The EU proposed CRA law may have unintended consequence for the Python ecosystem

https://pyfound.blogspot.com/2023/04/the-eus-proposed-cra-law-may-have.html

by AlexeyBrin • 3 years ago

186 134 3 years ago

pyfound.blogspot.com

2rsf• 3 years ago

If the proposed law is enforced as currently written, the authors of open-source components might bear legal and financial responsibility for the way their components are applied in someone else’s commercial product.

Oh shit, this is huge. I wonder if it applies retroactively for code in the wild, as an open source contributor you can't recollect you code back.

canadiantim• 3 years ago

If true and enforced that would be the death of the open-source community as we know it

tensor• 3 years ago

In the EU at least. No doubt disclaimers would go up on all source repositories that access from the EU is forbidden.

xeromal• 3 years ago

I'm sure repos would just block access to European IP address if the maintainer requests it.

mrweasel• 3 years ago

It would also absolutely destroy the EU economy. Developers in the EU would be blocked from PyPi, GitHub, NPM, Stack Overflow and much much more. Pretty much every single commercial software product contains at least one open source package. You wouldn't even be able to use Java or .Net. There's also no way in hell that commercial companies like Oracle or Microsoft will assume any kind of responsibility for errors their code would result in in a customers code base. At least not without massive compensation.

And how about Linux, or Android... or iOS, they contain open source software as well. Could you go after some random kernel developer for a bug that affects Android?

This hasn't been tought through in any way, the ramifications could be enormous.

josefx• 3 years ago

This thing wont be fairly enforced until the ISO is fined $50 Googol for publishing the C spec. .

oaiey• 3 years ago

Who invented null again? I need an address for the lawyers.

Asmod4n2• 3 years ago

You can potentially hold those responsible who published the first open source TCP/IP stack for anything happening on the internet if it retroactively applies to existing code, fun times.

Gud• 3 years ago

The first TCP/IP stack was actually open source(before the term even existed). Written by Bill Joy(and maybe others) of Vi, Sun and BSD fame.

qwerki• 3 years ago

The open source community in general needs to pay more attention to this space – not just the python ecosystem. More maintainers need to know that well intentioned people are proposing policies that would in some instances make them financially and legally liable for the code they write.

AlanYx2• 3 years ago

The new EU AI Act also has this problem, in that it imposes liability for developing components that may at some future point be misused by others.

The source of the problem is a particular approach to legislation that has become popular in the EU that purports to regulate across the entire supply chain for a product. Which might make sense for production of physical items or for software developed completely from scratch 30 years ago under a waterfall model, but is strongly disconnected from the way software is currently built.

foobiekr• 3 years ago

“Well intentioned” does not actually describe the strong IT companies that support actions like this to try and recapture value. European big tech companies like Siemens, Ericsson, Nokia and so on are not fans of open source since it negatively impacted their captive customer bases.

dsr_2• 3 years ago

"a version of Python is downloaded over 300 million times per day."

If true, this is insane.

marginalia_nu2• 3 years ago

No doubt the vast majority of those downloads are from CI systems and build scripts executing on every commit.

dsr_2• 3 years ago

Which is insane. Local caches should be ubiquitous, along with lightweight validation checks.

hunglee2• 3 years ago

No exaggeration to say that the EU might inadvertently divert the civilisational path of humanity

miohtama2• 3 years ago

What’s a civilisation or two in the name of think of the children

fermigier• 3 years ago

More reactions on the same subject:

- From the Eclipse Foundation: https://eclipse-foundation.blog/2023/01/15/european-cyber-re... and https://blogs.eclipse.org/post/mike-milinkovich/cyber-resili...

- From the Internet Society: https://www.internetsociety.org/blog/2022/10/the-eus-propose...

With more to come... This is a serious situation.

agilob2• 3 years ago

Its been only a years since:

Google wants to work with government to secure open-source software

https://blog.google/technology/safety-security/making-open-s...

https://www.techradar.com/news/white-house-calls-summit-on-o...

https://www.engadget.com/google-open-source-private-public-p...

