[HN Gopher] FOSS could be an unintended victim of EU crusade to ...
___________________________________________________________________
FOSS could be an unintended victim of EU crusade to make software
more secure
Author : JoachimS
Score : 120 points
Date : 2023-02-10 12:54 UTC (10 hours ago)
(HTM) web link (www.theregister.com)
(TXT) w3m dump (www.theregister.com)
| bee_rider wrote:
| > The CRA draft even exempts FOSS from compliance - but only if
| no commercial use is made of it, including things like technical
| support and as part of monetized services.
|
| This seems sort of reasonable. If you charge for tech support,
| you have a business. I'm all for not making it harder for people
| who are actually just sharing their hobby projects, but a project
| that makes money isn't a hobby anymore.
|
| I mean we wouldn't want to leave a gap large enough to send
| Android through, right?
| api wrote:
| Would this create a way for FOSS projects to charge SaaS
| companies for monetized use of software by offering a compliant
| version?
|
| Could be an unintended side benefit given that as it stands
| FOSS is basically free labor for SaaS with the latter
| delivering a user experience that is significantly less open
| and free than the old closed source paradigm FOSS intended to
| replace.
|
| FOSS + SaaS = less freedom than old closed source.
| JohnFen wrote:
| SaaS by itself is a total disaster on that front.
| okl wrote:
| I guess companies that run mirrors, for example distro repos,
| would fall under that definition too. What about donations and
| not-for-profit orgs?
| bee_rider wrote:
| This is a good question. I'd hope that just hosting a free
| repo wouldn't confer responsibility.
|
| Another thing I'm wondering about is academic code.
| Hypothetically the code I wrote for my thesis is available
| online and I was paid to write it, I guess, or at least it is
| part of the research I was given a stipend to do. (Happily,
| it has nothing to do with security!).
|
| Nobody is making any money off it. Hypothetically it could be
| seen as something that is there to add (very marginal!) value
| to my resume or to the university by showing off research
| chops... I dunno. If we had a law like this in the US, I
| wonder if it could stay up. I guess universities would end up
| with an additional CYA administrative step before posting
| code, and a big disclaimer in all their licenses.
| BlueTemplar wrote:
| Why are there no reminders here about the difference between
| open source and free (= libre) software ?
|
| It's specifically an important feature of libre software that
| others are free to resell or to make money from support of your
| own software : this is seen as a good thing because
| distribution (and support) are not free for the distributor
| (though I guess much less relevant in a world with widespread
| high speed Internet and peer to peer distribution software ?)
| (and supporter).
| amalcon wrote:
| That's not a fundamental feature of open source, or a
| fundamental restriction of free software. E.g the GPL is
| approved by OSI, and the MIT license is approved by the FSF.
|
| The distinction is really much more about philosophical
| objectives and marketing than it is about anything material.
| ghaff wrote:
| >Why are there no reminders here about the difference between
| open source and free (= libre) software
|
| Because there isn't a difference.
| JohnFen wrote:
| Well, there is a difference. Open source software includes
| certain things that may not be included in libre software,
| such as access to source code, customer participation in
| development, etc.
| ghaff wrote:
| Open source can be different from "free as in beer" but
| certainly not different other than as a
| philosophical/marketing thing from "free as in freedom"
| as the FSF uses the libre term.
|
| I may generally prefer permissive licenses but I
| certainly don't see how the GPL, for example, doesn't
| enable access to source code--though it may sometimes
| discourage participation in development.
| simiones wrote:
| Why is this relevant in this context? The question is which
| entity should be liable for abiding by this regulation, and
| the clear intention is that the answer is the one that
| Stallman himself would agree with: responsibility should sit
| entirely with whoever is distributing the software and making
| money off of it.
| JohnFen wrote:
| > a project that makes money isn't a hobby anymore
|
| It all depends. There are plenty of people who have hobbies and
| engage in some sort of low-level commerce in order to fund
| them. They aren't intending to profit by them (and don't), but
| are looking to reduce their loss.
