11 ms·

The EU proposed CRA law may have unintended consequence for the Python ecosystem

186 points by AlexeyBrin 4y ago

2rsf 4y ago
> If the proposed law is enforced as currently written, the authors of open-source components might bear legal and financial responsibility for the way their components are applied in someone else’s commercial product. Oh shit, this is huge. I wonder if it applies retroactively for code in the wild, as an open source contributor you can't recollect you code back.
- canadiantim 4y ago
  If true and enforced that would be the death of the open-source community as we know it
  - tensor 4y ago
    In the EU at least. No doubt disclaimers would go up on all source repositories that access from the EU is forbidden.
    - josephcsible 4y ago
      How many more laws like this one need to get passed for people to stop saying Brexit was the worst thing that could have happened to the UK?
      - ben_w 4y ago
        Depends on the people you want to stop saying it. There's people like me, who moved from the UK to Germany as a direct reaction to Brexit. I don't have a Boolean heaven-or-hell (Devon-or-Hull?) attitude to any of this — Brexit itself was stupid, but not (yet) the worst thing the Westminster government did to United Kingdom people. Sure, a repeat of the Potato Famine may happen, but probably not. Then you've got people who have made it part of their identity. On both sides, they're never going to admit the possibility of Team Them making the slightest of mistakes. For example, the specific mistake of the government passing a law that allowed a regional ambulance service to find out the preceding 6 months of internet domains accessed by any person, without any need for a warrant; something that was obviously not compatible with the Human Rights obligations but which the government passed anyway, and as that government was loudly conflating the EU with the human rights courts, I just assumed they'd force it into effect regardless of any objection I could bring, when they actually managed to leave the EU. https://en.wikipedia.org/wiki/Investigatory_Powers_Act_2016 https://en.wikipedia.org/wiki/Investigatory_Powers_Act_2016 "Less bad" isn't automatically perfect (the topic of this discussion may be an example of such an imperfection), but it is less bad.
        908B64B197 4y ago
        > the government passing a law that allowed a regional ambulance service to find out the preceding 6 months of internet domains accessed by any person, without any need for a warrant Wow. And people voted in favor of that? No wonder we're flooded with resumes from the UK over here...
        ben_w 4y ago
        I still don't know why they even asked for that power; the arguments given at the time were predicable clichés that had about as much connection to reality as the average stock photo of a hacker — if I assume they were sincere then they must have been incompetent, and if competent then insincere. https://votes.parliament.uk/Votes/Commons/Division/80 https://votes.parliament.uk/Votes/Commons/Division/80
      - flangola7 4y ago
        The only reason there's a possibility Brexit isn't the worst thing is the large pool of competitively bad things.
      - r_hoods_ghost 4y ago
        In case you hadn't noticed, this law hasn't been passed. It is currently out for consultation through a relatively transparent process. Certainly more transparent than the, let's all meet at the club and thrash it out between us, what what, process that takes place in Westminster under the current lot. This is how democracy is supposed to work, but alas very few people take the time to learn that or engage in the actual process.
      - benhurmarcel 4y ago
        Maybe don't base your opinion of the EU on some speculative HN comments about a non-voted law proposal?
    - SkyBelow 4y ago
      If the EU is willing to hold you financially liable for something you provided for free with no promise of it functioning or being safe to use, might they also hold you financially liable even though you said it shouldn't be used by anyone in the EU?
      - FredPret 4y ago
        Maybe the safest approach is to firewall them off of the internet. They can have their own bureaucratic paradise without involving the rest of us in their mad schemes.
        sclarisse 4y ago
        I mean, the newspapers already do that with the GDPR regulations, so it may be inevitable
        FredPret 4y ago
        Personally I modified my (paid service) project's EULA to make it unavailable to EU residents, citizens, and people currently located there just to be safe. First it was fonts and cookies, now this; I don't want to see where this jaw-dropping progression ends up. In 2016 I thought Britain was absolutely mad, but they're starting to look smarter and smarter
        cronix 4y ago
        I wonder how much collective time the world would save not having to click on cookie permissions every time they visit a website.
        jart 4y ago
        MaxMind has a free utility called GeoIpLite that has an explicit field which tells you if an IP address should be considered part of the EU.
        FredPret 4y ago
    - noworriesnate 4y ago
      What about extradition treaties? Do I need to be concerned about someone in Europe misusing my mathematical expression parser library in a medical device, people die, and then I get extradited? I heard a third-hand story about a Boeing engineer held responsible for an aircraft crash in China, and the US was going to extradite him to China. He committed suicide. Don't know if it was true, although it was a Boeing employee who told me about it, and she certainly thought it was true.
      - Jtsummers 4y ago
        The US doesn't have an extradition treaty with China, so that's probably an urban legend or someone pulling your leg or trying to put the fear of god (China?) into her and other engineers so they take the job seriously.
    - octacat 4y ago
      Pretty much that. After GDPR many small shops refused to work with EU IP addresses and just redirect to a page with some disclaimer. But big players (who were consulting politicians when GDPR regulations were written) only won from GDPR, they don't need to show the cookies banner all the time on their platforms and still have a lot of power over your private data. Certification of software is always expensive, so expect new open source licenses: "Open source as usual, but if you are from EU, you are not allowed to use that code". Or expect Amazon to take an open source product, close source their fork, do certification and provide SAAS. Again, there are companies who can do some commercial support for their code, but they are really could not be interested in adopting all the EU regulations.
  - xeromal 4y ago
    I'm sure repos would just block access to European IP address if the maintainer requests it.
  - mrweasel 4y ago
    It would also absolutely destroy the EU economy. Developers in the EU would be blocked from PyPi, GitHub, NPM, Stack Overflow and much much more. Pretty much every single commercial software product contains at least one open source package. You wouldn't even be able to use Java or .Net. There's also no way in hell that commercial companies like Oracle or Microsoft will assume any kind of responsibility for errors their code would result in in a customers code base. At least not without massive compensation. And how about Linux, or Android... or iOS, they contain open source software as well. Could you go after some random kernel developer for a bug that affects Android? This hasn't been tought through in any way, the ramifications could be enormous.
    - estebarb 4y ago
      At some point would be cheaper to just block access from whole Europe than complying with their laws. The worst part is that a lot of politicians in other countries are just copying the EU tech legislation, instead of trying to produce something better.
      - ClumsyPilot 4y ago
