4 ms·

Cool thing to note: this argument was made a lot in responses to the Office of the National Cyber Directors' recent Request for Input on improving open source s

Cool thing to note: this argument was made a lot in responses to the Office of the National Cyber Directors' recent Request for Input on improving open source software security. That said, there's a state of tension on this topic right now. The European Union's draft Cyber Resilience Act has included language across multiple versions that would in at least some cases assign liability to producers of open source software. They've tried to modify the language to exclude non-commercial open source projects, but there's been a lot of wrangling over the exact definition of "commercial."

bee_rider 3y ago
Honestly, there should be tension and arguing there. For example, Google should (IMO) very clearly be treated as selling products in the cases of Android and Chrome despite the fact that these technically are related to open source projects. I’m quite glad they aren’t ignoring the complexity.
- alilleybrinker 3y ago
  I agree that there are details to sincerely work out here. I know in earlier drafts the wording of the "commercial" definition was such that it could be read to classify cases like a solo OSS developer who makes $10/month from GitHub Sponsors as "commercial" (and thus assign liability to them). This received substantial pushback from organizations like (as I recall) the Eclipse Foundation and the Electronic Frontier Foundation. I'm not sure where the draft language stands now.
  - bee_rider 3y ago
    That seems like a really hard edge case. I wonder how the liability works out for, say, a carpenter who makes home-made chairs if one breaks and hurts somebody.
jjav 3y ago
> but there's been a lot of wrangling over the exact definition of "commercial." That's disturbing since the definition should be trivial! If I publish a library (whether open source or not, doesn't really matter) and charge you money to use it in your product, that's commercial. I'm happy to take the liability (and will of course charge you enough money to make it worth it to me). If I throw out some code on github but you're not paying me, that's obviously not commercial.

bee_rider 3y ago

Honestly, there should be tension and arguing there. For example, Google should (IMO) very clearly be treated as selling products in the cases of Android and Chrome despite the fact that these technically are related to open source projects. I’m quite glad they aren’t ignoring the complexity.

alilleybrinker 3y ago
I agree that there are details to sincerely work out here. I know in earlier drafts the wording of the "commercial" definition was such that it could be read to classify cases like a solo OSS developer who makes $10/month from GitHub Sponsors as "commercial" (and thus assign liability to them). This received substantial pushback from organizations like (as I recall) the Eclipse Foundation and the Electronic Frontier Foundation. I'm not sure where the draft language stands now.
- bee_rider 3y ago
  That seems like a really hard edge case. I wonder how the liability works out for, say, a carpenter who makes home-made chairs if one breaks and hurts somebody.

jjav 3y ago

> but there's been a lot of wrangling over the exact definition of "commercial." That's disturbing since the definition should be trivial! If I publish a library (whether open source or not, doesn't really matter) and charge you money to use it in your product, that's commercial. I'm happy to take the liability (and will of course charge you enough money to make it worth it to me). If I throw out some code on github but you're not paying me, that's obviously not commercial.