8 ms·

EU's Cyber Resilience Act contains a poison pill

137 points by jjgreen 4y ago

jruohonen 4y ago
A little too alarmist take to my liking, but it is nevertheless a good thing that he is calling others to join the lobbying (which he oddly calls "education"). While also GitHub seems to have done a decent job during the consultation, I'd take the genuinity of their position with a grain of salt due to the CoPilot fiasco. In fact, they are saying that "open source licenses disclaim all warranty, making explicit the expectation that any entity seeking to use or integrate the open source software bears responsibility to ensure its compliance with relevant laws". The pot calling the kettle black. https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/13410-Cyber-resilience-act-new-cybersecurity-rules-for-digital-products-and-ancillary-services/F3376627_en https://ec.europa.eu/info/law/better-regulation/have-your-sa...
- samtho 4y ago
  Being alarmist and pedantic about specific language of legal text is precisely what is needed to point out flaws. The only thing more terrifying than a governing body making laws about things they fundamentally do not understand is having the courts, with their own incomplete understanding, decide their own interpretation of them.
  - jruohonen 4y ago
    Agreed, and that is also a good advice for those submitting responses to open consultations. Yet, Vaughan-Nichols certainly was not pedantic in this piece.
  - SiempreViernes 4y ago
    I'd argue a small group of people on an obscure mail list defining things so as to best suit them is an even worse form of governance, despite its relative popularity in this forum compared to more standard methods.
  - deleted 4y ago
    [deleted]
- solarkraft 4y ago
  > lobbying (which he oddly calls "education") Looks like he has lobbying experience :)
poopsmithe 4y ago
Why is this called a poison pill?
- DoughnutHole 4y ago
  Definitely just a misuse of the term. "Poison pill" doesn't just mean a terrible provision of legislation - it's possible for legislation to be terrible while conceived entirely in good faith. In this case it's bad legislation due to EU legislators not understanding open source. A "poison pill" provision or amendment is an element deliberately added to turn people who otherwise would have supported the legislation against it. The person proposing the poison pill is acting it in bad faith - they have no expectation of it passing, they might not even support the idea themselves - the only reason it's added is to make the original legislation's supporters drop their support, killing said legislation. I don't think anyone is seriously proposing that the EU is deliberately hamstringing open source in order to kill their own cyber-security act. They've just written a bad piece of legislation.
  - danaris 4y ago
    Given how frequently problems like this crop up in legislation these days, it seems like we do need a term for it, though. Maybe something like "food poisoning pill"? Made with good intentions, but without proper understanding or taking proper precautions, so it becomes toxic...
  - unity1001 4y ago
    > it's possible for legislation to be terrible while conceived entirely in good faith This is way too fine-tuned to destroy small software segments, open source and private developers included, for the benefit of large companies that will be able to afford the potential fines.
    - DoughnutHole 4y ago
      That has nothing to do with what I mean by good faith - I just mean that the legislation they’ve proposed is the legislation that they want passed. That’s different from a poison pill amendment, where the intention isn’t to actually implement the policy, just to kill the legislation that you’re attaching it to.
LadyCailin 4y ago
I don’t know how you solve this exactly, but I do think allowing open source devs to just wash their hands of all responsibility isn’t a tenable solution. There’s a reason we don’t have “open source bridges”. You have to be a licensed civil engineer before you’re allowed to build a bridge, you can’t just build one and slap a “NO WARRANTY” disclaimer on it. Bridges can’t be downloaded from Russia, however, and requiring open source devs to carry liability insurance probably just destroys open source, so I am genuinely unsure how you solve this in practice. But I think that is a conversation we should be having, rather than just saying that the status quo is the ideal, and allowing no room for discussion.
- pharmakom 4y ago
  It’s up to the person choosing and deploying the software to decide if the OSS project is sufficiently secured. This is the person (or party) who should shoulder the blame. I don’t see why someone pushing to GitHub or whatever should have any responsibility for how their stuff is misused.
  - LadyCailin 4y ago
    Followed to its logical end, this also destroys open source as we know it today. If I’m going to have to vet your OSS with a fine tuned comb before I use it, I might as well just write it myself, and also be unencumbered from whatever license you chose. Only projects backed by FAANG would actually be used then.
    - anthk 4y ago
      Then watch the ActiveX disaster and Blaster coming back but by 20000. Worst Botnet/ransomware attack from NK/Russia ever. The UE on HUGE losses. BSD and GNU depending companies almost get bankrupt overnight. Productivity halts with a worse outcome than COVID.
  - rini17 4y ago
    It does not work so well in practice. Projects like sqlite and curl had to take steps to hide themselves from end users, who are grasping at straws in face of malfunctioning product.
timrichard 4y ago
"Secure the product over its whole life" I wonder how this will affect the business model where you get updates while your subscription is active.
jriddle567 4y ago
FOSS is a specified exception in the CRA. Am I missing something?
- Ralfp 4y ago
  This exception only applies if you have clear intent to make no money on the software. As soon as you put "donate" button the site, you lose the protections.
  - hgs3 4y ago
    The "exception" doesn't go far enough. If code is open source then anyone can fork and fix it. Money doesn't change this.
    - rad_gruchalski 4y ago
      It doesn’t matter in the face of how that directive is phrased today. No matter how much in denial one may be.
  - debugnik 4y ago