        So every 2 weeks i read posts like this, 'Company X will just quit" if they have to pay tax/comply with some law/ follow basic decency But it never happens. The only example is Google leaving China because of authoritarianism. And now they are back. Maybe it can happen to a tiny country. But do you actually imagine that the entire 17 trillion economy of EU will be left without software? Companies do not 'just quit' huge markets. They don't leave money on the table.
        estebarb 4y ago
        Big companies obviously no. But a bootstrapped startup? Probably yes, at least initially. And here we are not talking about "basic decency" or taxes. The audit requirements by the new EU law are extremely expensive. They assume that every software developer is BigCo. I don't see that the EU is requesting every tabloid article to be fully audited to remove false claims or that each medical decision must be audited. The requirement is disproportional.
- josefx 4y ago
  This thing wont be fairly enforced until the ISO is fined $50 Googol for publishing the C spec. .
  - oaiey 4y ago
    Who invented null again? I need an address for the lawyers.
    - green7ea 4y ago
      | I call my billion-dollar mistake. It was | the invention of the null reference in 1965. | | -- Tony Hoare It might turn into a real billion-dollar mistake, not just a metaphorical one...
    - ben_w 4y ago
      Mr Nüll Null St 0°N, 0°E https://en.wikipedia.org/wiki/Eduard_van_der_Nüll https://en.wikipedia.org/wiki/Eduard_van_der_Nüll (I assume this is a record error) https://goo.gl/maps/fDEbp5ymtTiYPMKZA https://goo.gl/maps/fDEbp5ymtTiYPMKZA https://en.wikipedia.org/wiki/Null_Island https://en.wikipedia.org/wiki/Null_Island
    - lelanthran 4y ago
      The address of null is zero, obviously
- Asmod4n 4y ago
  You can potentially hold those responsible who published the first open source TCP/IP stack for anything happening on the internet if it retroactively applies to existing code, fun times.
  - Gud 4y ago
    The first TCP/IP stack was actually open source(before the term even existed). Written by Bill Joy(and maybe others) of Vi, Sun and BSD fame.
qwerki 4y ago
The open source community in general needs to pay more attention to this space – not just the python ecosystem. More maintainers need to know that well intentioned people are proposing policies that would in some instances make them financially and legally liable for the code they write.
- AlanYx 4y ago
  The new EU AI Act also has this problem, in that it imposes liability for developing components that may at some future point be misused by others. The source of the problem is a particular approach to legislation that has become popular in the EU that purports to regulate across the entire supply chain for a product. Which might make sense for production of physical items or for software developed completely from scratch 30 years ago under a waterfall model, but is strongly disconnected from the way software is currently built.
- foobiekr 4y ago
  “Well intentioned” does not actually describe the strong IT companies that support actions like this to try and recapture value. European big tech companies like Siemens, Ericsson, Nokia and so on are not fans of open source since it negatively impacted their captive customer bases.
dsr_ 4y ago
"a version of Python is downloaded over 300 million times per day." If true, this is insane.
- marginalia_nu 4y ago
  No doubt the vast majority of those downloads are from CI systems and build scripts executing on every commit.
  - dsr_ 4y ago
    Which is insane. Local caches should be ubiquitous, along with lightweight validation checks.
    - marginalia_nu 4y ago
      Yeah. It's quite a problem. Although I think in many cases, the people doing this aren't aware it's happening. It's a git action kicking off some jenkins agent somewhere in a kubernetes container on a virtualized server that was set up and forgotten about based on a patchwork of online tutorials.
      - pmontra 4y ago
        Probably everybody knows that each test run and build is downloading GB of data but they're doing it quickly, they don't cost much money or none at all, and it's easier to do it than setting up a local cache and use it (CI, local dev machines,) etc. The only reason I ever saw some optimization at that level was because building the base image took too long, so we were saving one and we were rebuilding it only when dependencies changed. I can't remember the details.
        dp-hackernews 4y ago
        Try doing that in am air-gapped environment and you'll soon learn about the importance of local artifact caches and caching proxies with tight retrieval policies, or having downloads gated for review... ;-)
hunglee2 4y ago
No exaggeration to say that the EU might inadvertently divert the civilisational path of humanity
- miohtama 4y ago
  What’s a civilisation or two in the name of think of the children
fermigier 4y ago
More reactions on the same subject: - From the Eclipse Foundation: https://eclipse-foundation.blog/2023/01/15/european-cyber-resiliency-act-potential-impact-on-the-eclipse-foundation/ https://eclipse-foundation.blog/2023/01/15/european-cyber-re... and https://blogs.eclipse.org/post/mike-milinkovich/cyber-resilience-act-good-intentions-and-unintended-consequences https://blogs.eclipse.org/post/mike-milinkovich/cyber-resili... - From the Internet Society: https://www.internetsociety.org/blog/2022/10/the-eus-proposed-cyber-resilience-act-will-damage-the-open-source-ecosystem/ https://www.internetsociety.org/blog/2022/10/the-eus-propose... With more to come... This is a serious situation.
deleted 4y ago
[deleted]
agilob 4y ago
Its been only a years since: >Google wants to work with government to secure open-source software https://blog.google/technology/safety-security/making-open-source-software-safer-and-more-secure/ https://blog.google/technology/safety-security/making-open-s... https://www.techradar.com/news/white-house-calls-summit-on-open-source-security-following-log4j-attacks https://www.techradar.com/news/white-house-calls-summit-on-o... https://www.engadget.com/google-open-source-private-public-partnership-204840652.html https://www.engadget.com/google-open-source-private-public-p... And 2 years since: >If your open-source software project is considered "critical", you could be facing a lot more work and responsibility in the future. But for now, it's just some ideas from a few of Google's top engineers. https://www.zdnet.com/article/open-source-google-wants-new-rules-for-developers-working-on-critical-projects/ https://www.zdnet.com/article/open-source-google-wants-new-r...
- acedTrex 4y ago
  There is no responsibility with open source, thats the entire point.
  - agilob 4y ago
    there is as much responsibility as money
AbrahamParangi 4y ago
Why on earth would they make the original vendor of a component liable instead of the last corporate vendor wholly liable for all components of the final product they sell? This seems like something which can only benefit: 1) very large corporations 2) who use a lot of components they don’t make This seems almost designed as protectionist legislation for dinosaur companies unable to manage their software dependencies at any level of competence.
- ajsnigrutin 4y ago
  Yep, it's interesting because this is the case in eg. device warranties... if something breaks down, you don't search who the manufacturer of the capacitor was, but just take the device to the seller/retailer/store and have them deal with it.
  - ghaff 4y ago
    Mostly. There are some exceptions. For example, with cars, tires are often warrantied directly with the tire manufacturer. Also, in the case of material defect, e.g. the airbag issue a number of years back, the auto manufacturer is mostly the entity on the hook for consumers but there are absolutely various liabilities up the supply chain.
    - AbrahamParangi 4y ago
      For sure, it’s reasonable that the airbag vendor, having sold a product to the auto vendor, is liable to the auto vendor. I don’t think the airbag vendor should be separately liable to the user since it’s the auto vendor’s responsibility to ensure that the holistic system works- even without considering the case of open source wherein there’s no contract at all between the OSS “vendor” and either the immediate “buyer” or end customer.
