4 ms·

Debian statement, Dec 2023, https://bits.debian.org/2023/12/debian-statement-cyber-resillience-act.md.html https://bits.debian.org/2023/12/debian-statement-cybe

Debian statement, Dec 2023, https://bits.debian.org/2023/12/debian-statement-cyber-resillience-act.md.html https://bits.debian.org/2023/12/debian-statement-cyber-resil... > Even if only "commercial activities" are in the scope of CRA, the Free Software community - and as a consequence, everybody - will lose a lot of small projects. CRA will force many small enterprises and most probably all self employed developers out of business because they simply cannot fulfill the requirements imposed by CRA. Debian and other Linux distributions depend on their work. If accepted as it is, CRA will undermine not only an established community but also a thriving market. CRA needs an exemption for small businesses and, at the very least, solo-entrepreneurs.

hcfman 3y ago
Well stated. Another thing people can do is to disallow governments to use any software you produce by default. This doesn't change your obligations to the law but it does attach consequences to government decisions. Right now they make sweeping decisions to benefit large players and screw small players, which is like stealing from the poor to give to the rich. And worst, the whole thing is effectively retroactive to all of the people whose collective work gave them all the nice things. Government should learn that decisions should be thought about very carefully and the only way to start a change in thinking is to attach consequences.
- rmbyrro 3y ago
  Politicians don't care about this. It'll only impact the lives of developers working at governamental positions. This is also against the principle of OSS, which is to not discriminate about usage.
  - hcfman 3y ago
    So is that law. Small players would be discriminated against by virtue of not having the money to mitigate the legal risk.
- dns_snek 3y ago
  Such limitation would effectively change the project's license, which would no longer be F/OSS approved. Most people and businesses don't evaluate custom licenses, they'll just skip your project because it doesn't have a well-known, approved license.
- deleted 3y ago
  [deleted]
- alwayslikethis 3y ago
  How do you expect that to be respected when you have things like illegal surveillance or eminent domain? A well behaving government wouldn't be the target for this, and a badly behaving one wouldn't respect it anyways.
  - thfuran 3y ago
    It tends not to be agencies like the USDA, USGS, VA, etc conducting illegal surveillance, yet they all use computers. And I'm not sure what eminent domain has to do with it.
  - hcfman 3y ago
    That’s absolutely true. It’s more symbolic than practical.
- Karellen 3y ago
  > Another thing people can do is to disallow governments to use any software you produce by default. So, instead of having governments become part of an open (software) commons, using software that costs less in taxes[0], which they would then have a stake in supporting and helping to make better, you're proposing that they purchase higher-cost proprietary software from private corporations, supporting their shareholders? Yeah, that'll help. > the only way to start a change in thinking is to attach consequences. That's not how FLOSS has got where it is today, so it is clearly not "the only way". FLOSS succeeds by allowing everyone in, in allowing them to reap the benefits first, so that they understand the value first-hand. Then, they come to depend on it, and when they see how much it would cost them to stop using FLOSS, do they realise how much they have invested in the ecosystem. Keeping people out means that they never get entangled in the first place. [0] Or, requires less money to be created, depending on your viewpoint.
- wolverine876 3y ago
  Didn't government do what you want in this case? A long deliberative, consultative process, addressing the needs of small players?
  - x0x0 3y ago
    No. They should have started by competently and carefully thinking through the consequences of the liabilities they were about to impose on open source, rather than obligating open source to expend limited resources explaining the obvious consequences. These problems were obvious to anyone competent who spent even a second thinking about it: people who give software away cannot accept liability for doing so, and the act of giving software away can't impose obligations to people who receive nothing or they will obviously have to stop.
