The European regulators listened to the Open Source communities

https://blog.opensource.org/the-european-regulators-listened-to-the-open-source-communities/

by jlpcsl • 2 years ago

194 80 2 years ago

blog.opensource.org

transpute• 2 years ago

Debian statement, Dec 2023, https://bits.debian.org/2023/12/debian-statement-cyber-resil...

Even if only "commercial activities" are in the scope of CRA, the Free Software community - and as a consequence, everybody - will lose a lot of small projects. CRA will force many small enterprises and most probably all self employed developers out of business because they simply cannot fulfill the requirements imposed by CRA. Debian and other Linux distributions depend on their work. If accepted as it is, CRA will undermine not only an established community but also a thriving market. CRA needs an exemption for small businesses and, at the very least, solo-entrepreneurs.

hcfman7• 2 years ago

Well stated.

Another thing people can do is to disallow governments to use any software you produce by default.

This doesn't change your obligations to the law but it does attach consequences to government decisions. Right now they make sweeping decisions to benefit large players and screw small players, which is like stealing from the poor to give to the rich. And worst, the whole thing is effectively retroactive to all of the people whose collective work gave them all the nice things.

Government should learn that decisions should be thought about very carefully and the only way to start a change in thinking is to attach consequences.

rmbyrro2• 2 years ago

Politicians don't care about this. It'll only impact the lives of developers working at governamental positions.

This is also against the principle of OSS, which is to not discriminate about usage.

dns_snek• 2 years ago

Such limitation would effectively change the project's license, which would no longer be F/OSS approved. Most people and businesses don't evaluate custom licenses, they'll just skip your project because it doesn't have a well-known, approved license.

alwayslikethis• 2 years ago

How do you expect that to be respected when you have things like illegal surveillance or eminent domain? A well behaving government wouldn't be the target for this, and a badly behaving one wouldn't respect it anyways.

Karellen• 2 years ago

Another thing people can do is to disallow governments to use any software you produce by default.

So, instead of having governments become part of an open (software) commons, using software that costs less in taxes[0], which they would then have a stake in supporting and helping to make better, you're proposing that they purchase higher-cost proprietary software from private corporations, supporting their shareholders?

Yeah, that'll help.

the only way to start a change in thinking is to attach consequences.

That's not how FLOSS has got where it is today, so it is clearly not "the only way". FLOSS succeeds by allowing everyone in, in allowing them to reap the benefits first, so that they understand the value first-hand. Then, they come to depend on it, and when they see how much it would cost them to stop using FLOSS, do they realise how much they have invested in the ecosystem.

Keeping people out means that they never get entangled in the first place.

[0] Or, requires less money to be created, depending on your viewpoint.

wolverine8762• 2 years ago

Didn't government do what you want in this case? A long deliberative, consultative process, addressing the needs of small players?

sunshine-o• 2 years ago

CRA needs an exemption for small businesses and, at the very least, solo-entrepreneurs.

My guess is even medium size businesses will face enormous risk and cost related to this.

In the end we might see the worst scenario happening: open source is good, but only if sold by a big company who can afford compliance, risks and lawyers.

This will be somehow similar to what happened with GDPR, most small & medium shops cannot spend too much time on this. And ironically it pushed a lot of people in the 3 big public clouds.

bluGill4• 2 years ago

I think medium software sized shops - 500 employees are large enough to afford the details and so will be okay. Anything smaller though and this is too much overhead. Of course many projects don't need 500 people. If you use Linux you can buy support from several actors of this size who can afford the overhead (also covering tools like ls that are part of an OS, maybe covering the basic gnome desktop, but not many of the lesser used tools that make linux useful). I'm sure the Apache and FreeBSD foundations will look into this and decide that they are able to handle the overhead by starting (legally this may be finding people to start?) such a company. However I'm not sure OpenBSD is large enough to be worth starting such an organization.

There are a lot of tools that are not large/popular enough. Who will support OpenScad, FreeCad, cppcheck, and all the other open source projects that don't have a large company behind them and probably are not interesting to enough companies to be worth starting something to support them just for legal purposes. There are also projects that are supported by a company today, but the company is not large enough - will enough more customers come in to make it worth hiring a dozen laywers - cmake and sqlite come into mind as projects in this category.

ashildr• 2 years ago

GDPR is easy as a small organization IF you are not greedy for other people‘s data. Keep your hands clean. I own (part of) a small company that makes software for a small market and we had absolutely no problems with GDPR because we try to not collect any data we don‘t absolutely need. It‘s not very complicated if you just invest some thought into your processes and don’t spy on your customers. Most of the time you don‘t need the data but someone wants to sell you a product to gather it.

pjmlp2• 2 years ago

In every other industry business of all sizes, even people selling stuff on the street, have to obey regulations, with exceptions where obeying regulations comes with certain flexibility.

Open source is no different from anythig else performed by street artists, food trucks.

