4 ms·

is there a explainer of what the legislation is supposed to do and how does it harm foss? i have had trouble with understanding the push for EVERYONE doing htt

is there a explainer of what the legislation is supposed to do and how does it harm foss? i have had trouble with understanding the push for EVERYONE doing https even in localhost because "security". boo. i live in a place where by law ISPs need to have DPI. they can access any communication regardless of SSL or https or anything in between so why should i bother with the added nonsense of "much security" when it is not supposed to even work? i understand there are attempts to make https to be as transparent when it works but why should that not be restricted to banking transactions or login pages and payment links? again, DPI. now this cyber resillience act which i am assuming wants to "security". what kind of security?

pseudotrash 3y ago
This post by the The Apache Software Foundation is fairly complete: > And what makes matters worse is that the type of open source organizations most affected are also exactly those that, today, tend to have very mature security processes, with vulnerabilities getting triaged, fixed, and disclosed responsibly with CVEs to match. While it generally is further downstream; with the companies that place the product on the market — that the CRA needs to drive significant improvement. It now risks doing the reverse. But all organizations (ECLIPSE, LINUX, ...) raised alarms https://news.apache.org/foundation/entry/save-open-source-the-impending-tragedy-of-the-cyber-resilience-act https://news.apache.org/foundation/entry/save-open-source-th... Edit: https://nitter.kavin.rocks/search?f=tweets&q=cyber+Resilience+act&since=&until=&near= https://nitter.kavin.rocks/search?f=tweets&q=cyber+Resilienc...
- raverbashing 3y ago
  Very good description, and if the protections from OSS are not enough I expect more noise in the next weeks/months > There is of course an elephant in the room: the well-oiled mechanism that “The internet treats censorship as a malfunction and routes around it” (John Perry Barlow). The parliament position reads: > Only free and open-source software made available on the market in the course of a commercial activity should be covered by this Regulation > Whether a free and open- source product has been made available as part of a commercial activity should be assessed on a product-by-product basis, looking at both the development model and the supply phase of the free and open-source product with digital elements. > (10a) For example, a fully decentralised development model, where no single commercial entity exercises control over what is accepted into the project’s code base, should be taken as an indication that the product has been developed in a non-commercial setting.
- fsflover 3y ago
  The corresponding HN submission: https://news.ycombinator.com/item?id=36783445 https://news.ycombinator.com/item?id=36783445
unmole 3y ago
> i live in a place where by law ISPs need to have DPI. Which law? I know ISPs in India are mandated to record session information but I haven't heard of DPI being mandatory. > they can access any communication regardless of SSL or https or anything in between No, DPI can't magically break encryption. Your ISP can't access encrypted content.
- autoexec 3y ago
  > No, DPI can't magically break encryption. Your ISP can't access encrypted content. they can if they require you to install a certificate and they man in the middle everything.
  - unmole 3y ago
    > they can if they require you to install a certificate and they man in the middle everything. Not exactly relevant because no ISP outside Kazakhstan is doing that.
    - mistrial9 3y ago
      you should ask before making that statement -- I suspect you will be surprised at the answers
  - Dah00n 3y ago
    I don't know how the US ISPs run things but this doesn't happen in the EU.
    - hellojesus 3y ago
      Nobody in the US would comply with forced root CAs. It breaks 4A.
      - autoexec 3y ago
        And nobody in the US could ever break that and get away with it! Not one Single American!

pseudotrash 3y ago

This post by the The Apache Software Foundation is fairly complete: > And what makes matters worse is that the type of open source organizations most affected are also exactly those that, today, tend to have very mature security processes, with vulnerabilities getting triaged, fixed, and disclosed responsibly with CVEs to match. While it generally is further downstream; with the companies that place the product on the market — that the CRA needs to drive significant improvement. It now risks doing the reverse. But all organizations (ECLIPSE, LINUX, ...) raised alarms https://news.apache.org/foundation/entry/save-open-source-the-impending-tragedy-of-the-cyber-resilience-act https://news.apache.org/foundation/entry/save-open-source-th... Edit: https://nitter.kavin.rocks/search?f=tweets&q=cyber+Resilience+act&since=&until=&near= https://nitter.kavin.rocks/search?f=tweets&q=cyber+Resilienc...

raverbashing 3y ago
Very good description, and if the protections from OSS are not enough I expect more noise in the next weeks/months > There is of course an elephant in the room: the well-oiled mechanism that “The internet treats censorship as a malfunction and routes around it” (John Perry Barlow). The parliament position reads: > Only free and open-source software made available on the market in the course of a commercial activity should be covered by this Regulation > Whether a free and open- source product has been made available as part of a commercial activity should be assessed on a product-by-product basis, looking at both the development model and the supply phase of the free and open-source product with digital elements. > (10a) For example, a fully decentralised development model, where no single commercial entity exercises control over what is accepted into the project’s code base, should be taken as an indication that the product has been developed in a non-commercial setting.
fsflover 3y ago
The corresponding HN submission: https://news.ycombinator.com/item?id=36783445 https://news.ycombinator.com/item?id=36783445

unmole 3y ago

> i live in a place where by law ISPs need to have DPI. Which law? I know ISPs in India are mandated to record session information but I haven't heard of DPI being mandatory. > they can access any communication regardless of SSL or https or anything in between No, DPI can't magically break encryption. Your ISP can't access encrypted content.

autoexec 3y ago
> No, DPI can't magically break encryption. Your ISP can't access encrypted content. they can if they require you to install a certificate and they man in the middle everything.
- unmole 3y ago
  > they can if they require you to install a certificate and they man in the middle everything. Not exactly relevant because no ISP outside Kazakhstan is doing that.
  - mistrial9 3y ago
    you should ask before making that statement -- I suspect you will be surprised at the answers
- Dah00n 3y ago
  I don't know how the US ISPs run things but this doesn't happen in the EU.
  - hellojesus 3y ago
    Nobody in the US would comply with forced root CAs. It breaks 4A.
    - autoexec 3y ago
      And nobody in the US could ever break that and get away with it! Not one Single American!