| dathinab wrote:
| The problem is it's not a suply chain in the classical sense.
|
| If you directly or indirectly (support contracts) sell some
| software sure it should apply, but the regulation isn't well
| defined (in it's draft state) and includes much more.
|
| A lot of FOSS is based around the idea:
|
| - provide software components as FOSS on a as is-basis,
| components you do not sell directly or indirectly but plan to
| use, or used, or planed to use until things changed etc.
|
| - the consumer of the software (other programmers/companies)
| are expected to do _their own_ risk assessment, reviews etc. IF
| they decide to use the software (but only if, i.e. not needed
| for prototyping)
|
| - if they use the software (hopefully) you get feedback from
| their review and assessment leading to bug fixes and
| improvements
|
| - in some cases projects are evaluated by enough other parties
| that not everyone needs to do their risk assessment
|
| - you don't make profit from the release, but you do get
| feedback which could safe cost and do get publicity and trust,
| so it has a commercial benefit so it's commercial in a certain
| way
|
| Now you probably can already spot the problem, in many cases
| companies do _not_ do their do due diligence in reviewing
| software and blindly assume "someone" did it.
|
| So an regulating which requires you to have made sure that
| someone did due diligence for all software you include in a
| product, including SaaS(!) is reasonable IMHO.
|
| But because the regulation is based on the concepts/ideas of a
| physical supply chain it is instead requiring anyone which is
| publishing software components (instead of using them) to do
| the due diligence if it's commercial. But due to OSS leading to
| feedback, publicity and trust _ANY_ OSS done by a company can
| be classified as "commercial", even if it's a tech demo
| explicitly not meant to be used in production or a early pre-
| pre-pre release version.
|
| Another problem is the definition of what I called due
| diligence but to comment on that I had to read the draft again.
|
| So IMHO the problem is not the regulation by itself, it might
| even make OSS better, but the exact formulation which either
| show a deep missing understanding of software development or
| bribed politicians, probably a bit of both. Ah I mean lobby
| influence politicians, it's practically the same, but not
| legally so better clarify that.
|
| EDIT: I.e. a lot of OSS software is more like sharing
| (potential prototype) technical blue prints in an informal
| shared development/research agreements then it is selling
| "parts" in a supply chain.
| bee_rider wrote:
| The data sheets for an electronic part will usually have some
| example applications included, I wonder what the legal
| framework around those is.
| Kon-Peki wrote:
| Exactly. If you want to be useful, help refine the
| "monetization" definitions. Don't try to kill the whole
| legislation.
|
| The Register appears to have bought into the FUD being spewed
| by a bunch of people being paid a lot of money to run "non-
| profits".
| littleraincloud wrote:
| The main risk I see is that every web host using Apache or
| Nginx will be required to handle certification on their own.
|
| Businesses like Litesspeed can sell their product as a
| certified one and sell that as a feature.
| simiones wrote:
| But isn't this normal?
|
| If I am distributing a product based on Linux, it is my job
| to ensure that I use Linux in a secure way, to the extent
| required by contracts between me and my customers, and by
| local regulations. I can either take on this work myself,
| or pay IBM RedHat or SUSE or whoever else to take on some
| of the responsibility.
|
| How else would this work?
| dathinab wrote:
| There is a difference between due diligence and required
| certification.
|
| Using a "standard" kernel, keeping it up to date, etc. is
| due diligence but WAY cheaper and easier to do then any
| form of certification.
|
| Software certification especially wrt. to security is and
| always has been a mostly a scam.
|
| It also is a _major_ driving factor(1) for insecure
| software not getting fixed. Because it's "certified" but
| the security fix is not. (1: in certain industries)
| bee_rider wrote:
| Due diligence is relative to the industry. I agree that
| having a reasonably up to date and boring kernel, and
| keeping updated, is the best we can do now. But there's
| something defective in the industry, if there wasn't,
| then we could apply industry standards to produce a fully
| understood and certified device that is actually known to
| be free of defects.
