16 ms·

The European regulators listened to the Open Source communities

194 points by jlpcsl 3y ago

codebard 3y ago
Doesnt this version still screw up the individual developers or smaller outfits that provide paid addons/upgrades to their open source software? It exonerates open source projects that dont engage in any business activity, but holds responsible the 'stewards' who provide paid services and addons? This would kill a lot of individual software developers and small outfits that fund themselves by selling paid upgrades/addons or other services whereas the non-profit projects still remain for major corporations to leech off of them. Added bonus is that the law will eliminate the small competitors of all those major corporations as individual devs and small outfits cant handle the financial burden of this compliance. To make an example from a healthy open source ecosystem: WordPress project would continue without issues, but all the small developers and outfits who make a living by creating plugins, themes and other things for that ecosystem will go kaput. Am I misunderstanding this?
transpute 3y ago
Debian statement, Dec 2023, https://bits.debian.org/2023/12/debian-statement-cyber-resillience-act.md.html https://bits.debian.org/2023/12/debian-statement-cyber-resil... > Even if only "commercial activities" are in the scope of CRA, the Free Software community - and as a consequence, everybody - will lose a lot of small projects. CRA will force many small enterprises and most probably all self employed developers out of business because they simply cannot fulfill the requirements imposed by CRA. Debian and other Linux distributions depend on their work. If accepted as it is, CRA will undermine not only an established community but also a thriving market. CRA needs an exemption for small businesses and, at the very least, solo-entrepreneurs.
- hcfman 3y ago
  Well stated. Another thing people can do is to disallow governments to use any software you produce by default. This doesn't change your obligations to the law but it does attach consequences to government decisions. Right now they make sweeping decisions to benefit large players and screw small players, which is like stealing from the poor to give to the rich. And worst, the whole thing is effectively retroactive to all of the people whose collective work gave them all the nice things. Government should learn that decisions should be thought about very carefully and the only way to start a change in thinking is to attach consequences.
  - rmbyrro 3y ago
    Politicians don't care about this. It'll only impact the lives of developers working at governamental positions. This is also against the principle of OSS, which is to not discriminate about usage.
    - hcfman 3y ago
      So is that law. Small players would be discriminated against by virtue of not having the money to mitigate the legal risk.
  - dns_snek 3y ago
    Such limitation would effectively change the project's license, which would no longer be F/OSS approved. Most people and businesses don't evaluate custom licenses, they'll just skip your project because it doesn't have a well-known, approved license.
  - deleted 3y ago
    [deleted]
  - alwayslikethis 3y ago
    How do you expect that to be respected when you have things like illegal surveillance or eminent domain? A well behaving government wouldn't be the target for this, and a badly behaving one wouldn't respect it anyways.
    - thfuran 3y ago
      It tends not to be agencies like the USDA, USGS, VA, etc conducting illegal surveillance, yet they all use computers. And I'm not sure what eminent domain has to do with it.
    - hcfman 3y ago
      That’s absolutely true. It’s more symbolic than practical.
  - Karellen 3y ago
- sunshine-o 3y ago
  > CRA needs an exemption for small businesses and, at the very least, solo-entrepreneurs. My guess is even medium size businesses will face enormous risk and cost related to this. In the end we might see the worst scenario happening: open source is good, but only if sold by a big company who can afford compliance, risks and lawyers. This will be somehow similar to what happened with GDPR, most small & medium shops cannot spend too much time on this. And ironically it pushed a lot of people in the 3 big public clouds.
  - bluGill 3y ago
    I think medium software sized shops - 500 employees are large enough to afford the details and so will be okay. Anything smaller though and this is too much overhead. Of course many projects don't need 500 people. If you use Linux you can buy support from several actors of this size who can afford the overhead (also covering tools like ls that are part of an OS, maybe covering the basic gnome desktop, but not many of the lesser used tools that make linux useful). I'm sure the Apache and FreeBSD foundations will look into this and decide that they are able to handle the overhead by starting (legally this may be finding people to start?) such a company. However I'm not sure OpenBSD is large enough to be worth starting such an organization. There are a lot of tools that are not large/popular enough. Who will support OpenScad, FreeCad, cppcheck, and all the other open source projects that don't have a large company behind them and probably are not interesting to enough companies to be worth starting something to support them just for legal purposes. There are also projects that are supported by a company today, but the company is not large enough - will enough more customers come in to make it worth hiring a dozen laywers - cmake and sqlite come into mind as projects in this category.
