4 ms·

The reason is to make sure that all software that a normal run-the-mill business may use in the "in the course of a commercial activity" and receives regular re

The reason is to make sure that all software that a normal run-the-mill business may use in the "in the course of a commercial activity" and receives regular releases, is reasonably free from known significant vulnerabilities (the last release, at least). Would it be reasonable to use Nginx "in the course of a commercial activity"? Yes, it would. Thus, EU wants to ensure that if you as an SME install Nginx and keep it updated, it's reasonably free from CVEs (e.g. that Nginx Plus does not contain CVE fixes that were not released in the latest versions of the OSS version of Nginx). Bottom line: the criteria is written from the viewpoint of a software user, not the developer or vendor.

Veserv 3y ago
Does Nginx assert it is fit for commercial activity? If it does, then yes they should be required to meet their promises and keep it fit for commercial purposes. If it does not, then why the hell are you using it for commercial purposes? They told you it is not fit for that purpose. You do not get to demand they meet your needs because it is convenient for you cheap out by using inadequate dependencys.
- smarx007 3y ago
  As I wrote elsewhere in the thread, if EU didn't word it the way they did, most OSS projects would simply slap "not fit for commercial purposes" in the README next day after CRA became law with a smug smile. Regarding "cheaping out", I expect EU businesses to begin demanding that every dependency in their SBOM is CRA-compliant in some due time. This will most likely mean paying money. But I disagree on "by using inadequate dependencys": how do you expect a pizza shop owner to think that installing Ubuntu LTS and running "apt-get update && apt-get install nginx && apt-get upgrade" or a latest version of Chrome is somehow inadequate?
  - Veserv 3y ago
    I agree they would slap “not fit for commercial purposes” since they did not sign up for this. I also agree the EU businesses would start requiring it which means they would not be allowed to use software that smugly slapped it into their README. If developers actually want commercial users then they need to meet the standards. If they are hobbyists or do not care to support those use cases, then they do not need to do that. Any business still using the software that asserts it is not fit for commercial purposes is then clearly using inadequate dependencys. The developers said it was unfit or did not want to bother with it; so this is a perfectly true and proper characterization.
  - marcinzm 3y ago
    >As I wrote elsewhere in the thread, if EU didn't word it the way they did, most OSS projects would simply slap "not fit for commercial purposes" in the README next day after CRA became law with a smug smile. So? Seems an amazingly cut and dry case for the EU to go after any business using software with that clause (directly or indirectly). Isn't that exactly the goal here? To prevent businesses from using this software? If that is achieved why do you act like this is a bad outcome? Why do you act like punishing open source projects is the goal versus preventing commercial use of unsafe software? If businesses require some non-compliant OSS then they can pay for maintenance and compliance to make it compliant which would be a boon for OSS support.
    - smarx007 3y ago
      The goal of the EU is not to "go after any business", but instead to help them stay secure online (I know, people outside EU find it hard to believe that EU makes regulations to actually help people). EU considered various ways (see Section 3 "RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS" of the Memo that precedes the regulation text) but concluded that putting the burden on users to check the software (and all transitive dependencies) is secure and is fit for commercial use is too big. This is also consistent with the regulations on construction experts to make sure bridges are safe and on doctors to make sure the prescribed meds are relatively safe to take, instead of putting the burden on pedestrians and patients. I hope you'd agree that we'd all be laughing right now if EU instead mandated businesses to use only commercial-grade software, joking about how are they going to run cloud VMs without the Linux kernel, GCC etc. EU fully understands that the world of software is thoroughly built on OSS, whether we like it or not. It's also not a secret that many companies rely on OSS as a springboard for adoption, e.g. MongoDB. EU does not want to allow Mongo the company to avoid compliance merely by saying that their product is open-source(ish). And by the way, the regulation would require software to come with a secure by default configuration (page 2 of https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-34e9-11ed-9c68-01aa75ed71a1.0001.02/DOC_2&format=PDF https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-... ), wink wink ( https://snyk.io/blog/mongodb-hack-and-secure-defaults/ https://snyk.io/blog/mongodb-hack-and-secure-defaults/ ).
  - megous 3y ago
    > As I wrote elsewhere in the thread, if EU didn't word it the way they did, most OSS projects would simply slap "not fit for commercial purposes" in the README next day... Pretty much all software already has this in the license/EULA since forever. It's just worded slightly differently as "there's no guarantee of fitness for any purpose" and disclaimer of all warranties.

