5 ms·

I think, the CRA might create an incentive for companies not free loading Open Source Software but instead putting money in the open source eco system (though m

I think, the CRA might create an incentive for companies not free loading Open Source Software but instead putting money in the open source eco system (though mainly on Security) and that is somehow great!

hcfman 3y ago
Very optimistic. Call me a cynic.
- snowpid 3y ago
  so what would happen instead? The only alternative is using close source (which does have disadvantage, being not cheaper etc.),
  - narag 3y ago
    Outsourcing any function that needs software outside the EU.
    - snowpid 3y ago
      Moving out your business out of EU is somehow a non solution.
      - narag 3y ago
        I didn't say it's a solution.
      - bluGill 3y ago
        If you live in the EU it is hard to move. You have to find a country that will let you in. Most countries restrict immigration and so you are likely to only file a country that is dangerous to live in. You also leave your friends and extended family behind, which is difficult. That assumes it is your company to move in the first place. Which is unlikely. So add find a new job to the list of things you need to do.
    - lars_francke 3y ago
      The CRA still applies as soon as it is first brought onto the EU market. It might just be the distributor or importer having to do some things instead of the manufacturer.
      - narag 3y ago
        I mean the software is never used inside the EU. The final product is built outside and later imported, so you don't know what software was used. An example: EU is approving very restrictive legislation about pesticides for use inside the EU but it happily allows importing food grown in other countries using the very same forbidden substances.
        snowpid 3y ago
        still CRA applies.
        FredPret 3y ago
        This is the weirdest form of colonization. In bygone days, we had to accept European monarchs; now we have to live with the diktats of their bureaucrats.
        sgift 3y ago
        No colonization happening. If you don't want to follow the CRA, then don't make a product that gets into the EU market. If you want in the EU market, you have to follow EUs rules.
        narag 3y ago
        Maybe you're misunderstanding what I said. Otherwise it would be ridiculous. If I buy a screw made in the USA, no EU authority can know what's the software used in the machine tool. They can control physical properties, packaging, information... but the process used is opaque.
        lars_francke 3y ago
  - pjc50 3y ago
    As with CE marking: there's very little enforcement, so people would carry on downloading solutions from outside the EU and ignoring the rules. See the entire Aliexpress market.
hyperpape 3y ago
You haven't given any mechanism that would make this happen. Specifically, some reason that the company would see contributing be beneficial to it. Of course, it benefits from the existence of open-source as a whole, but what material difference does its contribution make? Take a small-medium sized business (say 5 - 50€ million annual revenue). Perhaps it can fund one library that is critical to it, but no contribution it makes will make a material difference to the trajectory of major products like Linux, or Python.
- Certhas 3y ago
  The mechanism is clear: If you use Open Source software commercially, you are now liable if the software misbehaves. Thus, you have an incentive to make sure the software is correct. For (A)GPL software, you have to publish your contributions. Not a lawyer, but it also seems to me that if you are a small shop, you might decide to pay, e.g. RedHat for taking on the liability. RedHat can pool these resources to make sure their software behaves as advertised.
  - pabs3 3y ago
    (A)GPL don't require publication, just giving code to your users, who may or may not elect to further distribute the code.
  - hightrix 3y ago
    > If you use Open Source software commercially, you are now liable if the software misbehaves. Thus, you have an incentive to make sure the software is correct. As a software developer at a non-tech firm, I can gaurantee this means we will not be able to use any open source software. If we are granted an exception, it will be such that we must maintain a private version of the open source software. This is simply a no-go for many companies of all sizes. The risk associated here is not something many (any?) legal department will be willing to take on.
    - Certhas 3y ago
      You just ignored the second part of my message? If your company is not willing to pay someone (another company ) for making sure the open source software used is actually working properly (and for assuming liability if it doesn't), then it can't use open source software. But then, what does open source lose when losing for profit users that are not willing to contribute back?
xondono 3y ago
I very much doubt it, and it’s probably going to do the opposite. CRA just brings the kind paperwork that physical products have always had to be licensed in the EU (CE marking) to software. Have you seen european companies investing in Open source hardware? The path of least resistance will be to use homegrown alternatives and sell them to potential investors and shareholders as valuable intellectual property that puts them ahead of competitors. Not only because that makes perfect business sense, but because this kind of IP is very hard to value fairly, so it will allow for a variety of accounting and tax avoidance shenanigans.
- snowpid 3y ago
  For a useful comparison you need to show if open source hardware is more common / more invested in other parts of the world. E. G. Risc V has a growing momentum https://riscv.org/blog/2023/07/the-growing-momentum-of-risc-v-in-europe/ https://riscv.org/blog/2023/07/the-growing-momentum-of-risc-...
- demondemidi 3y ago
  Really? Specific security requirements for iot devices “have always” been in existence? I’d really like to know the source for that. I sound snarky because I work in security and am unfamiliar with what you describe. I could also not be very good at my job.
  - xondono 3y ago
    No, but devices have strict regulations and paperwork intended to keep people safe. Keeping people safe when it comes to software means first and foremost having good security.
  - rcxdude 3y ago
    I think they were speaking more generally: the requirements in the legislation are similar in structure to the kind of safety/serviceability requirements that already exist for hardware being sold in the EU (much of which is just self-certifying you have implemented the relevant standards). Having security requirements and applying them to pure software products is what's new.