  - ashildr 3y ago
    GDPR is easy as a small organization IF you are not greedy for other people‘s data. Keep your hands clean. I own (part of) a small company that makes software for a small market and we had absolutely no problems with GDPR because we try to not collect any data we don‘t absolutely need. It‘s not very complicated if you just invest some thought into your processes and don’t spy on your customers. Most of the time you don‘t need the data but someone wants to sell you a product to gather it.
- Certhas 3y ago
  That statement was based on the old text, correct? The revised law seems to address this in the opinion of experts OSI spoke to: "In particular, “digital artisans” using Open Source software at small scale – the main concern of Debian – will need guidance from the European Commission. While the experts we have met have all said that using an Open Source software distribution as part of a commercial activity is unlikely to require CE marking of the distribution itself, the interpretation of the key phrase “making available on the market” will need careful clarification."
  - DCKing 3y ago
    > That statement was based on the old text, correct? Yes it has. The updated text was published on December 20th [1], and does a lot to address these concerns. See also Bert Hubert's analysis [2]. The amount of knee jerking in the comments for this law really brings down the quality of discussion and detracts from remaining issues. [1]: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CONSIL:ST_17000_2023_INIT https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CONS... [2]: https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-for-open-source/ https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-f...
    - diggan 3y ago
      > The amount of knee jerking in the comments for this law really brings down the quality of discussion and detracts from remaining issues. Sadly, there are topics that sometimes come up on HN that makes people have these knee-jerk reactions. Anything related to EU, unions, Tesla, Israel and more tend to bring out the worse from normally reasonable people. I'm probably guilty of it sometimes too, we're all humans after all.
snowpid 3y ago
I think, the CRA might create an incentive for companies not free loading Open Source Software but instead putting money in the open source eco system (though mainly on Security) and that is somehow great!
- hcfman 3y ago
  Very optimistic. Call me a cynic.
  - snowpid 3y ago
    so what would happen instead? The only alternative is using close source (which does have disadvantage, being not cheaper etc.),
    - narag 3y ago
      Outsourcing any function that needs software outside the EU.
      - snowpid 3y ago
        Moving out your business out of EU is somehow a non solution.
        narag 3y ago
        I didn't say it's a solution.
        bluGill 3y ago
        If you live in the EU it is hard to move. You have to find a country that will let you in. Most countries restrict immigration and so you are likely to only file a country that is dangerous to live in. You also leave your friends and extended family behind, which is difficult. That assumes it is your company to move in the first place. Which is unlikely. So add find a new job to the list of things you need to do.
      - 3y ago
deleted 3y ago
[deleted]
orwin 3y ago
> In particular, “digital artisans” using Open Source software at small scale – the main concern of Debian – will need guidance from the European Commission. Sadly I don't think it will move, the commission doesn't want to weaken the legislation because they don't want to much discrepancy between member states. It will once again be up to individual countries to set up this law with their own interpretation. In my experience with Rgpd, the watchdogs in at least 3 countries (France, Italy, Germany) are extremely helpful in navigating regulations, especially if you are incidentally its target (As a PaaS that hosted health data, we were). I understand that this is both unclear, unknowable and a pretty huge risk (not really factually, but it feels like one): I'm not saying Debian people are wrong to want to clarify, I'm not saying people should take this as a victory, or that EU is perfect : I'm just saying that as a complex federation, with current rules, this law will probably be the best we will get, and sadly, local 'forgiveness' and loose execution is the only thing you can count on. Because in the EU eyes, the law being loose is way, way worse than the local executive power being loose.