      - ghaff 4y ago
        Takata was sued by various parties (consumer class actions, at least one state) over their airbag defect although I'm not sure what the outcome was over and above the settlement by the various auto makers. People can sue for pretty much anything and there's a good chance you have to (or at least should) get a lawyer if that happens. While it's arguably negligible, there is some risk in putting tools/code out there even if it's free and not warrantied.
gdcbe 4y ago
I’m all for software vendors requiring to take more responsibility. Anything better then the current “if it works you’re lucky” guarantee that drives drives the bug parching normality. The responsibility lies with the commercial vendors however, not with the open source developers. What a perverse world we live in, that that can even be possible… Using our software for free and then holding us responsible… ha!
- game_the0ry 4y ago
  > Using our software for free and then holding us responsible… ha! Yeah...slap in the face for open source contributions that literally chnage the world for the better.
galaxytachyon 4y ago
Not all things can be or even should be regulated. This is almost akin to a law punishing good samaritan for helping someone in need because that someone ended up a criminal later. Not only is it dumb but also a perversion of authority. Hopefully they know what they are doing and revise the law.
- account42 4y ago
  "Good samaritan" is a pretty relevant keyword here because many countries have so called Good Samaritan Laws that explicitly give legal protection to those aiding others in peril. The idea is that you won't want to discourage people from helping those in need by fear of repercussions. Its not unreasonable that similar liability protections should apply to those freely sharing software.
  - Ekaros 4y ago
    On other hand. If I for example make food from rotten ingredients and share it on street for free, even with disclaimer and someone gets food poisoning I don't think anything protects me. Or should protect me. I have never understood why software is some special place. Specially if entity has anyway to monetize it.
    - account42 4y ago
      Making food from obviously rotten ingreedients is not akin to something that would fall under good samaritan laws. However I don't agree that you should be liable for providing food to those in need if you have made reasonable safety precautions. Restaurants throwing away their leftovers rather than be held liable is not a good thing for society. So no, I don't think software should have a special place here but rather that someone trying to "do good" should not be punished for it even if they mess up a bit.
knlje 4y ago
This is a quote from the linked document: > 10) In order not to hamper innovation or research, free and open-source software developed or supplied outside the course of a commercial activity should not be covered by this Regulation. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. In the context of software, a commercial activity might be characterized not only by charging a price for a product, but also by charging a price for technical support services, by providing a software platform through which the manufacturer monetises other services, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software.
- tgvaughan 4y ago
  How does this work for free software projects which aren't themselves commercial but list employees of big companies among their major contributors? E.g. the Linux kernel?
  - layer8 4y ago
    It will likely be tied to the “productization”. That is, the liability chain will only go as far as there is someone who turned the software into a product for monetization purposes. If a company sells a product that uses Linux, they will be liable regardless of whether they contributed to Linux development or not. If part of the product was itself purchased from a third party, the third party will be liable for that part. But open-source developers who don’t monetize the software won’t be liable. One case that could potentially become problematic is OSS developers who have Patreon subscribers or similar, where those subscribers could conceivably pass on liability claims.
    - deleted 4y ago
      [deleted]
- paol 4y ago
  That's from the "Cyber Resilience Act" link, and the "Product Liability Act" link has pretty much the same text in item 13.
gavinhoward 4y ago
Oh boy. If this passes, I'm basically going to have to not allow people to use my FOSS in Europe. I have actually written some Open Source licenses [1], and one different thing about these licenses is that they are null and void if the law requires the original contributors to accept any responsibility for the software unless they voluntarily accept it. In my opinion (IANAL, but I wrote those licenses), if things passes, then anything licensed under my licenses would not be legal to use in Europe or by EU citizens. Licenses will now need protections like this to keep FOSS alive, and places with laws like these will lose out. By the way, my licenses are currently being checked by a lawyer. However, it may cost me more than I can spare, so I may not be able to get them fully checked. [1]: https://yzena.com/licenses/ https://yzena.com/licenses/
endisneigh 4y ago
Seeing many of the EU's laws - I feel that they have given up in innovating, and have designed to go all in on legislation. Many of the rules they make are completely unnecessary IMHO. They treat their citizens as totally incompetent and incapable of evaluating alternatives themselves. I expect the EU to continue to falter in cutting edge tech as a result. Software in particular.
- jart 4y ago
  They're not called citizens, they call them subjects.
  - M2Ys4U 4y ago
    Article 20(1) of the Treaty on the Functioning of the European Union: "Citizenship of the Union is hereby established. Every person holding the nationality of a Member State shall be a citizen of the Union. Citizenship of the Union shall be additional to and not replace national citizenship."
- nemo44x 4y ago
  Indeed, they just can't seem to understand the modern economy. How many unicorn's has Europe created over the last 15 years? The idea that a wildly influential technology company coming from the EU instead of America or China is just not realistic. I guess they can continue to export luxury brands and tourism. I think Europeans tend to have an aversion to success/wealth and are scared to go out and try and build something. Just be conservative and go and work for a company that underpays. But at least you get to go on a vacation a couple times a year. I feel like the time I've spent in Europe and the time in the USA is that Americans are optimistic that something can be done and they go out and take a risk. Europeans are skeptical of anything new. And to me it's weird because the way social safety nets tend to work in Europe, people should be taking risks left and right. And to be sure there's no lack of very talented engineers in the EU. Is it that Europe relies so much on legacy? Their legacy colonial relationships around the world, their legacy brands, etc?
Asmod4n 4y ago
This law kinda only needs a few changes to actually increase the protection of consumers. - it only applies if you are directly selling a IT product/software to consumers. - when you use third party components and find a security flaw in them you have to inform the third party immediately. - in addition if you find a flaw in open source code you should send a patch if you are capable of doing so.
ApolloFortyNine 4y ago
Basically every license out there has some "can't be held liable" clause in it (see the mit license for an easy to find one). Does this mean the license may be invalid entirely in the EU, making it so you actually just can't use the software at all? I know that's how the GPL basically works, if you don't accept the GPL, then you simply have no license at all.
- layer8 4y ago
  Usually the respective clause just becomes legally void. This is different from you not accepting that clause. It doesn’t invalidate the license as such (even if the license would like that to happen).