And 2 years since:

If your open-source software project is considered "critical", you could be facing a lot more work and responsibility in the future. But for now, it's just some ideas from a few of Google's top engineers.

https://www.zdnet.com/article/open-source-google-wants-new-r...

acedTrex• 3 years ago

There is no responsibility with open source, thats the entire point.

agilob2• 3 years ago

there is as much responsibility as money

AbrahamParangi2• 3 years ago

Why on earth would they make the original vendor of a component liable instead of the last corporate vendor wholly liable for all components of the final product they sell? This seems like something which can only benefit:

1) very large corporations

2) who use a lot of components they don’t make

This seems almost designed as protectionist legislation for dinosaur companies unable to manage their software dependencies at any level of competence.

ajsnigrutin2• 3 years ago

Yep, it's interesting because this is the case in eg. device warranties... if something breaks down, you don't search who the manufacturer of the capacitor was, but just take the device to the seller/retailer/store and have them deal with it.

ghaff2• 3 years ago

Mostly. There are some exceptions. For example, with cars, tires are often warrantied directly with the tire manufacturer. Also, in the case of material defect, e.g. the airbag issue a number of years back, the auto manufacturer is mostly the entity on the hook for consumers but there are absolutely various liabilities up the supply chain.

miohtama2• 3 years ago

Because the EU wants to make sure someone else than the user liable for everything. Fully controlling the Internet is part of this development. It started with cookie laws and is now creeping towards total controlism a la China.

In the EUs model of social democracy citizens does not need to bear responsibility for their actions, but it’s government’s job to enforce everything is in harmony. “Someone else” e.g. corporates are responsible for any negative outcomes. Whether or not open source, or many other Internet produced contents, fits into this model is secondary. This is also very easy for politicians to sell as the evil is always outside (US corporations, China, Russia) and there is never anything wrong with country or its citizens themselves. If people can go to Internet and hurt themselves e.g. by downloading an application or a package of course it must be someone else’s liability.

RandomLensman• 3 years ago

Not really. You should at least take a look a personal liability settings in various EU countries before making your claims.

octacat4• 3 years ago

This seems like something which can only benefit: 1) very large corporations

Same was with GDPR... It will benefit companies, who have money to do audits (and companies which do audits).

yazzku• 3 years ago

https://fsfe.org/news/2023/news-20230323-01.en.html

The FSFE has already explained to them why the liability should be shifted to the company shipping the actual product.

gdcbe• 3 years ago

I’m all for software vendors requiring to take more responsibility. Anything better then the current “if it works you’re lucky” guarantee that drives drives the bug parching normality.

The responsibility lies with the commercial vendors however, not with the open source developers. What a perverse world we live in, that that can even be possible… Using our software for free and then holding us responsible… ha!

game_the0ry2• 3 years ago

Using our software for free and then holding us responsible… ha!

Yeah...slap in the face for open source contributions that literally chnage the world for the better.

galaxytachyon• 3 years ago

Not all things can be or even should be regulated. This is almost akin to a law punishing good samaritan for helping someone in need because that someone ended up a criminal later. Not only is it dumb but also a perversion of authority.

Hopefully they know what they are doing and revise the law.

account422• 3 years ago

"Good samaritan" is a pretty relevant keyword here because many countries have so called Good Samaritan Laws that explicitly give legal protection to those aiding others in peril. The idea is that you won't want to discourage people from helping those in need by fear of repercussions. Its not unreasonable that similar liability protections should apply to those freely sharing software.

Ekaros2• 3 years ago

On other hand. If I for example make food from rotten ingredients and share it on street for free, even with disclaimer and someone gets food poisoning I don't think anything protects me. Or should protect me.

I have never understood why software is some special place. Specially if entity has anyway to monetize it.

knlje• 3 years ago

This is a quote from the linked document:

10) In order not to hamper innovation or research, free and open-source software developed or supplied outside the course of a commercial activity should not be covered by this Regulation. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. In the context of software, a commercial activity might be characterized not only by charging a price for a product, but also by charging a price for technical support services, by providing a software platform through which the manufacturer monetises other services, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software.

paol• 3 years ago

That's from the "Cyber Resilience Act" link, and the "Product Liability Act" link has pretty much the same text in item 13.

luckylion2• 3 years ago

I'm not a lawyer, but I see no way a sane and reasonable person could read this as "and if someone you've supplied the software in a foss & non-commercial setting to uses that software in a commercial way, you're on the hook for everything".

