8 ms·

This is fearmongering. As others have mentioned, it hinges on whether offering open source software on GitHub is considered a product in the sense of the law. T

This is fearmongering. As others have mentioned, it hinges on whether offering open source software on GitHub is considered a product in the sense of the law. The details are probably up for courts to decide, and despite what we like to think, they are not completely stupid. The law is not geared towards "just putting some software on a server and calling it open source" which is what most projects do. It is geared as far as I understand towards bad IOT devices, among others. People sell them and know outright that there are existing vulnerabilities, and that rightfully should be illegal. I think (maybe after some adjustments) this will be a boon to open source. Because every company shipping a program or a physical product with some GPL or MIT source inside will now be forced to bring it up to good quality before making money out of it. And at least in case of GPL, it is likely it will be contributed back to upstream. (I personally prefer upstreaming all open source code even when not required to share it, because you don't have the burden of maintaining a fork, and you have a better relationship with the developers in case you need to incorporate new features.)

kevincox 3y ago
> The details are probably up for courts to decide As someone with lots of software publicly available with permissive licenses I absolutely do not want to participate in letting the "courts decide". If this was going through I would be strongly considering adding a banner saying that this software is not for EU consumers with the alternative being denying the fact that I am aware that EU people were using the software. I am happy to provide my software as-is with no warranty. But if there is a chance that I am somehow on the hook for any guarantees about that software I'm out. It is just too much risk for very little gain.
- 908B64B197 3y ago
  > I would be strongly considering adding a banner saying that this software is not for EU consumers This should be incorporated in the license. The alternative would be a (paid) support contract for EU customers.
  - jeroenhd 3y ago
    A paid support contract would put you outside of the exception for open source software. That's probably the exact opposite of what you want. If you're just making your code available for no charge and not selling the product, the obligations don't even apply under the current proposal.
    - 908B64B197 3y ago
      > If you're just making your code available for no charge and not selling the product, the obligations don't even apply under the current proposal. Sadly, we'll have to wait for the courts to settle the first cases.
  - denton-scratch 3y ago
    > The alternative would be a (paid) support contract for EU customers. I imagine such a contract would be fabulously expensive. Typically, FLOSS software with support contracts is for relatively complex software; the organisation offering support is often not the organisation that develops it. If offering support on FLOSS software exposes you to legal liability, then you need insurance, and insurers aren't going to have the expertise to price the risk. So premiums will be top-dollar. I think the (misguided) intention is to strongly favour commercial software production over one-man-and-his-dog FLOSS developers.
- jeroenhd 3y ago
  Are you selling that software in the EU or are you merely making it available? Because there an exception for free and open source software and the EU can't regulate the business you do outside of the EU. If you're selling support licenses to the EU for your open source software then you're on the hook for patching them, but you'd probably already be for other reasons.
  - kevincox 3y ago
    In my case I am not selling, only making it available. If selling I am happy to consider their needs and my legal obligations (for the right price). But as the grandparent states we are talking about just making free software available: > it hinges on whether offering open source software on GitHub is considered a product in the sense of the law.
    - jeroenhd 3y ago
      From the context of the rest of the law it seems pretty obvious to me that just making your code available doesn't turn it into a product. I don't know why people assume it does. I assume Github and friends are much more concerned with being on the hook for selling these products (i.e. through Copilot). Github does sell you software that happens to make open source code available, and that seems like a much more vague situation.
  - unity1001 3y ago
    > Are you selling that software in the EU or are you merely making it available? What difference does it make... If small developers and software businesses risk thousands of euros of fines, decided arbitrarily by the courts based on civil minimum and maximum limits, open source and small software in the Eu will die and the only ones to benefit from this will be the larger software companies that can afford the fines - who will be scooping up all the users of these open source projects and small developers - like the German software businesses who back the current German government and the German contingent in Euparl. Note how the draft is designed to exclude the software that these major software companies are mooching off of - like Linux. Its basically exclude what you benefit from, kill who eat into your profit margins and be happy - total American corporate style legislation...
unity1001 3y ago
> I think (maybe after some adjustments) this will be a boon to open source How can arbitrary fines that will be decided by the judge and that can reach up to hundreds of thousands of euros from a few thousand euros per violation be a boon to open source... Open source already has a problem funding itself. The funding comes from major corporate donors, who naturally decide the direction of the large projects they fund. The only Open source segment that successfully funds itself through its community members, users is WordPress, which remained free of corporate domination for a very long time as a result. With this law, any small time open source software producer and any small time private software producer risk themselves and their livelihood for producing software, based on ambiguous rules. Which would make it very difficult and risky for small time projects or companies to produce software in Europe, and as a result benefit the big companies that can actually afford those fines. This looks like a law crafted by the large German software business that currently dominates the German govt. and Euparl to hamper small time software for their own benefit. When the small open source projects and private software developers close up shop, the software and SaaS of these large businesses will scoop up their users. To the contrary of being a boon to Open source, this may be the biggest, most well-coordinated attack against Open source in decades...
- anthk 3y ago
  European here. If German SAP companies want to bankrupt themselves because of global cuts on ties on FLOSS, where almost every component has some dependency on these in one way or another, that's ok. Look what happened to the Amiga, and former propietary software companies with in-home rewritting refusing to co-operate with standards. If they want to be the next idio... dumb CEO's trying to not be lynched form the share holders, I'm totally fine. They... won't.
  - unity1001 3y ago
    > European here. If German SAP companies want to bankrupt themselves because of global cuts on ties on FLOSS, where almost every component has some dependency on these in one way or another, that's ok. Note how the legislation is drafted to exclude the large open source projects that these companies mooch off of - like Linux. Both the large software companies and the projects that they sponsor can afford the fines. But smaller software producers and open source projects that fund themselves through their users cant. So basically the law will kill smaller software producers and let the larger ones scoop everyone into their profitable SaaSes and installable software...
veeti 3y ago
> despite what we like to think, they are not completely stupid. Have you ever seen the decisions made by boomer judges in bumfuck German courts? What a dream for troll litigators. https://www.quad9.net/news/press/quad9-s-opinion-of-the-recent-court-ruling-in-leipzig/ https://www.quad9.net/news/press/quad9-s-opinion-of-the-rece...