  - ApolloFortyNine 4y ago
    Isn't that kind of insane? You get to ignore a crucial clause of the license and continue using the software? I mean one day they could also say copyleft is unreasonable and illegal, so now the GPL is just a free for all.
    - layer8 4y ago
      If a sales contract says that, by the way, the seller now owns your first-born, then that clause is void because it’s illegal. It doesn’t however mean that the contract is void and that you have to return what you bought or have to reimburse the seller. It’s the sellers fault that they put an illegal clause into the contract. It’s different from if the law would say that the whole type of contract is illegal.
- jart 4y ago
  I discussed this with an AI language model (GPT-4), and the general idea I gathered was that in the EU, it's possible that the "no warranty" clause in open source licenses could be invalidated by consumer protection laws, while the rest of the license remains valid. This could potentially expose authors to liability, even as their work continues to be used for free. However, it's important to note that this information came from an AI and should not be considered legal advice. The specific application of these laws may vary depending on the jurisdiction and circumstances.
Ekaros 4y ago
Then again maybe this will finally make people write software that is fit for purpose and isn't just stuff thrown at wall. Passing out poison for free doesn't go too well in real world, I don't see why software should be really different.
- prmoustache 4y ago
  The iot industry shows us daily that making pay for poison doesn't go much better yet is totally allowed to continue.
- game_the0ry 4y ago
  Feel free to stop using the internet then, since it is built on apache / nginx / python / java / javascript / php and many other open source technologies.
- madsbuch 4y ago
  well, it is easy for. open source. you just defer the semantics of your program. to. the implementation. then you will never have bugs.
- UncleEntity 4y ago
  Fit for what purpose? I have a couple things up on GitHub that are fit for my purpose but you probably don’t want to be using if your threat model is higher than “huh, that doesn’t work”. I have no expectations that anyone will ever read the code much less use it but it costs exactly nothing to put it out there on the off chance it may be useful to somebody. So, yeah, I should be responsible if someone hacks some crypto kitty clone and makes off with a billion dollars?
- darkarmani 4y ago
  > Passing out poison for free doesn't go too well in real world It's illegal to give out free poison in the real world? how do they sell it then?
BiteCode_dev 4y ago
IANAL but I would expect you can only be held reponsible for a product if you say it fits a particular purpose. But the python licence explicitly says: PSF is making Python 3.11.3 available to Licensee on an "AS IS" basis. PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON 3.11.3 WILL NOT INFRINGE ANY THIRD PARTY RIGHTS. So it's not sold to you, and not distributed with any implied level of quality or guaranted service.
- advisedwang 4y ago
  > I would expect you can only be held reponsible for a product if you say it fits a particular purpose. That is an incorrect expectation. Even in the American legal system "I said don't do that" is not a shield against liability. In the EU framework a new law can pretty much create any new liability they want, so a disclaimer absolutely could be rendered meaningless.
  - nequo 4y ago
    > Even in the American legal system "I said don't do that" is not a shield against liability. Also IANAL. As someone offering open source software for free, what shields you against liability in the American system?
    - colejohnson66 4y ago
      Nothing. You can be sued for anything no matter the disclaimer.
      - nequo 4y ago
        Do you know of a precedent of such a court case being decided against the author of free and open source software?
  - BiteCode_dev 4y ago
octacat 4y ago
So, if you work for a commercial company and wanna contribute something back to some open source project - you will not get a green light from your lawyers department once this is enforced (it is already pretty hard to convince them).
indymike 4y ago
This law will literally freeze software development in place, much like the US FAA did with civil aviation in the 1970s. Suddenly going from 100% disclaimed away warranty to a statutory warranty doesn't work. This may even be less intelligent than my home state's attempt to legislate that pi=3.15.
bluecalm 4y ago
Permissive license open source is going to be fine, for now anyway. The problem is that the arguments cited in the OP also apply to small devs who can't afford an army of lawyers. Such regulation will spell doom for software start-ups and small shops. It's a pattern of EU law makers going after the little guy: VAT MOSS, GDPR, now this. Not much of a problem if you have an accounting department next to legal department on the same floor of your corporate building. A huge burden for a small guy who only have limited number of man hours to distribute between paperwork and actual work.
- AlanYx 4y ago
  >Not much of a problem if you have an accounting department next to legal department on the same floor of your corporate building. It's demonstrative to read the official EU impact assessments for a lot of their recent legislation. For example, the impact assessment for the EU AI Act estimated prior-to-launch compliance costs for a small business with one AI product at €400,000. But when you look into the assessment in more detail, that estimate actually excludes legal costs (not joking here). It creates a very uneven playing field for small innovators.
dp-hackernews 4y ago
I think I will call this - "Revere Censorship" and it's the way the likes of George Orwell's "1984", John Carpenter's "They Live", Aldus Huxley's "A Brave New World", along with the ideas pushed by the government (WEF) in Ayan Rand's "Atlas Shrugged" are slowly being brought to life. Soon there will be a City of Ember to contend with, not to mentioned Enders Game... As I keep saying, the future is written in the past.
mordae 4y ago
If this passes, everyone will add to their code: DISCLAIMER: Following text is not a program code. It does not work. Do not execute it. And call it a day. As long as it was only brought to the market as a piece of prose, you are safe. :-)
ulnarkressty 4y ago
This doesn't make much sense - would publishing the code to a paper about object detection really make my professor liable for someone getting run over by a Tesla?
deleted 4y ago
[deleted]
popotamonga 4y ago
i made a company. no personal liability whatsoever, all profits go to me personally (heavy taz but its ok) so they can sue all they want
stametseater 4y ago
I remember when everybody was telling me that the demise of "net neutrality" would force me to pay my ISP for special "packages" to use different sites. Want to use HN? It's blocked unless you pay for the "tech forum package". ...Except that never happened. It turned out that the hysteria was manufactured by American tech corps like Google and Netflix that feared having to renegotiate their peering arrangements. This sounds like more of the same. The proposed EU law applies to commercial activity, which volunteer FOSS development is not. So now we have commercial interests trying to fan the flames of another hysteria.
- ApolloFortyNine 4y ago
  Many companies contribute to open source software, would they be responsible if some random user of Linux leaks some data due to a change redhat implemented? Despite that user having signed no contract with them? And last time this came up it seemed widely believe that a donation link is commercial activity.
tskguarantee 4y ago
I find it interesting that the EU does not define "free and open-source software" in either of the proposals. I think they need to define the terms as used. There isn't complete agreement in the software world as what that applies to. For example MongoDB and the SSPL license.
deleted 4y ago
[deleted]

