6 ms·

This just further incentivises over-regulatory EU to keep making burdensome regulation that slows down innovation for everyone. It is better for open source pr

This just further incentivises over-regulatory EU to keep making burdensome regulation that slows down innovation for everyone. It is better for open source projects to just pass a license claiming, software is not available for free in EU and to make EU companies pay sky high fees to use the software that is freely available for everyone else. That way EU bureaucrats will stop trying to be the World Police without paying the price that USA has to pay to keep its global influence (like funding military of other nations while americans die in hospitals, in homelessness , intentionally making american exports disadvantageous just to keep its global reserve currency status, etc). It is absolutely insane to me how EU thinks it can decide what charging port everyone should use USB-C , cookie banners for everyone, GDPR nightmare for everyone, and now this new government rule on opensource contributors to software being held liable for security breaches. Absolutely crazy. They just want free lunch while trying to control everyone and everything.

rwmj 2y ago
I won't bother addressing most of the nonsense you've written. I'll just say that the US has FedRAMP (https://en.wikipedia.org/wiki/FedRAMP https://en.wikipedia.org/wiki/FedRAMP) and EO 14028 (https://www.federalregister.gov/documents/2021/05/17/2021-10460/improving-the-nations-cybersecurity https://www.federalregister.gov/documents/2021/05/17/2021-10...). So if you imagine that this is somehow an EU-specific thing and doesn't affect the US, you're very wrong. Not to mention NIST and FIPS and CISA.
- teitoklien 2y ago
  CRA applies to all companies, Fedramp applies to just government. All major governments have policies like this, its an issue when government tries to over regulate private matters. What government regulates inside its own workforce, is absolutely upto them. But government shouldnt interfere so much into private matters.
  - lars_francke 2y ago
    But this is not a private matter. The costs of poor cybersecurity are born mostly not by the people producing the "bad" software but by their consumers. In the end we have law enforcement dealing with ransomware attacks, cybercrime etc. and this will never fully go away but some products don't even apply basic security principles and therefore distribute the cost of this amongst everyone. Yay, they get to produce cheap crap but at which cost? I'd rather have securer products to get started with and then take it from there.
    - teitoklien 2y ago
      > I'd rather have securer products to get started with and then take it from there. Look forward to great American, Chinese and Korean software and hardware, who’ll invest 100% of their funds into innovation and growth, while EU startups keep paying for Open Source software security and subsidising this security advantage for the whole world. The non-EU companies will grow big and then buy out the EU companies, while EU citizens will be left with wonder why all the major high paying tech and R&D jobs are all outside EU. Laws like these need to be agreed upon, by all major countries together. No one country should pass policies like this which just sabotages their own people’s innovative dreams.
      - lars_francke 2y ago
        You present one possible outcome but it is far from certain. Another possible scenario is that companies investing in these principles will be way ahead when similar regulation will pop up _everywhere_ else. You also present your opinion as a factual statement: "Laws like these need to be..." -> No, they don't as can be seen by GDPR, CRA and others. I am personally affected by the CRA, I have a startup here in Europe and I see this as a great chance for EU, FOSS and Software Development in general.
        teitoklien 2y ago
