3 ms·

The Internet Society quotes[1] that part and thinks selling support for stuff would count it as being supplied in “the course of commercial activity” even to th

The Internet Society quotes[1] that part and thinks selling support for stuff would count it as being supplied in “the course of commercial activity” even to those who aren’t buying the support. [1] https://www.internetsociety.org/blog/2022/10/the-eus-proposed-cyber-resilience-act-will-damage-the-open-source-ecosystem/ https://www.internetsociety.org/blog/2022/10/the-eus-propose..., via another comment here: https://news.ycombinator.com/item?id=35525876 https://news.ycombinator.com/item?id=35525876 [A previous version of this comment mentioned BIND, because I confused ISOC and ISC.]

ginko 4y ago
If someone sold me support for a piece of open source software (like ISC and BIND) then I definitely would expect some level of liability if there's something wrong with it. Otherwise why would I pay for support if I could just self-host? They can strictly define the parts they are willing to support, though.
- luckylion 4y ago
  I believe the point they're making is that while you could expect liability, I couldn't if I'm not buying support services but run it myself. As in "offering the support services to anyone" would assume global liability.
- parasense 4y ago
  > If someone sold me support for a piece of open source software (like ISC and BIND) then I definitely would expect some level of ... The word you were looking for is "support". If there is something wrong with the "supported" open-source software, then you may expect a certain level of "support". Full-stop. That generally entails an SLA that says your issue will be reacted to within N-time of opening the issue, which might be nuanced by the tier-level of support purchased. That you are provided access to documentation, or even the source code itself. You might be provided with best-effort support by an agent, which is limited to resolving documented defects, or configuration, or acknowledging standing-bugs which cannot be resolved. What you cannot expect is the software is updated in accordance with the support incident. For that, send patches, or pay somebody to send patches.
- croes 4y ago
  You offer support for your open source software so it's commercial open source, someone else uses your software in his software without your knowledge and he doesn't pay and doesn't want support. He doesn't update his version of your software and this leads to a security issue. Are you liable?
  - anigbrowl 4y ago
    No. Liability only arises if someone is paying you and you give them assurances that PyThing is fit for a particular purpose or behaves a particular way.
    - croes 4y ago
      >free and open-source software developed or supplied outside the course of a commercial activity This part isn't clear enough to confirm you assumption. It could mean the software instance installed by your support customer, it could mean the software as such you intend to sell support for, no matter if you are really get paid for support or not.
  - ginko 4y ago
    Obviously not. Why would you think so? You're only liable for the software shared under a support agreement. I feel people really try to pick the worst possible interpretation of these laws just so they can hate on the EU.
    - LolWolf 4y ago
      unfortunately lawyers (et al) will similarly pick the worst possible interpretation of a law as needed to win a case
    - codeflo 4y ago
      No, it’s people who possibly even agree with the intention of this wanting the letter of the law to be as clear as possible — so that a hypothetical uninformed judge a few years down the road has less wiggle room for a bad decision. (Also note that in some European law traditions, written law is more important than case law.)
908B64B197 4y ago
I want to believe the courts and non-elected bureaucrats will interpret it the same way. Sadly, with these laws, we'll have to wait for some case law to be certain of the liabilities to serving Europeans customers.
- ctoth 4y ago
  Does anyone else find this incredibly crazy? I had a similar reaction to the whole thing about some new anti-Tiktok law in the US potentially banning a whole bunch of other things, but nobody is actually sure. Like, is it a weird idea of mine that you should define your laws based on what you want them to do and then test them to make sure they are right before they actually, you know, become laws? How can no one know what the law will actually do until the law is actually enforced? If I wrote software like this I would be instantly fired. Can somebody please explain?
  - unixgoddess 4y ago
    even with already published laws you need a lawyer to understand how a judge will be more likely to interpret them; even then, it's just an informed guess, you never know what the end ruling will be until it comes.
    - ctoth 4y ago
      So... Why not have a judge whose job is to come in and rule on potential new laws? You're pointing at this like it's some knockdown argument when it just shows lawmakers are lazy.
      - mananaysiempre 4y ago
        Imagine all of your bugs were security bugs, hacking (and profiting from the results) was legal and incredibly lucrative, and (as a result) almost the entire available pool of testers was at best grey-hats each with their own political agenda. Even if you also had Designated Testers with lifetime appointments, would you expect them to do better in a year than a well-paid hacker could in a couple of weeks? Especially if the former category, though well-paid, is considerably understaffed and thus overworked, due in part to how hard it is to establish competence and good faith of a candidate? I’m not sure this is a good metaphor, but I think the main thrust should be true: the whole thing is adversarial like you’ve never seen, and that’s not at all the best way to establish truth, just the best you can do without trust assumptions. (Law : science and engineering :: democracy : benevolent dictatorship.)