Yeah, it could be even clearer (but laws tend to not want to enumerate everything that is obvious or they'd become books), but it feels somewhat exaggerated. Or is the actual fear that commercial support services by the authors could trigger liability? As far as I understand, that has been a preferred way to get paid and remain not-liable for the original product.

ncphil• 3 years ago

I _was_ a lawyer for a decade before going into tech. One of the good habits I acquired in practice was making sure to read all the way through every document, no matter how boring it got. I agree with you completely, except the article isn't just exaggerated: it's borderline FUD. Regulation is necessary because too many humans find self-regulation in the public interest too hard. The problem is that writing effective, targeted, regulations is also hard, and often beyond the capacity of those given the power to do it. Even when they mean well (never a given, as evidenced by a sordid history of self-sealing and favoritism), it often gets mucked up.

A4ET8a8uTh0• 3 years ago

Thank you. Do you think blogger missed it, focused on the 'should' part or it is part of clickbaity nature of our news cycle? Either seems as a likely possibility. I don't think EU would be stupid enough to kill open source.

occamrazor• 3 years ago

It’s more than clickbait. The intent of the proposed legislation in not to make volunteer open-source contributors liable for bugs, but the current draft may set the boundary between commercial and non-commercial developers in the wrong place.

tgvaughan• 3 years ago

How does this work for free software projects which aren't themselves commercial but list employees of big companies among their major contributors? E.g. the Linux kernel?

layer83• 3 years ago

It will likely be tied to the “productization”. That is, the liability chain will only go as far as there is someone who turned the software into a product for monetization purposes. If a company sells a product that uses Linux, they will be liable regardless of whether they contributed to Linux development or not. If part of the product was itself purchased from a third party, the third party will be liable for that part. But open-source developers who don’t monetize the software won’t be liable.

One case that could potentially become problematic is OSS developers who have Patreon subscribers or similar, where those subscribers could conceivably pass on liability claims.

mananaysiempre2• 3 years ago

The Internet Society quotes[1] that part and thinks selling support for stuff would count it as being supplied in “the course of commercial activity” even to those who aren’t buying the support.

[1] https://www.internetsociety.org/blog/2022/10/the-eus-propose..., via another comment here: https://news.ycombinator.com/item?id=35525876

[A previous version of this comment mentioned BIND, because I confused ISOC and ISC.]

ginko2• 3 years ago

If someone sold me support for a piece of open source software (like ISC and BIND) then I definitely would expect some level of liability if there's something wrong with it.

Otherwise why would I pay for support if I could just self-host? They can strictly define the parts they are willing to support, though.

908B64B1974• 3 years ago

I want to believe the courts and non-elected bureaucrats will interpret it the same way.

Sadly, with these laws, we'll have to wait for some case law to be certain of the liabilities to serving Europeans customers.

lars_francke• 3 years ago

This section has been rewritten (changed) in the latest (internal) draft of the CRA based on feedback of various open source foundations as far as I know.

I'm not sure how much I'm allowed to share but it'll be public at some point in April I believe.

mordae2• 3 years ago

Having it in the recital is way less safe than it being explicitly spelled out in an Article.

octacat4• 3 years ago

that is sooo bad. Basically anyone can give you support with some open source code (i.e. consultancy, they fix a bug/deploy/tweak for you and go away) except the authors of the code. Because if the authors do this, they are liable for the whole code base of the product. Nice.

Also, many open source projects have very complex authorship, good luck digging which company is responsable to do the audit.

Also, basically your favourite cloud provider could host your favourite open source database, but the authors providing hosting would be liable. Because "This Regulation does not regulate services, such as Software-as-a-Service (SaaS)"

gavinhoward• 3 years ago

Oh boy. If this passes, I'm basically going to have to not allow people to use my FOSS in Europe.

I have actually written some Open Source licenses [1], and one different thing about these licenses is that they are null and void if the law requires the original contributors to accept any responsibility for the software unless they voluntarily accept it.

In my opinion (IANAL, but I wrote those licenses), if things passes, then anything licensed under my licenses would not be legal to use in Europe or by EU citizens.

Licenses will now need protections like this to keep FOSS alive, and places with laws like these will lose out.

By the way, my licenses are currently being checked by a lawyer. However, it may cost me more than I can spare, so I may not be able to get them fully checked.

[1] https://yzena.com/licenses/

endisneigh• 3 years ago

Seeing many of the EU's laws - I feel that they have given up in innovating, and have designed to go all in on legislation. Many of the rules they make are completely unnecessary IMHO. They treat their citizens as totally incompetent and incapable of evaluating alternatives themselves.