186 points by AlexeyBrin 4y ago

2rsf 4y ago

> If the proposed law is enforced as currently written, the authors of open-source components might bear legal and financial responsibility for the way their components are applied in someone else’s commercial product. Oh shit, this is huge. I wonder if it applies retroactively for code in the wild, as an open source contributor you can't recollect you code back.

canadiantim 4y ago
If true and enforced that would be the death of the open-source community as we know it
- tensor 4y ago
  In the EU at least. No doubt disclaimers would go up on all source repositories that access from the EU is forbidden.
  - josephcsible 4y ago
    How many more laws like this one need to get passed for people to stop saying Brexit was the worst thing that could have happened to the UK?
    - ben_w 4y ago
      Depends on the people you want to stop saying it. There's people like me, who moved from the UK to Germany as a direct reaction to Brexit. I don't have a Boolean heaven-or-hell (Devon-or-Hull?) attitude to any of this — Brexit itself was stupid, but not (yet) the worst thing the Westminster government did to United Kingdom people. Sure, a repeat of the Potato Famine may happen, but probably not. Then you've got people who have made it part of their identity. On both sides, they're never going to admit the possibility of Team Them making the slightest of mistakes. For example, the specific mistake of the government passing a law that allowed a regional ambulance service to find out the preceding 6 months of internet domains accessed by any person, without any need for a warrant; something that was obviously not compatible with the Human Rights obligations but which the government passed anyway, and as that government was loudly conflating the EU with the human rights courts, I just assumed they'd force it into effect regardless of any objection I could bring, when they actually managed to leave the EU. https://en.wikipedia.org/wiki/Investigatory_Powers_Act_2016 https://en.wikipedia.org/wiki/Investigatory_Powers_Act_2016 "Less bad" isn't automatically perfect (the topic of this discussion may be an example of such an imperfection), but it is less bad.
      - 908B64B197 4y ago
        > the government passing a law that allowed a regional ambulance service to find out the preceding 6 months of internet domains accessed by any person, without any need for a warrant Wow. And people voted in favor of that? No wonder we're flooded with resumes from the UK over here...
        ben_w 4y ago
        I still don't know why they even asked for that power; the arguments given at the time were predicable clichés that had about as much connection to reality as the average stock photo of a hacker — if I assume they were sincere then they must have been incompetent, and if competent then insincere. https://votes.parliament.uk/Votes/Commons/Division/80 https://votes.parliament.uk/Votes/Commons/Division/80
    - flangola7 4y ago
      The only reason there's a possibility Brexit isn't the worst thing is the large pool of competitively bad things.
    - r_hoods_ghost 4y ago
      In case you hadn't noticed, this law hasn't been passed. It is currently out for consultation through a relatively transparent process. Certainly more transparent than the, let's all meet at the club and thrash it out between us, what what, process that takes place in Westminster under the current lot. This is how democracy is supposed to work, but alas very few people take the time to learn that or engage in the actual process.
    - benhurmarcel 4y ago
      Maybe don't base your opinion of the EU on some speculative HN comments about a non-voted law proposal?
  - SkyBelow 4y ago
    If the EU is willing to hold you financially liable for something you provided for free with no promise of it functioning or being safe to use, might they also hold you financially liable even though you said it shouldn't be used by anyone in the EU?
    - FredPret 4y ago
      Maybe the safest approach is to firewall them off of the internet. They can have their own bureaucratic paradise without involving the rest of us in their mad schemes.
      - sclarisse 4y ago
        I mean, the newspapers already do that with the GDPR regulations, so it may be inevitable
        FredPret 4y ago
        Personally I modified my (paid service) project's EULA to make it unavailable to EU residents, citizens, and people currently located there just to be safe. First it was fonts and cookies, now this; I don't want to see where this jaw-dropping progression ends up. In 2016 I thought Britain was absolutely mad, but they're starting to look smarter and smarter
      - cronix 4y ago
        I wonder how much collective time the world would save not having to click on cookie permissions every time they visit a website.
      - jart 4y ago
        MaxMind has a free utility called GeoIpLite that has an explicit field which tells you if an IP address should be considered part of the EU.
        FredPret 4y ago
  - noworriesnate 4y ago
    What about extradition treaties? Do I need to be concerned about someone in Europe misusing my mathematical expression parser library in a medical device, people die, and then I get extradited? I heard a third-hand story about a Boeing engineer held responsible for an aircraft crash in China, and the US was going to extradite him to China. He committed suicide. Don't know if it was true, although it was a Boeing employee who told me about it, and she certainly thought it was true.
    - Jtsummers 4y ago
      The US doesn't have an extradition treaty with China, so that's probably an urban legend or someone pulling your leg or trying to put the fear of god (China?) into her and other engineers so they take the job seriously.
  - octacat 4y ago
    Pretty much that. After GDPR many small shops refused to work with EU IP addresses and just redirect to a page with some disclaimer. But big players (who were consulting politicians when GDPR regulations were written) only won from GDPR, they don't need to show the cookies banner all the time on their platforms and still have a lot of power over your private data. Certification of software is always expensive, so expect new open source licenses: "Open source as usual, but if you are from EU, you are not allowed to use that code". Or expect Amazon to take an open source product, close source their fork, do certification and provide SAAS. Again, there are companies who can do some commercial support for their code, but they are really could not be interested in adopting all the EU regulations.
- xeromal 4y ago
  I'm sure repos would just block access to European IP address if the maintainer requests it.
- mrweasel 4y ago
  It would also absolutely destroy the EU economy. Developers in the EU would be blocked from PyPi, GitHub, NPM, Stack Overflow and much much more. Pretty much every single commercial software product contains at least one open source package. You wouldn't even be able to use Java or .Net. There's also no way in hell that commercial companies like Oracle or Microsoft will assume any kind of responsibility for errors their code would result in in a customers code base. At least not without massive compensation. And how about Linux, or Android... or iOS, they contain open source software as well. Could you go after some random kernel developer for a bug that affects Android? This hasn't been tought through in any way, the ramifications could be enormous.
  - estebarb 4y ago
    At some point would be cheaper to just block access from whole Europe than complying with their laws. The worst part is that a lot of politicians in other countries are just copying the EU tech legislation, instead of trying to produce something better.
    - ClumsyPilot 4y ago
      So every 2 weeks i read posts like this, 'Company X will just quit" if they have to pay tax/comply with some law/ follow basic decency But it never happens. The only example is Google leaving China because of authoritarianism. And now they are back. Maybe it can happen to a tiny country. But do you actually imagine that the entire 17 trillion economy of EU will be left without software? Companies do not 'just quit' huge markets. They don't leave money on the table.
      - estebarb 4y ago
        Big companies obviously no. But a bootstrapped startup? Probably yes, at least initially. And here we are not talking about "basic decency" or taxes. The audit requirements by the new EU law are extremely expensive. They assume that every software developer is BigCo. I don't see that the EU is requesting every tabloid article to be fully audited to remove false claims or that each medical decision must be audited. The requirement is disproportional.
josefx 4y ago
This thing wont be fairly enforced until the ISO is fined $50 Googol for publishing the C spec. .
- oaiey 4y ago
  Who invented null again? I need an address for the lawyers.
  - green7ea 4y ago
    | I call my billion-dollar mistake. It was | the invention of the null reference in 1965. | | -- Tony Hoare It might turn into a real billion-dollar mistake, not just a metaphorical one...
  - ben_w 4y ago
    Mr Nüll Null St 0°N, 0°E https://en.wikipedia.org/wiki/Eduard_van_der_Nüll https://en.wikipedia.org/wiki/Eduard_van_der_Nüll (I assume this is a record error) https://goo.gl/maps/fDEbp5ymtTiYPMKZA https://goo.gl/maps/fDEbp5ymtTiYPMKZA https://en.wikipedia.org/wiki/Null_Island https://en.wikipedia.org/wiki/Null_Island
  - lelanthran 4y ago
    The address of null is zero, obviously
Asmod4n 4y ago
You can potentially hold those responsible who published the first open source TCP/IP stack for anything happening on the internet if it retroactively applies to existing code, fun times.
- Gud 4y ago
  The first TCP/IP stack was actually open source(before the term even existed). Written by Bill Joy(and maybe others) of Vi, Sun and BSD fame.