    Donations are not a commercial activity if no good or service is exchanged (in which case they wouldn't be donations, just purchases).
    - Ralfp 3y ago
      This is correct, but EU's act we are discussing about says opposite, hence the discussion.
- x0x0 4y ago
  see the python software foundation's concerns https://pyfound.blogspot.com/2023/04/the-eus-proposed-cra-law-may-have.html https://pyfound.blogspot.com/2023/04/the-eus-proposed-cra-la... to wit: under a reasonable reading of the legislation, having any commercial activity (classes, conference tickets, etc) opens you to liability. Or imagine selling support. Additionally: if open source code is included by someone besides the author into a commercially available product, it's not clear that the open source author doesn't hold liability there. Even if the author received $0, or is unaware of the use of the software he/she created.
candiodari 4y ago
Strangely the EU has no laws on the books about them accepting responsibility for unintended consequences of legislation ... when that is more or less the same problem.
- Bran_son 4y ago
  Unfortunately it does, and nobody likes them: https://en.wikipedia.org/wiki/Comprehensive_Economic_and_Trade_Agreement#Investment_protection_and_investor-state-tribunals https://en.wikipedia.org/wiki/Comprehensive_Economic_and_Tra... They're called investor-state dispute settlements, and they let corporations sue governments for loss of profit from things such as environmental protection and public health laws: https://en.wikipedia.org/wiki/Investor%E2%80%93state_dispute_settlement#Cases_lost_by_governments https://en.wikipedia.org/wiki/Investor%E2%80%93state_dispute...
- jruohonen 4y ago
  What nonsense is this? The EU's laws are constantly fought in the courts.
xoa 4y ago
>The notional open source developer in Nebraska, thanklessly maintaining a vital small program, may not even know where Brussels is (it's in Belgium). This remains a curious example. Nebraska is not an EU country, it's an American state. EU law doesn't apply. The Nebraska developer (or me in my state) don't need to care beyond that if enough Europeans were interested they might contribute patches to meet their own new reqs, or make requests over it, and then maintainer would need to judge if it matched/was worth it, and if not it might get forked into a CRA one, or not. Ie., just the normal open source process. Unless someone can point to an American (Japanese/Australian/Canadian/Korean/Mexican/Chinese/Indian etc etc) law passed promising equivalence this continued notion that the EU laws are global is really weird. Certain things they've targeted at companies work, because said companies wish to have physical business within the EU, and the EU of course has jurisdiction over everyone within the EU. So the cost of not complying is the cost of losing a large chunk of business there, and since it's a huge market that's a big motivator (though not infinite, even for megacorps). But for those who don't have any physical interest, what's the issue?
- candiodari 4y ago
  Copyright has been as is enforced internationally. This is the subject of international treaties.
- NoZebra120vClip 4y ago
  The "Nebraska" reference is probably due to the relevant Xkcd: https://xkcd.com/2347/ https://xkcd.com/2347/
- Etheryte 4y ago
  It's a pop culture reference, you're reading way too much into a witty remark.
  - xoa 4y ago
    I don't agree with you (or sibling). I did consider that, and also for that matter that there could be a "Nebraska, Europe", after all there are various European cities/places names all over the US. But the extra context ("may not even know where Brussels is (it's in Belgium)") makes clear that while they are using the reference they are in fact referring to Americans as being covered, or else it makes no sense. And further, this has been an ongoing thread in relation to this act. ~3 weeks ago HN had a thread [0] on this as well regarding a letter to the European Parliament on the CRA from the Internet Systems Consortium [1], and it too had comments from non-Europeans thinking it applied to them. That over simplified narrative has been getting pushed on HN as well in general, such as with the GDPR.
zoobab 4y ago
The poison pill is our law makers writing "open source" without consulting anybody from the community if what they propose is sensible.
- jruohonen 4y ago
  I think you've misunderstood something about democracy. It is not like lawmakers can in advance inform everyone and each stakeholder who might be affected. Nor do I think they were writing this law proposal for open source in mind; quite the contrary, I think they probably missed this point of view during the drafting but are probably now aware of the issues. Perhaps the most striking issue revealed by the CRA is that open source stakeholders apparently do not have their NGOs at Brussels (or Capitol for that matter). There would be all kinds of opportunities like lobbying for funding, or fighting Big Tech if that is your game, etc.
hgs3 4y ago
Open source is decentralized. Everyone is the maintainer. If there is a bug in the code, then anyone can fork and fix it. I don't understand how this law can apply to OSS period.
- sidewndr46 4y ago
  It's simple. The police get a warrant, pursuant to local laws. They show up and arrest someone. That person is put on trial. What happens next, I don't know. Legal systems do not have to be coherent or logical, only actionable.
  - hgs3 4y ago
    > It's simple. The police get a warrant, pursuant to local laws. They show up and arrest someone. OSS is decentralized. Everyone has source access. The police will have to arrest everyone, including themselves.
    - sidewndr46 4y ago
      You seem to be acting deliberately ignorant. The police could in fact do that. But in reality a judge will write a warrant for either one individual or just a small group of individuals that a public prosecutor (I do not know the term in the EU) presents to the judge. The police will arrest only those people. "arrest everyone" is some bizarre fantasy that the legal system is both ineffective and stupid.
      - hgs3 4y ago
        > You seem to be acting deliberately ignorant. That's not a charitable interpretation. Try re-reading what I've written from the perspective of someone pointing out logical flaws of a proposed law.
        webstrand 4y ago
