5 ms·

>The notional open source developer in Nebraska, thanklessly maintaining a vital small program, may not even know where Brussels is (it's in Belgium). This rem

by xoa 3y ago

>The notional open source developer in Nebraska, thanklessly maintaining a vital small program, may not even know where Brussels is (it's in Belgium). This remains a curious example. Nebraska is not an EU country, it's an American state. EU law doesn't apply. The Nebraska developer (or me in my state) don't need to care beyond that if enough Europeans were interested they might contribute patches to meet their own new reqs, or make requests over it, and then maintainer would need to judge if it matched/was worth it, and if not it might get forked into a CRA one, or not. Ie., just the normal open source process. Unless someone can point to an American (Japanese/Australian/Canadian/Korean/Mexican/Chinese/Indian etc etc) law passed promising equivalence this continued notion that the EU laws are global is really weird. Certain things they've targeted at companies work, because said companies wish to have physical business within the EU, and the EU of course has jurisdiction over everyone within the EU. So the cost of not complying is the cost of losing a large chunk of business there, and since it's a huge market that's a big motivator (though not infinite, even for megacorps). But for those who don't have any physical interest, what's the issue?

candiodari 3y ago
Copyright has been as is enforced internationally. This is the subject of international treaties.
NoZebra120vClip 3y ago
The "Nebraska" reference is probably due to the relevant Xkcd: https://xkcd.com/2347/ https://xkcd.com/2347/
Etheryte 3y ago
It's a pop culture reference, you're reading way too much into a witty remark.
- xoa 3y ago
  I don't agree with you (or sibling). I did consider that, and also for that matter that there could be a "Nebraska, Europe", after all there are various European cities/places names all over the US. But the extra context ("may not even know where Brussels is (it's in Belgium)") makes clear that while they are using the reference they are in fact referring to Americans as being covered, or else it makes no sense. And further, this has been an ongoing thread in relation to this act. ~3 weeks ago HN had a thread [0] on this as well regarding a letter to the European Parliament on the CRA from the Internet Systems Consortium [1], and it too had comments from non-Europeans thinking it applied to them. That over simplified narrative has been getting pushed on HN as well in general, such as with the GDPR.
rad_gruchalski 3y ago
This has nothing to do with patches. The problem is that when someone from EU intends to use the software of the dev from Nebraska, the dev from Nebraska may be contacted to provide a proof that their software meets certain requirements. The dev from Nebraska may don’t care, I would not… but the EU-based dev cannot use that bit of software in a bigger commercial part, even if the license allows it. The EU-based dev may opt for doing their own certification of that component. It’s gate-keeping at its best. This is a blow to SMEs and a protectionist move on behalf of large enterprises. In my head, the reasoning is the following: certification will be another bureaucratic process to follow. It will cost money, it will require human resources on both sides, it will feed some companies who don’t have to do shit to turn profit—companies started to feed on others as those who “certify”, it will most likely imply that someone from the bureaucratic machine will look into your source code -> trade secrets, anyone? Big players (not going to name them here) like companies like SA…, De… Te… have enough resources and financial backing to push through that. The point is, they cannot compete with OSS on dev pace, they found a workaround - kill OSS and impact SMEs by putting a legal barrier to entry. On a personal note, as an EU-based person, I start getting fed up with this shit.
- captainmuon 3y ago
  That's great, the company who wants to sell stuff in the EU pays for the audit and the bugfixes, and it benefits all. As a PM in a previous position, I would have loved to fix known bugs, contribute back to open source, audit things properly. But when there was no legal pressure to do so, my bosses (understandably) said: great, that software is for free, take it, don't put to much work into it, ship it. Like it or not, open source software is part of our supply chains, and if there is no incentive to maintain it properly then that's a big problem.
  - rad_gruchalski 3y ago
    You assume that companies will share audits they conducted for free with everyone as a public service. Edit: there the other side of the coin. A single dev who wants to enter the market has an uphill battle. He is required to certify their own work, and provide audits of all dependencies. Good luck starting a business from your bedroom un such climate. If this is what people in the EU want, paraphrasing: I don’t want to live on this continent anymore.
spacebanana7 3y ago
At the moment, it's quite easy for the EU to enforce fines on big companies because they tend to have lots of assets in the EU by way of their operations (buildings, bank accounts, inventories etc). However, the EU would have a much more difficult time enforcing fines on entities with no European presence. In principal they could go through the international treaty system, but that would be very slow and expensive. I'm not aware of any case where they've actually successfully pursued this for non tax / copyright fines which tend to have special arrangements although I've not looked into it that much. Please let me know if anyone is aware of any precedent. Ultimately the ability of one country to enforce fines on another relies on goodwill and diplomacy. What could the EU do to say, India, if their courts declined to enforce a $20k fine on a small developer or take 7 years to decide the matter? Even if they were technically allowed to go after sovereign Indian assets instead by a treaty or threaten sanctions, it's hard to see the diplomatic cost being worth such a small fine.
Lapha 3y ago
>Unless someone can point to an American (Japanese/Australian/Canadian/Korean/Mexican/Chinese/Indian etc etc) law passed promising equivalence this continued notion that the EU laws are global is really weird. Extraterritorial jurisdiction isn't a new or unusual concept in the slightest, and I don't understand the recent trend of pretending that it's only the EU does this. The classic examples of money laundering, organised crime, sexual crimes committed against children, female genital mutilation, anti-competitive laws, etc, are so mainstream at this point that I don't think any Westerner would consider it controversial for somebody who does these acts in countries where they are less regulated to be arrested for them upon arriving in a Western country. There's also more HN specific examples like cybercrime, with a recent example being the arrest of Marcus Hutchins. Or copyright, where anybody from countries with less strict copyright laws from the US knows what I'm talking about. Japan has strict copyright laws too, and game companies like Sega and Nintendo are notoriously protective of their IP to the point where Sega has apologised for abusing the DMCA to take down videos produced by North American and European nationals. COPPA predates the GDPR by 15 years and is applicable everywhere. The Canadian Anti-Spam Legislation regulates sending spam to Canadians. The German NetzDG will send you a strongly worded letter if you criticise Germans. Many data protection laws also regulate how you handle data of their nationals. For example, the data protection laws India introduced in 2011, applicable to businesses that outsource operations to India, were described as much more restrictive than the EU or US counterparts. China regulates that foreign businesses doing business in China store all their data in China. South Korea has no scope on territory for their PIPA, but it's hard to tell if this applied to their 2011 legislation or just their 2020 legislation as these laws obviously aren't in English. Many newer laws are modelled after the GDPR and also have no scope on territory, e.g., Brazil, California, Russia, etc. There's other more general examples too. Many countries criminalise taking drugs, and evidence that you've taken drugs in the past can lead to you being deported. Consumer protection laws are generally pretty strong and banks will side with consumers in issuing charge backs. Anecdotally, Steam had a no refund policy for the longest time and support staff would berate you for asking for a refund for a game that doesn't work, but they still issued refunds and now have a refund policy (even if it doesn't fully comply with local laws). America regulates exporting arms, which caused a lot of drama in the Linux scene in the early 2000s when encryption was (still is?) considered munition. Doing commerce with embargoed or sanctioned countries can land you in hot water too, it might make sense for 'bad guy' countries like China, Russia, Iran, etc, but the US and Israel stand alone in defending the embargo on Cuba. Many countries have restrictions on freedom of speech, it might not be the best idea to travel to Turkey if you publicly criticise Erdoğan. Etc. -- None of this is to say that I agree with what the EU is doing, or that these examples are 1:1 parallels, but I think the attitude of 'these laws don't/shouldn't affect me' is naive at best, unless you plan on never leaving or doing business outside of your own country.

