5 ms·

"As long as a project is not organized as a legal or commercial entity, the CRA requires only a basic "readme" with a security contact." I share code for the g

"As long as a project is not organized as a legal or commercial entity, the CRA requires only a basic "readme" with a security contact." I share code for the good of the industry and society. A lot of what developers do, is solving problems, and the solutions can often be time consuming and difficult to find. So there is a lot of value in Open Source. What I will not do, is accept personal liability in any way for those solutions I share. Then it becomes a professional partnership, and I will expect a contract and compensation. CRA has a simple effect for me, I will no longer share code. I have deleted my github account because of this trend to "know your developer", and as a small stand agAInst our rush towards AGI. I wonder where the liability lies for all this AI/LLM regurgitated copyrighted code?

detaro 1y ago
did you read the sentence after the one you quoted?
- whitehexagon 1y ago
  sure, I have no control if the software is monetized or not. And this is still a fundamental change in how open source works. A name behind every line of code.
  - detaro 1y ago
    The one selling it is the one that has the obligations. If a company grabs open-source code from you and sells it (e.g. as part of a bigger product) to someone else, they have to assume liability towards their customer, you don't have to be involved at all if you don't want to. That's the good thing about the carve-outs established, it's not your problem if you are just publishing your code for fun, the ball is entirely in the court of people that want to profit from it.
    - whitehexagon 1y ago
      I understand that part. But I could read 'monetized' as a project the received a donation.
      - Borealid 1y ago
        I think that's how it's intended to be read. If you allow yourself to make money from the code, you're accepting liability for it. If you choose not to accept money in exchange for it, you don't have to accept liability. This seems fair to me - the law doesn't let you both "sell" it (however low the minimum price is) and refuse to give any rights to the people who gave you money.
        hcfman 1y ago
        The big problem is reward risk. Risk is 15,000,000 euros. Reward is peanuts. In the past we could choose to work for peanuts with low risk. Now we can't. We have to work for nothing or work for a lot to have a chance of covering compliance.
        jeroenhd 1y ago
        The GDPR carries a fine risk of up to 20 million, but usually the fines are a few hundred/thousand euros depending on the entity. Think "300 euro fine to a driving school" rather than "300 million euro fine to Google". And even then, you have to be unlucky enough to actually get caught and investigated by market surveillance authorities. I think you're going to be more likely to get caught up in income/donation/gift tax bracket fraud investigation than to ever feel the impact of the CRA as a hobby open source dev.
        iamnothere 1y ago
        It would be foolish to ignore the risk, however, especially if you work on something potentially controversial, such as encryption, privacy tools, or any software that may have uses that the EU frowns upon. I strongly suspect that this will eventually be used as a cudgel against disfavored projects/devs to compel project changes or even kill the project outright (or force it to move overseas). If you’re a FOSS dev in the EU who works on something controversial, and you accept donations, it would be better to outsource the project “ownership” to someone unnamed or outside of EU jurisdiction.
- eduction 1y ago
  The sentence says you can fall under more onerous terms if the project is “organized,” whatever that means, and even under the loosest terms you are required to report security issues to an outside organization. So there is liability if you don’t. And virtually any project has arguable security issues.
  - SAI_Peregrinus 1y ago
    CYA & report all issues to said outside organization? Any bug where a feature doesn't work is a denial of service on that feature, and therefore a security issue. Lack of accessibility features is a DoS against people who need those features and thus a security issue, and so adding screenreader support is a security fix. Etc, etc.
    - eduction 1y ago
      If people knew about all the vulns in their software the vulns wouldn’t exist. You can’t disclose if you don’t know. And establishing when you “should” know or what counts as an actionable report will require basically a lawyer to untangle. CYA = hire a lawyer for your open source code. No thanks I think I’ll keep it on my drive and off GitHub.
iamnothere 1y ago
You have another alternative: share the code on a Radicle node hosted as a Tor onion site. Nobody needs to know who you are. I am hoping an anonymous ecosystem springs up due to the increasingly hostile legal environment around development.
- ale42 1y ago
  Or put code in the public domain?
eduction 1y ago
This shouldn’t be downvoted. “I do not accept liability” is literally the core of every open source license. Go look. Even MIT.
- deleted 1y ago
  [deleted]

detaro 1y ago

did you read the sentence after the one you quoted?

whitehexagon 1y ago
sure, I have no control if the software is monetized or not. And this is still a fundamental change in how open source works. A name behind every line of code.
- detaro 1y ago
  The one selling it is the one that has the obligations. If a company grabs open-source code from you and sells it (e.g. as part of a bigger product) to someone else, they have to assume liability towards their customer, you don't have to be involved at all if you don't want to. That's the good thing about the carve-outs established, it's not your problem if you are just publishing your code for fun, the ball is entirely in the court of people that want to profit from it.
  - whitehexagon 1y ago
    I understand that part. But I could read 'monetized' as a project the received a donation.
    - Borealid 1y ago
      I think that's how it's intended to be read. If you allow yourself to make money from the code, you're accepting liability for it. If you choose not to accept money in exchange for it, you don't have to accept liability. This seems fair to me - the law doesn't let you both "sell" it (however low the minimum price is) and refuse to give any rights to the people who gave you money.
      - hcfman 1y ago
        The big problem is reward risk. Risk is 15,000,000 euros. Reward is peanuts. In the past we could choose to work for peanuts with low risk. Now we can't. We have to work for nothing or work for a lot to have a chance of covering compliance.
        jeroenhd 1y ago
        The GDPR carries a fine risk of up to 20 million, but usually the fines are a few hundred/thousand euros depending on the entity. Think "300 euro fine to a driving school" rather than "300 million euro fine to Google". And even then, you have to be unlucky enough to actually get caught and investigated by market surveillance authorities. I think you're going to be more likely to get caught up in income/donation/gift tax bracket fraud investigation than to ever feel the impact of the CRA as a hobby open source dev.
        iamnothere 1y ago
        It would be foolish to ignore the risk, however, especially if you work on something potentially controversial, such as encryption, privacy tools, or any software that may have uses that the EU frowns upon. I strongly suspect that this will eventually be used as a cudgel against disfavored projects/devs to compel project changes or even kill the project outright (or force it to move overseas). If you’re a FOSS dev in the EU who works on something controversial, and you accept donations, it would be better to outsource the project “ownership” to someone unnamed or outside of EU jurisdiction.
eduction 1y ago
The sentence says you can fall under more onerous terms if the project is “organized,” whatever that means, and even under the loosest terms you are required to report security issues to an outside organization. So there is liability if you don’t. And virtually any project has arguable security issues.
- SAI_Peregrinus 1y ago
  CYA & report all issues to said outside organization? Any bug where a feature doesn't work is a denial of service on that feature, and therefore a security issue. Lack of accessibility features is a DoS against people who need those features and thus a security issue, and so adding screenreader support is a security fix. Etc, etc.
  - eduction 1y ago
    If people knew about all the vulns in their software the vulns wouldn’t exist. You can’t disclose if you don’t know. And establishing when you “should” know or what counts as an actionable report will require basically a lawyer to untangle. CYA = hire a lawyer for your open source code. No thanks I think I’ll keep it on my drive and off GitHub.

iamnothere 1y ago

You have another alternative: share the code on a Radicle node hosted as a Tor onion site. Nobody needs to know who you are. I am hoping an anonymous ecosystem springs up due to the increasingly hostile legal environment around development.

ale42 1y ago
Or put code in the public domain?

eduction 1y ago

This shouldn’t be downvoted. “I do not accept liability” is literally the core of every open source license. Go look. Even MIT.

deleted 1y ago
[deleted]