        > I don't understand how this law can apply to OSS period. That's what the commenter is responding to. Laws are clearly not applied logically, and while you may be able to make that argument in court, it's never clear that it will be accepted.
oefrha 4y ago
This has already been discussed a few times, e.g. when PSF put out an article about it: https://news.ycombinator.com/item?id=35525384 https://news.ycombinator.com/item?id=35525384 More: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=cyber%20resilience&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
friendzis 4y ago
Author implicitly raises a question, but fails to articulate it and then answer it clearly. The question is whether open source software is to be considered a product and somewhat related whether downloading/using open source software creates a transaction. I can safely say that I don't now the answer to the question and therefore I cannot draw conclusions as far reaching as the article author does. Effectively, the CRA is going to impose certain security standard on software products. People in medical, automotive, aviation, military fields were already subject to certain security standards, so GitHub's claim regarding unobtainability is demonstrably misleading if not outright false, depending on definitions of safety/security standards. As it pertains to open source, it all depends on whether mere publication of open source software would be considered product release. I can agree with the author here that clarification may be needed. An important note here is that such regulation (OS is not affected) would have tremendous effect on open source. The companies using open source software in products would essentially be forced to either take open source under their belt with proper controls in place or be effectively forced to properly support open source development by at least providing security oversight. Sincerely, I have no idea what effect that would have as a whole.
deleted 4y ago
[deleted]
pier25 4y ago
Again, the EU making things more difficult for EU startups. As if GDPR wasn't enough.
- jruohonen 4y ago
  Right. It is not like the world needs more startups with software full of holes.
  - pier25 4y ago
    The intentions are good, just like GDPR, it's the implementation that sucks.
    - jruohonen 4y ago
      Frankly, I don't know what to say. If it is "the implementation that sucks", the implication probably is that everyone in this forum sucks.
      - pier25 4y ago
        Maybe, but probably no one in this forum is enacting laws.
  - jkeisling 4y ago
    Shocking that this kind of knee-jerk anti-innovation sentiment seems to be the dominant mood on Hacker News these days. Whatever legitimate criticisms of SV startups there are, this is mere contentless anti-tech sniping.
    - rad_gruchalski 4y ago
      Plenty of frustrated and sour people post-covid out there.
    - jruohonen 4y ago
      So you think improving security is about a "knee-jerk anti-innovation sentiment"? To better understand why these regulations are pushed forward throughout the world, read for instance Huston's elegant piece: https://www.potaroo.net/ispcol/2021-02/iot.html https://www.potaroo.net/ispcol/2021-02/iot.html
tasubotadas 4y ago
Invest in vpn stonks. It's gonna be popular in the Eu in the future
- sdfghswe 4y ago
  Are there any publicly traded vpns? EDIT: https://swingtradebot.com/stocks-tagged-as/4952-vpn https://swingtradebot.com/stocks-tagged-as/4952-vpn
popcorncowboy 4y ago
> "could chill or even prevent the availability of globally maintained open source software in Europe." Chill? More like obliterate. If this bill goes through, almost every single open source repo is going to necessarily end up with a banner saying: "MIT licensed ex EU. If you are an EU entity or intend to use this software in any way that may result in an EU entity coming into any contact (even indirectly) with this software, you are excluded from all rights granted under this license and prohibited from using any code provided here."
- jruohonen 4y ago
  Please. Don't spread FUD.
  - Sindisil 4y ago
    Why? Unless it's fixed, this act would be the cause of fear, uncertainty, and doubt. The most rational and likely outcome would be to add EU exclusions until and unless Open Source liability under the act is sorted.
    - geysersam 4y ago
      Of course they're not going to pass a law requiring FOSS volunteers to provide support for or pay fines for software they provide for free. That would be immoral and entirely unenforceable. They're not idiots. Maybe it's a bad law. It could be. But this FUD distracts from a real discussion about its merits and flaws.
- jeroenhd 4y ago
  Why? If you sell commercial support for your software, you're just as liable as a closed source developer selling commercial support for their software. What's wrong with that?
  - rad_gruchalski 4y ago
    Have you ever been 18yo and sold your first bit of software? Have you even been a contractor?
captainmuon 4y ago
This is fearmongering. As others have mentioned, it hinges on whether offering open source software on GitHub is considered a product in the sense of the law. The details are probably up for courts to decide, and despite what we like to think, they are not completely stupid. The law is not geared towards "just putting some software on a server and calling it open source" which is what most projects do. It is geared as far as I understand towards bad IOT devices, among others. People sell them and know outright that there are existing vulnerabilities, and that rightfully should be illegal. I think (maybe after some adjustments) this will be a boon to open source. Because every company shipping a program or a physical product with some GPL or MIT source inside will now be forced to bring it up to good quality before making money out of it. And at least in case of GPL, it is likely it will be contributed back to upstream. (I personally prefer upstreaming all open source code even when not required to share it, because you don't have the burden of maintaining a fork, and you have a better relationship with the developers in case you need to incorporate new features.)
- kevincox 4y ago