by xoa 3y ago

candiodari 3y ago

NoZebra120vClip 3y ago

The "Nebraska" reference is probably due to the relevant Xkcd: https://xkcd.com/2347/ https://xkcd.com/2347/

Etheryte 3y ago

It's a pop culture reference, you're reading way too much into a witty remark.

xoa 3y ago
I don't agree with you (or sibling). I did consider that, and also for that matter that there could be a "Nebraska, Europe", after all there are various European cities/places names all over the US. But the extra context ("may not even know where Brussels is (it's in Belgium)") makes clear that while they are using the reference they are in fact referring to Americans as being covered, or else it makes no sense. And further, this has been an ongoing thread in relation to this act. ~3 weeks ago HN had a thread [0] on this as well regarding a letter to the European Parliament on the CRA from the Internet Systems Consortium [1], and it too had comments from non-Europeans thinking it applied to them. That over simplified narrative has been getting pushed on HN as well in general, such as with the GDPR.

rad_gruchalski 3y ago

This has nothing to do with patches. The problem is that when someone from EU intends to use the software of the dev from Nebraska, the dev from Nebraska may be contacted to provide a proof that their software meets certain requirements. The dev from Nebraska may don’t care, I would not… but the EU-based dev cannot use that bit of software in a bigger commercial part, even if the license allows it. The EU-based dev may opt for doing their own certification of that component. It’s gate-keeping at its best. This is a blow to SMEs and a protectionist move on behalf of large enterprises. In my head, the reasoning is the following: certification will be another bureaucratic process to follow. It will cost money, it will require human resources on both sides, it will feed some companies who don’t have to do shit to turn profit—companies started to feed on others as those who “certify”, it will most likely imply that someone from the bureaucratic machine will look into your source code -> trade secrets, anyone? Big players (not going to name them here) like companies like SA…, De… Te… have enough resources and financial backing to push through that. The point is, they cannot compete with OSS on dev pace, they found a workaround - kill OSS and impact SMEs by putting a legal barrier to entry. On a personal note, as an EU-based person, I start getting fed up with this shit.