        > No, they don't as can be seen by GDPR, CRA and others. You’re optimism is great, tbh I am extremely cynical. But name one Fortune 50 tech company making great profits giving high salaries to EU devs and R&D folks that isnt relying on Government Funding from EU except SAP & ASML. Europe has far higher education outcomes for its young graduates, than both America and India. There is almost no student debt in most major EU countries. Yet why is it that not just America, even India a significantly poorer country, with worse infrastructure, bad quality colleges which forces their brightest minds to come to EU, America and Australia to study in higher education. And YET they do better than Europe when it comes to Tech ? Why ? It’s not just cheap labour, other places have even cheaper labour and more lax regulations. I’m just saying the reality, I love your optimism, but I wish EU bureaucrats were actually that effective. GDPR just allows non-EU companies to grow big in their domestic markets and then they think about regulations more and enter the EU market. While EU companies have to think of laws from the beginning. Security isn’t some black magic science which can be an intellectual secret, or give bleeding edge. It’s grunt work mostly, and gets postponed to invest in more profit generating parts of the business. If non-EU businesses think they are losing money due to lax security, they’ll flip the game, but this law doesnt do that, non-EU companies just first expand in their large domestic markets and then think about the rest later once they have more money to think of it. Consumer will definitely win from CRA, just like they did with GDPR, USB-C just in the short term. It’ll just continue forcing EU pioneers to move to America to start their business. I hope you are right and I am wrong, it would be great if a region like EU can prove that one can be great innovators while also being heavily regulated and pro-consumer in the long term. It just hasn’t happened yet, and continues to go the opposite direction. Now ASML is threatening to move elsewhere too (albeit for different reason).
fermigier 2y ago
"USB-C" -> Good for consumer, I believe. "cookie banners for everyone" -> cookie banners only if your website is using cookies in a way that needs a cookie banner. There are plenty of sites or web analytics technologies that don't mandate the use of a cookie banner. "GDPR nightmare for everyone" -> only for companies that intend touse personal data in non-ethical ways (cf. for instance: https://www.iccl.ie/digital-data/europes-hidden-security-crisis/ https://www.iccl.ie/digital-data/europes-hidden-security-cri... ). "now this new government rule on opensource contributors to software being held liable for security breaches." -> Indeed, that's problematic, specially the way this was (not) discussed with the open source sector. Cf. https://cnll.fr/news/la-france-doit-prot%C3%A9ger-sa-fili%C3%A8re-du-logiciel-libre-des-effets-de-bord-du-cyber-resilience-act-cra/ https://cnll.fr/news/la-france-doit-prot%C3%A9ger-sa-fili%C3... and https://cnll.fr/news/declaration-cra-cyber-resilience-act/ https://cnll.fr/news/declaration-cra-cyber-resilience-act/ (two texts that I wrote, in French, last year).
- teitoklien 2y ago
  "USB-C" -> Good for consumer, I believe With the same logic EU had tried to make Micro USB mandatory for everyone, it was a very poorly executed charging port which would break often and easily. If it was made industry standard back then, USB-C would have probably never come along or would have taken much much longer. The road to hell is paved with good intention, I doubt any decent government (which EU is) would pass laws that is bad for its people in short term. It’s just that these burden some regulations backfire in the long term. The problems with GDPR and Cookie Banner are well documented, it puts EU startups at a disadvantage because of having to pass all regulations before they can innovate and get up from the ground. Regulations like this should not apply to startups, the harm done to economy is far more than harm done to the public. Or else , EU citizens will forever be left using American Software, driving Japanese cars (EU car makers are in decline), use Chinese and American Robots (Largest German Robot company (KUKA Robotics) sold to China), use Chinese Solar Panels, Korean Phones, etc. I get what you’re saying, it all sounds sweet and good on paper. But it ends up being a race where brilliant european minds are running with 20kg weights on their shoes, while other major nations are supplying stimulants for their innovators to win the gold medal. It’s just the reality of what’s happening, if it continues EU will die a slow and painful death (Saying the truth as a well wisher for europe, they are pro-consumer in great many ways, but they are over regulating and hurting their next generation)