  > The details are probably up for courts to decide As someone with lots of software publicly available with permissive licenses I absolutely do not want to participate in letting the "courts decide". If this was going through I would be strongly considering adding a banner saying that this software is not for EU consumers with the alternative being denying the fact that I am aware that EU people were using the software. I am happy to provide my software as-is with no warranty. But if there is a chance that I am somehow on the hook for any guarantees about that software I'm out. It is just too much risk for very little gain.
  - 908B64B197 4y ago
    > I would be strongly considering adding a banner saying that this software is not for EU consumers This should be incorporated in the license. The alternative would be a (paid) support contract for EU customers.
    - jeroenhd 4y ago
deleted 4y ago
[deleted]
jeroenhd 4y ago
I think some of these reactions are rather overstated. I can't find language that states that you're on the hook for software support and fines just because you pushed a patch to Github that one time. The text mostly objected to is: > In order not to hamper innovation or research, free and open-source software developed or supplied outside the course of a commercial activity should not be covered by this Regulation. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. In the context of software, a commercial activity might be characterized not only by charging a price for a product, but also by charging a price for technical support services, by providing a software platform through which the manufacturer monetises other services, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software. From context it reads like open source is excluded unless the company developing software is selling services in the EU, in which case I don't see why open source software would need to be treated any differently from closed source software. I think it's very valid to object to the lack of a definition of what "free and open source" means (free as in speech or free as in mattress, for one). However, that doesn't seem to be the part that most of these companies object to. "If we post the source, we don't have to follow the CRA" would probably just lead to source dumps of crapware so that the law can be ignored. The cynic in me says that many of these objections are from people who don't want to be forced to patch the software they sell. Luckily, this is just a proposal for now. I see a lot of things I like in this proposal. Putting pressure on manufacturers to patch their shitty hardware might finally do something about the botnets of media players and security cameras that plague the modern internet.
- BlueTemplar 4y ago
  It might cause issues at (today's) margins ?? You know, how with FLOSS software (IIRC) you MUST provide the source on request, but CAN demand to be paid for the inconvenience (hosting, bandwidth, shipping physical storage...) Seems like this wouldn't be an issue, but it would still be nice that this situation had been covered by the law. P.S.: GPL : https://www.gnu.org/philosophy/selling.html https://www.gnu.org/philosophy/selling.html "Distributing free software is an opportunity to raise funds for development. Don't waste it!" OS : https://opensource.org/osd/ https://opensource.org/osd/ "The license shall not restrict any party from selling or giving away the software [...]" (Emphasis mine, literally the first non-fluff phrase !)
oytis 4y ago
There seems a pattern with legislators in EU trying to fit the digital ("hacker") culture into service provider/customer model. Individuals hacking on projects for fun, bringing up their standalone servers for fun etc. just shouldn't exist in their mind. "Customers" (i.e. non-tech people) demand protection and "service providers" (whoever puts their stuff online) should comply. Rant over. Honestly I don't understand why is it not done the same way as for other certification. You only need to have certification once you start selling your product in a regulated industry - e.g. a connected device in this case. If you use any components (hardware or software) it's your responsibility that they are either pre-certified for you (what commercial suppliers would do) or certify them yourself. This would shift responsibility from open source maintainers to where it's due.
- deleted 4y ago
  [deleted]
- rad_gruchalski 4y ago
  Because this is designed exactly to go after open source. Big European Tech (which is an oxymoron) cannot compete with OSS on levrl-playing field so they lobbied for this to eliminate competition.
  - oytis 3y ago
    Who that would be? The only European big tech company I know is SAP. Not sure what European companies are competing with open source and losing.
nforgerit 4y ago
German speaking. People seem to be downplaying the legal risks for “small” stakeholders that “would go under the radar of EU authorities” but the problem is that those laws introduce legal insecurity that many many developers I know are not willing to take. Those laws are shallowly formulated and will require plenty of court rulings over several years to form some kind of framework for concrete behavior. And as we’ve seen in the past, BigTech will be much better in handling this legal insecurity than smaller local startups. If EU’s intention really is to assert a level playing field, then they just achieve the opposite.
- MrBuddyCasino 4y ago
  > If EU’s intention really is to assert a level playing field, then they just achieve the opposite. To even pretend otherwise is idiotic. Regulation benefits mainly big incumbents, this has always been so and should be known by everyone who is even remotely interested in this topic.
  - geysersam 4y ago
    > Regulation benefits mainly big incumbents This is a gross overgeneralization. There are many examples of regulations explicitly intended to increase competition. It could very well be that this specific law does benefit big incumbents more.
    - MrBuddyCasino 3y ago
      Well: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4368609 https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4368609
rad_gruchalski 4y ago
It’s important to recognize that the CRA project was led at the EU by Eva Kaili, the Greek MEP involved in Qatargate and probed for multiple accounts of fraud: https://www.politico.eu/article/eva-kaili-qatargate-corruption-european-parliament-kickbacks-scheme/amp/ https://www.politico.eu/article/eva-kaili-qatargate-corrupti....

