7 ms·

Who is paying FOSS devs who will be implementing this? Who is providing them with legal indemnification since they are now apparently subject to fines for a fuc

Who is paying FOSS devs who will be implementing this? Who is providing them with legal indemnification since they are now apparently subject to fines for a fucking hobby if they do it wrong? Who is making CA the only jurisdiction instead of the myriad contradictory laws all over the place? Who is stepping in to make sure no additional legislation comes across regulating how FOSS has to include backdoors or weaken encryption?

alephnerd 8mo ago
> Who is paying FOSS devs who will be implementing this Most Linux maintainers are employed by Google, IBM, Facebook, and other similarly sized organizations. > Who is making CA the only jurisdiction instead of the myriad contradictory laws all over the place The US is a federal system. It's part of our checks and balances. > Who is stepping in to make sure no additional legislation comes across regulating how FOSS has to include backdoors or weaken encryption No one. This is why organizations with actual security requirements do their own dependency checks.
- iamnothere 8mo ago
  Linux is the kernel, it has nothing to do with this. The law apparently seems to target the packager/distributor of the distribution. Many small distros are hobby distros! > The US is a federal system. It's part of our checks and balances. Nonsensical answer. Different states are passing different requirements that often contradict each other. This is going to be a nightmare. > No one. This is why organizations with actual security requirements do their own dependency checks. So you’re saying that we should expect those laws too? Because before now “code is speech” has ruled, and the US government have not been able to be so invasive about how computers should work. If this is the direction we’re headed in, we need to organize and fight like hell.
  - alephnerd 8mo ago
    > Many small distros are hobby distros... Then region lock. You don't have to support California or NY or ... > Different states are passing different requirements that often contradict each other. This is going to be a nightmare Create regional feature flags or region lock. It's a solved problem. > So you’re saying that we should expect those laws too They already de facto exist contractually speaking. > Because before now “code is speech” has ruled, and the US government have not been able to be so invasive about how computers should work The mindset around tech regulation shifted after the 2016 election and Jan 6th. The maximalist tech civil libertarian view on privacy was an anomaly from the late 1990s to early 2010s when tech was viewed as inconsequential. The 2016 election and Jan 6th showed otherwise. --- The overlap between Linux daily drivers and "voters who can flip an election in California, NY, or <insert_state_here>" is nonexistent. This also appears to be a front-run at reducing the risk of an Australia-style regulation being proposed. Edit: can't reply > Europe realized this with their new infosec liability regulations European organizations (from private sectors to government agencies) sidestep this by contractually mandating SBOM and dependency requirements. You end up with the same result, but it's essentially regulated via contracts instead of the law. > Expecting volunteers to dump time into compliance is ridiculous. Not because they oppose the idea, but because huge swaths of the internet run on people doing something for free -- and they'll just do something else if governments begin threatening them That's a decision a lot of governments and organizations are fine with. OSS where maintainers are hired by sponsor organizations is already the norm, and government-backed OSS is becoming increasingly common in the EU and much of Asia. Hobbyists who don't wish to comply can region gate within their license - that solves your liability risk and will keep regulators happy.
    - iamnothere 8mo ago
      I think it would be better to create a parallel economy of underground unrestricted distributions while encouraging everyone to openly flaunt the law, and simultaneously fighting via lawfare and media. But maybe that’s just me!
      - alephnerd 8mo ago
        > encouraging everyone to openly flaunt the law > But maybe that’s just me If you are fine taking the legal liability and are open to civil and criminal prosecution, go right ahead. Western jurisdictions tend to cooperate on extradition as well, and American free speech laws are significantly more expansive than those in the EU, Canada, or ANZ so taking a principled approach wouldn't be a viable defense if you decided to go and incite via that route. > fighting via lawfare That is being done. > and media You heard about it via the media.
        iamnothere 8mo ago
        Fine by me, I’m willing to fight. The freedom to compute is one of our most fundamental freedoms, connected inherently with freedom of thought and speech. Cowards like you don’t deserve the benefits you enjoy, and you will surely complain about their absence when they are gone!
        orwin 8mo ago
