3 ms·

From what I can tell, it sounds like the lawmakers have the right intentions here. So I'm not too worried that this law will get passed in its current problemat

From what I can tell, it sounds like the lawmakers have the right intentions here. So I'm not too worried that this law will get passed in its current problematic state. Am I naive?

rad_gruchalski 3y ago
Are you naive? Difficult to judge. Who knows, maybe they have a good intent. The execution is bad. This will put so much legal burden on anyone who contributes AND accepts contributions. This isn't going to strengthen OSS in the EU. When this comes into effect, any company attempting to contribute back will have to answer a question: do we want to throw those devs under the legislative bus? From the other perspective: am I going to accept a contribution from anyone who may be remotely connected to any company in the EU? Well, nope. I don't want to deal with that stuff in my private time just because some EU bureaucrat decided that accepting a contribution from a corporate contributor is now legally speaking a "commercial activity". They will now hold a huge fat stick but there's no carrot. So when it's a commercial activity, can I have benefits like any other commercial entity? Say, claim VAT back?
PartiallyTyped 3y ago
My first thought in reading this is that it guts PostgreSQL and similar projects, and proprietary vendors like Oracle will make bank. Unless EU itself employs developers to contribute to OSS and ensure verification, this will only do harm.
- EMIRELADERO 3y ago
  What is it about this law that will make FOSS mantainers' lives unduly difficult? Are the requirement ridiculous? To me it just seems like they need to be more proactive and careful with publishing releases if they're aware of CVEs affecting the component.
  - PartiallyTyped 3y ago
    The problem with this law is that unless the organisation is fully decentralised, it will be considered for profit and thus need to abide by all this. It also means that companies will be reluctant to allow their employees to contribute to software as that would practically force the maintainers to abide by this which costs a lot. It also sets impossible standards like “must shop code that doesn’t have vulnerabilities”. And screws the process of dealing with exploits. Instead of informing ahead of time the authors and getting them fixed, then after 3 months issuing an announcement, you first need to inform a public organisation within hours of finding the exploit and then get the organisation to fix the bug again within hours.
nvm0n1 3y ago
Very. All laws start with good intentions (as perceived by the lawmaker). Yet, the world is full of bad law.

From what I can tell, it sounds like the lawmakers have the right intentions here. So I'm not too worried that this law will get passed in its current problematic state. Am I naive?

rad_gruchalski 3y ago

Are you naive? Difficult to judge. Who knows, maybe they have a good intent. The execution is bad. This will put so much legal burden on anyone who contributes AND accepts contributions. This isn't going to strengthen OSS in the EU. When this comes into effect, any company attempting to contribute back will have to answer a question: do we want to throw those devs under the legislative bus? From the other perspective: am I going to accept a contribution from anyone who may be remotely connected to any company in the EU? Well, nope. I don't want to deal with that stuff in my private time just because some EU bureaucrat decided that accepting a contribution from a corporate contributor is now legally speaking a "commercial activity". They will now hold a huge fat stick but there's no carrot. So when it's a commercial activity, can I have benefits like any other commercial entity? Say, claim VAT back?

PartiallyTyped 3y ago

My first thought in reading this is that it guts PostgreSQL and similar projects, and proprietary vendors like Oracle will make bank. Unless EU itself employs developers to contribute to OSS and ensure verification, this will only do harm.

EMIRELADERO 3y ago
What is it about this law that will make FOSS mantainers' lives unduly difficult? Are the requirement ridiculous? To me it just seems like they need to be more proactive and careful with publishing releases if they're aware of CVEs affecting the component.
- PartiallyTyped 3y ago
  The problem with this law is that unless the organisation is fully decentralised, it will be considered for profit and thus need to abide by all this. It also means that companies will be reluctant to allow their employees to contribute to software as that would practically force the maintainers to abide by this which costs a lot. It also sets impossible standards like “must shop code that doesn’t have vulnerabilities”. And screws the process of dealing with exploits. Instead of informing ahead of time the authors and getting them fixed, then after 3 months issuing an announcement, you first need to inform a public organisation within hours of finding the exploit and then get the organisation to fix the bug again within hours.

nvm0n1 3y ago

Very. All laws start with good intentions (as perceived by the lawmaker). Yet, the world is full of bad law.