ginko 4y ago

If someone sold me support for a piece of open source software (like ISC and BIND) then I definitely would expect some level of liability if there's something wrong with it. Otherwise why would I pay for support if I could just self-host? They can strictly define the parts they are willing to support, though.

luckylion 4y ago
I believe the point they're making is that while you could expect liability, I couldn't if I'm not buying support services but run it myself. As in "offering the support services to anyone" would assume global liability.
parasense 4y ago
> If someone sold me support for a piece of open source software (like ISC and BIND) then I definitely would expect some level of ... The word you were looking for is "support". If there is something wrong with the "supported" open-source software, then you may expect a certain level of "support". Full-stop. That generally entails an SLA that says your issue will be reacted to within N-time of opening the issue, which might be nuanced by the tier-level of support purchased. That you are provided access to documentation, or even the source code itself. You might be provided with best-effort support by an agent, which is limited to resolving documented defects, or configuration, or acknowledging standing-bugs which cannot be resolved. What you cannot expect is the software is updated in accordance with the support incident. For that, send patches, or pay somebody to send patches.
croes 4y ago
You offer support for your open source software so it's commercial open source, someone else uses your software in his software without your knowledge and he doesn't pay and doesn't want support. He doesn't update his version of your software and this leads to a security issue. Are you liable?
- anigbrowl 4y ago
  No. Liability only arises if someone is paying you and you give them assurances that PyThing is fit for a particular purpose or behaves a particular way.
  - croes 4y ago
    >free and open-source software developed or supplied outside the course of a commercial activity This part isn't clear enough to confirm you assumption. It could mean the software instance installed by your support customer, it could mean the software as such you intend to sell support for, no matter if you are really get paid for support or not.
- ginko 4y ago
  Obviously not. Why would you think so? You're only liable for the software shared under a support agreement. I feel people really try to pick the worst possible interpretation of these laws just so they can hate on the EU.
  - LolWolf 4y ago
    unfortunately lawyers (et al) will similarly pick the worst possible interpretation of a law as needed to win a case
  - codeflo 4y ago
    No, it’s people who possibly even agree with the intention of this wanting the letter of the law to be as clear as possible — so that a hypothetical uninformed judge a few years down the road has less wiggle room for a bad decision. (Also note that in some European law traditions, written law is more important than case law.)

908B64B197 4y ago

I want to believe the courts and non-elected bureaucrats will interpret it the same way. Sadly, with these laws, we'll have to wait for some case law to be certain of the liabilities to serving Europeans customers.

ctoth 4y ago
Does anyone else find this incredibly crazy? I had a similar reaction to the whole thing about some new anti-Tiktok law in the US potentially banning a whole bunch of other things, but nobody is actually sure. Like, is it a weird idea of mine that you should define your laws based on what you want them to do and then test them to make sure they are right before they actually, you know, become laws? How can no one know what the law will actually do until the law is actually enforced? If I wrote software like this I would be instantly fired. Can somebody please explain?
- unixgoddess 4y ago
  even with already published laws you need a lawyer to understand how a judge will be more likely to interpret them; even then, it's just an informed guess, you never know what the end ruling will be until it comes.
  - ctoth 4y ago
    So... Why not have a judge whose job is to come in and rule on potential new laws? You're pointing at this like it's some knockdown argument when it just shows lawmakers are lazy.
    - mananaysiempre 4y ago
      Imagine all of your bugs were security bugs, hacking (and profiting from the results) was legal and incredibly lucrative, and (as a result) almost the entire available pool of testers was at best grey-hats each with their own political agenda. Even if you also had Designated Testers with lifetime appointments, would you expect them to do better in a year than a well-paid hacker could in a couple of weeks? Especially if the former category, though well-paid, is considerably understaffed and thus overworked, due in part to how hard it is to establish competence and good faith of a candidate? I’m not sure this is a good metaphor, but I think the main thrust should be true: the whole thing is adversarial like you’ve never seen, and that’s not at all the best way to establish truth, just the best you can do without trust assumptions. (Law : science and engineering :: democracy : benevolent dictatorship.)