3 ms·

It does seem like they have explicit provisions to exempt those distributing non-commercial OS/FOSS from these requirements. This is in keeping with the EU's pr

It does seem like they have explicit provisions to exempt those distributing non-commercial OS/FOSS from these requirements. This is in keeping with the EU's promotion/funding of public benefit software.

fred_is_fred 2y ago
If a company uses free software in building their product, how does the law apply here. Does the liability fall on the commercial use or the original provider? Or what if the open source library itself is provided by a company. Let’s say Intel’s IPMI library has a vulnerability that affects Dell servers and causes a breach at a bank in Paris.
- orwin 2y ago
  It's on the commercial user. Basically if you don't pay for support you're liable for the issues, at least in my only experience: a company I worked for decided to stop paying for Atos/Bullion support because of how shitty/useless it was, and the only reason the CEO agreed was that we could instead use Redhat software and support to take on part of the liability.
- immibis 2y ago
  AFAIK if you take open source software, provided without liability, and use it commercially then you take the liability for that product, since you can't shift it to the creator, since they're volunteering for free. Which seems like common sense to me. It's good when the law mirrors common sense.
  - x0x0 2y ago
    > AFAIK if you take open source software, provided without liability, and use it commercially then you take the liability for that product, since you can't shift it to the creator, since they're volunteering for free. That is incorrect per my understanding. If that open source org offers eg paid support, they likely have liability, at least in the EU. Now they're probably, practically speaking, judgement proof. But they do have liability. see [1] [1] https://ubuntu.com/blog/the-cyber-resilience-act-what-it-means-for-open-source https://ubuntu.com/blog/the-cyber-resilience-act-what-it-mea...
    - immibis 2y ago
      Okay, but then they're selling a product, not volunteering. And the law is that people who sell software can be liable for that software. Which makes sense. This is how every other product on the market works. Note that "can be liable" does not mean "will pay so much money they go bankrupt". It just means that normal liability rules will apply and that person is not shielded from liability. If I sold you a broken car saying it was in perfect order, I may be liable, but if I can prove a mechanic told me it was in perfect order and I didn't break it after that, I may be able to transfer my liability to them. Now, if because the car was faulty, you crashed into a children's picnic, your car exploded into flames and and killed an entire orphanage, I or the mechanic may still go bankrupt paying their medical bills...
      - x0x0 2y ago
        "selling" a product for $0 is an insane twisting of english and common sense. And something now that only idiots do. And the reason no physical world analogies apply in the slightest is even if you give away (not sell) a car or some other physical possession, you don't sell a million copies and incur liability across a million users. For that same $0 cost. While that free download incurs effectively unbounded liability.
        immibis 2y ago
        Wait, so this paid support is $0 support? Then how is it paid?
        x0x0 2y ago
        taking $1 in support creates the obligation to anyone and everyone. Not the people who paid.
        immibis 2y ago
        If I give away free cookies I baked just to feed people and they develop minor food poisoning, I may be shielded by the fact I was volunteering in good faith. If I give away free cookies with the logo of some big event to advertise that event, now it's commercial and I may be liable for the cookies because I'm backed by the money of that big event and should have been held to a higher standard.
- fjfaase 2y ago
  What I understand (from having attended some Dutch government meetings about this), is that companies are liable and should make an assessment of all third party libraries that they are using with respect to the risk involved with cyber security. Furthermore, they should actively monitor any security updates of those third party libraries and incorporate fixes in their own software and push those to users of their software. This does include embedded software in the devices they sell. This applies to all software that is part of a commercial interaction, no matter whether the other party has to pay for the software or not. The software could be part of a device or be part of a certain service. I understood that as long as the developers of open software are not involved in a commercial interaction, they cannot be held liable. I guess that if you receive some kind of support (a grant) for developing open source software, you are not immediately in a commercial interaction. But if you have some kind of agreement with an organization to develop or maintain open source software specific for that organization, that could count as commercial interaction.
  - x0x0 2y ago
    > But if you have some kind of agreement with an organization to develop or maintain open source software specific for that organization, that could count as commercial interaction. I think that's the risk. It's not clear what counts as a commercial interaction. eg I built a lib used for data analysis of bio samples. I have occasionally done some consulting for users, but nothing in over a decade. Does that count as commercial interaction? It's unclear to me. I'm considering deleting the open source and/or updating the license to ban the EU. Like obviously this is a very low probability risk, but I don't care to take any risks for something that I give away for free :shrug: Separately, the idea that I have to have a security policy or any other thing; I decline.
    - fjfaase 2y ago
      I understand your worries as they were one of my reasons to join these government organized briefings. It seems very unlikely that such a lib in itself has any cyber security risk as long as it itself does not query an external database through a network connection. The users of the lib have to asses that it has no security risk. Did you sign any formal agreement with the users of the lib? Is there still any obligsation on your side with respect to the lib? If you would discover some security issue, like a buffer overrun, would you fix it? Then just mentioning it, would be enough. The users of the lib bear the greatest responsibility. They have to regularly check your lib for security problems.
- cookiengineer 2y ago
  That is what the safety and cyber security certification process is for. In your given example, that's iso27001/13/15 depending on what the bank itself does in their operation. The company owning the certification owns the responsibility. No cheating through cheap cyber security consultant chop shops from India anymore.

