3 ms·

I find the criteria for inclusion a bit weird: why would any given project should be the object of regulation? The way I see it, they should rather focus on the

I find the criteria for inclusion a bit weird: why would any given project should be the object of regulation? The way I see it, they should rather focus on the transaction. Products aren’t commercial by themselves. Selling them is. Distributing the thing for free? Not commercial. Selling support? Commercial, you must provide guarantees even if upstream does not. Selling something that uses non-commercial FOSS software under the hood? Commercial again, even if upstream is not. Receiving donations? Shouldn’t matter as far as I can tell. That being said, I can see donations being used as a loophole to bypass regulation. Maybe they’re trying to close that loophole.

sam_lowry_ 3y ago
You give EU bureaucrats too much credit. Incompetence, lack of involvement and a general feeling of doing fake work reign there.
mordae 3y ago
> I find the criteria for inclusion a bit weird: why would any given project should be the object of regulation? The way I see it, they should rather focus on the transaction. I asked them directly. There is no direct reason whatsoever. They just rushed it and fucked up. Nobody ever thought about FLOSS besides vaguely excluding it in the "noncommercial" way. There were more landmines in the original draft. Like the requirement for any known-vulnerable device not be put on the market. Well guess what? All those phones and laptops sitting on the shelves are having exploits discovered every month. Red Hat chimed in; apparently they have potential vulnerabilities on containers they publish sometimes in 15 minutes. Potential. How exactly are they supposed to act? The legislation just plain sucked and now it's being "fixed" behind closed doors.
- tremon 3y ago
  I'm pretty sure at least some of the lobbyists who wrote this were aware of the negative effects on FLOSS software.
  - Vuizur 3y ago
    The head of the Eclipse foundation said that they are aware, but that they thought that it would be too expensive for small businesses to get the verification. So the open source devs should do it for free. Related timestamp: https://youtu.be/AmsM5_5QO5A?t=1528 https://youtu.be/AmsM5_5QO5A?t=1528
smarx007 3y ago
The reason is to make sure that all software that a normal run-the-mill business may use in the "in the course of a commercial activity" and receives regular releases, is reasonably free from known significant vulnerabilities (the last release, at least). Would it be reasonable to use Nginx "in the course of a commercial activity"? Yes, it would. Thus, EU wants to ensure that if you as an SME install Nginx and keep it updated, it's reasonably free from CVEs (e.g. that Nginx Plus does not contain CVE fixes that were not released in the latest versions of the OSS version of Nginx). Bottom line: the criteria is written from the viewpoint of a software user, not the developer or vendor.
- Veserv 3y ago
  Does Nginx assert it is fit for commercial activity? If it does, then yes they should be required to meet their promises and keep it fit for commercial purposes. If it does not, then why the hell are you using it for commercial purposes? They told you it is not fit for that purpose. You do not get to demand they meet your needs because it is convenient for you cheap out by using inadequate dependencys.
  - smarx007 3y ago
    As I wrote elsewhere in the thread, if EU didn't word it the way they did, most OSS projects would simply slap "not fit for commercial purposes" in the README next day after CRA became law with a smug smile. Regarding "cheaping out", I expect EU businesses to begin demanding that every dependency in their SBOM is CRA-compliant in some due time. This will most likely mean paying money. But I disagree on "by using inadequate dependencys": how do you expect a pizza shop owner to think that installing Ubuntu LTS and running "apt-get update && apt-get install nginx && apt-get upgrade" or a latest version of Chrome is somehow inadequate?
    - Veserv 3y ago
      I agree they would slap “not fit for commercial purposes” since they did not sign up for this. I also agree the EU businesses would start requiring it which means they would not be allowed to use software that smugly slapped it into their README. If developers actually want commercial users then they need to meet the standards. If they are hobbyists or do not care to support those use cases, then they do not need to do that. Any business still using the software that asserts it is not fit for commercial purposes is then clearly using inadequate dependencys. The developers said it was unfit or did not want to bother with it; so this is a perfectly true and proper characterization.
Veserv 3y ago
Exactly this. To extend this further, the requirement should actually be on the receiver of the transaction to verify their dependencys are fit for purpose either by consuming a guarantee from upstream or by providing the guarantee if upstream does not. This is what literally every other industry does. They vet that their dependencys meet their requirements. It is literally ridiculous that this most basic of practices is still not standard in software development. It is insane to burden OSS developers by requiring them to assert commercial guarantees because the lazy bums who want to use their software for free can not even be bothered to check if it actually meets their needs.
thayne 3y ago
That would probably be better at providing funding for OSS. For projects that aren't backed by a company that sells support, customers could pay a third party company like Red Hat, Canonical, Tidelift, Collabora, etc. to certify the security of dependencies.
- smarx007 3y ago
  Isn't Tidelift a bit of a joke? https://tidelift.com/lifter/search/npm/d3 https://tidelift.com/lifter/search/npm/d3 offers $25/mo. https://tidelift.com/lifter/search/maven/org.apache.jena:apache-jena https://tidelift.com/lifter/search/maven/org.apache.jena:apa... is not covered despite being an Apache project with 1k stars and quite a lively mailing list with some corp users.

