4 ms·

Even if you get past the roadblocks Apple has put in place, it’s not beer and skittles for browser makers in the EU. The CRA, which is now in effect, lists bro

Even if you get past the roadblocks Apple has put in place, it’s not beer and skittles for browser makers in the EU. The CRA, which is now in effect, lists browsers as class I important products. Technical documentation, design documentation, user documentation, security conformance testing, a declared support period at the time of download, software bill of materials, the legal obligation to respond to and make all your internal documents available to market surveillance organizations, etc. And if the EU doesn’t publish harmonized development standards by 2027, you will be required to pay a 3rd party to come in and analyze you, your design, and the security of your browser, and make a report to send to the market surveillance organization, who gets to decide if you have the requisite conformance. Are you sure that anyone but the big boys want to make a browser in the EU? Here is the law, please point out where I am wrong. Much appreciated :) https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L_202402847 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L...

op00to 1y ago
Holy cow, they’re serious: Penalties: • Up to €15 million or 2.5 % of global turnover for essential requirement failures. • €10 million or 2 % turnover for other obligations. • €5 million or 1 % turnover for misleading or incomplete documents On the one hand, these are important standards. On the other, it seems impossible for small shops to adhere to a lot of this.
- FirmwareBurner 1y ago
  Hear me out, I have a tinfoil hat theory. What if, those requirements weren't put to help small shops making a new browser, but to guarantee the big shops who already have a browser are getting fined? *hits bong*
  - gjsman-1000 1y ago
    And this is why the EU's GDP versus the US is now only 65% and shrinking. The regulations are about beating US companies into compliance, sometimes with righteous motives; but there's no forethought on how a domestic EU startup might be able to comply, or how a startup would convince investors to take the gamble.
    - hshdhdhj4444 1y ago
      Yeah, because EU software companies were totally destroying the American software industry before the last decade… The EU’s relatively shrinking GDP has much more to do with their populations growing older and their population size stabilizing, and the relatively tiny amount of migration, than EU digital laws, most of which have been replicated throughout the world. Additionally, the EU has always had weak financial markets, and the only strong financial center, the city of London, quit the EU and both the EU and the city of London have suffered because of that, with a whole bunch of LSE listed companies moving to New York (including possibly Shell, which would be devastating for London as a financial center).
      - gjsman-1000 1y ago
        That's not necessarily true; as the EU had many major players, especially historically: SUSE, Ericsson, Nokia, SAP; all were or are being shredded by US competition despite a domestically entrenched position. Even in 2008, when both economies did badly, the EU and the US had nearly identical GDP figures. The EU might point to ASML as a point of pride; but that assumes an ASML competitor wouldn't get tens of billions to compete the moment ASML is inconvenient.
        FirmwareBurner 1y ago
        ASML (plus Airbus, SAP and Spotify) can't feed 300 million EU workers. Europe needs more than just a point of pride on the entire continent to be an economic powerhouse. Like we say in my country: "a single bloomed flower does not make spring".
        Rexxar 1y ago
        2008 was a point where euro was overvalued compared to dollar at 1.60$ after the subprime crises. It's not a significant number.
      - FirmwareBurner 1y ago
        >The EU’s relatively shrinking GDP has much more to do with their populations growing older I'm not buying this argument. Same how the US's economy isn't stronger because Americans have more kids because we're not talking about agrarian civilizations here where every pair of hands on the farm ads proportional labor output. In service based economies, a smart person with a wealthy VC behind him can generate the GDP growth of tens of thousands of traditional labor jobs so population growth isn't the bottleneck. EU economy is weak not because of lack of more kids, but because they have not captured any high growth industries (specifically tech) to generate better jobs and new wealth for future generations of youth. Europe is all old wealth and in the hands of old people. Once the economy becomes a fixed pie with no growth, population growth follows suit. EU economy is weak because after 2008 they went the route of austerity while the US printed it's way out dumping cheap money on fueling economic growth. If Europeans would hypothetically start having way more kids tomorrow, those kids would end up being even poorer having to share the same fixed pie of limited economic resources. Another argument why more kids != wealthier for Europeans, is a news I read today of another local university graduate who moved his start-up to the US, so what's the point in making more kids if they have no funds to increase the GPD here and they leave? More kids with no comparable growth in money = those kids competing with India or Bangladesh.
  - op00to 1y ago
    Probably the case!
- poisonborz 1y ago
  Watch them not enforce this at all whenever they need something from the US, like how they delayed (and afaik still do) heavy Google/Meta/Apple fines for DMA. Laws don't matter, only enforcement. See TikTok ban.
  - swat535 1y ago