captainmuon 3y ago
That's great, the company who wants to sell stuff in the EU pays for the audit and the bugfixes, and it benefits all. As a PM in a previous position, I would have loved to fix known bugs, contribute back to open source, audit things properly. But when there was no legal pressure to do so, my bosses (understandably) said: great, that software is for free, take it, don't put to much work into it, ship it. Like it or not, open source software is part of our supply chains, and if there is no incentive to maintain it properly then that's a big problem.
- rad_gruchalski 3y ago
  You assume that companies will share audits they conducted for free with everyone as a public service. Edit: there the other side of the coin. A single dev who wants to enter the market has an uphill battle. He is required to certify their own work, and provide audits of all dependencies. Good luck starting a business from your bedroom un such climate. If this is what people in the EU want, paraphrasing: I don’t want to live on this continent anymore.

spacebanana7 3y ago

At the moment, it's quite easy for the EU to enforce fines on big companies because they tend to have lots of assets in the EU by way of their operations (buildings, bank accounts, inventories etc). However, the EU would have a much more difficult time enforcing fines on entities with no European presence. In principal they could go through the international treaty system, but that would be very slow and expensive. I'm not aware of any case where they've actually successfully pursued this for non tax / copyright fines which tend to have special arrangements although I've not looked into it that much. Please let me know if anyone is aware of any precedent. Ultimately the ability of one country to enforce fines on another relies on goodwill and diplomacy. What could the EU do to say, India, if their courts declined to enforce a $20k fine on a small developer or take 7 years to decide the matter? Even if they were technically allowed to go after sovereign Indian assets instead by a treaty or threaten sanctions, it's hard to see the diplomatic cost being worth such a small fine.

Lapha 3y ago

>Unless someone can point to an American (Japanese/Australian/Canadian/Korean/Mexican/Chinese/Indian etc etc) law passed promising equivalence this continued notion that the EU laws are global is really weird. Extraterritorial jurisdiction isn't a new or unusual concept in the slightest, and I don't understand the recent trend of pretending that it's only the EU does this. The classic examples of money laundering, organised crime, sexual crimes committed against children, female genital mutilation, anti-competitive laws, etc, are so mainstream at this point that I don't think any Westerner would consider it controversial for somebody who does these acts in countries where they are less regulated to be arrested for them upon arriving in a Western country. There's also more HN specific examples like cybercrime, with a recent example being the arrest of Marcus Hutchins. Or copyright, where anybody from countries with less strict copyright laws from the US knows what I'm talking about. Japan has strict copyright laws too, and game companies like Sega and Nintendo are notoriously protective of their IP to the point where Sega has apologised for abusing the DMCA to take down videos produced by North American and European nationals. COPPA predates the GDPR by 15 years and is applicable everywhere. The Canadian Anti-Spam Legislation regulates sending spam to Canadians. The German NetzDG will send you a strongly worded letter if you criticise Germans. Many data protection laws also regulate how you handle data of their nationals. For example, the data protection laws India introduced in 2011, applicable to businesses that outsource operations to India, were described as much more restrictive than the EU or US counterparts. China regulates that foreign businesses doing business in China store all their data in China. South Korea has no scope on territory for their PIPA, but it's hard to tell if this applied to their 2011 legislation or just their 2020 legislation as these laws obviously aren't in English. Many newer laws are modelled after the GDPR and also have no scope on territory, e.g., Brazil, California, Russia, etc. There's other more general examples too. Many countries criminalise taking drugs, and evidence that you've taken drugs in the past can lead to you being deported. Consumer protection laws are generally pretty strong and banks will side with consumers in issuing charge backs. Anecdotally, Steam had a no refund policy for the longest time and support staff would berate you for asking for a refund for a game that doesn't work, but they still issued refunds and now have a refund policy (even if it doesn't fully comply with local laws). America regulates exporting arms, which caused a lot of drama in the Linux scene in the early 2000s when encryption was (still is?) considered munition. Doing commerce with embargoed or sanctioned countries can land you in hot water too, it might make sense for 'bad guy' countries like China, Russia, Iran, etc, but the US and Israel stand alone in defending the embargo on Cuba. Many countries have restrictions on freedom of speech, it might not be the best idea to travel to Turkey if you publicly criticise Erdoğan. Etc. -- None of this is to say that I agree with what the EU is doing, or that these examples are 1:1 parallels, but I think the attitude of 'these laws don't/shouldn't affect me' is naive at best, unless you plan on never leaving or doing business outside of your own country.