Veserv 3y ago

Does Nginx assert it is fit for commercial activity? If it does, then yes they should be required to meet their promises and keep it fit for commercial purposes. If it does not, then why the hell are you using it for commercial purposes? They told you it is not fit for that purpose. You do not get to demand they meet your needs because it is convenient for you cheap out by using inadequate dependencys.

smarx007 3y ago
As I wrote elsewhere in the thread, if EU didn't word it the way they did, most OSS projects would simply slap "not fit for commercial purposes" in the README next day after CRA became law with a smug smile. Regarding "cheaping out", I expect EU businesses to begin demanding that every dependency in their SBOM is CRA-compliant in some due time. This will most likely mean paying money. But I disagree on "by using inadequate dependencys": how do you expect a pizza shop owner to think that installing Ubuntu LTS and running "apt-get update && apt-get install nginx && apt-get upgrade" or a latest version of Chrome is somehow inadequate?
- Veserv 3y ago
  I agree they would slap “not fit for commercial purposes” since they did not sign up for this. I also agree the EU businesses would start requiring it which means they would not be allowed to use software that smugly slapped it into their README. If developers actually want commercial users then they need to meet the standards. If they are hobbyists or do not care to support those use cases, then they do not need to do that. Any business still using the software that asserts it is not fit for commercial purposes is then clearly using inadequate dependencys. The developers said it was unfit or did not want to bother with it; so this is a perfectly true and proper characterization.
- marcinzm 3y ago
  >As I wrote elsewhere in the thread, if EU didn't word it the way they did, most OSS projects would simply slap "not fit for commercial purposes" in the README next day after CRA became law with a smug smile. So? Seems an amazingly cut and dry case for the EU to go after any business using software with that clause (directly or indirectly). Isn't that exactly the goal here? To prevent businesses from using this software? If that is achieved why do you act like this is a bad outcome? Why do you act like punishing open source projects is the goal versus preventing commercial use of unsafe software? If businesses require some non-compliant OSS then they can pay for maintenance and compliance to make it compliant which would be a boon for OSS support.
  - smarx007 3y ago
    The goal of the EU is not to "go after any business", but instead to help them stay secure online (I know, people outside EU find it hard to believe that EU makes regulations to actually help people). EU considered various ways (see Section 3 "RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS" of the Memo that precedes the regulation text) but concluded that putting the burden on users to check the software (and all transitive dependencies) is secure and is fit for commercial use is too big. This is also consistent with the regulations on construction experts to make sure bridges are safe and on doctors to make sure the prescribed meds are relatively safe to take, instead of putting the burden on pedestrians and patients. I hope you'd agree that we'd all be laughing right now if EU instead mandated businesses to use only commercial-grade software, joking about how are they going to run cloud VMs without the Linux kernel, GCC etc. EU fully understands that the world of software is thoroughly built on OSS, whether we like it or not. It's also not a secret that many companies rely on OSS as a springboard for adoption, e.g. MongoDB. EU does not want to allow Mongo the company to avoid compliance merely by saying that their product is open-source(ish). And by the way, the regulation would require software to come with a secure by default configuration (page 2 of https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-34e9-11ed-9c68-01aa75ed71a1.0001.02/DOC_2&format=PDF https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-... ), wink wink ( https://snyk.io/blog/mongodb-hack-and-secure-defaults/ https://snyk.io/blog/mongodb-hack-and-secure-defaults/ ).
- megous 3y ago
  > As I wrote elsewhere in the thread, if EU didn't word it the way they did, most OSS projects would simply slap "not fit for commercial purposes" in the README next day... Pretty much all software already has this in the license/EULA since forever. It's just worded slightly differently as "there's no guarantee of fitness for any purpose" and disclaimer of all warranties.