4 ms·

What's stopping Rocky Linux from stating that its products are not certified for usage in Europe and having a third party that specializes in certification hand

What's stopping Rocky Linux from stating that its products are not certified for usage in Europe and having a third party that specializes in certification handle that aspect for a percentage of revenue from support contracts for European markets with the net effect being that near zero such foundations end up based in Europe and European companies experience it as licenses being 10% more expensive with smaller set products available. For open source libraries which presently are 100% free have the certification company charge companies who want to use those libraries to audit and certify them and pass a substantial amount of the cost on to the authors of those libraries.

rad_gruchalski 3y ago
If the legislator is so concerned that some random open source project with enough luck to become a foundation of something the EU relies on may be used to weaken its security... then why not just ... I don't know ... not use it and develop their own? It doesn't fit in my brain.
- michaelmrose 3y ago
  >---------------------------------------------------- The current CRA text only excludes OSS software that has no commercial activity around it. Unfortunately, it defines commercial activity in part, this way: “where the main contributors to free and open-source projects are developers employed by commercial entities and when such developers or the employer can exercise control as to which modifications are accepted in the code base, the project should generally be considered to be of a commercial nature.” This can be read to mean that if the main contributors are not unemployed, then the project is commercially tainted. >---------------------------------------------------- It applies not just to foundations and companies but basically all software created or distributed within the EU so basically all software created by professional developers even outside of their employment. Where the creator is beyond the reach of the EU the onus doesn't cease to exist it just falls on the company to certify as part of their due diligence for their product and this doesn't even make that version of that software or library itself certified out of scope of that usage so all non-certified software would need to be verified once per work unless someone stands up an entity to provide a certified version of whatever. For open source software you are asking companies to write or buy their own everything. The most reasonable scenario is probably European developers using a limited palette of software versions behind the US wherein in many cases the have to pay a European maintainer who pays the cheapest offshore labor it can find to give its rubber stamping of security a thin veneer of respectability while contributing nothing back to the people who write the software. What it logically needs is a requirement that such labor come from the EU and a portion go back to the source project. We can call it the FULL EMPLOYMENT for EUROPEAN DEVS MAINTAINERS and ENGINEERS aka FEEDME In this fantasy land non-europeans would register for their portion of the money.

rad_gruchalski 3y ago

If the legislator is so concerned that some random open source project with enough luck to become a foundation of something the EU relies on may be used to weaken its security... then why not just ... I don't know ... not use it and develop their own? It doesn't fit in my brain.

michaelmrose 3y ago
>---------------------------------------------------- The current CRA text only excludes OSS software that has no commercial activity around it. Unfortunately, it defines commercial activity in part, this way: “where the main contributors to free and open-source projects are developers employed by commercial entities and when such developers or the employer can exercise control as to which modifications are accepted in the code base, the project should generally be considered to be of a commercial nature.” This can be read to mean that if the main contributors are not unemployed, then the project is commercially tainted. >---------------------------------------------------- It applies not just to foundations and companies but basically all software created or distributed within the EU so basically all software created by professional developers even outside of their employment. Where the creator is beyond the reach of the EU the onus doesn't cease to exist it just falls on the company to certify as part of their due diligence for their product and this doesn't even make that version of that software or library itself certified out of scope of that usage so all non-certified software would need to be verified once per work unless someone stands up an entity to provide a certified version of whatever. For open source software you are asking companies to write or buy their own everything. The most reasonable scenario is probably European developers using a limited palette of software versions behind the US wherein in many cases the have to pay a European maintainer who pays the cheapest offshore labor it can find to give its rubber stamping of security a thin veneer of respectability while contributing nothing back to the people who write the software. What it logically needs is a requirement that such labor come from the EU and a portion go back to the source project. We can call it the FULL EMPLOYMENT for EUROPEAN DEVS MAINTAINERS and ENGINEERS aka FEEDME In this fantasy land non-europeans would register for their portion of the money.