    This is the biggeest issue that techies on HN don't understand. These tech giants are essentially extensions of the United State's government now and fining them or imposing restrictions isn't as simple as fining any corporation due to the geopolitics at play. The long term solution is for EU to decouple its reliance on American technology. Anything else is a bandaid IMO.
    - poisonborz 1y ago
      The problem is not the technical reliance, EU is relying on the US, full stop. This isn't a question of making a new EU cloud hosting provider (already hard). This turn of events was completely unexpected and decades of strategizing crumbled.
      - ahju 1y ago
        [dead]
dns_snek 1y ago
As usual this is a panicked overreaction. No, startups won't be fined out of existence by the iron fist of regulators who despise innovation. > (93) In relation to microenterprises and small enterprises, in order to ensure proportionality, it is appropriate to alleviate administrative costs without affecting the level of cybersecurity protection [...] It is therefore appropriate for the Commission to establish a simplified technical documentation form targeted at the needs of microenterprises and small enterprises. [...] In doing so, the form would contribute to alleviating the administrative compliance burden by providing the enterprises concerned with legal certainty about the extent and detail of information to be provided. [...] > (96) In order to ensure proportionality, conformity assessment bodies, when setting the fees for conformity assessment procedures, should take into account the specific interests and needs of microenterprises and small and medium-sized enterprises, including start-ups. In particular, conformity assessment bodies should apply the relevant examination procedure and tests provided for in this Regulation only where appropriate and following a risk-based approach > (97) The objectives of regulatory sandboxes should be to foster innovation and competitiveness for businesses by establishing controlled testing environments before the placing on the market of products with digital elements. Regulatory sandboxes should contribute to improve legal certainty for all actors that fall within the scope of this Regulation and facilitate and accelerate access to the Union market for products with digital elements, in particular when provided by microenterprises and small enterprises, including start-ups. > (118) [...] specify the simplified documentation form targeted at the needs of microenterprises and small enterprises, and decide on corrective or restrictive measures at Union level in exceptional circumstances which justify an immediate intervention [...] > (120) [...] When deciding on the amount of the administrative fine in each individual case, all relevant circumstances of the specific situation should be taken into account [...], including whether the manufacturer is a microenterprise or a small or medium-sized enterprise, including a start-up [...]. Given that administrative fines do not apply to microenterprises or small enterprises for a failure to meet the 24-hour deadline for the early warning notification of actively exploited vulnerabilities or severe incidents having an impact on the security of the product with digital elements, nor to open-source software stewards for any infringement of this Regulation, and subject to the principle that penalties should be effective, proportionate and dissuasive, Member States should not impose other kinds of penalties with pecuniary character on those entities.
danbruc 1y ago
We are not generally used to this in our field but just think about the amount of paperwork you have to go through in order to construct a bridge or an airplane. Browsers have become a critical component and it seem not really unexpected that there will eventually be legal requirements to help to ensure that browsers are safe given the amount of software that runs on top of browsers. And this is also not new, there have been legal requirements for all kinds of software for a long time, you will just not think about those unless you work in an affected area.
- Seattle3503 1y ago
  How will regulations on browsers make us safer though?
  - troupo 1y ago
    By making their implementors responsible for implementation and safety errors, presumably. See every other engineering profession and business
  - isomorphic 1y ago
    Right. Define "safe." Personally I consider Chrome to be one of the least-safe browsers available, because it sends my data to Google. Also it perpetuates a monoculture. However, others may define "safe" differently, excluding such considerations.
- dmitrygr 1y ago
  Are you seriously suggesting that becoming more regulated like bridge/building builders is GOOD for software? You sure you are ready to freeze all innovation forever? Cause there is a well documented inverse relationship between regulation and innovation. (Small teams cannot afford compliance officers and other such dross. Big ones do move fast, and, without competition from the smells, do not need to)
  - account42 1y ago
    For software used by regular people who do not know anything about software and shouldn't have to, used to manage their banking, do their taxes and other things that they need to be able to do online these days? Yes.
GGByron 1y ago
> "Are you sure that anyone but the big boys want to make a browser in the EU?" Surely that's the point - a collusive oligopoly making end runs around the "free market". Just look at all the other replies, rich with apologia.
hungmung 1y ago
Can somebody tell me if this applies to FOSS browsers?
- paisawalla 1y ago
  Someone will need to establish an entity to bring a distributable version of that browser to an app store, and in doing so, taking on the compliance liability.
  - krzyk 1y ago
    Doesn't Firefox already have it? Or the requirements for Apple store different from Google in EU?