sam_lowry_ 3y ago

You give EU bureaucrats too much credit. Incompetence, lack of involvement and a general feeling of doing fake work reign there.

mordae 3y ago

> I find the criteria for inclusion a bit weird: why would any given project should be the object of regulation? The way I see it, they should rather focus on the transaction. I asked them directly. There is no direct reason whatsoever. They just rushed it and fucked up. Nobody ever thought about FLOSS besides vaguely excluding it in the "noncommercial" way. There were more landmines in the original draft. Like the requirement for any known-vulnerable device not be put on the market. Well guess what? All those phones and laptops sitting on the shelves are having exploits discovered every month. Red Hat chimed in; apparently they have potential vulnerabilities on containers they publish sometimes in 15 minutes. Potential. How exactly are they supposed to act? The legislation just plain sucked and now it's being "fixed" behind closed doors.

tremon 3y ago
I'm pretty sure at least some of the lobbyists who wrote this were aware of the negative effects on FLOSS software.
- Vuizur 3y ago
  The head of the Eclipse foundation said that they are aware, but that they thought that it would be too expensive for small businesses to get the verification. So the open source devs should do it for free. Related timestamp: https://youtu.be/AmsM5_5QO5A?t=1528 https://youtu.be/AmsM5_5QO5A?t=1528

smarx007 3y ago

The reason is to make sure that all software that a normal run-the-mill business may use in the "in the course of a commercial activity" and receives regular releases, is reasonably free from known significant vulnerabilities (the last release, at least). Would it be reasonable to use Nginx "in the course of a commercial activity"? Yes, it would. Thus, EU wants to ensure that if you as an SME install Nginx and keep it updated, it's reasonably free from CVEs (e.g. that Nginx Plus does not contain CVE fixes that were not released in the latest versions of the OSS version of Nginx). Bottom line: the criteria is written from the viewpoint of a software user, not the developer or vendor.

Veserv 3y ago
Does Nginx assert it is fit for commercial activity? If it does, then yes they should be required to meet their promises and keep it fit for commercial purposes. If it does not, then why the hell are you using it for commercial purposes? They told you it is not fit for that purpose. You do not get to demand they meet your needs because it is convenient for you cheap out by using inadequate dependencys.
- smarx007 3y ago
  As I wrote elsewhere in the thread, if EU didn't word it the way they did, most OSS projects would simply slap "not fit for commercial purposes" in the README next day after CRA became law with a smug smile. Regarding "cheaping out", I expect EU businesses to begin demanding that every dependency in their SBOM is CRA-compliant in some due time. This will most likely mean paying money. But I disagree on "by using inadequate dependencys": how do you expect a pizza shop owner to think that installing Ubuntu LTS and running "apt-get update && apt-get install nginx && apt-get upgrade" or a latest version of Chrome is somehow inadequate?
  - Veserv 3y ago
    I agree they would slap “not fit for commercial purposes” since they did not sign up for this. I also agree the EU businesses would start requiring it which means they would not be allowed to use software that smugly slapped it into their README. If developers actually want commercial users then they need to meet the standards. If they are hobbyists or do not care to support those use cases, then they do not need to do that. Any business still using the software that asserts it is not fit for commercial purposes is then clearly using inadequate dependencys. The developers said it was unfit or did not want to bother with it; so this is a perfectly true and proper characterization.

Veserv 3y ago

Exactly this. To extend this further, the requirement should actually be on the receiver of the transaction to verify their dependencys are fit for purpose either by consuming a guarantee from upstream or by providing the guarantee if upstream does not. This is what literally every other industry does. They vet that their dependencys meet their requirements. It is literally ridiculous that this most basic of practices is still not standard in software development. It is insane to burden OSS developers by requiring them to assert commercial guarantees because the lazy bums who want to use their software for free can not even be bothered to check if it actually meets their needs.

thayne 3y ago

That would probably be better at providing funding for OSS. For projects that aren't backed by a company that sells support, customers could pay a third party company like Red Hat, Canonical, Tidelift, Collabora, etc. to certify the security of dependencies.

smarx007 3y ago
Isn't Tidelift a bit of a joke? https://tidelift.com/lifter/search/npm/d3 https://tidelift.com/lifter/search/npm/d3 offers $25/mo. https://tidelift.com/lifter/search/maven/org.apache.jena:apache-jena https://tidelift.com/lifter/search/maven/org.apache.jena:apa... is not covered despite being an Apache project with 1k stars and quite a lively mailing list with some corp users.