137 points by jjgreen 4y ago

A little too alarmist take to my liking, but it is nevertheless a good thing that he is calling others to join the lobbying (which he oddly calls "education"). While also GitHub seems to have done a decent job during the consultation, I'd take the genuinity of their position with a grain of salt due to the CoPilot fiasco. In fact, they are saying that "open source licenses disclaim all warranty, making explicit the expectation that any entity seeking to use or integrate the open source software bears responsibility to ensure its compliance with relevant laws". The pot calling the kettle black. https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/13410-Cyber-resilience-act-new-cybersecurity-rules-for-digital-products-and-ancillary-services/F3376627_en https://ec.europa.eu/info/law/better-regulation/have-your-sa...

samtho 4y ago
Being alarmist and pedantic about specific language of legal text is precisely what is needed to point out flaws. The only thing more terrifying than a governing body making laws about things they fundamentally do not understand is having the courts, with their own incomplete understanding, decide their own interpretation of them.
- jruohonen 4y ago
  Agreed, and that is also a good advice for those submitting responses to open consultations. Yet, Vaughan-Nichols certainly was not pedantic in this piece.
- SiempreViernes 4y ago
  I'd argue a small group of people on an obscure mail list defining things so as to best suit them is an even worse form of governance, despite its relative popularity in this forum compared to more standard methods.
- deleted 4y ago
  [deleted]
solarkraft 4y ago
> lobbying (which he oddly calls "education") Looks like he has lobbying experience :)

poopsmithe 4y ago

Why is this called a poison pill?

DoughnutHole 4y ago
Definitely just a misuse of the term. "Poison pill" doesn't just mean a terrible provision of legislation - it's possible for legislation to be terrible while conceived entirely in good faith. In this case it's bad legislation due to EU legislators not understanding open source. A "poison pill" provision or amendment is an element deliberately added to turn people who otherwise would have supported the legislation against it. The person proposing the poison pill is acting it in bad faith - they have no expectation of it passing, they might not even support the idea themselves - the only reason it's added is to make the original legislation's supporters drop their support, killing said legislation. I don't think anyone is seriously proposing that the EU is deliberately hamstringing open source in order to kill their own cyber-security act. They've just written a bad piece of legislation.
- danaris 4y ago
  Given how frequently problems like this crop up in legislation these days, it seems like we do need a term for it, though. Maybe something like "food poisoning pill"? Made with good intentions, but without proper understanding or taking proper precautions, so it becomes toxic...
- unity1001 4y ago
  > it's possible for legislation to be terrible while conceived entirely in good faith This is way too fine-tuned to destroy small software segments, open source and private developers included, for the benefit of large companies that will be able to afford the potential fines.
  - DoughnutHole 4y ago
    That has nothing to do with what I mean by good faith - I just mean that the legislation they’ve proposed is the legislation that they want passed. That’s different from a poison pill amendment, where the intention isn’t to actually implement the policy, just to kill the legislation that you’re attaching it to.

LadyCailin 4y ago

I don’t know how you solve this exactly, but I do think allowing open source devs to just wash their hands of all responsibility isn’t a tenable solution. There’s a reason we don’t have “open source bridges”. You have to be a licensed civil engineer before you’re allowed to build a bridge, you can’t just build one and slap a “NO WARRANTY” disclaimer on it. Bridges can’t be downloaded from Russia, however, and requiring open source devs to carry liability insurance probably just destroys open source, so I am genuinely unsure how you solve this in practice. But I think that is a conversation we should be having, rather than just saying that the status quo is the ideal, and allowing no room for discussion.

pharmakom 4y ago
It’s up to the person choosing and deploying the software to decide if the OSS project is sufficiently secured. This is the person (or party) who should shoulder the blame. I don’t see why someone pushing to GitHub or whatever should have any responsibility for how their stuff is misused.
- LadyCailin 4y ago
  Followed to its logical end, this also destroys open source as we know it today. If I’m going to have to vet your OSS with a fine tuned comb before I use it, I might as well just write it myself, and also be unencumbered from whatever license you chose. Only projects backed by FAANG would actually be used then.
  - anthk 4y ago
    Then watch the ActiveX disaster and Blaster coming back but by 20000. Worst Botnet/ransomware attack from NK/Russia ever. The UE on HUGE losses. BSD and GNU depending companies almost get bankrupt overnight. Productivity halts with a worse outcome than COVID.
- rini17 4y ago
  It does not work so well in practice. Projects like sqlite and curl had to take steps to hide themselves from end users, who are grasping at straws in face of malfunctioning product.

timrichard 4y ago

"Secure the product over its whole life" I wonder how this will affect the business model where you get updates while your subscription is active.

jriddle567 4y ago

FOSS is a specified exception in the CRA. Am I missing something?