- robertlagrant 3y ago
  > the watchdogs in at least 3 countries (France, Italy, Germany) are extremely helpful in navigating regulations This is a bad dependency to have. For example, for the new EU medical device regulation, IVDR, a lot of the regulatory infrastructure just isn't ready[0], and many bodies are bowing out due to the complexity. Ironically, the British Standards Institute is one of the few notified bodies to take it on! And that's medical devices, which are a tighter form of software. Regulating software in general seems like a very difficult task. [0] https://www.degruyter.com/document/doi/10.1515/cclm-2021-0975/html https://www.degruyter.com/document/doi/10.1515/cclm-2021-097...
  - orwin 3y ago
    Yes, I think I was unclear: depending on local governmental watchdogs/agencies goodwill isn't a good solution. It's the one EU choose however. It's weird for Anglo countries, or countries with the Anglo law system, where the legislation might have holes and weak points, but decree and case law fill those holes (the French system work like that too). EU can't do that because it's a federation of countries with different culture and interest. Again, not saying it's good, I'm saying that's how it works.
rmbyrro 3y ago
If you want to entrepreneur in the software industry, move fast, folks. They're closing in and the level of freedom we have today isn't likely to exist in years to come.
- esarbe 3y ago
  With "freedom", you mean the ability to exploit customers and disregards any responsibility when it comes to protecting customer's private data? Yeah, let's hope so.
- sofixa 3y ago
  > level of freedom There are freedoms to and freedoms from. The Cyber Resilience Act is giving freedoms from to consumers that never had them before, at the expense of some freedoms to abuse from software vendors.
PaulKeeble 3y ago
This reminds me very much of the warnings by people like Robert C Martin over a decade ago that unless the software industry adopted better practices for quality and regulated itself regulators would step in. Regulators understand very little about the software process so the laws they are pass are unlikely to be the best way to solve it. Years after those lectures little has changed and now the regulation is coming at an increasing pace. None of this will be good for small software companies, this sort of regulation will entrench the big players as it always does.
- jan3024-2r 3y ago
  [dead]
- mouse_ 3y ago
  "Big tech must regulate itself lest it become an unstoppable monopoly and crush any new competition." This sounds less like a warning and more like a playbook.
tzs 3y ago
OT: Anyone have a more useful link to the Apache Foundation's statement? All the links to the other statements in the article go to the sites of the organizations they are quoting, but the one for the Apache Foundation goes to something called sandbox-pad.webm.ink. That just gives me an error dialog in Chrome, Firefox, and Safari that says "sframe-boot.js must only be loaded in a nested context" then a shield with a keyhole image fads in over it along with "Loading..." text, and nothing more happens (at least in the 30 minutes I've had that tab open).
- legobmw99 3y ago
  https://news.apache.org/foundation/entry/update-on-eu-software-regulation-lots-of-improvements-good-news https://news.apache.org/foundation/entry/update-on-eu-softwa... This appears to be the article intended. At the very least it contains the quoted sentence
mistrial9 3y ago
there are improvements but please, the implementations are the test. Regulators, senior politicians and others can and do change the course in implementation phase. this is not over, in any way
max_ 3y ago
I don't understand what's going on. Could someone give me a birds eye view of what this is about? - What is the regulation aimed at? - What did the open source community communicate?
- sofixa 3y ago
  The legislation (Cyber Resilience Act) aims to enforce some standards and add liability around software products, to enforce that vendors don't just throw something out, never touch it again and it becomes a problem (customers stuck with paperweights, security holes exploited). The problem is that if you enforce that sort of thing on random open source projects, many will be simply incapable of even trying to follow the legislation because they're a small one-two dev team that cannot navigate complex laws. So, progressively, more and more exceptions have been added to who does the regulation apply to.
- matheusmoreira 3y ago
  Liability for software developers and vendors. The only problem is they forgot to make an exception for free and open source software developers. It simply makes no sense for me to publish free software out there for free if that can get me sued.
  - legobmw99 3y ago
    TFA is about how they did make those exceptions in the final text
    - Nostromos 3y ago
      Did they though? The article says that the final text mitigated "pretty much all" of the issues. What wasn't mitigated?