| abbe98 wrote:
| > This seems sort of reasonable. If you charge for tech
| support, you have a business. I'm all for not making it harder
| for people who are actually just sharing their hobby projects,
| but a project that makes money isn't a hobby anymore.
|
| With the current writing it might be that a distributor
| different from the commercial entity might be liable for
| vulnerabilities and reporting.
|
| https://blog.sonatype.com/eu-cyber-resilience-act-good-for-s...
| ghaff wrote:
| Furthermore, as the author of the Sonatype piece told me last
| fall, it also goes beyond the upstream project and any
| distributor. In the case of a lot of vulnerabilities, the
| fixes have existed in the upstream for maybe a year or more.
| But they're still in downstream code that has never been
| updated.
| 908B64B197 wrote:
| I'm always impressed at how little European regulators seem
| to understand tech (and at how little they want a healthy
| tech sector to grow in Europe, preferring American and
| Chinese alternatives).
|
| To me it sounds like the "software is delivered as is" clause
| would nullify that.
| JohnFen wrote:
| But there are huge problems with "as is" clauses, and in
| the US anyway, they aren't always enforceable. If I sell a
| doohicky that I know is likely to kill people, slapping an
| "as-is" clause on it probably won't keep me out of jail.
| 908B64B197 wrote:
| In the case of OSS libraries and open-source
| distributors, there's no sale happening.
|
| What I see emerging is a dual license system where you
| can buy a supported version that's compliant with
| whatever European law or get the one hosted on an
| American mirror (where thankfully European law doesn't
| apply).
| JohnFen wrote:
| > In the case of OSS libraries and open-source
| distributors, there's no sale happening.
|
| True. I should have said "distribute". But the point
| holds.
| cm2187 wrote:
| > _The European Union has a commendable love for the safety of
| its citizens. Armed with the keys to a market of 300 million of
| the world 's richest consumers_
|
| More like 450m
| oaiey wrote:
| When I introduce a product to users I have to take care of its
| post-market cybersecurity. This is healthcare reality for years
| and now comes to all products.
|
| The interesting here is: What is a product? Most open source is
| not. The millions of libraries are not products. A product
| accumulates the various aspects (cybersecurity, license, ....)
| into a package. If I buy the software from a vendor I will make
| him responsible for it. If I hack it together on my self, this
| duty is on me.
|
| Open Source will survive that. But open source owners will get
| tons of questions and should be better be prepared to answer
| questions. GitLab and GitHub are already working on the consumer
| side with their security analysis features.
| weinzierl wrote:
| > _" But open source owners will get tons of questions and
| should be better be prepared to answer questions."_
|
| ...for appropriate pay.
| oaiey wrote:
| Ideally
| 908B64B197 wrote:
| Not ideally. Without a support contract they should,
| rightfully so, ignore these support requests.
| tensor wrote:
| But the rub is that open source owners have no actual
| obligation to you. So while you might want them to be "prepared
| with answers" they don't actually need to be. Some will want to
| be because they want their software to be used and up-to-date.
| But others have likely shelved their software, or just don't
| care to solve your security problems for you but will accept a
| patch if you provide one.
| karmicthreat wrote:
| And its literally what developers that are taking open source
| software and using it to sell something need to understand.
| The sellers are adding that value and taking that risk. If I
| go to the store, buy some wood, build a shelf from the wood
| and sell the shelf. Then it burns my customers house down,
| its on me not Home Depot.
| est31 wrote:
| That's where OSS companies like Suse or RedHat come in: they
| do provide support for their distributions. And, unlike
| Amazon, they also employ many maintainers and if they don't
| employ them, they sometimes submit patches to upstream so are
| good OSS citizens.
| oaiey wrote:
| That is all fair. The premise is the article headline that
| open source or Foss is dead. An open source software no one
| can use is a dead software. So the success of a Foss software
| might not only depend on functional aspects in Future but
| also on non functional aspects like the Cybersecurity
| management.