op00to 1y ago

Holy cow, they’re serious: Penalties: • Up to €15 million or 2.5 % of global turnover for essential requirement failures. • €10 million or 2 % turnover for other obligations. • €5 million or 1 % turnover for misleading or incomplete documents On the one hand, these are important standards. On the other, it seems impossible for small shops to adhere to a lot of this.

FirmwareBurner 1y ago
Hear me out, I have a tinfoil hat theory. What if, those requirements weren't put to help small shops making a new browser, but to guarantee the big shops who already have a browser are getting fined? *hits bong*
- gjsman-1000 1y ago
  And this is why the EU's GDP versus the US is now only 65% and shrinking. The regulations are about beating US companies into compliance, sometimes with righteous motives; but there's no forethought on how a domestic EU startup might be able to comply, or how a startup would convince investors to take the gamble.
  - hshdhdhj4444 1y ago
    Yeah, because EU software companies were totally destroying the American software industry before the last decade… The EU’s relatively shrinking GDP has much more to do with their populations growing older and their population size stabilizing, and the relatively tiny amount of migration, than EU digital laws, most of which have been replicated throughout the world. Additionally, the EU has always had weak financial markets, and the only strong financial center, the city of London, quit the EU and both the EU and the city of London have suffered because of that, with a whole bunch of LSE listed companies moving to New York (including possibly Shell, which would be devastating for London as a financial center).
    - gjsman-1000 1y ago
      That's not necessarily true; as the EU had many major players, especially historically: SUSE, Ericsson, Nokia, SAP; all were or are being shredded by US competition despite a domestically entrenched position. Even in 2008, when both economies did badly, the EU and the US had nearly identical GDP figures. The EU might point to ASML as a point of pride; but that assumes an ASML competitor wouldn't get tens of billions to compete the moment ASML is inconvenient.
      - FirmwareBurner 1y ago
        ASML (plus Airbus, SAP and Spotify) can't feed 300 million EU workers. Europe needs more than just a point of pride on the entire continent to be an economic powerhouse. Like we say in my country: "a single bloomed flower does not make spring".
      - Rexxar 1y ago
        2008 was a point where euro was overvalued compared to dollar at 1.60$ after the subprime crises. It's not a significant number.
    - FirmwareBurner 1y ago
      >The EU’s relatively shrinking GDP has much more to do with their populations growing older I'm not buying this argument. Same how the US's economy isn't stronger because Americans have more kids because we're not talking about agrarian civilizations here where every pair of hands on the farm ads proportional labor output. In service based economies, a smart person with a wealthy VC behind him can generate the GDP growth of tens of thousands of traditional labor jobs so population growth isn't the bottleneck. EU economy is weak not because of lack of more kids, but because they have not captured any high growth industries (specifically tech) to generate better jobs and new wealth for future generations of youth. Europe is all old wealth and in the hands of old people. Once the economy becomes a fixed pie with no growth, population growth follows suit. EU economy is weak because after 2008 they went the route of austerity while the US printed it's way out dumping cheap money on fueling economic growth. If Europeans would hypothetically start having way more kids tomorrow, those kids would end up being even poorer having to share the same fixed pie of limited economic resources. Another argument why more kids != wealthier for Europeans, is a news I read today of another local university graduate who moved his start-up to the US, so what's the point in making more kids if they have no funds to increase the GPD here and they leave? More kids with no comparable growth in money = those kids competing with India or Bangladesh.
- op00to 1y ago
  Probably the case!
poisonborz 1y ago
Watch them not enforce this at all whenever they need something from the US, like how they delayed (and afaik still do) heavy Google/Meta/Apple fines for DMA. Laws don't matter, only enforcement. See TikTok ban.
- swat535 1y ago
  This is the biggeest issue that techies on HN don't understand. These tech giants are essentially extensions of the United State's government now and fining them or imposing restrictions isn't as simple as fining any corporation due to the geopolitics at play. The long term solution is for EU to decouple its reliance on American technology. Anything else is a bandaid IMO.
  - poisonborz 1y ago
    The problem is not the technical reliance, EU is relying on the US, full stop. This isn't a question of making a new EU cloud hosting provider (already hard). This turn of events was completely unexpected and decades of strategizing crumbled.
    - ahju 1y ago
      [dead]