I expect the EU to continue to falter in cutting edge tech as a result. Software in particular.

jart4• 3 years ago

They're not called citizens, they call them subjects.

M2Ys4U• 3 years ago

Article 20(1) of the Treaty on the Functioning of the European Union:

"Citizenship of the Union is hereby established. Every person holding the nationality of a Member State shall be a citizen of the Union. Citizenship of the Union shall be additional to and not replace national citizenship."

nemo44x• 3 years ago

Indeed, they just can't seem to understand the modern economy. How many unicorn's has Europe created over the last 15 years? The idea that a wildly influential technology company coming from the EU instead of America or China is just not realistic.

I guess they can continue to export luxury brands and tourism.

I think Europeans tend to have an aversion to success/wealth and are scared to go out and try and build something. Just be conservative and go and work for a company that underpays. But at least you get to go on a vacation a couple times a year.

I feel like the time I've spent in Europe and the time in the USA is that Americans are optimistic that something can be done and they go out and take a risk. Europeans are skeptical of anything new. And to me it's weird because the way social safety nets tend to work in Europe, people should be taking risks left and right. And to be sure there's no lack of very talented engineers in the EU.

Is it that Europe relies so much on legacy? Their legacy colonial relationships around the world, their legacy brands, etc?

Asmod4n2• 3 years ago

This law kinda only needs a few changes to actually increase the protection of consumers.

- it only applies if you are directly selling a IT product/software to consumers.

- when you use third party components and find a security flaw in them you have to inform the third party immediately.

- in addition if you find a flaw in open source code you should send a patch if you are capable of doing so.

ApolloFortyNine3• 3 years ago

Basically every license out there has some "can't be held liable" clause in it (see the mit license for an easy to find one).

Does this mean the license may be invalid entirely in the EU, making it so you actually just can't use the software at all? I know that's how the GPL basically works, if you don't accept the GPL, then you simply have no license at all.

layer83• 3 years ago

Usually the respective clause just becomes legally void. This is different from you not accepting that clause. It doesn’t invalidate the license as such (even if the license would like that to happen).

ApolloFortyNine3• 3 years ago

Isn't that kind of insane? You get to ignore a crucial clause of the license and continue using the software?

I mean one day they could also say copyleft is unreasonable and illegal, so now the GPL is just a free for all.

jart4• 3 years ago

I discussed this with an AI language model (GPT-4), and the general idea I gathered was that in the EU, it's possible that the "no warranty" clause in open source licenses could be invalidated by consumer protection laws, while the rest of the license remains valid. This could potentially expose authors to liability, even as their work continues to be used for free. However, it's important to note that this information came from an AI and should not be considered legal advice. The specific application of these laws may vary depending on the jurisdiction and circumstances.

Ekaros2• 3 years ago

Then again maybe this will finally make people write software that is fit for purpose and isn't just stuff thrown at wall.

Passing out poison for free doesn't go too well in real world, I don't see why software should be really different.

prmoustache• 3 years ago

The iot industry shows us daily that making pay for poison doesn't go much better yet is totally allowed to continue.

game_the0ry2• 3 years ago

Feel free to stop using the internet then, since it is built on apache / nginx / python / java / javascript / php and many other open source technologies.

madsbuch• 3 years ago

well, it is easy for. open source. you just defer the semantics of your program. to. the implementation.

then you will never have bugs.

UncleEntity• 3 years ago

Fit for what purpose?

I have a couple things up on GitHub that are fit for my purpose but you probably don’t want to be using if your threat model is higher than “huh, that doesn’t work”.

I have no expectations that anyone will ever read the code much less use it but it costs exactly nothing to put it out there on the off chance it may be useful to somebody.

So, yeah, I should be responsible if someone hacks some crypto kitty clone and makes off with a billion dollars?

darkarmani• 3 years ago

Passing out poison for free doesn't go too well in real world

It's illegal to give out free poison in the real world? how do they sell it then?

BiteCode_dev2• 3 years ago

IANAL but I would expect you can only be held reponsible for a product if you say it fits a particular purpose.

But the python licence explicitly says:

PSF is making Python 3.11.3 available to Licensee on an "AS IS" basis. PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON 3.11.3 WILL NOT INFRINGE ANY THIRD PARTY RIGHTS.