Certhas3• 2 years ago

That statement was based on the old text, correct? The revised law seems to address this in the opinion of experts OSI spoke to:

"In particular, “digital artisans” using Open Source software at small scale – the main concern of Debian – will need guidance from the European Commission. While the experts we have met have all said that using an Open Source software distribution as part of a commercial activity is unlikely to require CE marking of the distribution itself, the interpretation of the key phrase “making available on the market” will need careful clarification."

DCKing• 2 years ago

That statement was based on the old text, correct?

Yes it has. The updated text was published on December 20th [1], and does a lot to address these concerns. See also Bert Hubert's analysis [2].

The amount of knee jerking in the comments for this law really brings down the quality of discussion and detracts from remaining issues.

[1] https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CONS...

[2] https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-f...

snowpid7• 2 years ago

I think, the CRA might create an incentive for companies not free loading Open Source Software but instead putting money in the open source eco system (though mainly on Security) and that is somehow great!

hcfman7• 2 years ago

Very optimistic. Call me a cynic.

snowpid7• 2 years ago

so what would happen instead? The only alternative is using close source (which does have disadvantage, being not cheaper etc.),

hyperpape• 2 years ago

You haven't given any mechanism that would make this happen. Specifically, some reason that the company would see contributing be beneficial to it. Of course, it benefits from the existence of open-source as a whole, but what material difference does its contribution make?

Take a small-medium sized business (say 5 - 50€ million annual revenue). Perhaps it can fund one library that is critical to it, but no contribution it makes will make a material difference to the trajectory of major products like Linux, or Python.

Certhas3• 2 years ago

The mechanism is clear: If you use Open Source software commercially, you are now liable if the software misbehaves. Thus, you have an incentive to make sure the software is correct. For (A)GPL software, you have to publish your contributions.

Not a lawyer, but it also seems to me that if you are a small shop, you might decide to pay, e.g. RedHat for taking on the liability. RedHat can pool these resources to make sure their software behaves as advertised.

snowpid7• 2 years ago

Of course, an SME company will not hire a developer to constantly perform security checks and apply patches for an important library libImportant.

What will happen is that company A will hire company B to do this and assume liability for it. If we set the annual cost of this at 100k, the monthly cost is about 8333 EUR. Let's say company B has 20 customers to protect the security of libImportant, that is 416 EUR per month and SME can afford that. There are OS that are of course used more frequently and that scales much better (i.e. cheaper per month). I actually see a new market niche here and perhaps they will find resourceful entrepreneurs.

bluGill4• 2 years ago

Most users of open source don't really care to make a difference to the trajectory. Someone else made the linux drivers I need, that is good enough for me.

For linux you will probably be able to buy a certified Linux distribution for similar costs to Windows which is affordable to a medium sized company that needs certification. However that will only cover your basic OS: linux, ls, basic gnome desktop (but not many applications, just the window manager, a file management, and email client) - probably not a web browser.

However there are a lot of small projects that are not popular enough for anyone to certify like that.

xondono4• 2 years ago

I very much doubt it, and it’s probably going to do the opposite.

CRA just brings the kind paperwork that physical products have always had to be licensed in the EU (CE marking) to software. Have you seen european companies investing in Open source hardware?

The path of least resistance will be to use homegrown alternatives and sell them to potential investors and shareholders as valuable intellectual property that puts them ahead of competitors.

Not only because that makes perfect business sense, but because this kind of IP is very hard to value fairly, so it will allow for a variety of accounting and tax avoidance shenanigans.

snowpid7• 2 years ago

For a useful comparison you need to show if open source hardware is more common / more invested in other parts of the world. E. G. Risc V has a growing momentum https://riscv.org/blog/2023/07/the-growing-momentum-of-risc-...

demondemidi• 2 years ago

Really? Specific security requirements for iot devices “have always” been in existence? I’d really like to know the source for that. I sound snarky because I work in security and am unfamiliar with what you describe. I could also not be very good at my job.

riffraff• 2 years ago

Have you seen european companies investing in Open source hardware?

Arduino and RepRap are poster children of open source hardware, and originated in the EU, I think.

hcfman7• 2 years ago

One more of the reasons I don’t make hardware.

orwin2• 2 years ago

In particular, “digital artisans” using Open Source software at small scale – the main concern of Debian – will need guidance from the European Commission.

Sadly I don't think it will move, the commission doesn't want to weaken the legislation because they don't want to much discrepancy between member states.

It will once again be up to individual countries to set up this law with their own interpretation.

In my experience with Rgpd, the watchdogs in at least 3 countries (France, Italy, Germany) are extremely helpful in navigating regulations, especially if you are incidentally its target (As a PaaS that hosted health data, we were).

I understand that this is both unclear, unknowable and a pretty huge risk (not really factually, but it feels like one): I'm not saying Debian people are wrong to want to clarify, I'm not saying people should take this as a victory, or that EU is perfect : I'm just saying that as a complex federation, with current rules, this law will probably be the best we will get, and sadly, local 'forgiveness' and loose execution is the only thing you can count on.

