HN user
https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CONS...
Important bits (10c and around):
* Libraries/non-end products are fine, unless monetized.
* Employee contributions seem to be fine.
* Foundations seem to be fine.
* Non-core developers are fine
Seems like significantly better version.
That is already part of CRA:
It is of particular importance for manufacturers to ensure that their products do not contain vulnerable components developed by third parties.
Manufacturers shall, upon identifying a vulnerability in a component, including in an open source component, which is integrated in the product with digital elements, report the vulnerability to the person or entity maintaining the component.
EDIT: Also, I concur the poster below. It's developers who oppose against management to allocate time for bugs and technical debt instead of new features.
It's called tidelift.com
First, I like how you included “popular” adjective. That alone disqualifies 99% of projects. These are the projects “hacked” by non-paid devs.
Second, some proof would be nice. I live in .net/nugget ecosystem and other than libraries backed by MS, most popular projects are not (at least ones I know of).
That is one of them, here is the second version with different amendedments by European Council: https://data.consilium.europa.eu/doc/document/ST-11726-2023-...
They are now hashing out a final consolidated version in a trialogue.
TBF there is a lot of things “free of charge” connected to commercial activity, e.g. Android, .NET Core, MongoDb, ElasticSearch, even RedHat with Linux …
I understand need to somehow include them, but the line should be at the for-profit companies and exclude non profits and individual developers.
How to formulate it without easy loopholes is no easy task.
You are asking how requiring open source with no money to satisfy plethora of regulations along with legal liability (I.e. making it a commercial grade) makes it less likely for open source be made?
Ask log4j or OpenSSL.
Go read this: https://blogs.eclipse.org/post/mike-milinkovich/european-cyb...
There is some hope for individual developers in EP amended version https://www.europarl.europa.eu/meetdocs/2014_2019/plmrep/COM... article 10c: > Developers contributing individually to free and open-source projects should not be subject to obligations pursuant to this Regulation.
Actually it’s an improved version. Hopefully it will make it through consolidation with EC version.
it’s called professional accountability
Professional does for money, by definition. That doesn’t apply for most open source. RedHat employee contributing to Linux kernel is an exception, not a rule.
To put it bluntly, it means a significant risk when creating any open source project. It’s a common knowledge that there is no money in open source, but suddenly I am liable. Half of open source licenses is disclaimer of liability. Also a lot of other yet to be defined requirements (harmonised regulations it is called I believe).
Linux, World Wide Web… not worth the risk.
So I am making something in my free time, as a hobby, no monetary gain and suddenly I can easily get sued to oblivion. I need to at least buy insurance. My library is used left and right in commercial activity.
The impact assessment for CRA is a total lie. It assumes 100% decrease in cyber damages and laughably low compliance cost and very small amount of impacted entities (only companies, not individuals and each company makes one product).
TBF, version amended by EP explicitly excludes individual developers, hopefully it makes it through trialogue.
Edit: basically imagine authors of log4j. Remember that security flaw that impacted half the internet? That is what’s called liability. Did they use ‘ apply effective and regular tests and reviews of the security of the product with digital elements;’? Better make it industrial grade product, with no money, in their free time.
1. Reproduction is already heavily subsidized in many countries, be it direct grants, tax breats and so on. This is nothing new.
2. Most people actually want children. Getting someone to actually procreate with that will share burden.
3. Investing in children should hel to fund future pension payments. There is pretty good case for self-interest.
4. China won't care, neither will Russia or other parts of world.
5. Countries that will do that will have a better outcome than countries full of retirees. Unless AI takes over, natural selection will take care of rest
That assumes that new humans can be only by women.
There is no reason, why artificial womb, possibly with multiple selection box for genes, is not a very realistic possibility, along with state funded child rearing services. (see Norway)
Maybe, but normal developer interracts with sane parts.
Honestly, the biggest problem with git is sane environment for merge conflicts and that is out of scope of git CLI. In most cases, imposing rule for small PRs/feature branches will solve it.
git add, git commit, git log, git blame, git push, git rebase -i --onto. That is 95+% of what developers use (maybe an option here or there, like -m or --amend). Merges are done on CI after it passes.