qwerki 4y ago

The open source community in general needs to pay more attention to this space – not just the python ecosystem. More maintainers need to know that well intentioned people are proposing policies that would in some instances make them financially and legally liable for the code they write.

AlanYx 4y ago
The new EU AI Act also has this problem, in that it imposes liability for developing components that may at some future point be misused by others. The source of the problem is a particular approach to legislation that has become popular in the EU that purports to regulate across the entire supply chain for a product. Which might make sense for production of physical items or for software developed completely from scratch 30 years ago under a waterfall model, but is strongly disconnected from the way software is currently built.
foobiekr 4y ago
“Well intentioned” does not actually describe the strong IT companies that support actions like this to try and recapture value. European big tech companies like Siemens, Ericsson, Nokia and so on are not fans of open source since it negatively impacted their captive customer bases.

dsr_ 4y ago

"a version of Python is downloaded over 300 million times per day." If true, this is insane.

marginalia_nu 4y ago
No doubt the vast majority of those downloads are from CI systems and build scripts executing on every commit.
- dsr_ 4y ago
  Which is insane. Local caches should be ubiquitous, along with lightweight validation checks.
  - marginalia_nu 4y ago
    Yeah. It's quite a problem. Although I think in many cases, the people doing this aren't aware it's happening. It's a git action kicking off some jenkins agent somewhere in a kubernetes container on a virtualized server that was set up and forgotten about based on a patchwork of online tutorials.
    - pmontra 4y ago
      Probably everybody knows that each test run and build is downloading GB of data but they're doing it quickly, they don't cost much money or none at all, and it's easier to do it than setting up a local cache and use it (CI, local dev machines,) etc. The only reason I ever saw some optimization at that level was because building the base image took too long, so we were saving one and we were rebuilding it only when dependencies changed. I can't remember the details.
      - dp-hackernews 4y ago
        Try doing that in am air-gapped environment and you'll soon learn about the importance of local artifact caches and caching proxies with tight retrieval policies, or having downloads gated for review... ;-)

hunglee2 4y ago

No exaggeration to say that the EU might inadvertently divert the civilisational path of humanity

miohtama 4y ago
What’s a civilisation or two in the name of think of the children

fermigier 4y ago

More reactions on the same subject: - From the Eclipse Foundation: https://eclipse-foundation.blog/2023/01/15/european-cyber-resiliency-act-potential-impact-on-the-eclipse-foundation/ https://eclipse-foundation.blog/2023/01/15/european-cyber-re... and https://blogs.eclipse.org/post/mike-milinkovich/cyber-resilience-act-good-intentions-and-unintended-consequences https://blogs.eclipse.org/post/mike-milinkovich/cyber-resili... - From the Internet Society: https://www.internetsociety.org/blog/2022/10/the-eus-proposed-cyber-resilience-act-will-damage-the-open-source-ecosystem/ https://www.internetsociety.org/blog/2022/10/the-eus-propose... With more to come... This is a serious situation.

deleted 4y ago

[deleted]

agilob 4y ago

Its been only a years since: >Google wants to work with government to secure open-source software https://blog.google/technology/safety-security/making-open-source-software-safer-and-more-secure/ https://blog.google/technology/safety-security/making-open-s... https://www.techradar.com/news/white-house-calls-summit-on-open-source-security-following-log4j-attacks https://www.techradar.com/news/white-house-calls-summit-on-o... https://www.engadget.com/google-open-source-private-public-partnership-204840652.html https://www.engadget.com/google-open-source-private-public-p... And 2 years since: >If your open-source software project is considered "critical", you could be facing a lot more work and responsibility in the future. But for now, it's just some ideas from a few of Google's top engineers. https://www.zdnet.com/article/open-source-google-wants-new-rules-for-developers-working-on-critical-projects/ https://www.zdnet.com/article/open-source-google-wants-new-r...

acedTrex 4y ago
There is no responsibility with open source, thats the entire point.
- agilob 4y ago
  there is as much responsibility as money

AbrahamParangi 4y ago

Why on earth would they make the original vendor of a component liable instead of the last corporate vendor wholly liable for all components of the final product they sell? This seems like something which can only benefit: 1) very large corporations 2) who use a lot of components they don’t make This seems almost designed as protectionist legislation for dinosaur companies unable to manage their software dependencies at any level of competence.