|
| And do not think that this influence will not happen. There
| are reason why the non functional requirement licensing has
| switched to MIT from previously more LGPL constructs.
|
| Having said all that... Yes, no one is obligated to answer.
| mikewarot wrote:
| Security is the job of the operating system, not applications.
| The seK4 kernel makes it possible to build operating systems that
| actually enforce security, rather than hope applications do the
| right thing.
|
| If this push isn't stopped... we'll all be taking a crash course
| on microkernels and the principle of least privilege. (A long
| overdue crash course, but that's my opinion, and not widely
| shared)
| eternityforest wrote:
| So far, world cybersecurity has been good enough. In an average
| year, if you ask 100 people what problems they experienced, data
| breach related issues are not going to dominate the list.
|
| While I'm generally a big fan of heavy regulation, there's just
| so much tech that doesn't matter, that we just use to make other
| things that don't matter easier.
|
| I would much rather see the regulation confined to domain
| specific things, stuff that directly deals with finances, life
| safety, industrial, etc.
| vaylian wrote:
| What I find interesting in this context: Most FOSS licenses have
| a no-warranty and no fitness for any purpose clause:
|
| GPL 3: there is no warranty for the program, to the extent
| permitted by applicable law. except when otherwise stated in
| writing the copyright holders and/or other parties provide the
| program "as is" without warranty of any kind, ...
|
| BSD-3-Clause: this software is provided by the author ``as is''
| and any express or implied warranties, including, but not limited
| to, ...
|
| Apache 1.1: this software is provided ``as is'' and any expressed
| or implied * warranties, ...
|
| Which means that the liability lies entirely with the user if
| they use the software for something critical.
| bee_rider wrote:
| Depending on the jurisdiction, courts might strike down or
| ignore parts of a license. On the other hand, you might not
| care what a court says, depending on your travel plans.
| aheliocentric wrote:
| One of the main guys behind Maven Central guy did a thing on
| this: https://blog.sonatype.com/eu-cyber-resilience-act-good-
| for-s...
| hodgesrm wrote:
| This was a very thoughtful article. Thanks for posting.
| nindalf wrote:
| Great article.
|
| TFA this thread is based on is low quality. It's breathless in
| its criticism of the legislation but uses hyperbole instead of
| calmly laying out the issues.
|
| The Maven Central guy puts it plainly - the proposed
| legislation doesn't penalise OSS developers, unless they
| distribute software they also get a commercial benefit from.
| But that describes the operator of Maven Central, who publishes
| software and has some commercial interests tied to it. However
| they cannot possibly take on liability for every published
| package. In that case they would be left with no choice but to
| block EU users.
| account42 wrote:
| Having to profit from the software isn't neccessarily that
| big of a caveat either depending on what precise wording that
| ends up in the law. Do donations count? What if you accept a
| bug bounty? How about a one time contract to implement a
| minor feature? Monetizing OSS is already hard enough that
| having to deal with compliance even for (money wise) tiny
| projects will make it impossible for many more.
| RobotToaster wrote:
| Calling it "unintended" is making a lot of assumptions.
| GTP wrote:
| So we should assume that it is intended?
| throw_m239339 wrote:
| > So we should assume that it is intended?
|
| Regulatory capture. It's very much intended by whoever really
| drafted that bill.
| AdrianB1 wrote:
| EU regulators are not shy of ignoring side-effects, so
| intention is not likely but negligence is widespread. EU
| loves to regulate even for the sake or regulating; it was
| even listed as one of the reasons listed behind Brexit, even
| if that is a completely different story.
| dathinab wrote:
| A lot of the "reasons for Brexit" turned out to be well
| spread misinformation if you looked closer into them or
| where cause by UK government instead of the EU so that a
| pretty stupid argument to bring up.
| imtringued wrote:
| This is one of the things that the UK could have simply
| vetoed on.
| blibble wrote:
| not true, this is an EU competency so is under Qualified
| Majority Voting rules
| simiones wrote:
| > EU loves to regulate even for the sake or regulating; it
| was even listed as one of the reasons listed behind Brexit,
| even if that is a completely different story.
