5 ms·

I think there's a version of this that could actually be beneficial for open-source software Many large companies are dependent on open-source libraries. With

I think there's a version of this that could actually be beneficial for open-source software Many large companies are dependent on open-source libraries. With these regulations they now have (more) incentive to get bugs and vulnerabilities in their dependencies fixed They can't ship with known vulnerabilities, so if a project is suffering from a vulnerability, they might realise they need to provide a financial incentive to maintainers so issues are fixed quickly Of course there's also a lot of other ways it could play out, but I don't think it's necessarily a given the result will be negative

EGreg 4y ago
But a lot of newer open source software doesn’t have the resources to do this to the level they require. Plus, there will be gatekeepers established by the government (listed in the article) that can allow some software or not. These gatekeepers should exist, but in the form of certification companies, rather than taking on this ridiculous character: https://www.forbes.com/sites/jennyodegard/2017/09/06/whats-the-deal-with-new-yorks-llc-publication-requirement/ https://www.forbes.com/sites/jennyodegard/2017/09/06/whats-t... (this is how it looks in my home state of NY — not only is the requirement outdated but each county has a favored newspaper that you must use so it can charge a large amount for a useless service). As a left-libertarian, I agree with a lot of arguments from right-libertarians and ancaps, one of them being that regulations are welcomed by the big boys because they provide a government-enforced barrier to entry for all the smaller guys. Think of Facebook’s threat to “buy or copy” competitors, but now it would be “buy or put out of business with government force”. Sounds a lot more menacing when you put it that way, no?
- Scandiravian 4y ago
  I think the difference in how government enforces regulations is very different between the EU and US Overall I don't think EU will go after smaller projects, since that would hurt the economy in an undesirable way. I think it's more likely that they'll use this to go after bigger corporations since that's an actual security risks for member states That's also why there's a statement about proportionality in the proposal. The more critical the software is, the more you'll need to ensure safety
  - EGreg 4y ago
    And I predict there will be a lot more pseudonyms like Satoshi cropping up soon.
  - aww_dang 4y ago
    >Overall I don't think EU will go after smaller projects... Sure keeping your head down is always a smart choice. But willfully living at the whims of capricious bureaucrats? Given the choice I'd prefer to not have that sword of Damocles in play.
    - Scandiravian 4y ago
      I prefer having strong governmental institutions with elected officials who answers to their voters compared to large corporations who answer to shareholders Taking GDPR as an example, it shows that enforcement is done in proportion to the size of the corporation. Big corporations get fined, smaller companies receive warnings
      - aww_dang 4y ago
        And what of the failure mode when these institutions are swayed by malign incentives? If there are tangible harms, why have judicial institutions not entertained civil suits? If there are tangible harms, yet the institutions have not entertained civil suits, could it be that malign incentives are already in play? Would you trust voters in your locality to vote on how you create your next software project? Shall we vote on what you eat for lunch? Ultimately these discussions boil down to our core premises. Doubtful either of us will convince the other to change those.
        Scandiravian 4y ago
        To me it's not about convincing anyone. I'm sharing my views on the topic because I'm interested in hearing other opinions and broaden my perspective I can understand why some people are worried when looking at how many governmental institutions have failed in their duty to serve the public. The EU has definitely got its share off bad decisions, but overall I think it has a good track record Politically I'd probably identify myself as an anarchist, so if I could change the world to look exactly like I thought best, I'd probably get rid of nation states and governments all together That's however not how the world works and I'd rather work with the tools I have available right now There's a war going on not far away from where I live and cyber attacks against critical infrastructure are happening almost daily Even on this site, where I think discussions are generally pretty civilised, I'm starting to see a lot of retoric that's suspiciously similar to the alt-right retoric in many other places on the web It makes me think that there's a growing number of users here on this site who are only here to further their political agenda of authoritarianism and violence That scares me much more than having to make sure that the code I write doesn't have security vulnerabilities I think it's worth considering what actions can be taken to preserve society the best under these circumstances (society is different from government and states in this context)
throw_m239339 4y ago
> Many large companies are dependent on open-source libraries. With these regulations they now have (more) incentive to get bugs and vulnerabilities in their dependencies fixed This is not what is going to happen, what is going to happen is that open source will be deemed a legal liability and every institution will turn to Microsoft proprietary solutions. Nobody is going to put more money into hiring people to fix bugs or vulnerabilities in open source projects.
- Scandiravian 4y ago
  How much are you willing to bet on that? I'm happy to put down $1000 that this will not happen Germany has for instance transitioned to using significantly more open-source software in the governmental institutions, as has many other EU member states They would not support this proposal if it would result in an expensive reversal of these efforts
  - EGreg 4y ago
    Governments having standards for themselves and their contractors is just fine: https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/ https://www.whitehouse.gov/briefing-room/presidential-action... Imposing gatekeepers on the rest of the public with penalties even in private use cases is not.
    - Scandiravian 4y ago
      That's your personal opinion and you're of course welcome to that, though I'm curios why you take such an offence to other regions with a different political situation, cultural history, and most importantly security concerns, implementing laws that you're not subjected to. Could you expand on that?
      - EGreg 4y ago
        Simple: this law will affect me as a software developer. Any software “made available” in Europe can be subject to this, just like with GDPR. And most open source software is designed to be “made available” anywhere! This is the first time the developers of such free software can be hit with massive fines. And frankly, even if that wasn’t the case, I care about human beings elsewhere.

