I am distributing a product based on Linux, it is my job to ensure that I use Linux in a secure way, to the extent required by contracts between me and my customers, and by local regulations. I can either take on this work myself, or pay IBM RedHat or SUSE or whoever else to take on some of the responsibility. How else would this work?
    - dathinab 4y ago
      There is a difference between due diligence and required certification. Using a "standard" kernel, keeping it up to date, etc. is due diligence but WAY cheaper and easier to do then any form of certification. Software certification especially wrt. to security is and always has been a mostly a scam. It also is a _major_ driving factor(1) for insecure software not getting fixed. Because it's "certified" but the security fix is not. (1: in certain industries)

ocdtrekkie 4y ago

This is, as per usual, big companies trying to scare you into believing regulations meant for them will hurt the little guys. Learn to recognize this news pattern and disregard it immediately. The EU is probably the leading body of government trying to drive FOSS adoption.

msla 4y ago
> This is, as per usual, big companies trying to scare you into believing regulations meant for them will hurt the little guys. Except those regulations hurt the little guys more than the big companies. Even if the big companies can't buy their way out of compliance, compliance inherently costs less for them and regulatory bodies are more willing to work with a big company than a small group of hobbyists, leading to the big company being able to follow the law with nary a hiccup whereas the hobbyists get destroyed by zealous enforcement.
- ocdtrekkie 4y ago
  This isn't true for a myriad of reasons. Smaller organizations are usually inherently more compliant, their smaller scale makes it far easier and cheaper for them to become compliant, and enforcement agencies are less interested in investing significantly in enforcement actions against them.
  - jessaustin 4y ago
    ...their smaller scale makes it far easier and cheaper for them to become compliant... This is often somewhat true. However, as I have observed in several USA contexts, large organizations are often exempted (whether explicitly or not) from pesky new regulations, citing this very point. For example, I personally attended a California PUC meeting in which VZN and SBC were exempted from "lifeline" regulations that continued to be imposed (with nonzero costs) on the small CLEC that employed me. Large organizations have to keep lawyers and lobbyists employed, so they might as well keep them busy. Creating regulations and exempting themselves is common practice. Perhaps things work differently in Europe.

pjmlp 4y ago

Well, that is the thing, I am free to offer food on the street, yet I am suject to the same kind of health regulations as any kind of restaurant. Same applies to any kind of business. Why should FOSS be any different? Maybe this is the culmination of the bazaar idea after all, including quickly stuffing the products back into a bag and running away from the law enforcement official between the crowd, by not having either a license or the expected quality.

DasIch 4y ago
> Why should FOSS be any different? Because it's not a business. Health regulations for restaurants also don't apply to your kitchen at home, even if you are inviting friends for dinner.
- pjmlp 4y ago
  They surely apply if they happen to get food poisoning and sue you afterwards.
  - yfr7ryfhh 4y ago
    Shockingly it's actually the fact you gave them food poisoning that decides that one. But I wouldn't be surprised if the Europeans thought that in need of fixing too.
    - pjmlp 4y ago
      It means that you haven't taken the proper care to prevent it from happening in first place.
      - account42 4y ago
        There is a difference between being held accountable if your negligence ends up hurting someone vs. proactive audits and reporting requirements - the second has overhead even for those that already have high standards, overhead that is unreasonable outside a business setting.

oaiey 4y ago

When I introduce a product to users I have to take care of its post-market cybersecurity. This is healthcare reality for years and now comes to all products. The interesting here is: What is a product? Most open source is not. The millions of libraries are not products. A product accumulates the various aspects (cybersecurity, license, ....) into a package. If I buy the software from a vendor I will make him responsible for it. If I hack it together on my self, this duty is on me. Open Source will survive that. But open source owners will get tons of questions and should be better be prepared to answer questions. GitLab and GitHub are already working on the consumer side with their security analysis features.

tensor 4y ago
But the rub is that open source owners have no actual obligation to you. So while you might want them to be "prepared with answers" they don't actually need to be. Some will want to be because they want their software to be used and up-to-date. But others have likely shelved their software, or just don't care to solve your security problems for you but will accept a patch if you provide one.
- karmicthreat 4y ago
  And its literally what developers that are taking open source software and using it to sell something need to understand. The sellers are adding that value and taking that risk. If I go to the store, buy some wood, build a shelf from the wood and sell the shelf. Then it burns my customers house down, its on me not Home Depot.
- est31 4y ago
  That's where OSS companies like Suse or RedHat come in: they do provide support for their distributions. And, unlike Amazon, they also employ many maintainers and if they don't employ them, they sometimes submit patches to upstream so are good OSS citizens.
- oaiey 4y ago
  That is all fair. The premise is the article headline that open source or Foss is dead. An open source software no one can use is a dead software. So the success of a Foss software might not only depend on functional aspects in Future but also on non functional aspects like the Cybersecurity management. And do not think that this influence will not happen. There are reason why the non functional requirement licensing has switched to MIT from previously more LGPL constructs. Having said all that... Yes, no one is obligated to answer.

jakeogh 4y ago

"Unintended"? No... it's the whole point.

christkv 4y ago

Will we have to change licenses to exclude use in the EU?

cm2187 4y ago

> The European Union has a commendable love for the safety of its citizens. Armed with the keys to a market of 300 million of the world's richest consumers More like 450m

jcarrano 4y ago

A lot of of questions... It is whether, for companies that offer paid support for FOSS, the obligations are towards the paying customers or all. The same with FOSS which is used as a basis for commercial products. E.g. Google makes money off Android, but is AOSP with no Google stuff also covered by this law? And how does it affect companies providing support for software they do not own? (e.g. consultancies).

davidgrenier 4y ago

How is this take? Free and Open Source Software isn't owned by anyone. Being a contributor, even to my own pet project, cannot compel me to contribute my valuable time to the project in ways that I do not so chose. And you can't compel me either to spend my money to hire some third party security firm to audit this code that isn't owned by me or anyone. If some third party wants to compile this un-owned piece of code and sell it to another, the onus is on them to comply with security regulations.

vaylian 4y ago

What I find interesting in this context: Most FOSS licenses have a no-warranty and no fitness for any purpose clause: GPL 3: there is no warranty for the program, to the extent permitted by applicable law. except when otherwise stated in writing the copyright holders and/or other parties provide the program “as is” without warranty of any kind, ... BSD-3-Clause: this software is provided by the author ``as is'' and any express or implied warranties, including, but not limited to, ... Apache 1.1: this software is provided ``as is'' and any expressed or implied * warranties, ... Which means that the liability lies entirely with the user if they use the software for something critical.

bee_rider 4y ago
Depending on the jurisdiction, courts might strike down or ignore parts of a license. On the other hand, you might not care what a court says, depending on your travel plans.

mikewarot 4y ago

Security is the job of the operating system, not applications. The seK4 kernel makes it possible to build operating systems that actually enforce security, rather than hope applications do the right thing. If this push isn't stopped... we'll all be taking a crash course on microkernels and the principle of least privilege. (A long overdue crash course, but that's my opinion, and not widely shared)

eternityforest 4y ago

So far, world cybersecurity has been good enough. In an average year, if you ask 100 people what problems they experienced, data breach related issues are not going to dominate the list. While I'm generally a big fan of heavy regulation, there's just so much tech that doesn't matter, that we just use to make other things that don't matter easier. I would much rather see the regulation confined to domain specific things, stuff that directly deals with finances, life safety, industrial, etc.

GRACE44 4y ago

[dead]