dns_snek 1y ago

As usual this is a panicked overreaction. No, startups won't be fined out of existence by the iron fist of regulators who despise innovation. > (93) In relation to microenterprises and small enterprises, in order to ensure proportionality, it is appropriate to alleviate administrative costs without affecting the level of cybersecurity protection [...] It is therefore appropriate for the Commission to establish a simplified technical documentation form targeted at the needs of microenterprises and small enterprises. [...] In doing so, the form would contribute to alleviating the administrative compliance burden by providing the enterprises concerned with legal certainty about the extent and detail of information to be provided. [...] > (96) In order to ensure proportionality, conformity assessment bodies, when setting the fees for conformity assessment procedures, should take into account the specific interests and needs of microenterprises and small and medium-sized enterprises, including start-ups. In particular, conformity assessment bodies should apply the relevant examination procedure and tests provided for in this Regulation only where appropriate and following a risk-based approach > (97) The objectives of regulatory sandboxes should be to foster innovation and competitiveness for businesses by establishing controlled testing environments before the placing on the market of products with digital elements. Regulatory sandboxes should contribute to improve legal certainty for all actors that fall within the scope of this Regulation and facilitate and accelerate access to the Union market for products with digital elements, in particular when provided by microenterprises and small enterprises, including start-ups. > (118) [...] specify the simplified documentation form targeted at the needs of microenterprises and small enterprises, and decide on corrective or restrictive measures at Union level in exceptional circumstances which justify an immediate intervention [...] > (120) [...] When deciding on the amount of the administrative fine in each individual case, all relevant circumstances of the specific situation should be taken into account [...], including whether the manufacturer is a microenterprise or a small or medium-sized enterprise, including a start-up [...]. Given that administrative fines do not apply to microenterprises or small enterprises for a failure to meet the 24-hour deadline for the early warning notification of actively exploited vulnerabilities or severe incidents having an impact on the security of the product with digital elements, nor to open-source software stewards for any infringement of this Regulation, and subject to the principle that penalties should be effective, proportionate and dissuasive, Member States should not impose other kinds of penalties with pecuniary character on those entities.

danbruc 1y ago

We are not generally used to this in our field but just think about the amount of paperwork you have to go through in order to construct a bridge or an airplane. Browsers have become a critical component and it seem not really unexpected that there will eventually be legal requirements to help to ensure that browsers are safe given the amount of software that runs on top of browsers. And this is also not new, there have been legal requirements for all kinds of software for a long time, you will just not think about those unless you work in an affected area.

Seattle3503 1y ago
How will regulations on browsers make us safer though?
- troupo 1y ago
  By making their implementors responsible for implementation and safety errors, presumably. See every other engineering profession and business
- isomorphic 1y ago
  Right. Define "safe." Personally I consider Chrome to be one of the least-safe browsers available, because it sends my data to Google. Also it perpetuates a monoculture. However, others may define "safe" differently, excluding such considerations.
dmitrygr 1y ago
Are you seriously suggesting that becoming more regulated like bridge/building builders is GOOD for software? You sure you are ready to freeze all innovation forever? Cause there is a well documented inverse relationship between regulation and innovation. (Small teams cannot afford compliance officers and other such dross. Big ones do move fast, and, without competition from the smells, do not need to)
- account42 1y ago
  For software used by regular people who do not know anything about software and shouldn't have to, used to manage their banking, do their taxes and other things that they need to be able to do online these days? Yes.

GGByron 1y ago

> "Are you sure that anyone but the big boys want to make a browser in the EU?" Surely that's the point - a collusive oligopoly making end runs around the "free market". Just look at all the other replies, rich with apologia.

hungmung 1y ago

Can somebody tell me if this applies to FOSS browsers?

paisawalla 1y ago
Someone will need to establish an entity to bring a distributable version of that browser to an app store, and in doing so, taking on the compliance liability.
- krzyk 1y ago
  Doesn't Firefox already have it? Or the requirements for Apple store different from Google in EU?