3 ms·

One of the main guys behind Maven Central guy did a thing on this: https://blog.sonatype.com/eu-cyber-resilience-act-good-for-software-supply-chain-security-bad

• hodgesrm 4y ago
  This was a very thoughtful article. Thanks for posting.
• nindalf 4y ago
  Great article. TFA this thread is based on is low quality. It’s breathless in its criticism of the legislation but uses hyperbole instead of calmly laying out the issues. The Maven Central guy puts it plainly - the proposed legislation doesn’t penalise OSS developers, unless they distribute software they also get a commercial benefit from. But that describes the operator of Maven Central, who publishes software and has some commercial interests tied to it. However they cannot possibly take on liability for every published package. In that case they would be left with no choice but to block EU users.
  • account42 4y ago
    Having to profit from the software isn't neccessarily that big of a caveat either depending on what precise wording that ends up in the law. Do donations count? What if you accept a bug bounty? How about a one time contract to implement a minor feature? Monetizing OSS is already hard enough that having to deal with compliance even for (money wise) tiny projects will make it impossible for many more.