Ralfp 4y ago
This exception only applies if you have clear intent to make no money on the software. As soon as you put "donate" button the site, you lose the protections.
- hgs3 4y ago
  The "exception" doesn't go far enough. If code is open source then anyone can fork and fix it. Money doesn't change this.
  - rad_gruchalski 4y ago
    It doesn’t matter in the face of how that directive is phrased today. No matter how much in denial one may be.
- debugnik 4y ago
  Donations are not a commercial activity if no good or service is exchanged (in which case they wouldn't be donations, just purchases).
  - Ralfp 3y ago
    This is correct, but EU's act we are discussing about says opposite, hence the discussion.
x0x0 4y ago
see the python software foundation's concerns https://pyfound.blogspot.com/2023/04/the-eus-proposed-cra-law-may-have.html https://pyfound.blogspot.com/2023/04/the-eus-proposed-cra-la... to wit: under a reasonable reading of the legislation, having any commercial activity (classes, conference tickets, etc) opens you to liability. Or imagine selling support. Additionally: if open source code is included by someone besides the author into a commercially available product, it's not clear that the open source author doesn't hold liability there. Even if the author received $0, or is unaware of the use of the software he/she created.

candiodari 4y ago

Strangely the EU has no laws on the books about them accepting responsibility for unintended consequences of legislation ... when that is more or less the same problem.

Bran_son 4y ago
Unfortunately it does, and nobody likes them: https://en.wikipedia.org/wiki/Comprehensive_Economic_and_Trade_Agreement#Investment_protection_and_investor-state-tribunals https://en.wikipedia.org/wiki/Comprehensive_Economic_and_Tra... They're called investor-state dispute settlements, and they let corporations sue governments for loss of profit from things such as environmental protection and public health laws: https://en.wikipedia.org/wiki/Investor%E2%80%93state_dispute_settlement#Cases_lost_by_governments https://en.wikipedia.org/wiki/Investor%E2%80%93state_dispute...
jruohonen 4y ago
What nonsense is this? The EU's laws are constantly fought in the courts.

xoa 4y ago

>The notional open source developer in Nebraska, thanklessly maintaining a vital small program, may not even know where Brussels is (it's in Belgium). This remains a curious example. Nebraska is not an EU country, it's an American state. EU law doesn't apply. The Nebraska developer (or me in my state) don't need to care beyond that if enough Europeans were interested they might contribute patches to meet their own new reqs, or make requests over it, and then maintainer would need to judge if it matched/was worth it, and if not it might get forked into a CRA one, or not. Ie., just the normal open source process. Unless someone can point to an American (Japanese/Australian/Canadian/Korean/Mexican/Chinese/Indian etc etc) law passed promising equivalence this continued notion that the EU laws are global is really weird. Certain things they've targeted at companies work, because said companies wish to have physical business within the EU, and the EU of course has jurisdiction over everyone within the EU. So the cost of not complying is the cost of losing a large chunk of business there, and since it's a huge market that's a big motivator (though not infinite, even for megacorps). But for those who don't have any physical interest, what's the issue?

candiodari 4y ago
Copyright has been as is enforced internationally. This is the subject of international treaties.
NoZebra120vClip 4y ago
The "Nebraska" reference is probably due to the relevant Xkcd: https://xkcd.com/2347/ https://xkcd.com/2347/
Etheryte 4y ago
It's a pop culture reference, you're reading way too much into a witty remark.
- xoa 4y ago
  I don't agree with you (or sibling). I did consider that, and also for that matter that there could be a "Nebraska, Europe", after all there are various European cities/places names all over the US. But the extra context ("may not even know where Brussels is (it's in Belgium)") makes clear that while they are using the reference they are in fact referring to Americans as being covered, or else it makes no sense. And further, this has been an ongoing thread in relation to this act. ~3 weeks ago HN had a thread [0] on this as well regarding a letter to the European Parliament on the CRA from the Internet Systems Consortium [1], and it too had comments from non-Europeans thinking it applied to them. That over simplified narrative has been getting pushed on HN as well in general, such as with the GDPR.

zoobab 4y ago

The poison pill is our law makers writing "open source" without consulting anybody from the community if what they propose is sensible.

jruohonen 4y ago
I think you've misunderstood something about democracy. It is not like lawmakers can in advance inform everyone and each stakeholder who might be affected. Nor do I think they were writing this law proposal for open source in mind; quite the contrary, I think they probably missed this point of view during the drafting but are probably now aware of the issues. Perhaps the most striking issue revealed by the CRA is that open source stakeholders apparently do not have their NGOs at Brussels (or Capitol for that matter). There would be all kinds of opportunities like lobbying for funding, or fighting Big Tech if that is your game, etc.

hgs3 4y ago

Open source is decentralized. Everyone is the maintainer. If there is a bug in the code, then anyone can fork and fix it. I don't understand how this law can apply to OSS period.

sidewndr46 4y ago
It's simple. The police get a warrant, pursuant to local laws. They show up and arrest someone. That person is put on trial. What happens next, I don't know. Legal systems do not have to be coherent or logical, only actionable.
- hgs3 4y ago
  > It's simple. The police get a warrant, pursuant to local laws. They show up and arrest someone. OSS is decentralized. Everyone has source access. The police will have to arrest everyone, including themselves.
  - sidewndr46 4y ago
    You seem to be acting deliberately ignorant. The police could in fact do that. But in reality a judge will write a warrant for either one individual or just a small group of individuals that a public prosecutor (I do not know the term in the EU) presents to the judge. The police will arrest only those people. "arrest everyone" is some bizarre fantasy that the legal system is both ineffective and stupid.
    - hgs3 4y ago
      > You seem to be acting deliberately ignorant. That's not a charitable interpretation. Try re-reading what I've written from the perspective of someone pointing out logical flaws of a proposed law.
      - webstrand 4y ago
        > I don't understand how this law can apply to OSS period. That's what the commenter is responding to. Laws are clearly not applied logically, and while you may be able to make that argument in court, it's never clear that it will be accepted.

