3 ms·

This post by the The Apache Software Foundation is fairly complete: > And what makes matters worse is that the type of open source organizations most affected

This post by the The Apache Software Foundation is fairly complete: > And what makes matters worse is that the type of open source organizations most affected are also exactly those that, today, tend to have very mature security processes, with vulnerabilities getting triaged, fixed, and disclosed responsibly with CVEs to match. While it generally is further downstream; with the companies that place the product on the market — that the CRA needs to drive significant improvement. It now risks doing the reverse. But all organizations (ECLIPSE, LINUX, ...) raised alarms https://news.apache.org/foundation/entry/save-open-source-the-impending-tragedy-of-the-cyber-resilience-act https://news.apache.org/foundation/entry/save-open-source-th... Edit: https://nitter.kavin.rocks/search?f=tweets&q=cyber+Resilience+act&since=&until=&near= https://nitter.kavin.rocks/search?f=tweets&q=cyber+Resilienc...

raverbashing 3y ago
Very good description, and if the protections from OSS are not enough I expect more noise in the next weeks/months > There is of course an elephant in the room: the well-oiled mechanism that “The internet treats censorship as a malfunction and routes around it” (John Perry Barlow). The parliament position reads: > Only free and open-source software made available on the market in the course of a commercial activity should be covered by this Regulation > Whether a free and open- source product has been made available as part of a commercial activity should be assessed on a product-by-product basis, looking at both the development model and the supply phase of the free and open-source product with digital elements. > (10a) For example, a fully decentralised development model, where no single commercial entity exercises control over what is accepted into the project’s code base, should be taken as an indication that the product has been developed in a non-commercial setting.
fsflover 3y ago
The corresponding HN submission: https://news.ycombinator.com/item?id=36783445 https://news.ycombinator.com/item?id=36783445

raverbashing 3y ago

Very good description, and if the protections from OSS are not enough I expect more noise in the next weeks/months > There is of course an elephant in the room: the well-oiled mechanism that “The internet treats censorship as a malfunction and routes around it” (John Perry Barlow). The parliament position reads: > Only free and open-source software made available on the market in the course of a commercial activity should be covered by this Regulation > Whether a free and open- source product has been made available as part of a commercial activity should be assessed on a product-by-product basis, looking at both the development model and the supply phase of the free and open-source product with digital elements. > (10a) For example, a fully decentralised development model, where no single commercial entity exercises control over what is accepted into the project’s code base, should be taken as an indication that the product has been developed in a non-commercial setting.

fsflover 3y ago

The corresponding HN submission: https://news.ycombinator.com/item?id=36783445 https://news.ycombinator.com/item?id=36783445