There are a lot of arcane parts and switches. git-send-email is likely used a lot on kernel development, but very rarely in the rest of the world.
I've got 10 years in it and it still bites me in the ass.
Can you give some examples? I had some problems in the beginnings, but it was because i tried to be "smart".
After I embraced KISS, everything works nicely. As long as I keep "public" branches protected, any splash zone is very small and at worst, just redo it(synergy with small PRs).
MS stores windows codebase in a single repo (https://devblogs.microsoft.com/bharry/the-largest-git-repo-o...). 300GB.
I don't really see a benefit of having all code of an org in a single repo. Single product, sure. But whole company? Why. Not to mention, these are serious outliers.
From security standpoint, it doesn't seem great, from practical side, it's not great (bandwidth cost ect).
Rather surprising that they don't offer sign up with Facebook/Google.
I know, i know, but that's pretty big speed bump in the onboarding process.
Probably, but I will take this victory. Google has power to make this happen.
Because they are collecting a shitload of data about me to make them work.
It's like a little camera accompanying you everywhere and you don't get to say no and it's used for anything they can get away with.
Maybe when uutils ship their gnu compatible version(deviations from GNU are considered bugs), macos will update.
MIT, Rust, active development... Maybe in few years.
I suspect such versions won't comply with Cyber Resilience Act (=company would be on hook for a fine). Browsers are in category 2 iirc.
Edit: rest of world might be fine(big maybe, these things have tendency to proliferate),eu citizens... screws are tightening.
You can try to patent anything, but patent might not be accepted.
The thing is that patent office is funded by patent fees, so there is an incentive to accept the patent plus they are often hard to read.
Huawei and HarmonyOS? I know, rather unpopular ouside of China.
Sure, but position of Intel back then was very different than today.
Being dethroned and free cash flow negative is rather bad I am told.
For example you can get Chrome-style updates where Windows will keep the app fresh in the background even if it's not running
Considering the ability to update itself is a requirement of Cyber Resilience Act in EU, I foresee a big uptick in usage (and app stores usage of course).
Check out the full changes file, it has dates of changes:
https://www.ghisler.com/history1100.txt
Even after 30 years there are still things to fix pretty much every day. Maintenance is really endless task
Two panels + fast keyboard navigation across directories is big for me. I like the overview, speed and simplicity. File Explorer is just ... nope.
I am sure there are other programs, like Double Commander or maybe Salamander Commander if it still exists, but this is what I settled on.
My most used features are:
Archives:
* Comparison of files in Zip file/directories, just go to the zip file and do synchronize directory to see differences
* Edit file and save it to zip after modification - no need to copy to temp location, it does it for you
* Pack/unpack are common
Lister
* Easy switch from hexa to text, fast, lightweight.
* Checksums - create and verify
Spoken like a person who never even touched it even on a small project.
No cookies... so no language preferences. That is a profile cookie.
Right to erasure. What about invoices and orders? When can it be anonymous and when is it old enough to anonymize.
Do I get away with replacing personal data random data? Do I replace references to real people with 'anonymous person'? Will my sql constraints still work?
When I restore data from backup and someone has been anonymized in the meantime, what mechanism will be used to anonymize the user after restore?
Right to data portability. How much of the database and in what format?
MozJPEG is a patch for libjpeg-turbo. Please send pull requests to libjpeg-turbo if the changes aren't specific to newly-added MozJPEG-only compression code.
https://github.com/mozilla/mozjpeg#mozilla-jpeg-encoder-proj...
Llc stands for limited liability company.
Corporation, n. An ingenious device for obtaining individual profit without individual responsibility.
Thw method to remove limit unlimited liability is at the core of our economical system.
We are allowing it, because it works remarkably well and makes us richer.
I am shocked! shocked! Well, not that shocked.
Still, don't heat stuff for the infants in a plastic.
He likely means that companies will use the software and create issues with their problems without contributing anything back = developer will be free support for companies making money with no benefit.
AGPL doesn't have such problems because it's more radioactive than anything for companies = will be used only by other free software developers