Lariscus 2y ago
CRA requires integrators of open source components to perform their own due diligence. Open Source contributors are not held liable for security breaches. In fact this regulation will probably increase investment in open source projects because companies are obliged to share vulnerabilities they have discovered including any relevant patches they might have developed.[1] [1] https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-for-open-source/ https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-f...
- graemep 2y ago
  That exemption only covers non-commercial open source. Anyone who monetises the open source project (e.g. by offering related consultancy or hosting business, or offering the code under a commercial license as well) is still liable. It only covers pure hobby projects by pure hobby developers.
  - Sukera 2y ago
    It doesn't only cover pure hobby projects: > (10c) the mere fact that an open-source software product receives financial support by manufacturers or that manufacturers contribute to the development of such a product should not in itself determine that the activity is of commercial nature. > (10) Accepting donations without the intention of making a profit should not be considered to be a commercial activity. > (10c).. for the purpose of this Regulation, the development of products qualifying as free and open-source software by not-for-profit organisations should not be considered a commercial activity as long as the organisation is set up in a way that ensures that all earnings after cost are used to achieve not-for-profit objectives. See https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-for-open-source/ https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-f...
    - temac 2y ago
      To be clear "related consultancy or hosting business" is still commercial. The notion of "accepting donations without the intention of making a profit" seems insane, too.
graemep 2y ago
> It is better for open source projects to just pass a license claiming, software is not available for free in EU and to make EU companies pay sky high fees to use the software that is freely available for everyone else. I have been wondering whether it would be possible to a add a limitation of liability in line with GPL3 7 a) that allows "Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License" to prevent redistribution that exposes the authors to any liability. it is definitely possible to add an indemnification clause to cover any risk under clause 7 f.
- arlcode 2y ago
  No matter what that it is not possible to override the law with a license. Of course if it is outside your local jurisdiction you can ignore but you don't need a license text for that. If it applies to you it does so regardless of your license. A court would simply rule the terms illegal. But as others said this will (arguabely) only apply to real commercial activy and in that realm you (usually9 cannot dislaim liability anyway.
  - graemep 2y ago
    > No matter what that it is not possible to override the law with a license. That is not what I am suggesting. I am wondering about ways to not allow people to redistribute in ways that increases your liability. i.e. the law would apply, but the people using it in the way that exposes you to liability would be in breach of copyright. Sadly, looking more closely at the wording, this cannot be done in a GPL comaptible way. maybe we need new licenses to cover this. > but as others said this will (arguably) only apply to real commercial activy Aguably? maybe, but we need certainty. It does look as though a lot of smaller projects and developers will be at risk here if (for example) they dual license with a paid for version available, or sell support of consultancy services.
isodev 2y ago
The EU's approach is the result of the industry not advancing enough to self-regulate. Legislation is required to outline the lines we can no longer afford to cross, and we can't turn normal people into tiny cash cows to make the already rich even richer. Both GDPR, DSA, DMA and related policy have been a win for consumers and normal people using electronic services (which is practically everyone). I expect the CRA to bring much needed awareness regarding security and that it's no longer OK to just put together something with spit and chewing gum and let people submit their personal data into it!