194 points by jlpcsl 3y ago

Doesnt this version still screw up the individual developers or smaller outfits that provide paid addons/upgrades to their open source software? It exonerates open source projects that dont engage in any business activity, but holds responsible the 'stewards' who provide paid services and addons? This would kill a lot of individual software developers and small outfits that fund themselves by selling paid upgrades/addons or other services whereas the non-profit projects still remain for major corporations to leech off of them. Added bonus is that the law will eliminate the small competitors of all those major corporations as individual devs and small outfits cant handle the financial burden of this compliance. To make an example from a healthy open source ecosystem: WordPress project would continue without issues, but all the small developers and outfits who make a living by creating plugins, themes and other things for that ecosystem will go kaput. Am I misunderstanding this?

transpute 3y ago

Debian statement, Dec 2023, https://bits.debian.org/2023/12/debian-statement-cyber-resillience-act.md.html https://bits.debian.org/2023/12/debian-statement-cyber-resil... > Even if only "commercial activities" are in the scope of CRA, the Free Software community - and as a consequence, everybody - will lose a lot of small projects. CRA will force many small enterprises and most probably all self employed developers out of business because they simply cannot fulfill the requirements imposed by CRA. Debian and other Linux distributions depend on their work. If accepted as it is, CRA will undermine not only an established community but also a thriving market. CRA needs an exemption for small businesses and, at the very least, solo-entrepreneurs.

hcfman 3y ago
Well stated. Another thing people can do is to disallow governments to use any software you produce by default. This doesn't change your obligations to the law but it does attach consequences to government decisions. Right now they make sweeping decisions to benefit large players and screw small players, which is like stealing from the poor to give to the rich. And worst, the whole thing is effectively retroactive to all of the people whose collective work gave them all the nice things. Government should learn that decisions should be thought about very carefully and the only way to start a change in thinking is to attach consequences.
- rmbyrro 3y ago
  Politicians don't care about this. It'll only impact the lives of developers working at governamental positions. This is also against the principle of OSS, which is to not discriminate about usage.
  - hcfman 3y ago
    So is that law. Small players would be discriminated against by virtue of not having the money to mitigate the legal risk.
- dns_snek 3y ago
  Such limitation would effectively change the project's license, which would no longer be F/OSS approved. Most people and businesses don't evaluate custom licenses, they'll just skip your project because it doesn't have a well-known, approved license.
- deleted 3y ago
  [deleted]
- alwayslikethis 3y ago
  How do you expect that to be respected when you have things like illegal surveillance or eminent domain? A well behaving government wouldn't be the target for this, and a badly behaving one wouldn't respect it anyways.
  - thfuran 3y ago
    It tends not to be agencies like the USDA, USGS, VA, etc conducting illegal surveillance, yet they all use computers. And I'm not sure what eminent domain has to do with it.
  - hcfman 3y ago
    That’s absolutely true. It’s more symbolic than practical.
- Karellen 3y ago
sunshine-o 3y ago
> CRA needs an exemption for small businesses and, at the very least, solo-entrepreneurs. My guess is even medium size businesses will face enormous risk and cost related to this. In the end we might see the worst scenario happening: open source is good, but only if sold by a big company who can afford compliance, risks and lawyers. This will be somehow similar to what happened with GDPR, most small & medium shops cannot spend too much time on this. And ironically it pushed a lot of people in the 3 big public clouds.
- bluGill 3y ago
  I think medium software sized shops - 500 employees are large enough to afford the details and so will be okay. Anything smaller though and this is too much overhead. Of course many projects don't need 500 people. If you use Linux you can buy support from several actors of this size who can afford the overhead (also covering tools like ls that are part of an OS, maybe covering the basic gnome desktop, but not many of the lesser used tools that make linux useful). I'm sure the Apache and FreeBSD foundations will look into this and decide that they are able to handle the overhead by starting (legally this may be finding people to start?) such a company. However I'm not sure OpenBSD is large enough to be worth starting such an organization. There are a lot of tools that are not large/popular enough. Who will support OpenScad, FreeCad, cppcheck, and all the other open source projects that don't have a large company behind them and probably are not interesting to enough companies to be worth starting something to support them just for legal purposes. There are also projects that are supported by a company today, but the company is not large enough - will enough more customers come in to make it worth hiring a dozen laywers - cmake and sqlite come into mind as projects in this category.
- ashildr 3y ago
  GDPR is easy as a small organization IF you are not greedy for other people‘s data. Keep your hands clean. I own (part of) a small company that makes software for a small market and we had absolutely no problems with GDPR because we try to not collect any data we don‘t absolutely need. It‘s not very complicated if you just invest some thought into your processes and don’t spy on your customers. Most of the time you don‘t need the data but someone wants to sell you a product to gather it.
Certhas 3y ago
That statement was based on the old text, correct? The revised law seems to address this in the opinion of experts OSI spoke to: "In particular, “digital artisans” using Open Source software at small scale – the main concern of Debian – will need guidance from the European Commission. While the experts we have met have all said that using an Open Source software distribution as part of a commercial activity is unlikely to require CE marking of the distribution itself, the interpretation of the key phrase “making available on the market” will need careful clarification."
- DCKing 3y ago
  > That statement was based on the old text, correct? Yes it has. The updated text was published on December 20th [1], and does a lot to address these concerns. See also Bert Hubert's analysis [2]. The amount of knee jerking in the comments for this law really brings down the quality of discussion and detracts from remaining issues. [1]: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CONSIL:ST_17000_2023_INIT https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CONS... [2]: https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-for-open-source/ https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-f...
  - diggan 3y ago
    > The amount of knee jerking in the comments for this law really brings down the quality of discussion and detracts from remaining issues. Sadly, there are topics that sometimes come up on HN that makes people have these knee-jerk reactions. Anything related to EU, unions, Tesla, Israel and more tend to bring out the worse from normally reasonable people. I'm probably guilty of it sometimes too, we're all humans after all.