    - wolverine876 3y ago
      I'd much rather they consult open source people about open source needs, rather than try to guess. IME, you need to talk to the people on the front lines. In fact, unless I talk to people I know best, even family members, I don't really know.
      - x0x0 3y ago
        They didn't consult. They made open source go lobby them to avoid having to block the EU. That's the exact opposite of asking open source, in advance of legislation, what would happen if they did X.
sunshine-o 3y ago
> CRA needs an exemption for small businesses and, at the very least, solo-entrepreneurs. My guess is even medium size businesses will face enormous risk and cost related to this. In the end we might see the worst scenario happening: open source is good, but only if sold by a big company who can afford compliance, risks and lawyers. This will be somehow similar to what happened with GDPR, most small & medium shops cannot spend too much time on this. And ironically it pushed a lot of people in the 3 big public clouds.
- bluGill 3y ago
  I think medium software sized shops - 500 employees are large enough to afford the details and so will be okay. Anything smaller though and this is too much overhead. Of course many projects don't need 500 people. If you use Linux you can buy support from several actors of this size who can afford the overhead (also covering tools like ls that are part of an OS, maybe covering the basic gnome desktop, but not many of the lesser used tools that make linux useful). I'm sure the Apache and FreeBSD foundations will look into this and decide that they are able to handle the overhead by starting (legally this may be finding people to start?) such a company. However I'm not sure OpenBSD is large enough to be worth starting such an organization. There are a lot of tools that are not large/popular enough. Who will support OpenScad, FreeCad, cppcheck, and all the other open source projects that don't have a large company behind them and probably are not interesting to enough companies to be worth starting something to support them just for legal purposes. There are also projects that are supported by a company today, but the company is not large enough - will enough more customers come in to make it worth hiring a dozen laywers - cmake and sqlite come into mind as projects in this category.
- ashildr 3y ago
  GDPR is easy as a small organization IF you are not greedy for other people‘s data. Keep your hands clean. I own (part of) a small company that makes software for a small market and we had absolutely no problems with GDPR because we try to not collect any data we don‘t absolutely need. It‘s not very complicated if you just invest some thought into your processes and don’t spy on your customers. Most of the time you don‘t need the data but someone wants to sell you a product to gather it.
Certhas 3y ago
That statement was based on the old text, correct? The revised law seems to address this in the opinion of experts OSI spoke to: "In particular, “digital artisans” using Open Source software at small scale – the main concern of Debian – will need guidance from the European Commission. While the experts we have met have all said that using an Open Source software distribution as part of a commercial activity is unlikely to require CE marking of the distribution itself, the interpretation of the key phrase “making available on the market” will need careful clarification."
- DCKing 3y ago
  > That statement was based on the old text, correct? Yes it has. The updated text was published on December 20th [1], and does a lot to address these concerns. See also Bert Hubert's analysis [2]. The amount of knee jerking in the comments for this law really brings down the quality of discussion and detracts from remaining issues. [1]: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CONSIL:ST_17000_2023_INIT https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CONS... [2]: https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-for-open-source/ https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-f...
  - diggan 3y ago
    > The amount of knee jerking in the comments for this law really brings down the quality of discussion and detracts from remaining issues. Sadly, there are topics that sometimes come up on HN that makes people have these knee-jerk reactions. Anything related to EU, unions, Tesla, Israel and more tend to bring out the worse from normally reasonable people. I'm probably guilty of it sometimes too, we're all humans after all.