rwmj 2y ago

I won't bother addressing most of the nonsense you've written. I'll just say that the US has FedRAMP (https://en.wikipedia.org/wiki/FedRAMP https://en.wikipedia.org/wiki/FedRAMP) and EO 14028 (https://www.federalregister.gov/documents/2021/05/17/2021-10460/improving-the-nations-cybersecurity https://www.federalregister.gov/documents/2021/05/17/2021-10...). So if you imagine that this is somehow an EU-specific thing and doesn't affect the US, you're very wrong. Not to mention NIST and FIPS and CISA.

teitoklien 2y ago
CRA applies to all companies, Fedramp applies to just government. All major governments have policies like this, its an issue when government tries to over regulate private matters. What government regulates inside its own workforce, is absolutely upto them. But government shouldnt interfere so much into private matters.
- lars_francke 2y ago
  But this is not a private matter. The costs of poor cybersecurity are born mostly not by the people producing the "bad" software but by their consumers. In the end we have law enforcement dealing with ransomware attacks, cybercrime etc. and this will never fully go away but some products don't even apply basic security principles and therefore distribute the cost of this amongst everyone. Yay, they get to produce cheap crap but at which cost? I'd rather have securer products to get started with and then take it from there.
  - teitoklien 2y ago
    > I'd rather have securer products to get started with and then take it from there. Look forward to great American, Chinese and Korean software and hardware, who’ll invest 100% of their funds into innovation and growth, while EU startups keep paying for Open Source software security and subsidising this security advantage for the whole world. The non-EU companies will grow big and then buy out the EU companies, while EU citizens will be left with wonder why all the major high paying tech and R&D jobs are all outside EU. Laws like these need to be agreed upon, by all major countries together. No one country should pass policies like this which just sabotages their own people’s innovative dreams.
    - lars_francke 2y ago
      You present one possible outcome but it is far from certain. Another possible scenario is that companies investing in these principles will be way ahead when similar regulation will pop up _everywhere_ else. You also present your opinion as a factual statement: "Laws like these need to be..." -> No, they don't as can be seen by GDPR, CRA and others. I am personally affected by the CRA, I have a startup here in Europe and I see this as a great chance for EU, FOSS and Software Development in general.
      - teitoklien 2y ago
        > No, they don't as can be seen by GDPR, CRA and others. You’re optimism is great, tbh I am extremely cynical. But name one Fortune 50 tech company making great profits giving high salaries to EU devs and R&D folks that isnt relying on Government Funding from EU except SAP & ASML. Europe has far higher education outcomes for its young graduates, than both America and India. There is almost no student debt in most major EU countries. Yet why is it that not just America, even India a significantly poorer country, with worse infrastructure, bad quality colleges which forces their brightest minds to come to EU, America and Australia to study in higher education. And YET they do better than Europe when it comes to Tech ? Why ? It’s not just cheap labour, other places have even cheaper labour and more lax regulations. I’m just saying the reality, I love your optimism, but I wish EU bureaucrats were actually that effective. GDPR just allows non-EU companies to grow big in their domestic markets and then they think about regulations more and enter the EU market. While EU companies have to think of laws from the beginning. Security isn’t some black magic science which can be an intellectual secret, or give bleeding edge. It’s grunt work mostly, and gets postponed to invest in more profit generating parts of the business. If non-EU businesses think they are losing money due to lax security, they’ll flip the game, but this law doesnt do that, non-EU companies just first expand in their large domestic markets and then think about the rest later once they have more money to think of it. Consumer will definitely win from CRA, just like they did with GDPR, USB-C just in the short term. It’ll just continue forcing EU pioneers to move to America to start their business. I hope you are right and I am wrong, it would be great if a region like EU can prove that one can be great innovators while also being heavily regulated and pro-consumer in the long term. It just hasn’t happened yet, and continues to go the opposite direction. Now ASML is threatening to move elsewhere too (albeit for different reason).

fermigier 2y ago

"USB-C" -> Good for consumer, I believe. "cookie banners for everyone" -> cookie banners only if your website is using cookies in a way that needs a cookie banner. There are plenty of sites or web analytics technologies that don't mandate the use of a cookie banner. "GDPR nightmare for everyone" -> only for companies that intend touse personal data in non-ethical ways (cf. for instance: https://www.iccl.ie/digital-data/europes-hidden-security-crisis/ https://www.iccl.ie/digital-data/europes-hidden-security-cri... ). "now this new government rule on opensource contributors to software being held liable for security breaches." -> Indeed, that's problematic, specially the way this was (not) discussed with the open source sector. Cf. https://cnll.fr/news/la-france-doit-prot%C3%A9ger-sa-fili%C3%A8re-du-logiciel-libre-des-effets-de-bord-du-cyber-resilience-act-cra/ https://cnll.fr/news/la-france-doit-prot%C3%A9ger-sa-fili%C3... and https://cnll.fr/news/declaration-cra-cyber-resilience-act/ https://cnll.fr/news/declaration-cra-cyber-resilience-act/ (two texts that I wrote, in French, last year).