        This is not the first time I read comments from you, I just want to tell you you're probably one of the most annoyingly, reasonably correct person I read. And take it as a compliment, because each time I disagree with you I have to look at my position because I fear being on the wrong side of the argument (which is probably what I find annoying. I want to be unreasonable sometimes!).
        LtWorf 8mo ago
        He's completely incorrect in saying that most free software developers work for some USA megacorp.
whywhywhywhy 8mo ago
>Who is paying FOSS devs who will be implementing this? honestly if they let it be known they'd do it for payment the same person who's paying off the politicians to push this through would probably pay them too.
- alephnerd 8mo ago
  A large number of maintainers for larger OSS projects are employed by tech companies directly.
  - LtWorf 8mo ago
    Not that large, no.
GoblinSlayer 8mo ago
I suppose it can be handled like porn: torrenting linux isos will be lewd.
jeroenhd 8mo ago
Work on a standardised solution has already been done and proposals are already being discussed. Things aren't moving as fast as they could be because every time something like this hits a front page somewhere a bunch of people have to come in and comment that they dislike the law, but the people behind open source projects don't seem to be bothered by the time they need to put into this. Their employer is probably just paying them to do so anyway. Linux desktops already have APIs for profile management. This is just another field to add to those APIs. Very few core Linux desktop development is coming from hobbyists compared to the massive corporations maintaining Linux as a real option. Companies like Red Hat and System76 isn't going to drop California as a customer base to make a statement that no politician will ever listen to.
- iamnothere 8mo ago
  A number of distros (even some large and well known ones) have signaled noncompliance or do not believe they are impacted due to technical reasons (Gentoo) or jurisdiction (OpenBSD, NixOS). Other US distros are not yet signaling agreement because of uncertainty regarding different laws in different states/countries and potential legal challenges. This is not set in stone and it’s still possible to present a united front of noncompliance.
shadowgovt 8mo ago
To be fair, "it's just a fucking hobby" no longer being an excuse has been a long time coming, much in the same way that driving cars or flying airplanes started as just a hobby but became no longer one when practicing it had outsized consequences to non-practitioners. Signed, someone who notes frequently that the default apache configs probably put a web developer in violation of the GDPR (since if you just left on collecting IP addresses for no reason, you are de-facto not collecting them for "network security.")
- iamnothere 8mo ago
  You’re arguing against freedom of computing, itself an extension of freedom of thought and freedom of speech. These laws are an attempt to regulate not just what you do with your computer, but how it operates. This is fundamentally an attack on rights and freedoms, and if it goes unchallenged then it will expand into other areas. Maybe that doesn’t move you; it seems like you don’t care much for personal liberties. (A Euro, go figure.) But this is America and we have constitutional guarantees here.
  - Apocryphon 8mo ago
    Freedom doesn’t flow one way though. Their GDPR example just gives freedom to non-state malefactors to impinge upon user freedoms. You’re crying about 1984 and they’re crying about Neuromancer. An age-old dilemma. https://theonion.com/the-future-will-be-a-totalitarian-government-dystopia-v-1819594281/ https://theonion.com/the-future-will-be-a-totalitarian-gover...
  - shadowgovt 8mo ago
    You have made some fascinating assumptions about the person you are addressing. I recommend refraining from that in the future and instead asking why a fellow American takes a position other than the one you hold. Two guys built a website to try and help people curb their undesired sexual proclivities and because they were bad at security, their users' personal information (including their own logs of their sexual proclivities) is leaked. They will see no consequences other than "oops, oh well, I guess we're going to shut down our website now and, probably, build another one." Why is that okay? We've de-facto operated as if it os okay for decades under a notion of "user beware," but that notion is increasingly incompatible with the goals of treating Internet access as a human right because if you let everyone on, you are definitely letting people on who lack the capacity, knowledge, or savvy to beware. And we lack a framework for holding "two guys who just told the world how often you jack off" accountable for their violation of confidentiality. Individual users become nodes in botnets. Individual users have their identities compromised. Individual users are talked into being kidnapped by anonymous victimizers. Individual users are, increasingly, everyone's concern the moment they connect to a shared network. And, perhaps most significantly to this topic: the Internet does not distinguish between two guys building a hobby app and a professional service. This specific notion, age-gating access, may not be the right step. But we should be a lot more serious about taking more than zero steps. The time of effing around and pretending there are no consequences to these technologies is over.

