6 ms·

This regulation is so shitty. I'm quite sure that it is supported by big actors in the end, because the end goal is to ensure to have a regulatory barrier that

This regulation is so shitty. I'm quite sure that it is supported by big actors in the end, because the end goal is to ensure to have a regulatory barrier that will avoid small actors to be able to strive in the software field. Also, to avoid "dangerous" not yet professional amateurs having a chance against big editors.

EMIRELADERO 3y ago
[flagged]
EtienneK 3y ago
This was the first question on my mind as well. How will this affect the one-man webshop owner or software developer? Seems only big established firms will be able to conform to this?
- EMIRELADERO 3y ago
  This question was asked a lot when GDPR came around, and it's essentially an implication that the regulator will act in bad faith. Courts and regulators, particularily European ones, understand when there's a "will" to follow the law. It's one of the differences between "rules-based" and "principles-based" regulations. https://news.ycombinator.com/item?id=17100541 https://news.ycombinator.com/item?id=17100541
  - EtienneK 3y ago
    I don’t understand? So you should only in principle audit your Wordpress blog?
    - EMIRELADERO 3y ago
      Read the comment I linked. It's about the regulation being enforced with its principles in mind, not robotically through its strict interpretation.
    - troupo 3y ago
      Questions: - If you run a commercial kitchen on your own (or, let's say, with a staff of 2-3 people), can you ignore the food safety regulations? The fire regulations? - If you run a one-man plumbing company, can you ignore safety regulations? Water regulations? Sewage regulations? etc. Why is it than when it comes to "commercial software" it is inevitably "oh my god these laws are so hard, why should I as one-man company be forced to comply with them". Because that is literally your job.
      - galdor 3y ago
        In kitchens as in plumbings: - There are rules, and clear established practices that allow you to follow these rules. In software the rabbit hole goes so deep that your average developer cannot even be aware of all the risks. - You do not have to rely on millions of lines of code you have no control on. As a simple example, if you are using network communications, you are probably using OpenSSL, GnuTLS or one of the few other TLS implementations. All of them have regular security issues, and simply selling support on an Open Source software you built using one of them will make you liable for these issues. There is no choice: you need TLS, and you're not going to implement it yourself. What are you supposed to do? The fact that a solo developer selling 100€/month of support is treated the same way than a billion dollar company demonstrates the complete insanity of this act.
        EMIRELADERO 3y ago
        > The fact that a solo developer selling 100€/month of support is treated the same way than a billion dollar company demonstrates the complete insanity of this act. But they're not treated the same way. Both by the law itself and the standards courts and regulatory agencies use throught Europe.
        galdor 3y ago
        The text of this act treat them the same way unless I'm missing something (feel free to point me the text saying otherwise). A sane legal text would put in place thresholds with different levels of expectations and liability depending on the size of the company, who you are selling to (companies or individuals) and its revenues, respecting the principle of proportionality.
    - arlcode 3y ago
      It means you will get treated differently whether you operate a one man show or a global conglomerate. Follow best practices and demonstrate that you care goes a long way (that has been demonstrated time and time again in courts throughout the union). Also it differentiates between what kind of product you are building (see the annexes). Most of the requirements (look them up) are best software dev practices unless you are in one of the specific "critical" categories of products. Then, to be honest I don't really care that you are a one person (commercial) shop when my car gets steered off the road because of a preventable security hole.
  - hatenberg 3y ago
    And then there’s the real world issue of Abmahn-Factories in Germany.
Lariscus 3y ago
Unless you sell critical products as described in Annex III[1] the requirements to fulfill CRA are quite harmless. It's mostly stuff you should be doing anyway like a risk assessment and documentation. An additionally requirement is to provide a conformity assessment, which you can do yourself for non critical software, and you must report vulnerabilities within 24 hours. Not too bad really. [1] https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-34e9-11ed-9c68-01aa75ed71a1.0001.02/DOC_2&format=PDF https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-...
- greatgib 3y ago
  The light is quite large and and vague.
- gustavus 3y ago
  Ya so if some kid whose 16 is messing around on his computer figures out some cool app starts publishing it and then bam the incumbents can smack him down. The regulations are designed to deepen the software moat, and security theater, and I say this as an InfoSec professional.
  - Lariscus 3y ago
    This is nonsense, because non-commercial activities are exempt from the CRAs requirements.
    - jart 3y ago
      Yes and regulation will ensure non-commercial activities stay that way. I write open source code because I love building software tools and there aren't a whole lot of opportunities to commercialize my work. I'd love it if an opportunity ever came along one day to get rich building a tool, that I could pounce on, in which case I'd love to know that I wouldn't immediately get jumped and mobbed by regulators.
      - troupo 3y ago
kossTKR 3y ago
Yeah this could be terrible unless there's very specific exceptions for sub 1mil revenue players. Lots of big players are already providing shit software to millions of customers especially through government contracts because they've hired armies of legal and sales teams, squashing the little guy in the process. If just providing some small web service built on top of open source now requires hiring a huge legal team, well goodbye to any entrepreneurship. I know this because i've seen big players win contracts over actually talented people 9 of 10 times because they can play this regulation game, and i've seen small companies burn 100s of thousands in consultancy fees over GDPR that made zero difference for their Wordpress setup that a talented coder could have used 10 hours to fix. That said the intentions are good, but for some reason EU thinks small players should have the same extreme measures as Facebook, Google, ie the actual reasons this regulation was made in the first place. Bizarre.
greatgib 3y ago
In fact, I'm even wondering if this legislation is not a legal trojan horse in some way. Look at everything that is included (VPN, OS, anything related to security,...). This regulation forces to have full declaration of the identity of the editor/manufacturer and more. Any other product that is not under the control of the authority will be illegal.