oefrha 4y ago

This has already been discussed a few times, e.g. when PSF put out an article about it: https://news.ycombinator.com/item?id=35525384 https://news.ycombinator.com/item?id=35525384 More: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=cyber%20resilience&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

friendzis 4y ago

Author implicitly raises a question, but fails to articulate it and then answer it clearly. The question is whether open source software is to be considered a product and somewhat related whether downloading/using open source software creates a transaction. I can safely say that I don't now the answer to the question and therefore I cannot draw conclusions as far reaching as the article author does. Effectively, the CRA is going to impose certain security standard on software products. People in medical, automotive, aviation, military fields were already subject to certain security standards, so GitHub's claim regarding unobtainability is demonstrably misleading if not outright false, depending on definitions of safety/security standards. As it pertains to open source, it all depends on whether mere publication of open source software would be considered product release. I can agree with the author here that clarification may be needed. An important note here is that such regulation (OS is not affected) would have tremendous effect on open source. The companies using open source software in products would essentially be forced to either take open source under their belt with proper controls in place or be effectively forced to properly support open source development by at least providing security oversight. Sincerely, I have no idea what effect that would have as a whole.

deleted 4y ago

[deleted]

pier25 4y ago

Again, the EU making things more difficult for EU startups. As if GDPR wasn't enough.

jruohonen 4y ago
Right. It is not like the world needs more startups with software full of holes.
- pier25 4y ago
  The intentions are good, just like GDPR, it's the implementation that sucks.
  - jruohonen 4y ago
    Frankly, I don't know what to say. If it is "the implementation that sucks", the implication probably is that everyone in this forum sucks.
    - pier25 4y ago
      Maybe, but probably no one in this forum is enacting laws.
- jkeisling 4y ago
  Shocking that this kind of knee-jerk anti-innovation sentiment seems to be the dominant mood on Hacker News these days. Whatever legitimate criticisms of SV startups there are, this is mere contentless anti-tech sniping.
  - rad_gruchalski 4y ago
    Plenty of frustrated and sour people post-covid out there.
  - jruohonen 4y ago
    So you think improving security is about a "knee-jerk anti-innovation sentiment"? To better understand why these regulations are pushed forward throughout the world, read for instance Huston's elegant piece: https://www.potaroo.net/ispcol/2021-02/iot.html https://www.potaroo.net/ispcol/2021-02/iot.html

tasubotadas 4y ago

Invest in vpn stonks. It's gonna be popular in the Eu in the future

sdfghswe 4y ago
Are there any publicly traded vpns? EDIT: https://swingtradebot.com/stocks-tagged-as/4952-vpn https://swingtradebot.com/stocks-tagged-as/4952-vpn

popcorncowboy 4y ago

> "could chill or even prevent the availability of globally maintained open source software in Europe." Chill? More like obliterate. If this bill goes through, almost every single open source repo is going to necessarily end up with a banner saying: "MIT licensed ex EU. If you are an EU entity or intend to use this software in any way that may result in an EU entity coming into any contact (even indirectly) with this software, you are excluded from all rights granted under this license and prohibited from using any code provided here."

jruohonen 4y ago
Please. Don't spread FUD.
- Sindisil 4y ago
  Why? Unless it's fixed, this act would be the cause of fear, uncertainty, and doubt. The most rational and likely outcome would be to add EU exclusions until and unless Open Source liability under the act is sorted.
  - geysersam 4y ago
    Of course they're not going to pass a law requiring FOSS volunteers to provide support for or pay fines for software they provide for free. That would be immoral and entirely unenforceable. They're not idiots. Maybe it's a bad law. It could be. But this FUD distracts from a real discussion about its merits and flaws.
jeroenhd 4y ago
Why? If you sell commercial support for your software, you're just as liable as a closed source developer selling commercial support for their software. What's wrong with that?
- rad_gruchalski 4y ago
  Have you ever been 18yo and sold your first bit of software? Have you even been a contractor?

captainmuon 4y ago

This is fearmongering. As others have mentioned, it hinges on whether offering open source software on GitHub is considered a product in the sense of the law. The details are probably up for courts to decide, and despite what we like to think, they are not completely stupid. The law is not geared towards "just putting some software on a server and calling it open source" which is what most projects do. It is geared as far as I understand towards bad IOT devices, among others. People sell them and know outright that there are existing vulnerabilities, and that rightfully should be illegal. I think (maybe after some adjustments) this will be a boon to open source. Because every company shipping a program or a physical product with some GPL or MIT source inside will now be forced to bring it up to good quality before making money out of it. And at least in case of GPL, it is likely it will be contributed back to upstream. (I personally prefer upstreaming all open source code even when not required to share it, because you don't have the burden of maintaining a fork, and you have a better relationship with the developers in case you need to incorporate new features.)