alephnerd 8mo ago

> Who is paying FOSS devs who will be implementing this Most Linux maintainers are employed by Google, IBM, Facebook, and other similarly sized organizations. > Who is making CA the only jurisdiction instead of the myriad contradictory laws all over the place The US is a federal system. It's part of our checks and balances. > Who is stepping in to make sure no additional legislation comes across regulating how FOSS has to include backdoors or weaken encryption No one. This is why organizations with actual security requirements do their own dependency checks.

iamnothere 8mo ago
Linux is the kernel, it has nothing to do with this. The law apparently seems to target the packager/distributor of the distribution. Many small distros are hobby distros! > The US is a federal system. It's part of our checks and balances. Nonsensical answer. Different states are passing different requirements that often contradict each other. This is going to be a nightmare. > No one. This is why organizations with actual security requirements do their own dependency checks. So you’re saying that we should expect those laws too? Because before now “code is speech” has ruled, and the US government have not been able to be so invasive about how computers should work. If this is the direction we’re headed in, we need to organize and fight like hell.
- alephnerd 8mo ago
  > Many small distros are hobby distros... Then region lock. You don't have to support California or NY or ... > Different states are passing different requirements that often contradict each other. This is going to be a nightmare Create regional feature flags or region lock. It's a solved problem. > So you’re saying that we should expect those laws too They already de facto exist contractually speaking. > Because before now “code is speech” has ruled, and the US government have not been able to be so invasive about how computers should work The mindset around tech regulation shifted after the 2016 election and Jan 6th. The maximalist tech civil libertarian view on privacy was an anomaly from the late 1990s to early 2010s when tech was viewed as inconsequential. The 2016 election and Jan 6th showed otherwise. --- The overlap between Linux daily drivers and "voters who can flip an election in California, NY, or <insert_state_here>" is nonexistent. This also appears to be a front-run at reducing the risk of an Australia-style regulation being proposed. Edit: can't reply > Europe realized this with their new infosec liability regulations European organizations (from private sectors to government agencies) sidestep this by contractually mandating SBOM and dependency requirements. You end up with the same result, but it's essentially regulated via contracts instead of the law. > Expecting volunteers to dump time into compliance is ridiculous. Not because they oppose the idea, but because huge swaths of the internet run on people doing something for free -- and they'll just do something else if governments begin threatening them That's a decision a lot of governments and organizations are fine with. OSS where maintainers are hired by sponsor organizations is already the norm, and government-backed OSS is becoming increasingly common in the EU and much of Asia. Hobbyists who don't wish to comply can region gate within their license - that solves your liability risk and will keep regulators happy.
  - iamnothere 8mo ago
    I think it would be better to create a parallel economy of underground unrestricted distributions while encouraging everyone to openly flaunt the law, and simultaneously fighting via lawfare and media. But maybe that’s just me!
    - alephnerd 8mo ago
      > encouraging everyone to openly flaunt the law > But maybe that’s just me If you are fine taking the legal liability and are open to civil and criminal prosecution, go right ahead. Western jurisdictions tend to cooperate on extradition as well, and American free speech laws are significantly more expansive than those in the EU, Canada, or ANZ so taking a principled approach wouldn't be a viable defense if you decided to go and incite via that route. > fighting via lawfare That is being done. > and media You heard about it via the media.
      - iamnothere 8mo ago
        Fine by me, I’m willing to fight. The freedom to compute is one of our most fundamental freedoms, connected inherently with freedom of thought and speech. Cowards like you don’t deserve the benefits you enjoy, and you will surely complain about their absence when they are gone!
      - orwin 8mo ago
        This is not the first time I read comments from you, I just want to tell you you're probably one of the most annoyingly, reasonably correct person I read. And take it as a compliment, because each time I disagree with you I have to look at my position because I fear being on the wrong side of the argument (which is probably what I find annoying. I want to be unreasonable sometimes!).
        LtWorf 8mo ago
        He's completely incorrect in saying that most free software developers work for some USA megacorp.

whywhywhywhy 8mo ago

>Who is paying FOSS devs who will be implementing this? honestly if they let it be known they'd do it for payment the same person who's paying off the politicians to push this through would probably pay them too.

alephnerd 8mo ago
A large number of maintainers for larger OSS projects are employed by tech companies directly.
- LtWorf 8mo ago
  Not that large, no.