EGreg 4y ago

But a lot of newer open source software doesn’t have the resources to do this to the level they require. Plus, there will be gatekeepers established by the government (listed in the article) that can allow some software or not. These gatekeepers should exist, but in the form of certification companies, rather than taking on this ridiculous character: https://www.forbes.com/sites/jennyodegard/2017/09/06/whats-the-deal-with-new-yorks-llc-publication-requirement/ https://www.forbes.com/sites/jennyodegard/2017/09/06/whats-t... (this is how it looks in my home state of NY — not only is the requirement outdated but each county has a favored newspaper that you must use so it can charge a large amount for a useless service). As a left-libertarian, I agree with a lot of arguments from right-libertarians and ancaps, one of them being that regulations are welcomed by the big boys because they provide a government-enforced barrier to entry for all the smaller guys. Think of Facebook’s threat to “buy or copy” competitors, but now it would be “buy or put out of business with government force”. Sounds a lot more menacing when you put it that way, no?

Scandiravian 4y ago
I think the difference in how government enforces regulations is very different between the EU and US Overall I don't think EU will go after smaller projects, since that would hurt the economy in an undesirable way. I think it's more likely that they'll use this to go after bigger corporations since that's an actual security risks for member states That's also why there's a statement about proportionality in the proposal. The more critical the software is, the more you'll need to ensure safety
- EGreg 4y ago
  And I predict there will be a lot more pseudonyms like Satoshi cropping up soon.
- aww_dang 4y ago
  >Overall I don't think EU will go after smaller projects... Sure keeping your head down is always a smart choice. But willfully living at the whims of capricious bureaucrats? Given the choice I'd prefer to not have that sword of Damocles in play.
  - Scandiravian 4y ago
    I prefer having strong governmental institutions with elected officials who answers to their voters compared to large corporations who answer to shareholders Taking GDPR as an example, it shows that enforcement is done in proportion to the size of the corporation. Big corporations get fined, smaller companies receive warnings
    - aww_dang 4y ago
      And what of the failure mode when these institutions are swayed by malign incentives? If there are tangible harms, why have judicial institutions not entertained civil suits? If there are tangible harms, yet the institutions have not entertained civil suits, could it be that malign incentives are already in play? Would you trust voters in your locality to vote on how you create your next software project? Shall we vote on what you eat for lunch? Ultimately these discussions boil down to our core premises. Doubtful either of us will convince the other to change those.
      - Scandiravian 4y ago
        To me it's not about convincing anyone. I'm sharing my views on the topic because I'm interested in hearing other opinions and broaden my perspective I can understand why some people are worried when looking at how many governmental institutions have failed in their duty to serve the public. The EU has definitely got its share off bad decisions, but overall I think it has a good track record Politically I'd probably identify myself as an anarchist, so if I could change the world to look exactly like I thought best, I'd probably get rid of nation states and governments all together That's however not how the world works and I'd rather work with the tools I have available right now There's a war going on not far away from where I live and cyber attacks against critical infrastructure are happening almost daily Even on this site, where I think discussions are generally pretty civilised, I'm starting to see a lot of retoric that's suspiciously similar to the alt-right retoric in many other places on the web It makes me think that there's a growing number of users here on this site who are only here to further their political agenda of authoritarianism and violence That scares me much more than having to make sure that the code I write doesn't have security vulnerabilities I think it's worth considering what actions can be taken to preserve society the best under these circumstances (society is different from government and states in this context)

throw_m239339 4y ago

> Many large companies are dependent on open-source libraries. With these regulations they now have (more) incentive to get bugs and vulnerabilities in their dependencies fixed This is not what is going to happen, what is going to happen is that open source will be deemed a legal liability and every institution will turn to Microsoft proprietary solutions. Nobody is going to put more money into hiring people to fix bugs or vulnerabilities in open source projects.

Scandiravian 4y ago
How much are you willing to bet on that? I'm happy to put down $1000 that this will not happen Germany has for instance transitioned to using significantly more open-source software in the governmental institutions, as has many other EU member states They would not support this proposal if it would result in an expensive reversal of these efforts
- EGreg 4y ago
  Governments having standards for themselves and their contractors is just fine: https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/ https://www.whitehouse.gov/briefing-room/presidential-action... Imposing gatekeepers on the rest of the public with penalties even in private use cases is not.
  - Scandiravian 4y ago
    That's your personal opinion and you're of course welcome to that, though I'm curios why you take such an offence to other regions with a different political situation, cultural history, and most importantly security concerns, implementing laws that you're not subjected to. Could you expand on that?
    - EGreg 4y ago
      Simple: this law will affect me as a software developer. Any software “made available” in Europe can be subject to this, just like with GDPR. And most open source software is designed to be “made available” anywhere! This is the first time the developers of such free software can be hit with massive fines. And frankly, even if that wasn’t the case, I care about human beings elsewhere.