kevincox 4y ago
> The details are probably up for courts to decide As someone with lots of software publicly available with permissive licenses I absolutely do not want to participate in letting the "courts decide". If this was going through I would be strongly considering adding a banner saying that this software is not for EU consumers with the alternative being denying the fact that I am aware that EU people were using the software. I am happy to provide my software as-is with no warranty. But if there is a chance that I am somehow on the hook for any guarantees about that software I'm out. It is just too much risk for very little gain.
- 908B64B197 4y ago
  > I would be strongly considering adding a banner saying that this software is not for EU consumers This should be incorporated in the license. The alternative would be a (paid) support contract for EU customers.
  - jeroenhd 4y ago

deleted 4y ago

[deleted]

jeroenhd 4y ago

I think some of these reactions are rather overstated. I can't find language that states that you're on the hook for software support and fines just because you pushed a patch to Github that one time. The text mostly objected to is: > In order not to hamper innovation or research, free and open-source software developed or supplied outside the course of a commercial activity should not be covered by this Regulation. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. In the context of software, a commercial activity might be characterized not only by charging a price for a product, but also by charging a price for technical support services, by providing a software platform through which the manufacturer monetises other services, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software. From context it reads like open source is excluded unless the company developing software is selling services in the EU, in which case I don't see why open source software would need to be treated any differently from closed source software. I think it's very valid to object to the lack of a definition of what "free and open source" means (free as in speech or free as in mattress, for one). However, that doesn't seem to be the part that most of these companies object to. "If we post the source, we don't have to follow the CRA" would probably just lead to source dumps of crapware so that the law can be ignored. The cynic in me says that many of these objections are from people who don't want to be forced to patch the software they sell. Luckily, this is just a proposal for now. I see a lot of things I like in this proposal. Putting pressure on manufacturers to patch their shitty hardware might finally do something about the botnets of media players and security cameras that plague the modern internet.

BlueTemplar 4y ago
It might cause issues at (today's) margins ?? You know, how with FLOSS software (IIRC) you MUST provide the source on request, but CAN demand to be paid for the inconvenience (hosting, bandwidth, shipping physical storage...) Seems like this wouldn't be an issue, but it would still be nice that this situation had been covered by the law. P.S.: GPL : https://www.gnu.org/philosophy/selling.html https://www.gnu.org/philosophy/selling.html "Distributing free software is an opportunity to raise funds for development. Don't waste it!" OS : https://opensource.org/osd/ https://opensource.org/osd/ "The license shall not restrict any party from selling or giving away the software [...]" (Emphasis mine, literally the first non-fluff phrase !)

oytis 4y ago

There seems a pattern with legislators in EU trying to fit the digital ("hacker") culture into service provider/customer model. Individuals hacking on projects for fun, bringing up their standalone servers for fun etc. just shouldn't exist in their mind. "Customers" (i.e. non-tech people) demand protection and "service providers" (whoever puts their stuff online) should comply. Rant over. Honestly I don't understand why is it not done the same way as for other certification. You only need to have certification once you start selling your product in a regulated industry - e.g. a connected device in this case. If you use any components (hardware or software) it's your responsibility that they are either pre-certified for you (what commercial suppliers would do) or certify them yourself. This would shift responsibility from open source maintainers to where it's due.

deleted 4y ago
[deleted]
rad_gruchalski 4y ago
Because this is designed exactly to go after open source. Big European Tech (which is an oxymoron) cannot compete with OSS on levrl-playing field so they lobbied for this to eliminate competition.
- oytis 3y ago
  Who that would be? The only European big tech company I know is SAP. Not sure what European companies are competing with open source and losing.

nforgerit 4y ago

German speaking. People seem to be downplaying the legal risks for “small” stakeholders that “would go under the radar of EU authorities” but the problem is that those laws introduce legal insecurity that many many developers I know are not willing to take. Those laws are shallowly formulated and will require plenty of court rulings over several years to form some kind of framework for concrete behavior. And as we’ve seen in the past, BigTech will be much better in handling this legal insecurity than smaller local startups. If EU’s intention really is to assert a level playing field, then they just achieve the opposite.

MrBuddyCasino 4y ago
> If EU’s intention really is to assert a level playing field, then they just achieve the opposite. To even pretend otherwise is idiotic. Regulation benefits mainly big incumbents, this has always been so and should be known by everyone who is even remotely interested in this topic.
- geysersam 4y ago
  > Regulation benefits mainly big incumbents This is a gross overgeneralization. There are many examples of regulations explicitly intended to increase competition. It could very well be that this specific law does benefit big incumbents more.
  - MrBuddyCasino 3y ago
    Well: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4368609 https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4368609

rad_gruchalski 4y ago

It’s important to recognize that the CRA project was led at the EU by Eva Kaili, the Greek MEP involved in Qatargate and probed for multiple accounts of fraud: https://www.politico.eu/article/eva-kaili-qatargate-corruption-european-parliament-kickbacks-scheme/amp/ https://www.politico.eu/article/eva-kaili-qatargate-corrupti....