snowpid 3y ago

I think, the CRA might create an incentive for companies not free loading Open Source Software but instead putting money in the open source eco system (though mainly on Security) and that is somehow great!

hcfman 3y ago
Very optimistic. Call me a cynic.
- snowpid 3y ago
  so what would happen instead? The only alternative is using close source (which does have disadvantage, being not cheaper etc.),
  - narag 3y ago
    Outsourcing any function that needs software outside the EU.
    - snowpid 3y ago
      Moving out your business out of EU is somehow a non solution.
      - narag 3y ago
        I didn't say it's a solution.
      - bluGill 3y ago
        If you live in the EU it is hard to move. You have to find a country that will let you in. Most countries restrict immigration and so you are likely to only file a country that is dangerous to live in. You also leave your friends and extended family behind, which is difficult. That assumes it is your company to move in the first place. Which is unlikely. So add find a new job to the list of things you need to do.
    - 3y ago

deleted 3y ago

[deleted]

orwin 3y ago

> In particular, “digital artisans” using Open Source software at small scale – the main concern of Debian – will need guidance from the European Commission. Sadly I don't think it will move, the commission doesn't want to weaken the legislation because they don't want to much discrepancy between member states. It will once again be up to individual countries to set up this law with their own interpretation. In my experience with Rgpd, the watchdogs in at least 3 countries (France, Italy, Germany) are extremely helpful in navigating regulations, especially if you are incidentally its target (As a PaaS that hosted health data, we were). I understand that this is both unclear, unknowable and a pretty huge risk (not really factually, but it feels like one): I'm not saying Debian people are wrong to want to clarify, I'm not saying people should take this as a victory, or that EU is perfect : I'm just saying that as a complex federation, with current rules, this law will probably be the best we will get, and sadly, local 'forgiveness' and loose execution is the only thing you can count on. Because in the EU eyes, the law being loose is way, way worse than the local executive power being loose.