|
| Some proof of that would be nice. The phrase "it was even
| listed as one of the reasons for Brexit" sends my personal
| prior in the direction of it being a lie, though I am quite
| willing to adjust if there is some evidence.
| vaylian wrote:
| I'm also skeptical. Most EU laws take a very long time to
| be negotiated, because different countries bring forward
| different needs/desires. But I do think it is hard for
| the average citizen to notice that there is a new law
| being drafted that could have bad consequences for one's
| personal life circumstances.
| rjzzleep wrote:
| Remember when the CDU politicians celebrated when they
| successfully lobbied for upload filters for their publisher
| friends in the EU? Why should not assume that its
| intended?Plenty of McKinsey consultants around to make sure
| governments don't use too much FOSS to keep paying those nice
| license fees to MS.
| GTP wrote:
| >Plenty of McKinsey consultants around to make sure
| governments don't use too much FOSS to keep paying those
| nice license fees to MS.
|
| Maybe, but remember that Ursula von der Leyen herself has
| been advocating for a while for EU's "digital sovereignty"
| (not having to depend on products and services form non-EU
| countries) and the easiest way to achieve that would be to
| heavily rely on FOSS.
| account42 wrote:
| > and the easiest way to achieve that would be to heavily
| rely on FOSS.
|
| But is it also the most profitable way for politicians.
| BlueTemplar wrote:
| Notably, for that there are tiers depending on the number
| of users or revenue.
| RobotToaster wrote:
| I'm saying we shouldn't assume either way. So we shouldn't
| rule out it being intentional.
| wazoox wrote:
| Yep. I remember back in 2003 when I wrote a personal letter to
| all EU MPs to ask them to reject software patents. Software
| patents enforcement would have been terrible for EU software
| and a boon for the rich US software company who constantly
| lobby the EU parliament...
|
| Well, I'm pretty sure that these same US software companies are
| still there lobbying in their own interest, in a complete
| absence of transparency.
| christkv wrote:
| Will we have to change licenses to exclude use in the EU?
| ocdtrekkie wrote:
| This is, as per usual, big companies trying to scare you into
| believing regulations meant for them will hurt the little guys.
| Learn to recognize this news pattern and disregard it
| immediately.
|
| The EU is probably the leading body of government trying to drive
| FOSS adoption.
| msla wrote:
| > This is, as per usual, big companies trying to scare you into
| believing regulations meant for them will hurt the little guys.
|
| Except those regulations hurt the little guys more than the big
| companies.
|
| Even if the big companies can't buy their way out of
| compliance, compliance inherently costs less for them and
| regulatory bodies are more willing to work with a big company
| than a small group of hobbyists, leading to the big company
| being able to follow the law with nary a hiccup whereas the
| hobbyists get destroyed by zealous enforcement.
| ocdtrekkie wrote:
| This isn't true for a myriad of reasons. Smaller
| organizations are usually inherently more compliant, their
| smaller scale makes it far easier and cheaper for them to
| become compliant, and enforcement agencies are less
| interested in investing significantly in enforcement actions
| against them.
| jessaustin wrote:
| _...their smaller scale makes it far easier and cheaper for
| them to become compliant..._
|
| This is often somewhat true. However, as I have observed in
| several USA contexts, large organizations are often
| exempted (whether explicitly or not) from pesky new
| regulations, citing this very point. For example, I
| personally attended a California PUC meeting in which VZN
| and SBC were exempted from "lifeline" regulations that
| continued to be imposed (with nonzero costs) on the small
| CLEC that employed me. Large organizations have to keep
| lawyers and lobbyists employed, so they might as well keep
| them busy. Creating regulations and exempting themselves is
| common practice.
|
| Perhaps things work differently in Europe.
| hyperman1 wrote:
| In Europe, small companies tend to be exempted. E.g. no
| GDPR data protection officer required when less than 250
| people in the company. 10, 50 and 100 are also personnel
| counts seen on a regular base.