hcfman 3y ago

Well stated. Another thing people can do is to disallow governments to use any software you produce by default. This doesn't change your obligations to the law but it does attach consequences to government decisions. Right now they make sweeping decisions to benefit large players and screw small players, which is like stealing from the poor to give to the rich. And worst, the whole thing is effectively retroactive to all of the people whose collective work gave them all the nice things. Government should learn that decisions should be thought about very carefully and the only way to start a change in thinking is to attach consequences.

rmbyrro 3y ago
Politicians don't care about this. It'll only impact the lives of developers working at governamental positions. This is also against the principle of OSS, which is to not discriminate about usage.
- hcfman 3y ago
  So is that law. Small players would be discriminated against by virtue of not having the money to mitigate the legal risk.
dns_snek 3y ago
Such limitation would effectively change the project's license, which would no longer be F/OSS approved. Most people and businesses don't evaluate custom licenses, they'll just skip your project because it doesn't have a well-known, approved license.
deleted 3y ago
[deleted]
alwayslikethis 3y ago
How do you expect that to be respected when you have things like illegal surveillance or eminent domain? A well behaving government wouldn't be the target for this, and a badly behaving one wouldn't respect it anyways.
- thfuran 3y ago
  It tends not to be agencies like the USDA, USGS, VA, etc conducting illegal surveillance, yet they all use computers. And I'm not sure what eminent domain has to do with it.
- hcfman 3y ago
  That’s absolutely true. It’s more symbolic than practical.
Karellen 3y ago
> Another thing people can do is to disallow governments to use any software you produce by default. So, instead of having governments become part of an open (software) commons, using software that costs less in taxes[0], which they would then have a stake in supporting and helping to make better, you're proposing that they purchase higher-cost proprietary software from private corporations, supporting their shareholders? Yeah, that'll help. > the only way to start a change in thinking is to attach consequences. That's not how FLOSS has got where it is today, so it is clearly not "the only way". FLOSS succeeds by allowing everyone in, in allowing them to reap the benefits first, so that they understand the value first-hand. Then, they come to depend on it, and when they see how much it would cost them to stop using FLOSS, do they realise how much they have invested in the ecosystem. Keeping people out means that they never get entangled in the first place. [0] Or, requires less money to be created, depending on your viewpoint.
wolverine876 3y ago
Didn't government do what you want in this case? A long deliberative, consultative process, addressing the needs of small players?
- x0x0 3y ago
  No. They should have started by competently and carefully thinking through the consequences of the liabilities they were about to impose on open source, rather than obligating open source to expend limited resources explaining the obvious consequences. These problems were obvious to anyone competent who spent even a second thinking about it: people who give software away cannot accept liability for doing so, and the act of giving software away can't impose obligations to people who receive nothing or they will obviously have to stop.
  - wolverine876 3y ago
    I'd much rather they consult open source people about open source needs, rather than try to guess. IME, you need to talk to the people on the front lines. In fact, unless I talk to people I know best, even family members, I don't really know.
    - x0x0 3y ago
      They didn't consult. They made open source go lobby them to avoid having to block the EU. That's the exact opposite of asking open source, in advance of legislation, what would happen if they did X.

sunshine-o 3y ago

> CRA needs an exemption for small businesses and, at the very least, solo-entrepreneurs. My guess is even medium size businesses will face enormous risk and cost related to this. In the end we might see the worst scenario happening: open source is good, but only if sold by a big company who can afford compliance, risks and lawyers. This will be somehow similar to what happened with GDPR, most small & medium shops cannot spend too much time on this. And ironically it pushed a lot of people in the 3 big public clouds.

bluGill 3y ago
I think medium software sized shops - 500 employees are large enough to afford the details and so will be okay. Anything smaller though and this is too much overhead. Of course many projects don't need 500 people. If you use Linux you can buy support from several actors of this size who can afford the overhead (also covering tools like ls that are part of an OS, maybe covering the basic gnome desktop, but not many of the lesser used tools that make linux useful). I'm sure the Apache and FreeBSD foundations will look into this and decide that they are able to handle the overhead by starting (legally this may be finding people to start?) such a company. However I'm not sure OpenBSD is large enough to be worth starting such an organization. There are a lot of tools that are not large/popular enough. Who will support OpenScad, FreeCad, cppcheck, and all the other open source projects that don't have a large company behind them and probably are not interesting to enough companies to be worth starting something to support them just for legal purposes. There are also projects that are supported by a company today, but the company is not large enough - will enough more customers come in to make it worth hiring a dozen laywers - cmake and sqlite come into mind as projects in this category.
ashildr 3y ago
GDPR is easy as a small organization IF you are not greedy for other people‘s data. Keep your hands clean. I own (part of) a small company that makes software for a small market and we had absolutely no problems with GDPR because we try to not collect any data we don‘t absolutely need. It‘s not very complicated if you just invest some thought into your processes and don’t spy on your customers. Most of the time you don‘t need the data but someone wants to sell you a product to gather it.

Certhas 3y ago

That statement was based on the old text, correct? The revised law seems to address this in the opinion of experts OSI spoke to: "In particular, “digital artisans” using Open Source software at small scale – the main concern of Debian – will need guidance from the European Commission. While the experts we have met have all said that using an Open Source software distribution as part of a commercial activity is unlikely to require CE marking of the distribution itself, the interpretation of the key phrase “making available on the market” will need careful clarification."

DCKing 3y ago
> That statement was based on the old text, correct? Yes it has. The updated text was published on December 20th [1], and does a lot to address these concerns. See also Bert Hubert's analysis [2]. The amount of knee jerking in the comments for this law really brings down the quality of discussion and detracts from remaining issues. [1]: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CONSIL:ST_17000_2023_INIT https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CONS... [2]: https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-for-open-source/ https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-f...
- diggan 3y ago
  > The amount of knee jerking in the comments for this law really brings down the quality of discussion and detracts from remaining issues. Sadly, there are topics that sometimes come up on HN that makes people have these knee-jerk reactions. Anything related to EU, unions, Tesla, Israel and more tend to bring out the worse from normally reasonable people. I'm probably guilty of it sometimes too, we're all humans after all.