ajsnigrutin 4y ago
Yep, it's interesting because this is the case in eg. device warranties... if something breaks down, you don't search who the manufacturer of the capacitor was, but just take the device to the seller/retailer/store and have them deal with it.
- ghaff 4y ago
  Mostly. There are some exceptions. For example, with cars, tires are often warrantied directly with the tire manufacturer. Also, in the case of material defect, e.g. the airbag issue a number of years back, the auto manufacturer is mostly the entity on the hook for consumers but there are absolutely various liabilities up the supply chain.
  - AbrahamParangi 4y ago
    For sure, it’s reasonable that the airbag vendor, having sold a product to the auto vendor, is liable to the auto vendor. I don’t think the airbag vendor should be separately liable to the user since it’s the auto vendor’s responsibility to ensure that the holistic system works- even without considering the case of open source wherein there’s no contract at all between the OSS “vendor” and either the immediate “buyer” or end customer.
    - ghaff 4y ago
      Takata was sued by various parties (consumer class actions, at least one state) over their airbag defect although I'm not sure what the outcome was over and above the settlement by the various auto makers. People can sue for pretty much anything and there's a good chance you have to (or at least should) get a lawyer if that happens. While it's arguably negligible, there is some risk in putting tools/code out there even if it's free and not warrantied.

gdcbe 4y ago

I’m all for software vendors requiring to take more responsibility. Anything better then the current “if it works you’re lucky” guarantee that drives drives the bug parching normality. The responsibility lies with the commercial vendors however, not with the open source developers. What a perverse world we live in, that that can even be possible… Using our software for free and then holding us responsible… ha!

game_the0ry 4y ago
> Using our software for free and then holding us responsible… ha! Yeah...slap in the face for open source contributions that literally chnage the world for the better.

galaxytachyon 4y ago

Not all things can be or even should be regulated. This is almost akin to a law punishing good samaritan for helping someone in need because that someone ended up a criminal later. Not only is it dumb but also a perversion of authority. Hopefully they know what they are doing and revise the law.

account42 4y ago
"Good samaritan" is a pretty relevant keyword here because many countries have so called Good Samaritan Laws that explicitly give legal protection to those aiding others in peril. The idea is that you won't want to discourage people from helping those in need by fear of repercussions. Its not unreasonable that similar liability protections should apply to those freely sharing software.
- Ekaros 4y ago
  On other hand. If I for example make food from rotten ingredients and share it on street for free, even with disclaimer and someone gets food poisoning I don't think anything protects me. Or should protect me. I have never understood why software is some special place. Specially if entity has anyway to monetize it.
  - account42 4y ago
    Making food from obviously rotten ingreedients is not akin to something that would fall under good samaritan laws. However I don't agree that you should be liable for providing food to those in need if you have made reasonable safety precautions. Restaurants throwing away their leftovers rather than be held liable is not a good thing for society. So no, I don't think software should have a special place here but rather that someone trying to "do good" should not be punished for it even if they mess up a bit.

knlje 4y ago

This is a quote from the linked document: > 10) In order not to hamper innovation or research, free and open-source software developed or supplied outside the course of a commercial activity should not be covered by this Regulation. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. In the context of software, a commercial activity might be characterized not only by charging a price for a product, but also by charging a price for technical support services, by providing a software platform through which the manufacturer monetises other services, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software.

tgvaughan 4y ago
How does this work for free software projects which aren't themselves commercial but list employees of big companies among their major contributors? E.g. the Linux kernel?
- layer8 4y ago
  It will likely be tied to the “productization”. That is, the liability chain will only go as far as there is someone who turned the software into a product for monetization purposes. If a company sells a product that uses Linux, they will be liable regardless of whether they contributed to Linux development or not. If part of the product was itself purchased from a third party, the third party will be liable for that part. But open-source developers who don’t monetize the software won’t be liable. One case that could potentially become problematic is OSS developers who have Patreon subscribers or similar, where those subscribers could conceivably pass on liability claims.
  - deleted 4y ago
    [deleted]
paol 4y ago
That's from the "Cyber Resilience Act" link, and the "Product Liability Act" link has pretty much the same text in item 13.

gavinhoward 4y ago

Oh boy. If this passes, I'm basically going to have to not allow people to use my FOSS in Europe. I have actually written some Open Source licenses [1], and one different thing about these licenses is that they are null and void if the law requires the original contributors to accept any responsibility for the software unless they voluntarily accept it. In my opinion (IANAL, but I wrote those licenses), if things passes, then anything licensed under my licenses would not be legal to use in Europe or by EU citizens. Licenses will now need protections like this to keep FOSS alive, and places with laws like these will lose out. By the way, my licenses are currently being checked by a lawyer. However, it may cost me more than I can spare, so I may not be able to get them fully checked. [1]: https://yzena.com/licenses/ https://yzena.com/licenses/

endisneigh 4y ago

Seeing many of the EU's laws - I feel that they have given up in innovating, and have designed to go all in on legislation. Many of the rules they make are completely unnecessary IMHO. They treat their citizens as totally incompetent and incapable of evaluating alternatives themselves. I expect the EU to continue to falter in cutting edge tech as a result. Software in particular.

jart 4y ago
They're not called citizens, they call them subjects.
- M2Ys4U 4y ago
  Article 20(1) of the Treaty on the Functioning of the European Union: "Citizenship of the Union is hereby established. Every person holding the nationality of a Member State shall be a citizen of the Union. Citizenship of the Union shall be additional to and not replace national citizenship."
nemo44x 4y ago
Indeed, they just can't seem to understand the modern economy. How many unicorn's has Europe created over the last 15 years? The idea that a wildly influential technology company coming from the EU instead of America or China is just not realistic. I guess they can continue to export luxury brands and tourism. I think Europeans tend to have an aversion to success/wealth and are scared to go out and try and build something. Just be conservative and go and work for a company that underpays. But at least you get to go on a vacation a couple times a year. I feel like the time I've spent in Europe and the time in the USA is that Americans are optimistic that something can be done and they go out and take a risk. Europeans are skeptical of anything new. And to me it's weird because the way social safety nets tend to work in Europe, people should be taking risks left and right. And to be sure there's no lack of very talented engineers in the EU. Is it that Europe relies so much on legacy? Their legacy colonial relationships around the world, their legacy brands, etc?

Asmod4n 4y ago

This law kinda only needs a few changes to actually increase the protection of consumers. - it only applies if you are directly selling a IT product/software to consumers. - when you use third party components and find a security flaw in them you have to inform the third party immediately. - in addition if you find a flaw in open source code you should send a patch if you are capable of doing so.