EMIRELADERO 3y ago

[flagged]

EtienneK 3y ago

This was the first question on my mind as well. How will this affect the one-man webshop owner or software developer? Seems only big established firms will be able to conform to this?

EMIRELADERO 3y ago
This question was asked a lot when GDPR came around, and it's essentially an implication that the regulator will act in bad faith. Courts and regulators, particularily European ones, understand when there's a "will" to follow the law. It's one of the differences between "rules-based" and "principles-based" regulations. https://news.ycombinator.com/item?id=17100541 https://news.ycombinator.com/item?id=17100541
- EtienneK 3y ago
  I don’t understand? So you should only in principle audit your Wordpress blog?
  - EMIRELADERO 3y ago
    Read the comment I linked. It's about the regulation being enforced with its principles in mind, not robotically through its strict interpretation.
  - troupo 3y ago
    Questions: - If you run a commercial kitchen on your own (or, let's say, with a staff of 2-3 people), can you ignore the food safety regulations? The fire regulations? - If you run a one-man plumbing company, can you ignore safety regulations? Water regulations? Sewage regulations? etc. Why is it than when it comes to "commercial software" it is inevitably "oh my god these laws are so hard, why should I as one-man company be forced to comply with them". Because that is literally your job.
    - galdor 3y ago
      In kitchens as in plumbings: - There are rules, and clear established practices that allow you to follow these rules. In software the rabbit hole goes so deep that your average developer cannot even be aware of all the risks. - You do not have to rely on millions of lines of code you have no control on. As a simple example, if you are using network communications, you are probably using OpenSSL, GnuTLS or one of the few other TLS implementations. All of them have regular security issues, and simply selling support on an Open Source software you built using one of them will make you liable for these issues. There is no choice: you need TLS, and you're not going to implement it yourself. What are you supposed to do? The fact that a solo developer selling 100€/month of support is treated the same way than a billion dollar company demonstrates the complete insanity of this act.
      - EMIRELADERO 3y ago
        > The fact that a solo developer selling 100€/month of support is treated the same way than a billion dollar company demonstrates the complete insanity of this act. But they're not treated the same way. Both by the law itself and the standards courts and regulatory agencies use throught Europe.
        galdor 3y ago
        The text of this act treat them the same way unless I'm missing something (feel free to point me the text saying otherwise). A sane legal text would put in place thresholds with different levels of expectations and liability depending on the size of the company, who you are selling to (companies or individuals) and its revenues, respecting the principle of proportionality.
  - arlcode 3y ago
    It means you will get treated differently whether you operate a one man show or a global conglomerate. Follow best practices and demonstrate that you care goes a long way (that has been demonstrated time and time again in courts throughout the union). Also it differentiates between what kind of product you are building (see the annexes). Most of the requirements (look them up) are best software dev practices unless you are in one of the specific "critical" categories of products. Then, to be honest I don't really care that you are a one person (commercial) shop when my car gets steered off the road because of a preventable security hole.
- hatenberg 3y ago
  And then there’s the real world issue of Abmahn-Factories in Germany.

Lariscus 3y ago

Unless you sell critical products as described in Annex III[1] the requirements to fulfill CRA are quite harmless. It's mostly stuff you should be doing anyway like a risk assessment and documentation. An additionally requirement is to provide a conformity assessment, which you can do yourself for non critical software, and you must report vulnerabilities within 24 hours. Not too bad really. [1] https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-34e9-11ed-9c68-01aa75ed71a1.0001.02/DOC_2&format=PDF https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-...

greatgib 3y ago
The light is quite large and and vague.
gustavus 3y ago
Ya so if some kid whose 16 is messing around on his computer figures out some cool app starts publishing it and then bam the incumbents can smack him down. The regulations are designed to deepen the software moat, and security theater, and I say this as an InfoSec professional.
- Lariscus 3y ago
  This is nonsense, because non-commercial activities are exempt from the CRAs requirements.
  - jart 3y ago
    Yes and regulation will ensure non-commercial activities stay that way. I write open source code because I love building software tools and there aren't a whole lot of opportunities to commercialize my work. I'd love it if an opportunity ever came along one day to get rich building a tool, that I could pounce on, in which case I'd love to know that I wouldn't immediately get jumped and mobbed by regulators.
    - troupo 3y ago

kossTKR 3y ago

Yeah this could be terrible unless there's very specific exceptions for sub 1mil revenue players. Lots of big players are already providing shit software to millions of customers especially through government contracts because they've hired armies of legal and sales teams, squashing the little guy in the process. If just providing some small web service built on top of open source now requires hiring a huge legal team, well goodbye to any entrepreneurship. I know this because i've seen big players win contracts over actually talented people 9 of 10 times because they can play this regulation game, and i've seen small companies burn 100s of thousands in consultancy fees over GDPR that made zero difference for their Wordpress setup that a talented coder could have used 10 hours to fix. That said the intentions are good, but for some reason EU thinks small players should have the same extreme measures as Facebook, Google, ie the actual reasons this regulation was made in the first place. Bizarre.

greatgib 3y ago

In fact, I'm even wondering if this legislation is not a legal trojan horse in some way. Look at everything that is included (VPN, OS, anything related to security,...). This regulation forces to have full declaration of the identity of the editor/manufacturer and more. Any other product that is not under the control of the authority will be illegal.