3 ms·

Note: it's not clear from the title, but this is in the context of the Cyber Resilience Act, the one that might make OSS developers responsible and liable for b

by tgv 4y ago

Note: it's not clear from the title, but this is in the context of the Cyber Resilience Act, the one that might make OSS developers responsible and liable for bugs.

actionfromafar 4y ago
I wasn't going to click because I believed it was about the futile "won't somebody think of the open source developers, give them a little money". It's true, but it won't happen at scale. This was much more interesting.
oftenwrong 4y ago
That liability is a part of the proposed revisions to the Product Liability Directive, which is also covered by this letter. The Cyber Resilience Act would potentially require open source developers to follow a compliance regimen, similar to any EU manufacturer. The concern is that this would place too high of a regulatory burden on item source projects. The act's view of the software world is less nuanced than that of the open source community, making a distinction only between commercial and non-commercial. I don't fully understand the implications for open source projects, but it also seems like the legislators do not understand the implications for the EU. There is legitimate concern that the EU could be cut off from open source repositories as the entities running them seek to avoid liability.
FrustratedMonky 4y ago
Is this for real? If there are people that want to hold independent volunteers responsible, that would kill the world. Most of our current technology is stacked on top of OSS developers that worked for free. Now they can be responsible for any bug someone might find? Then, who would bother to continue putting code out there to share. This can't be right. It would be like holding people responsible if someone got hit on the head by an apple that fell from the tree they planted as a volunteer on earth day.
- eternalban 4y ago
  What about the case of a major corporation releasing an OSS package.
- ketzu 4y ago
  > hold independent volunteers responsible iirc there is already a carveout for free open-source contributions, it only applies to (the very widely applicable) commercial activity. My understanding is, this letter is about developers organized as non-profits, but who are still paid for their work. One problem I got are package repositories publishing work and making money through other sources might be liable for all packages they host.
- oaiey 4y ago
  It is for real, but what you write is why it will never hold up. It is a bug in the legal text.
phkahler 4y ago
Commercial software isn't even liable for bugs. See EULAs, zero days, ransomware, etc...
- hyperman1 4y ago
  That's exactly what this law wants to fix: Companies won't be able to hide behind license agreements for some of the high impact security bugs.

by tgv 4y ago

Note: it's not clear from the title, but this is in the context of the Cyber Resilience Act, the one that might make OSS developers responsible and liable for bugs.

actionfromafar 4y ago

I wasn't going to click because I believed it was about the futile "won't somebody think of the open source developers, give them a little money". It's true, but it won't happen at scale. This was much more interesting.

oftenwrong 4y ago

That liability is a part of the proposed revisions to the Product Liability Directive, which is also covered by this letter. The Cyber Resilience Act would potentially require open source developers to follow a compliance regimen, similar to any EU manufacturer. The concern is that this would place too high of a regulatory burden on item source projects. The act's view of the software world is less nuanced than that of the open source community, making a distinction only between commercial and non-commercial. I don't fully understand the implications for open source projects, but it also seems like the legislators do not understand the implications for the EU. There is legitimate concern that the EU could be cut off from open source repositories as the entities running them seek to avoid liability.

FrustratedMonky 4y ago

Is this for real? If there are people that want to hold independent volunteers responsible, that would kill the world. Most of our current technology is stacked on top of OSS developers that worked for free. Now they can be responsible for any bug someone might find? Then, who would bother to continue putting code out there to share. This can't be right. It would be like holding people responsible if someone got hit on the head by an apple that fell from the tree they planted as a volunteer on earth day.

eternalban 4y ago
What about the case of a major corporation releasing an OSS package.
ketzu 4y ago
> hold independent volunteers responsible iirc there is already a carveout for free open-source contributions, it only applies to (the very widely applicable) commercial activity. My understanding is, this letter is about developers organized as non-profits, but who are still paid for their work. One problem I got are package repositories publishing work and making money through other sources might be liable for all packages they host.
oaiey 4y ago
It is for real, but what you write is why it will never hold up. It is a bug in the legal text.

phkahler 4y ago

Commercial software isn't even liable for bugs. See EULAs, zero days, ransomware, etc...

hyperman1 4y ago
That's exactly what this law wants to fix: Companies won't be able to hide behind license agreements for some of the high impact security bugs.