|
| In practice, a lot of companies stop growing just below
| the limit, and e.g. split in parts that have supplier
| relations to each other. No, we don't have 2000
| employees. We are a group of 200 companies, owned by the
| same owners, and having 10 employees each.
| rightbyte wrote:
| Having 200 boards can't be more cost effective than not
| hiring one data protection officer, right? Even two
| boards has to be more expensive.
| jakeogh wrote:
| "Unintended"? No... it's the whole point.
| nivenkos wrote:
| Just to help shore up old institutional corporations like SAP,
| etc.
|
| The EU is basically an association for German business owners and
| landowners. Happy to impede technological progress if it serves
| their interests.
| GTP wrote:
| > The EU is basically an association for German business owners
| and landowners. Happy to impede technological progress if it
| serves their interests.
|
| That's not true at all, and I don't see which interest there
| would be in hampering FOSS development.
| [deleted]
| leonardp wrote:
| Their interests are money and power, so this should be pretty
| self explanatory.
| TEP_Kim_Il_Sung wrote:
| That's not true; The EU is also an association of French,
| BeNeLux business owners and royalty playing politics.
| mkl95 wrote:
| The way the remote job market is being flooded by American
| companies proves your point. EU companies do not even try to
| compete with them, with a few exceptions.
| ergonaught wrote:
| Probably shouldn't oversimplify it. Ex: I'm in the USA and
| every company I've worked for in the past 20 years was remote
| work and based in Europe. They opened American offices to
| make some things easier here, but They Came From Europe
| (ooohhh spoooooky).
| [deleted]
| pjmlp wrote:
| Well, that is the thing, I am free to offer food on the street,
| yet I am suject to the same kind of health regulations as any
| kind of restaurant.
|
| Same applies to any kind of business.
|
| Why should FOSS be any different?
|
| Maybe this is the culmination of the bazaar idea after all,
| including quickly stuffing the products back into a bag and
| running away from the law enforcement official between the crowd,
| by not having either a license or the expected quality.
| DasIch wrote:
| > Why should FOSS be any different?
|
| Because it's not a business. Health regulations for restaurants
| also don't apply to your kitchen at home, even if you are
| inviting friends for dinner.
| izacus wrote:
| And if FOSS is not a business, it's excluded from this
| regulation as well.
|
| If you make business with said FOSS you need to provide
| security just like how a food truck making food from open
| recipes has to make sure to not poison people either.
| bioemerl wrote:
| What if I provide it for free and a business starts using
| it?
| hyperman1 wrote:
| What if you give self baked cookies to a restaurant
| owner, and he sells them? Then the commercial entity
| assumes the risks and is supposed to safety check them.
| pjmlp wrote:
| They surely apply if they happen to get food poisoning and
| sue you afterwards.
| yfr7ryfhh wrote:
| Shockingly it's actually the fact you gave them food
| poisoning that decides that one. But I wouldn't be
| surprised if the Europeans thought that in need of fixing
| too.
| pjmlp wrote:
| It means that you haven't taken the proper care to
| prevent it from happening in first place.
| account42 wrote:
| There is a difference between being held accountable if
| your negligence ends up hurting someone vs. proactive
| audits and reporting requirements - the second has
| overhead even for those that already have high standards,
| overhead that is unreasonable outside a business setting.
| watwut wrote:
| Proactive audit system seems to be better one to me. It
| is more predictable - you know in advance which rules you
| are supposed to follow. It also allows for widely
| accepted risk standard know in advance to both customers
| and providers.
|
| The "do what you want and we will punish you hard if luck
| strikes badly" is less predictable. It has unfair
| results. It leads to both excessive risk avoidance
| (because if you are unlucky punishment is
| disproportionate) and risk taking customer is unable to
| proactively avoid.
| meltyness wrote:
| It's more like berries.
|
| Holly bushes grow berries that you shouldn't eat.
|
| Should government destroy all holly bushes? No. All berries?
| Certainly not.