kevincox 3y ago

> The details are probably up for courts to decide As someone with lots of software publicly available with permissive licenses I absolutely do not want to participate in letting the "courts decide". If this was going through I would be strongly considering adding a banner saying that this software is not for EU consumers with the alternative being denying the fact that I am aware that EU people were using the software. I am happy to provide my software as-is with no warranty. But if there is a chance that I am somehow on the hook for any guarantees about that software I'm out. It is just too much risk for very little gain.

908B64B197 3y ago
> I would be strongly considering adding a banner saying that this software is not for EU consumers This should be incorporated in the license. The alternative would be a (paid) support contract for EU customers.
- jeroenhd 3y ago
  A paid support contract would put you outside of the exception for open source software. That's probably the exact opposite of what you want. If you're just making your code available for no charge and not selling the product, the obligations don't even apply under the current proposal.
  - 908B64B197 3y ago
    > If you're just making your code available for no charge and not selling the product, the obligations don't even apply under the current proposal. Sadly, we'll have to wait for the courts to settle the first cases.
- denton-scratch 3y ago
  > The alternative would be a (paid) support contract for EU customers. I imagine such a contract would be fabulously expensive. Typically, FLOSS software with support contracts is for relatively complex software; the organisation offering support is often not the organisation that develops it. If offering support on FLOSS software exposes you to legal liability, then you need insurance, and insurers aren't going to have the expertise to price the risk. So premiums will be top-dollar. I think the (misguided) intention is to strongly favour commercial software production over one-man-and-his-dog FLOSS developers.
jeroenhd 3y ago
Are you selling that software in the EU or are you merely making it available? Because there an exception for free and open source software and the EU can't regulate the business you do outside of the EU. If you're selling support licenses to the EU for your open source software then you're on the hook for patching them, but you'd probably already be for other reasons.
- kevincox 3y ago
  In my case I am not selling, only making it available. If selling I am happy to consider their needs and my legal obligations (for the right price). But as the grandparent states we are talking about just making free software available: > it hinges on whether offering open source software on GitHub is considered a product in the sense of the law.
  - jeroenhd 3y ago
    From the context of the rest of the law it seems pretty obvious to me that just making your code available doesn't turn it into a product. I don't know why people assume it does. I assume Github and friends are much more concerned with being on the hook for selling these products (i.e. through Copilot). Github does sell you software that happens to make open source code available, and that seems like a much more vague situation.
- unity1001 3y ago
  > Are you selling that software in the EU or are you merely making it available? What difference does it make... If small developers and software businesses risk thousands of euros of fines, decided arbitrarily by the courts based on civil minimum and maximum limits, open source and small software in the Eu will die and the only ones to benefit from this will be the larger software companies that can afford the fines - who will be scooping up all the users of these open source projects and small developers - like the German software businesses who back the current German government and the German contingent in Euparl. Note how the draft is designed to exclude the software that these major software companies are mooching off of - like Linux. Its basically exclude what you benefit from, kill who eat into your profit margins and be happy - total American corporate style legislation...

unity1001 3y ago

> I think (maybe after some adjustments) this will be a boon to open source How can arbitrary fines that will be decided by the judge and that can reach up to hundreds of thousands of euros from a few thousand euros per violation be a boon to open source... Open source already has a problem funding itself. The funding comes from major corporate donors, who naturally decide the direction of the large projects they fund. The only Open source segment that successfully funds itself through its community members, users is WordPress, which remained free of corporate domination for a very long time as a result. With this law, any small time open source software producer and any small time private software producer risk themselves and their livelihood for producing software, based on ambiguous rules. Which would make it very difficult and risky for small time projects or companies to produce software in Europe, and as a result benefit the big companies that can actually afford those fines. This looks like a law crafted by the large German software business that currently dominates the German govt. and Euparl to hamper small time software for their own benefit. When the small open source projects and private software developers close up shop, the software and SaaS of these large businesses will scoop up their users. To the contrary of being a boon to Open source, this may be the biggest, most well-coordinated attack against Open source in decades...

anthk 3y ago
European here. If German SAP companies want to bankrupt themselves because of global cuts on ties on FLOSS, where almost every component has some dependency on these in one way or another, that's ok. Look what happened to the Amiga, and former propietary software companies with in-home rewritting refusing to co-operate with standards. If they want to be the next idio... dumb CEO's trying to not be lynched form the share holders, I'm totally fine. They... won't.
- unity1001 3y ago
  > European here. If German SAP companies want to bankrupt themselves because of global cuts on ties on FLOSS, where almost every component has some dependency on these in one way or another, that's ok. Note how the legislation is drafted to exclude the large open source projects that these companies mooch off of - like Linux. Both the large software companies and the projects that they sponsor can afford the fines. But smaller software producers and open source projects that fund themselves through their users cant. So basically the law will kill smaller software producers and let the larger ones scoop everyone into their profitable SaaSes and installable software...

veeti 3y ago

> despite what we like to think, they are not completely stupid. Have you ever seen the decisions made by boomer judges in bumfuck German courts? What a dream for troll litigators. https://www.quad9.net/news/press/quad9-s-opinion-of-the-recent-court-ruling-in-leipzig/ https://www.quad9.net/news/press/quad9-s-opinion-of-the-rece...