teitoklien 2y ago
"USB-C" -> Good for consumer, I believe With the same logic EU had tried to make Micro USB mandatory for everyone, it was a very poorly executed charging port which would break often and easily. If it was made industry standard back then, USB-C would have probably never come along or would have taken much much longer. The road to hell is paved with good intention, I doubt any decent government (which EU is) would pass laws that is bad for its people in short term. It’s just that these burden some regulations backfire in the long term. The problems with GDPR and Cookie Banner are well documented, it puts EU startups at a disadvantage because of having to pass all regulations before they can innovate and get up from the ground. Regulations like this should not apply to startups, the harm done to economy is far more than harm done to the public. Or else , EU citizens will forever be left using American Software, driving Japanese cars (EU car makers are in decline), use Chinese and American Robots (Largest German Robot company (KUKA Robotics) sold to China), use Chinese Solar Panels, Korean Phones, etc. I get what you’re saying, it all sounds sweet and good on paper. But it ends up being a race where brilliant european minds are running with 20kg weights on their shoes, while other major nations are supplying stimulants for their innovators to win the gold medal. It’s just the reality of what’s happening, if it continues EU will die a slow and painful death (Saying the truth as a well wisher for europe, they are pro-consumer in great many ways, but they are over regulating and hurting their next generation)

Lariscus 2y ago

CRA requires integrators of open source components to perform their own due diligence. Open Source contributors are not held liable for security breaches. In fact this regulation will probably increase investment in open source projects because companies are obliged to share vulnerabilities they have discovered including any relevant patches they might have developed.[1] [1] https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-for-open-source/ https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-f...

graemep 2y ago
That exemption only covers non-commercial open source. Anyone who monetises the open source project (e.g. by offering related consultancy or hosting business, or offering the code under a commercial license as well) is still liable. It only covers pure hobby projects by pure hobby developers.
- Sukera 2y ago
  It doesn't only cover pure hobby projects: > (10c) the mere fact that an open-source software product receives financial support by manufacturers or that manufacturers contribute to the development of such a product should not in itself determine that the activity is of commercial nature. > (10) Accepting donations without the intention of making a profit should not be considered to be a commercial activity. > (10c).. for the purpose of this Regulation, the development of products qualifying as free and open-source software by not-for-profit organisations should not be considered a commercial activity as long as the organisation is set up in a way that ensures that all earnings after cost are used to achieve not-for-profit objectives. See https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-for-open-source/ https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-f...
  - temac 2y ago
    To be clear "related consultancy or hosting business" is still commercial. The notion of "accepting donations without the intention of making a profit" seems insane, too.

graemep 2y ago

> It is better for open source projects to just pass a license claiming, software is not available for free in EU and to make EU companies pay sky high fees to use the software that is freely available for everyone else. I have been wondering whether it would be possible to a add a limitation of liability in line with GPL3 7 a) that allows "Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License" to prevent redistribution that exposes the authors to any liability. it is definitely possible to add an indemnification clause to cover any risk under clause 7 f.

arlcode 2y ago
No matter what that it is not possible to override the law with a license. Of course if it is outside your local jurisdiction you can ignore but you don't need a license text for that. If it applies to you it does so regardless of your license. A court would simply rule the terms illegal. But as others said this will (arguabely) only apply to real commercial activy and in that realm you (usually9 cannot dislaim liability anyway.
- graemep 2y ago
  > No matter what that it is not possible to override the law with a license. That is not what I am suggesting. I am wondering about ways to not allow people to redistribute in ways that increases your liability. i.e. the law would apply, but the people using it in the way that exposes you to liability would be in breach of copyright. Sadly, looking more closely at the wording, this cannot be done in a GPL comaptible way. maybe we need new licenses to cover this. > but as others said this will (arguably) only apply to real commercial activy Aguably? maybe, but we need certainty. It does look as though a lot of smaller projects and developers will be at risk here if (for example) they dual license with a paid for version available, or sell support of consultancy services.

isodev 2y ago

The EU's approach is the result of the industry not advancing enough to self-regulate. Legislation is required to outline the lines we can no longer afford to cross, and we can't turn normal people into tiny cash cows to make the already rich even richer. Both GDPR, DSA, DMA and related policy have been a win for consumers and normal people using electronic services (which is practically everyone). I expect the CRA to bring much needed awareness regarding security and that it's no longer OK to just put together something with spit and chewing gum and let people submit their personal data into it!