|
| Speech is a natural right and software is speech, so it can't
| be meaningfully viewed any other way, unless you're mindlessly
| parroting representative government deliberations.
| PaulDavisThe1st wrote:
| Here in New Mexico, there's a whole class of food preparation
| (specifically, involving food that does not need refrigeration
| to stay "safe" for a specified time period) that is _NOT_
| subject to the same kind of health regulations as a restaurant.
|
| It's one of the smartest laws I've seen in this area. Want to
| run a small coffee shack with some cakes, cookies etc? No need
| for a certified kitchen, "fully trained" cook, etc. The only
| thing you have to do is take a course that helps differentiate
| between refrigeration-required and no-refrigeration required
| food.
|
| Interesting to think how this model would apply in the software
| context...
| watwut wrote:
| Restaurant regulations in EU do not mandate any special
| education for cooks. Also I don't know what you mean by
| "certified kitchen", it is not really a thing. There are
| regulations around handling and storing food, ventilation and
| what not in EU countries.
|
| And those do apply to small stands and full kitchens. But if
| you want to claim they are unreasonable, then you should
| argue by existing ones rather then made up ones.
| PaulDavisThe1st wrote:
| In the USA, to prepare food for commercial purposes, you
| generally need to have a kitchen that has been inspected
| and permitted for such things. You cannot, for example, use
| your own home kitchen (this varies by state, but that's
| generally true). Some states require training courses for
| all users of these kitchens (and some do not). Some require
| that the kitchen can only be used when someone trained is
| present.
|
| I did not make anything up. The New Mexico law I mentioned
| went into effect only a few years ago. Before that, it
| would be illegal to, for example, bake a cake in your home
| kitchen and offer it for sale. This is no longer the case.
| bee_rider wrote:
| It should be different because software is different from
| physics objects like food, it works differently and people
| interact with it differently.
|
| Imagine you were making cookies for your friends, and Nabisco
| happened to get one of the cookies somehow. Should you be
| responsible if they decide to use the ability, conferred from
| having one cookie, to create an infinite number of copies of
| that cookie (without checking it for defects or even really
| investigating it much) and start selling them across the
| country? I'd say probably not. But our legal framework doesn't
| cover it, because physical objects don't work like that, unlike
| software.
|
| We could also look at software as more like a recipe. If
| Nabisco decided to copy my cookie recipe, they'd unambiguous be
| responsible for checking it and making sure it wasn't actually
| poisonous. We also have cook books, I guess if you put a
| poisonous recipe in a cookbook you'd have some responsibility.
| But this is all manageable because cooking recipes are pretty
| short and easy enough to verify, and the foot-guns of the
| hobbyist cooking field are mostly well known.
|
| A closer recipe analogy is probably -- Nabisco probably gets
| their bulk supplies from a network of suppliers, who have to
| manage things like contamination levels and fitness for a given
| purpose. But now we're hitting the point where the analogy is
| at least as complicated as the software supply network; I'm
| sure there are lots of shared responsibilities and regulations
| in that network, and it is all professionalized and for-profit.
| davidgrenier wrote:
| How is this take? Free and Open Source Software isn't owned by
| anyone.
|
| Being a contributor, even to my own pet project, cannot compel me
| to contribute my valuable time to the project in ways that I do
| not so chose. And you can't compel me either to spend my money to
| hire some third party security firm to audit this code that isn't
| owned by me or anyone.
|
| If some third party wants to compile this un-owned piece of code
| and sell it to another, the onus is on them to comply with
| security regulations.
| jcarrano wrote:
| A lot of of questions...
|
| It is whether, for companies that offer paid support for FOSS,
| the obligations are towards the paying customers or all.
|
| The same with FOSS which is used as a basis for commercial
| products. E.g. Google makes money off Android, but is AOSP with
| no Google stuff also covered by this law?
|
| And how does it affect companies providing support for software
| they do not own? (e.g. consultancies).
___________________________________________________________________
(page generated 2023-02-10 23:02 UTC)