ApolloFortyNine 4y ago

Basically every license out there has some "can't be held liable" clause in it (see the mit license for an easy to find one). Does this mean the license may be invalid entirely in the EU, making it so you actually just can't use the software at all? I know that's how the GPL basically works, if you don't accept the GPL, then you simply have no license at all.

layer8 4y ago
Usually the respective clause just becomes legally void. This is different from you not accepting that clause. It doesn’t invalidate the license as such (even if the license would like that to happen).
- ApolloFortyNine 4y ago
  Isn't that kind of insane? You get to ignore a crucial clause of the license and continue using the software? I mean one day they could also say copyleft is unreasonable and illegal, so now the GPL is just a free for all.
  - layer8 4y ago
    If a sales contract says that, by the way, the seller now owns your first-born, then that clause is void because it’s illegal. It doesn’t however mean that the contract is void and that you have to return what you bought or have to reimburse the seller. It’s the sellers fault that they put an illegal clause into the contract. It’s different from if the law would say that the whole type of contract is illegal.
jart 4y ago
I discussed this with an AI language model (GPT-4), and the general idea I gathered was that in the EU, it's possible that the "no warranty" clause in open source licenses could be invalidated by consumer protection laws, while the rest of the license remains valid. This could potentially expose authors to liability, even as their work continues to be used for free. However, it's important to note that this information came from an AI and should not be considered legal advice. The specific application of these laws may vary depending on the jurisdiction and circumstances.

Ekaros 4y ago

Then again maybe this will finally make people write software that is fit for purpose and isn't just stuff thrown at wall. Passing out poison for free doesn't go too well in real world, I don't see why software should be really different.

prmoustache 4y ago
The iot industry shows us daily that making pay for poison doesn't go much better yet is totally allowed to continue.
game_the0ry 4y ago
Feel free to stop using the internet then, since it is built on apache / nginx / python / java / javascript / php and many other open source technologies.
madsbuch 4y ago
well, it is easy for. open source. you just defer the semantics of your program. to. the implementation. then you will never have bugs.
UncleEntity 4y ago
Fit for what purpose? I have a couple things up on GitHub that are fit for my purpose but you probably don’t want to be using if your threat model is higher than “huh, that doesn’t work”. I have no expectations that anyone will ever read the code much less use it but it costs exactly nothing to put it out there on the off chance it may be useful to somebody. So, yeah, I should be responsible if someone hacks some crypto kitty clone and makes off with a billion dollars?
darkarmani 4y ago
> Passing out poison for free doesn't go too well in real world It's illegal to give out free poison in the real world? how do they sell it then?

BiteCode_dev 4y ago

IANAL but I would expect you can only be held reponsible for a product if you say it fits a particular purpose. But the python licence explicitly says: PSF is making Python 3.11.3 available to Licensee on an "AS IS" basis. PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON 3.11.3 WILL NOT INFRINGE ANY THIRD PARTY RIGHTS. So it's not sold to you, and not distributed with any implied level of quality or guaranted service.

advisedwang 4y ago
> I would expect you can only be held reponsible for a product if you say it fits a particular purpose. That is an incorrect expectation. Even in the American legal system "I said don't do that" is not a shield against liability. In the EU framework a new law can pretty much create any new liability they want, so a disclaimer absolutely could be rendered meaningless.
- nequo 4y ago
  > Even in the American legal system "I said don't do that" is not a shield against liability. Also IANAL. As someone offering open source software for free, what shields you against liability in the American system?
  - colejohnson66 4y ago
    Nothing. You can be sued for anything no matter the disclaimer.
    - nequo 4y ago
      Do you know of a precedent of such a court case being decided against the author of free and open source software?
- BiteCode_dev 4y ago

octacat 4y ago

So, if you work for a commercial company and wanna contribute something back to some open source project - you will not get a green light from your lawyers department once this is enforced (it is already pretty hard to convince them).

indymike 4y ago

This law will literally freeze software development in place, much like the US FAA did with civil aviation in the 1970s. Suddenly going from 100% disclaimed away warranty to a statutory warranty doesn't work. This may even be less intelligent than my home state's attempt to legislate that pi=3.15.

bluecalm 4y ago

Permissive license open source is going to be fine, for now anyway. The problem is that the arguments cited in the OP also apply to small devs who can't afford an army of lawyers. Such regulation will spell doom for software start-ups and small shops. It's a pattern of EU law makers going after the little guy: VAT MOSS, GDPR, now this. Not much of a problem if you have an accounting department next to legal department on the same floor of your corporate building. A huge burden for a small guy who only have limited number of man hours to distribute between paperwork and actual work.

AlanYx 4y ago
>Not much of a problem if you have an accounting department next to legal department on the same floor of your corporate building. It's demonstrative to read the official EU impact assessments for a lot of their recent legislation. For example, the impact assessment for the EU AI Act estimated prior-to-launch compliance costs for a small business with one AI product at €400,000. But when you look into the assessment in more detail, that estimate actually excludes legal costs (not joking here). It creates a very uneven playing field for small innovators.

dp-hackernews 4y ago

I think I will call this - "Revere Censorship" and it's the way the likes of George Orwell's "1984", John Carpenter's "They Live", Aldus Huxley's "A Brave New World", along with the ideas pushed by the government (WEF) in Ayan Rand's "Atlas Shrugged" are slowly being brought to life. Soon there will be a City of Ember to contend with, not to mentioned Enders Game... As I keep saying, the future is written in the past.

mordae 4y ago

If this passes, everyone will add to their code: DISCLAIMER: Following text is not a program code. It does not work. Do not execute it. And call it a day. As long as it was only brought to the market as a piece of prose, you are safe. :-)

ulnarkressty 4y ago

This doesn't make much sense - would publishing the code to a paper about object detection really make my professor liable for someone getting run over by a Tesla?

deleted 4y ago

[deleted]

popotamonga 4y ago

i made a company. no personal liability whatsoever, all profits go to me personally (heavy taz but its ok) so they can sue all they want

stametseater 4y ago

I remember when everybody was telling me that the demise of "net neutrality" would force me to pay my ISP for special "packages" to use different sites. Want to use HN? It's blocked unless you pay for the "tech forum package". ...Except that never happened. It turned out that the hysteria was manufactured by American tech corps like Google and Netflix that feared having to renegotiate their peering arrangements. This sounds like more of the same. The proposed EU law applies to commercial activity, which volunteer FOSS development is not. So now we have commercial interests trying to fan the flames of another hysteria.

ApolloFortyNine 4y ago
Many companies contribute to open source software, would they be responsible if some random user of Linux leaks some data due to a change redhat implemented? Despite that user having signed no contract with them? And last time this came up it seemed widely believe that a donation link is commercial activity.

tskguarantee 4y ago

I find it interesting that the EU does not define "free and open-source software" in either of the proposals. I think they need to define the terms as used. There isn't complete agreement in the software world as what that applies to. For example MongoDB and the SSPL license.

deleted 4y ago

[deleted]