hcfman 3y ago

Very optimistic. Call me a cynic.

snowpid 3y ago
so what would happen instead? The only alternative is using close source (which does have disadvantage, being not cheaper etc.),
- narag 3y ago
  Outsourcing any function that needs software outside the EU.
  - snowpid 3y ago
    Moving out your business out of EU is somehow a non solution.
    - narag 3y ago
      I didn't say it's a solution.
    - bluGill 3y ago
      If you live in the EU it is hard to move. You have to find a country that will let you in. Most countries restrict immigration and so you are likely to only file a country that is dangerous to live in. You also leave your friends and extended family behind, which is difficult. That assumes it is your company to move in the first place. Which is unlikely. So add find a new job to the list of things you need to do.
  - lars_francke 3y ago
    The CRA still applies as soon as it is first brought onto the EU market. It might just be the distributor or importer having to do some things instead of the manufacturer.
    - narag 3y ago
      I mean the software is never used inside the EU. The final product is built outside and later imported, so you don't know what software was used. An example: EU is approving very restrictive legislation about pesticides for use inside the EU but it happily allows importing food grown in other countries using the very same forbidden substances.
      - snowpid 3y ago
        still CRA applies.
        FredPret 3y ago
        This is the weirdest form of colonization. In bygone days, we had to accept European monarchs; now we have to live with the diktats of their bureaucrats.
        sgift 3y ago
        No colonization happening. If you don't want to follow the CRA, then don't make a product that gets into the EU market. If you want in the EU market, you have to follow EUs rules.
        narag 3y ago
        Maybe you're misunderstanding what I said. Otherwise it would be ridiculous. If I buy a screw made in the USA, no EU authority can know what's the software used in the machine tool. They can control physical properties, packaging, information... but the process used is opaque.
      - lars_francke 3y ago
- pjc50 3y ago
  As with CE marking: there's very little enforcement, so people would carry on downloading solutions from outside the EU and ignoring the rules. See the entire Aliexpress market.

hyperpape 3y ago

You haven't given any mechanism that would make this happen. Specifically, some reason that the company would see contributing be beneficial to it. Of course, it benefits from the existence of open-source as a whole, but what material difference does its contribution make? Take a small-medium sized business (say 5 - 50€ million annual revenue). Perhaps it can fund one library that is critical to it, but no contribution it makes will make a material difference to the trajectory of major products like Linux, or Python.

Certhas 3y ago
The mechanism is clear: If you use Open Source software commercially, you are now liable if the software misbehaves. Thus, you have an incentive to make sure the software is correct. For (A)GPL software, you have to publish your contributions. Not a lawyer, but it also seems to me that if you are a small shop, you might decide to pay, e.g. RedHat for taking on the liability. RedHat can pool these resources to make sure their software behaves as advertised.
- pabs3 3y ago
  (A)GPL don't require publication, just giving code to your users, who may or may not elect to further distribute the code.
- hightrix 3y ago
  > If you use Open Source software commercially, you are now liable if the software misbehaves. Thus, you have an incentive to make sure the software is correct. As a software developer at a non-tech firm, I can gaurantee this means we will not be able to use any open source software. If we are granted an exception, it will be such that we must maintain a private version of the open source software. This is simply a no-go for many companies of all sizes. The risk associated here is not something many (any?) legal department will be willing to take on.
  - Certhas 3y ago
    You just ignored the second part of my message? If your company is not willing to pay someone (another company ) for making sure the open source software used is actually working properly (and for assuming liability if it doesn't), then it can't use open source software. But then, what does open source lose when losing for profit users that are not willing to contribute back?

xondono 3y ago

I very much doubt it, and it’s probably going to do the opposite. CRA just brings the kind paperwork that physical products have always had to be licensed in the EU (CE marking) to software. Have you seen european companies investing in Open source hardware? The path of least resistance will be to use homegrown alternatives and sell them to potential investors and shareholders as valuable intellectual property that puts them ahead of competitors. Not only because that makes perfect business sense, but because this kind of IP is very hard to value fairly, so it will allow for a variety of accounting and tax avoidance shenanigans.

snowpid 3y ago
For a useful comparison you need to show if open source hardware is more common / more invested in other parts of the world. E. G. Risc V has a growing momentum https://riscv.org/blog/2023/07/the-growing-momentum-of-risc-v-in-europe/ https://riscv.org/blog/2023/07/the-growing-momentum-of-risc-...
demondemidi 3y ago
Really? Specific security requirements for iot devices “have always” been in existence? I’d really like to know the source for that. I sound snarky because I work in security and am unfamiliar with what you describe. I could also not be very good at my job.
- xondono 3y ago
  No, but devices have strict regulations and paperwork intended to keep people safe. Keeping people safe when it comes to software means first and foremost having good security.
- rcxdude 3y ago
  I think they were speaking more generally: the requirements in the legislation are similar in structure to the kind of safety/serviceability requirements that already exist for hardware being sold in the EU (much of which is just self-certifying you have implemented the relevant standards). Having security requirements and applying them to pure software products is what's new.