GoblinSlayer 8mo ago

I suppose it can be handled like porn: torrenting linux isos will be lewd.

jeroenhd 8mo ago

Work on a standardised solution has already been done and proposals are already being discussed. Things aren't moving as fast as they could be because every time something like this hits a front page somewhere a bunch of people have to come in and comment that they dislike the law, but the people behind open source projects don't seem to be bothered by the time they need to put into this. Their employer is probably just paying them to do so anyway. Linux desktops already have APIs for profile management. This is just another field to add to those APIs. Very few core Linux desktop development is coming from hobbyists compared to the massive corporations maintaining Linux as a real option. Companies like Red Hat and System76 isn't going to drop California as a customer base to make a statement that no politician will ever listen to.

iamnothere 8mo ago
A number of distros (even some large and well known ones) have signaled noncompliance or do not believe they are impacted due to technical reasons (Gentoo) or jurisdiction (OpenBSD, NixOS). Other US distros are not yet signaling agreement because of uncertainty regarding different laws in different states/countries and potential legal challenges. This is not set in stone and it’s still possible to present a united front of noncompliance.

shadowgovt 8mo ago

To be fair, "it's just a fucking hobby" no longer being an excuse has been a long time coming, much in the same way that driving cars or flying airplanes started as just a hobby but became no longer one when practicing it had outsized consequences to non-practitioners. Signed, someone who notes frequently that the default apache configs probably put a web developer in violation of the GDPR (since if you just left on collecting IP addresses for no reason, you are de-facto not collecting them for "network security.")

iamnothere 8mo ago
You’re arguing against freedom of computing, itself an extension of freedom of thought and freedom of speech. These laws are an attempt to regulate not just what you do with your computer, but how it operates. This is fundamentally an attack on rights and freedoms, and if it goes unchallenged then it will expand into other areas. Maybe that doesn’t move you; it seems like you don’t care much for personal liberties. (A Euro, go figure.) But this is America and we have constitutional guarantees here.
- Apocryphon 8mo ago
  Freedom doesn’t flow one way though. Their GDPR example just gives freedom to non-state malefactors to impinge upon user freedoms. You’re crying about 1984 and they’re crying about Neuromancer. An age-old dilemma. https://theonion.com/the-future-will-be-a-totalitarian-government-dystopia-v-1819594281/ https://theonion.com/the-future-will-be-a-totalitarian-gover...
- shadowgovt 8mo ago
  You have made some fascinating assumptions about the person you are addressing. I recommend refraining from that in the future and instead asking why a fellow American takes a position other than the one you hold. Two guys built a website to try and help people curb their undesired sexual proclivities and because they were bad at security, their users' personal information (including their own logs of their sexual proclivities) is leaked. They will see no consequences other than "oops, oh well, I guess we're going to shut down our website now and, probably, build another one." Why is that okay? We've de-facto operated as if it os okay for decades under a notion of "user beware," but that notion is increasingly incompatible with the goals of treating Internet access as a human right because if you let everyone on, you are definitely letting people on who lack the capacity, knowledge, or savvy to beware. And we lack a framework for holding "two guys who just told the world how often you jack off" accountable for their violation of confidentiality. Individual users become nodes in botnets. Individual users have their identities compromised. Individual users are talked into being kidnapped by anonymous victimizers. Individual users are, increasingly, everyone's concern the moment they connect to a shared network. And, perhaps most significantly to this topic: the Internet does not distinguish between two guys building a hobby app and a professional service. This specific notion, age-gating access, may not be the right step. But we should be a lot more serious about taking more than zero steps. The time of effing around and pretending there are no consequences to these technologies is over.