fred_is_fred 2y ago

If a company uses free software in building their product, how does the law apply here. Does the liability fall on the commercial use or the original provider? Or what if the open source library itself is provided by a company. Let’s say Intel’s IPMI library has a vulnerability that affects Dell servers and causes a breach at a bank in Paris.

orwin 2y ago
It's on the commercial user. Basically if you don't pay for support you're liable for the issues, at least in my only experience: a company I worked for decided to stop paying for Atos/Bullion support because of how shitty/useless it was, and the only reason the CEO agreed was that we could instead use Redhat software and support to take on part of the liability.
immibis 2y ago
AFAIK if you take open source software, provided without liability, and use it commercially then you take the liability for that product, since you can't shift it to the creator, since they're volunteering for free. Which seems like common sense to me. It's good when the law mirrors common sense.
- x0x0 2y ago
  > AFAIK if you take open source software, provided without liability, and use it commercially then you take the liability for that product, since you can't shift it to the creator, since they're volunteering for free. That is incorrect per my understanding. If that open source org offers eg paid support, they likely have liability, at least in the EU. Now they're probably, practically speaking, judgement proof. But they do have liability. see [1] [1] https://ubuntu.com/blog/the-cyber-resilience-act-what-it-means-for-open-source https://ubuntu.com/blog/the-cyber-resilience-act-what-it-mea...
  - immibis 2y ago
    Okay, but then they're selling a product, not volunteering. And the law is that people who sell software can be liable for that software. Which makes sense. This is how every other product on the market works. Note that "can be liable" does not mean "will pay so much money they go bankrupt". It just means that normal liability rules will apply and that person is not shielded from liability. If I sold you a broken car saying it was in perfect order, I may be liable, but if I can prove a mechanic told me it was in perfect order and I didn't break it after that, I may be able to transfer my liability to them. Now, if because the car was faulty, you crashed into a children's picnic, your car exploded into flames and and killed an entire orphanage, I or the mechanic may still go bankrupt paying their medical bills...
    - x0x0 2y ago
      "selling" a product for $0 is an insane twisting of english and common sense. And something now that only idiots do. And the reason no physical world analogies apply in the slightest is even if you give away (not sell) a car or some other physical possession, you don't sell a million copies and incur liability across a million users. For that same $0 cost. While that free download incurs effectively unbounded liability.
      - immibis 2y ago
        Wait, so this paid support is $0 support? Then how is it paid?
        x0x0 2y ago
        taking $1 in support creates the obligation to anyone and everyone. Not the people who paid.
        immibis 2y ago
        If I give away free cookies I baked just to feed people and they develop minor food poisoning, I may be shielded by the fact I was volunteering in good faith. If I give away free cookies with the logo of some big event to advertise that event, now it's commercial and I may be liable for the cookies because I'm backed by the money of that big event and should have been held to a higher standard.
fjfaase 2y ago
What I understand (from having attended some Dutch government meetings about this), is that companies are liable and should make an assessment of all third party libraries that they are using with respect to the risk involved with cyber security. Furthermore, they should actively monitor any security updates of those third party libraries and incorporate fixes in their own software and push those to users of their software. This does include embedded software in the devices they sell. This applies to all software that is part of a commercial interaction, no matter whether the other party has to pay for the software or not. The software could be part of a device or be part of a certain service. I understood that as long as the developers of open software are not involved in a commercial interaction, they cannot be held liable. I guess that if you receive some kind of support (a grant) for developing open source software, you are not immediately in a commercial interaction. But if you have some kind of agreement with an organization to develop or maintain open source software specific for that organization, that could count as commercial interaction.
- x0x0 2y ago
  > But if you have some kind of agreement with an organization to develop or maintain open source software specific for that organization, that could count as commercial interaction. I think that's the risk. It's not clear what counts as a commercial interaction. eg I built a lib used for data analysis of bio samples. I have occasionally done some consulting for users, but nothing in over a decade. Does that count as commercial interaction? It's unclear to me. I'm considering deleting the open source and/or updating the license to ban the EU. Like obviously this is a very low probability risk, but I don't care to take any risks for something that I give away for free :shrug: Separately, the idea that I have to have a security policy or any other thing; I decline.
  - fjfaase 2y ago
    I understand your worries as they were one of my reasons to join these government organized briefings. It seems very unlikely that such a lib in itself has any cyber security risk as long as it itself does not query an external database through a network connection. The users of the lib have to asses that it has no security risk. Did you sign any formal agreement with the users of the lib? Is there still any obligsation on your side with respect to the lib? If you would discover some security issue, like a buffer overrun, would you fix it? Then just mentioning it, would be enough. The users of the lib bear the greatest responsibility. They have to regularly check your lib for security problems.
cookiengineer 2y ago
That is what the safety and cyber security certification process is for. In your given example, that's iso27001/13/15 depending on what the bank itself does in their operation. The company owning the certification owns the responsibility. No cheating through cheap cyber security consultant chop shops from India anymore.