So it's not sold to you, and not distributed with any implied level of quality or guaranted service.

advisedwang2• 3 years ago

I would expect you can only be held reponsible for a product if you say it fits a particular purpose.

That is an incorrect expectation. Even in the American legal system "I said don't do that" is not a shield against liability. In the EU framework a new law can pretty much create any new liability they want, so a disclaimer absolutely could be rendered meaningless.

nequo2• 3 years ago

Even in the American legal system "I said don't do that" is not a shield against liability.

Also IANAL. As someone offering open source software for free, what shields you against liability in the American system?

BiteCode_dev2• 3 years ago

It's not "I said don't do that", but rather "I got a thing, but can't advice for any use case".

If you sell rope with no label for anything whatsoever, and people use it to do rock climbing and die, I doubt you will lose in court.

Yet again, IANAL at all.

octacat4• 3 years ago

So, if you work for a commercial company and wanna contribute something back to some open source project - you will not get a green light from your lawyers department once this is enforced (it is already pretty hard to convince them).

indymike• 3 years ago

This law will literally freeze software development in place, much like the US FAA did with civil aviation in the 1970s. Suddenly going from 100% disclaimed away warranty to a statutory warranty doesn't work. This may even be less intelligent than my home state's attempt to legislate that pi=3.15.

bluecalm• 3 years ago

Permissive license open source is going to be fine, for now anyway. The problem is that the arguments cited in the OP also apply to small devs who can't afford an army of lawyers. Such regulation will spell doom for software start-ups and small shops.

It's a pattern of EU law makers going after the little guy: VAT MOSS, GDPR, now this. Not much of a problem if you have an accounting department next to legal department on the same floor of your corporate building. A huge burden for a small guy who only have limited number of man hours to distribute between paperwork and actual work.

AlanYx2• 3 years ago

Not much of a problem if you have an accounting department next to legal department on the same floor of your corporate building.

It's demonstrative to read the official EU impact assessments for a lot of their recent legislation. For example, the impact assessment for the EU AI Act estimated prior-to-launch compliance costs for a small business with one AI product at €400,000. But when you look into the assessment in more detail, that estimate actually excludes legal costs (not joking here). It creates a very uneven playing field for small innovators.

dp-hackernews2• 3 years ago

I think I will call this - "Revere Censorship" and it's the way the likes of George Orwell's "1984", John Carpenter's "They Live", Aldus Huxley's "A Brave New World", along with the ideas pushed by the government (WEF) in Ayan Rand's "Atlas Shrugged" are slowly being brought to life. Soon there will be a City of Ember to contend with, not to mentioned Enders Game... As I keep saying, the future is written in the past.

mordae2• 3 years ago

If this passes, everyone will add to their code:

DISCLAIMER: Following text is not a program code. It does not work. Do not execute it.

And call it a day. As long as it was only brought to the market as a piece of prose, you are safe. :-)

ulnarkressty• 3 years ago

This doesn't make much sense - would publishing the code to a paper about object detection really make my professor liable for someone getting run over by a Tesla?

popotamonga• 3 years ago

i made a company. no personal liability whatsoever, all profits go to me personally (heavy taz but its ok) so they can sue all they want

stametseater• 3 years ago

I remember when everybody was telling me that the demise of "net neutrality" would force me to pay my ISP for special "packages" to use different sites. Want to use HN? It's blocked unless you pay for the "tech forum package". ...Except that never happened. It turned out that the hysteria was manufactured by American tech corps like Google and Netflix that feared having to renegotiate their peering arrangements.

This sounds like more of the same. The proposed EU law applies to commercial activity, which volunteer FOSS development is not. So now we have commercial interests trying to fan the flames of another hysteria.

ApolloFortyNine3• 3 years ago

Many companies contribute to open source software, would they be responsible if some random user of Linux leaks some data due to a change redhat implemented? Despite that user having signed no contract with them?

And last time this came up it seemed widely believe that a donation link is commercial activity.

tskguarantee• 3 years ago

I find it interesting that the EU does not define "free and open-source software" in either of the proposals. I think they need to define the terms as used. There isn't complete agreement in the software world as what that applies to. For example MongoDB and the SSPL license.

The EU proposed CRA law may have unintended consequence for the Python ecosystem

Related Stories