robertlagrant 3y ago
> the watchdogs in at least 3 countries (France, Italy, Germany) are extremely helpful in navigating regulations This is a bad dependency to have. For example, for the new EU medical device regulation, IVDR, a lot of the regulatory infrastructure just isn't ready[0], and many bodies are bowing out due to the complexity. Ironically, the British Standards Institute is one of the few notified bodies to take it on! And that's medical devices, which are a tighter form of software. Regulating software in general seems like a very difficult task. [0] https://www.degruyter.com/document/doi/10.1515/cclm-2021-0975/html https://www.degruyter.com/document/doi/10.1515/cclm-2021-097...
- orwin 3y ago
  Yes, I think I was unclear: depending on local governmental watchdogs/agencies goodwill isn't a good solution. It's the one EU choose however. It's weird for Anglo countries, or countries with the Anglo law system, where the legislation might have holes and weak points, but decree and case law fill those holes (the French system work like that too). EU can't do that because it's a federation of countries with different culture and interest. Again, not saying it's good, I'm saying that's how it works.

rmbyrro 3y ago

If you want to entrepreneur in the software industry, move fast, folks. They're closing in and the level of freedom we have today isn't likely to exist in years to come.

esarbe 3y ago
With "freedom", you mean the ability to exploit customers and disregards any responsibility when it comes to protecting customer's private data? Yeah, let's hope so.
sofixa 3y ago
> level of freedom There are freedoms to and freedoms from. The Cyber Resilience Act is giving freedoms from to consumers that never had them before, at the expense of some freedoms to abuse from software vendors.

PaulKeeble 3y ago

This reminds me very much of the warnings by people like Robert C Martin over a decade ago that unless the software industry adopted better practices for quality and regulated itself regulators would step in. Regulators understand very little about the software process so the laws they are pass are unlikely to be the best way to solve it. Years after those lectures little has changed and now the regulation is coming at an increasing pace. None of this will be good for small software companies, this sort of regulation will entrench the big players as it always does.

jan3024-2r 3y ago
[dead]
mouse_ 3y ago
"Big tech must regulate itself lest it become an unstoppable monopoly and crush any new competition." This sounds less like a warning and more like a playbook.

tzs 3y ago

OT: Anyone have a more useful link to the Apache Foundation's statement? All the links to the other statements in the article go to the sites of the organizations they are quoting, but the one for the Apache Foundation goes to something called sandbox-pad.webm.ink. That just gives me an error dialog in Chrome, Firefox, and Safari that says "sframe-boot.js must only be loaded in a nested context" then a shield with a keyhole image fads in over it along with "Loading..." text, and nothing more happens (at least in the 30 minutes I've had that tab open).

legobmw99 3y ago
https://news.apache.org/foundation/entry/update-on-eu-software-regulation-lots-of-improvements-good-news https://news.apache.org/foundation/entry/update-on-eu-softwa... This appears to be the article intended. At the very least it contains the quoted sentence

mistrial9 3y ago

there are improvements but please, the implementations are the test. Regulators, senior politicians and others can and do change the course in implementation phase. this is not over, in any way

max_ 3y ago

I don't understand what's going on. Could someone give me a birds eye view of what this is about? - What is the regulation aimed at? - What did the open source community communicate?

sofixa 3y ago
The legislation (Cyber Resilience Act) aims to enforce some standards and add liability around software products, to enforce that vendors don't just throw something out, never touch it again and it becomes a problem (customers stuck with paperweights, security holes exploited). The problem is that if you enforce that sort of thing on random open source projects, many will be simply incapable of even trying to follow the legislation because they're a small one-two dev team that cannot navigate complex laws. So, progressively, more and more exceptions have been added to who does the regulation apply to.
matheusmoreira 3y ago
Liability for software developers and vendors. The only problem is they forgot to make an exception for free and open source software developers. It simply makes no sense for me to publish free software out there for free if that can get me sued.
- legobmw99 3y ago
  TFA is about how they did make those exceptions in the final text
  - Nostromos 3y ago
    Did they though? The article says that the final text mitigated "pretty much all" of the issues. What wasn't mitigated?