Because in the EU eyes, the law being loose is way, way worse than the local executive power being loose.

robertlagrant• 2 years ago

the watchdogs in at least 3 countries (France, Italy, Germany) are extremely helpful in navigating regulations

This is a bad dependency to have. For example, for the new EU medical device regulation, IVDR, a lot of the regulatory infrastructure just isn't ready[0], and many bodies are bowing out due to the complexity. Ironically, the British Standards Institute is one of the few notified bodies to take it on!

And that's medical devices, which are a tighter form of software. Regulating software in general seems like a very difficult task.

[0] https://www.degruyter.com/document/doi/10.1515/cclm-2021-097...

orwin2• 2 years ago

Yes, I think I was unclear: depending on local governmental watchdogs/agencies goodwill isn't a good solution. It's the one EU choose however.

It's weird for Anglo countries, or countries with the Anglo law system, where the legislation might have holes and weak points, but decree and case law fill those holes (the French system work like that too). EU can't do that because it's a federation of countries with different culture and interest.

Again, not saying it's good, I'm saying that's how it works.

WA• 2 years ago

I still wonder who enforces the MDR if a company from outside the EU offers their app/software to EU citizens without any certification.

There are quite a few health apps that are considered medical devices under MDR, but not in other countries. The EU companies must comply with the regulations, but nobody seems to be responsible for removing non-certified apps made by non-EU companies. That is a huge competitive disadvantage for EU companies.

rmbyrro2• 2 years ago

If you want to entrepreneur in the software industry, move fast, folks.

They're closing in and the level of freedom we have today isn't likely to exist in years to come.

esarbe• 2 years ago

With "freedom", you mean the ability to exploit customers and disregards any responsibility when it comes to protecting customer's private data?

Yeah, let's hope so.

sofixa2• 2 years ago

level of freedom

There are freedoms to and freedoms from. The Cyber Resilience Act is giving freedoms from to consumers that never had them before, at the expense of some freedoms to abuse from software vendors.

PaulKeeble• 2 years ago

This reminds me very much of the warnings by people like Robert C Martin over a decade ago that unless the software industry adopted better practices for quality and regulated itself regulators would step in. Regulators understand very little about the software process so the laws they are pass are unlikely to be the best way to solve it. Years after those lectures little has changed and now the regulation is coming at an increasing pace.

None of this will be good for small software companies, this sort of regulation will entrench the big players as it always does.

mouse_• 2 years ago

"Big tech must regulate itself lest it become an unstoppable monopoly and crush any new competition."

This sounds less like a warning and more like a playbook.

tzs• 2 years ago

OT: Anyone have a more useful link to the Apache Foundation's statement?

All the links to the other statements in the article go to the sites of the organizations they are quoting, but the one for the Apache Foundation goes to something called sandbox-pad.webm.ink.

That just gives me an error dialog in Chrome, Firefox, and Safari that says "sframe-boot.js must only be loaded in a nested context" then a shield with a keyhole image fads in over it along with "Loading..." text, and nothing more happens (at least in the 30 minutes I've had that tab open).

legobmw992• 2 years ago

https://news.apache.org/foundation/entry/update-on-eu-softwa...

This appears to be the article intended. At the very least it contains the quoted sentence

mistrial9• 2 years ago

there are improvements but please, the implementations are the test. Regulators, senior politicians and others can and do change the course in implementation phase.

this is not over, in any way

max_• 2 years ago

I don't understand what's going on. Could someone give me a birds eye view of what this is about?

- What is the regulation aimed at?

- What did the open source community communicate?

sofixa2• 2 years ago

The legislation (Cyber Resilience Act) aims to enforce some standards and add liability around software products, to enforce that vendors don't just throw something out, never touch it again and it becomes a problem (customers stuck with paperweights, security holes exploited). The problem is that if you enforce that sort of thing on random open source projects, many will be simply incapable of even trying to follow the legislation because they're a small one-two dev team that cannot navigate complex laws. So, progressively, more and more exceptions have been added to who does the regulation apply to.

matheusmoreira• 2 years ago

Liability for software developers and vendors. The only problem is they forgot to make an exception for free and open source software developers. It simply makes no sense for me to publish free software out there for free if that can get me sued.

legobmw992• 2 years ago

TFA is about how they did make those exceptions in the final text

codebard• 2 years ago

Doesnt this version still screw up the individual developers or smaller outfits that provide paid addons/upgrades to their open source software? It exonerates open source projects that dont engage in any business activity, but holds responsible the 'stewards' who provide paid services and addons? This would kill a lot of individual software developers and small outfits that fund themselves by selling paid upgrades/addons or other services whereas the non-profit projects still remain for major corporations to leech off of them. Added bonus is that the law will eliminate the small competitors of all those major corporations as individual devs and small outfits cant handle the financial burden of this compliance. To make an example from a healthy open source ecosystem: WordPress project would continue without issues, but all the small developers and outfits who make a living by creating plugins, themes and other things for that ecosystem will go kaput.

Am I misunderstanding this?

The European regulators listened to the Open Source communities

Related Stories