4 ms·

https://eclipse-foundation.blog/2023/02/23/cyber-resilience-act-good-intentions-and-unintended-consequences/ https://eclipse-foundation.blog/2023/02/23/cyber-re

by EGreg 4y ago

https://eclipse-foundation.blog/2023/02/23/cyber-resilience-act-good-intentions-and-unintended-consequences/ https://eclipse-foundation.blog/2023/02/23/cyber-resilience-... As many well-known open source foundations have warned, this will bring unintended consequences. This means Europe will cut itself off from a lot of software as an unintended consequence. The whole point of open source software, a lot of the time, is that contributions are done incrementally by people without the means to certify this software to the level they want. Given enough time and distribution, open source software often becomes much more resilient than its closed counterparts, not due to any government regulations, but because it is run in so many environments and there are so many critical eyes on the project, able to submit a patch. In fact, most of the infrastructure on the Internet runs on open source software. That said, the package managers we use do have a problem — they rely on packages maintained by individual developers, and gradually update hundreds of versions, opposed to, say, the way operating systems are released. Commercial releases like RedHat etc. can be certified! They should go after companies that make actual promises. Having said that, a robust process in place for peer review in open source projects is good, same as in science or Wikipedia. For the longest time, software development has grown by leaps and bounds, and software security is hardly the most costly thing to society. Proprietary software behind large Big Tech companies externalizes cost to society. Consider how the world looked for instance before the open Web: we had AOL, MSN, etc. and everyone had to pay to play. Yes, it’s easy to regulate, but also increases the dependency on giant, centralized corporations and governments. Many people felt that networked software and technology empowers people and frees people up to organize in ways that don’t rely on institutions. For example: E-Mail vs the post office The Web vs newspapers, radio Ethereum vs banks, corporations Now you will only be able to run things approved by the government. Because people won’t be able to develop or update anything else. MY BIGGEST WORRY IS THAT THEY WILL REPURPOSE AND EXPAND THIS LICENSING REGIME TO EXCLUDE SOFTWARE THEY DON’T LIKE, SUCH AS FILE SHARING SOFTWARE OR END-TO-END ENCRYPTED MESSAGING SOFTWARE BECAUSE THEY WILL SAY THE “SECURITY” OF THE STATE WILL BE COMPROMISED. Once you have an effective licensing regime in place, you tighten the noose. They are doing this with rolling out DIGITAL IDs for everyone too… https://m.youtube.com/watch?v=uwRSzNTp2ko https://m.youtube.com/watch?v=uwRSzNTp2ko It’s a process that can take 10 years but you’re like the proverbial frogs in the pot.

Scandiravian 4y ago
I think there's a version of this that could actually be beneficial for open-source software Many large companies are dependent on open-source libraries. With these regulations they now have (more) incentive to get bugs and vulnerabilities in their dependencies fixed They can't ship with known vulnerabilities, so if a project is suffering from a vulnerability, they might realise they need to provide a financial incentive to maintainers so issues are fixed quickly Of course there's also a lot of other ways it could play out, but I don't think it's necessarily a given the result will be negative
- EGreg 4y ago
  But a lot of newer open source software doesn’t have the resources to do this to the level they require. Plus, there will be gatekeepers established by the government (listed in the article) that can allow some software or not. These gatekeepers should exist, but in the form of certification companies, rather than taking on this ridiculous character: https://www.forbes.com/sites/jennyodegard/2017/09/06/whats-the-deal-with-new-yorks-llc-publication-requirement/ https://www.forbes.com/sites/jennyodegard/2017/09/06/whats-t... (this is how it looks in my home state of NY — not only is the requirement outdated but each county has a favored newspaper that you must use so it can charge a large amount for a useless service). As a left-libertarian, I agree with a lot of arguments from right-libertarians and ancaps, one of them being that regulations are welcomed by the big boys because they provide a government-enforced barrier to entry for all the smaller guys. Think of Facebook’s threat to “buy or copy” competitors, but now it would be “buy or put out of business with government force”. Sounds a lot more menacing when you put it that way, no?
  - Scandiravian 4y ago
    I think the difference in how government enforces regulations is very different between the EU and US Overall I don't think EU will go after smaller projects, since that would hurt the economy in an undesirable way. I think it's more likely that they'll use this to go after bigger corporations since that's an actual security risks for member states That's also why there's a statement about proportionality in the proposal. The more critical the software is, the more you'll need to ensure safety

by EGreg 4y ago

Scandiravian 4y ago

I think there's a version of this that could actually be beneficial for open-source software Many large companies are dependent on open-source libraries. With these regulations they now have (more) incentive to get bugs and vulnerabilities in their dependencies fixed They can't ship with known vulnerabilities, so if a project is suffering from a vulnerability, they might realise they need to provide a financial incentive to maintainers so issues are fixed quickly Of course there's also a lot of other ways it could play out, but I don't think it's necessarily a given the result will be negative

EGreg 4y ago
But a lot of newer open source software doesn’t have the resources to do this to the level they require. Plus, there will be gatekeepers established by the government (listed in the article) that can allow some software or not. These gatekeepers should exist, but in the form of certification companies, rather than taking on this ridiculous character: https://www.forbes.com/sites/jennyodegard/2017/09/06/whats-the-deal-with-new-yorks-llc-publication-requirement/ https://www.forbes.com/sites/jennyodegard/2017/09/06/whats-t... (this is how it looks in my home state of NY — not only is the requirement outdated but each county has a favored newspaper that you must use so it can charge a large amount for a useless service). As a left-libertarian, I agree with a lot of arguments from right-libertarians and ancaps, one of them being that regulations are welcomed by the big boys because they provide a government-enforced barrier to entry for all the smaller guys. Think of Facebook’s threat to “buy or copy” competitors, but now it would be “buy or put out of business with government force”. Sounds a lot more menacing when you put it that way, no?
- Scandiravian 4y ago
  I think the difference in how government enforces regulations is very different between the EU and US Overall I don't think EU will go after smaller projects, since that would hurt the economy in an undesirable way. I think it's more likely that they'll use this to go after bigger corporations since that's an actual security risks for member states That's also why there's a statement about proportionality in the proposal. The more critical the software is, the more you'll need to ensure safety