3 ms·

That's great, the company who wants to sell stuff in the EU pays for the audit and the bugfixes, and it benefits all. As a PM in a previous position, I would h

That's great, the company who wants to sell stuff in the EU pays for the audit and the bugfixes, and it benefits all. As a PM in a previous position, I would have loved to fix known bugs, contribute back to open source, audit things properly. But when there was no legal pressure to do so, my bosses (understandably) said: great, that software is for free, take it, don't put to much work into it, ship it. Like it or not, open source software is part of our supply chains, and if there is no incentive to maintain it properly then that's a big problem.

rad_gruchalski 3y ago
You assume that companies will share audits they conducted for free with everyone as a public service. Edit: there the other side of the coin. A single dev who wants to enter the market has an uphill battle. He is required to certify their own work, and provide audits of all dependencies. Good luck starting a business from your bedroom un such climate. If this is what people in the EU want, paraphrasing: I don’t want to live on this continent anymore.
- xoa 3y ago
  >You assume that companies will share audits they conducted for free with everyone as a public service. It depends, but in general there is significant, straightforward incentives to upstream most stuff. It makes things a lot cheaper over the long term for all involved, and particularly with security/stability and basic code hygiene there is basically never going to be any "special sauce" there where the company is getting some major additional value. It's all cost centers. So if an EU-based company audits and then needs to make some changes to a non-EU-based project, I'd assume by default they'd want all those changes upstreamed and made permanent since it'd reduce the burden going forward. Though again this is all highly speculative based on how it actually works. Also >A single dev who wants to enter the market has an uphill battle. He is required to certify their own work, and provide audits of all dependencies. Good luck starting a business from your bedroom in such climate. It is true I'm thinking of it from a non-European point of view, where it's not starting from scratch and by default it's not my problem. I'm not trying to downplay possible disincentives in those in the EU starting projects de novo. I just don't know enough about it.
  - rad_gruchalski 3y ago
    > So if an EU-based company audits and then needs to make some changes to a non-EU-based project, I'd assume by default they'd want all those changes upstreamed and made permanent since it'd reduce the burden going forward. Humans aren’t behaving logically. If a company A audited their dependencies, it doesn’t benefit them at all to “upstream” their audits because: 1) dependencies are already audited for that company and only new version has to be audited in the future, 2) holding an audit will be a competitive advantage because everyone else has to consume their resources to get audits in place, 3) “my people on my salary got those audits for me so if I had to pay for it, the others have to pay, why should I share that when I paid for it, it cost money and sweat, nobody’s getting it for free”.

rad_gruchalski 3y ago

You assume that companies will share audits they conducted for free with everyone as a public service. Edit: there the other side of the coin. A single dev who wants to enter the market has an uphill battle. He is required to certify their own work, and provide audits of all dependencies. Good luck starting a business from your bedroom un such climate. If this is what people in the EU want, paraphrasing: I don’t want to live on this continent anymore.

xoa 3y ago
>You assume that companies will share audits they conducted for free with everyone as a public service. It depends, but in general there is significant, straightforward incentives to upstream most stuff. It makes things a lot cheaper over the long term for all involved, and particularly with security/stability and basic code hygiene there is basically never going to be any "special sauce" there where the company is getting some major additional value. It's all cost centers. So if an EU-based company audits and then needs to make some changes to a non-EU-based project, I'd assume by default they'd want all those changes upstreamed and made permanent since it'd reduce the burden going forward. Though again this is all highly speculative based on how it actually works. Also >A single dev who wants to enter the market has an uphill battle. He is required to certify their own work, and provide audits of all dependencies. Good luck starting a business from your bedroom in such climate. It is true I'm thinking of it from a non-European point of view, where it's not starting from scratch and by default it's not my problem. I'm not trying to downplay possible disincentives in those in the EU starting projects de novo. I just don't know enough about it.
- rad_gruchalski 3y ago
  > So if an EU-based company audits and then needs to make some changes to a non-EU-based project, I'd assume by default they'd want all those changes upstreamed and made permanent since it'd reduce the burden going forward. Humans aren’t behaving logically. If a company A audited their dependencies, it doesn’t benefit them at all to “upstream” their audits because: 1) dependencies are already audited for that company and only new version has to be audited in the future, 2) holding an audit will be a competitive advantage because everyone else has to consume their resources to get audits in place, 3) “my people on my salary got those audits for me so if I had to pay for it, the others have to pay, why should I share that when I paid for it, it cost money and sweat, nobody’s getting it for free”.