[HN Gopher] The European regulators listened to the Open Source ...
       ___________________________________________________________________
        
       The European regulators listened to the Open Source communities
        
       Author : jlpcsl
       Score  : 173 points
       Date   : 2024-02-02 10:35 UTC (12 hours ago)
        
 (HTM) web link (blog.opensource.org)
 (TXT) w3m dump (blog.opensource.org)
        
       | transpute wrote:
       | Debian statement, Dec 2023,
       | https://bits.debian.org/2023/12/debian-statement-cyber-resil...
       | 
       |  _> Even if only  "commercial activities" are in the scope of
       | CRA, the Free Software community - and as a consequence,
       | everybody - will lose a lot of small projects. CRA will force
       | many small enterprises and most probably all self employed
       | developers out of business because they simply cannot fulfill the
       | requirements imposed by CRA. Debian and other Linux distributions
       | depend on their work. If accepted as it is, CRA will undermine
       | not only an established community but also a thriving market. CRA
       | needs an exemption for small businesses and, at the very least,
       | solo-entrepreneurs._
        
         | hcfman wrote:
         | Well stated.
         | 
         | Another thing people can do is to disallow governments to use
         | any software you produce by default.
         | 
         | This doesn't change your obligations to the law but it does
         | attach consequences to government decisions. Right now they
         | make sweeping decisions to benefit large players and screw
         | small players, which is like stealing from the poor to give to
         | the rich. And worst, the whole thing is effectively retroactive
         | to all of the people whose collective work gave them all the
         | nice things.
         | 
         | Government should learn that decisions should be thought about
         | very carefully and the only way to start a change in thinking
         | is to attach consequences.
        
           | rmbyrro wrote:
           | Politicians don't care about this. It'll only impact the
           | lives of developers working at governamental positions.
           | 
           | This is also against the principle of OSS, which is to not
           | discriminate about usage.
        
             | hcfman wrote:
             | So is that law. Small players would be discriminated
             | against by virtue of not having the money to mitigate the
             | legal risk.
        
           | dns_snek wrote:
           | Such limitation would effectively change the project's
           | license, which would no longer be F/OSS approved. Most people
           | and businesses don't evaluate custom licenses, they'll just
           | skip your project because it doesn't have a well-known,
           | approved license.
        
           | alwayslikethis wrote:
           | How do you expect that to be respected when you have things
           | like illegal surveillance or eminent domain? A well behaving
           | government wouldn't be the target for this, and a badly
           | behaving one wouldn't respect it anyways.
        
             | thfuran wrote:
             | It tends not to be agencies like the USDA, USGS, VA, etc
             | conducting illegal surveillance, yet they all use
             | computers. And I'm not sure what eminent domain has to do
             | with it.
        
             | hcfman wrote:
             | That's absolutely true. It's more symbolic than practical.
        
           | Karellen wrote:
           | > Another thing people can do is to disallow governments to
           | use any software you produce by default.
           | 
           | So, instead of having governments become part of an open
           | (software) commons, using software that costs less in
           | taxes[0], which they would then have a stake in supporting
           | and helping to make better, you're proposing that they
           | purchase higher-cost proprietary software from private
           | corporations, supporting their shareholders?
           | 
           | Yeah, that'll help.
           | 
           | > the only way to start a change in thinking is to attach
           | consequences.
           | 
           | That's not how FLOSS has got where it is today, so it is
           | clearly not "the only way". FLOSS succeeds by allowing
           | everyone in, in allowing them to reap the benefits _first_ ,
           | so that they understand the value first-hand. Then, they come
           | to depend on it, and when they see how much it would cost
           | them to _stop_ using FLOSS, do they realise how much they
           | have invested in the ecosystem.
           | 
           | Keeping people out means that they never get entangled in the
           | first place.
           | 
           | [0] Or, requires less money to be created, depending on your
           | viewpoint.
        
           | wolverine876 wrote:
           | Didn't government do what you want in this case? A long
           | deliberative, consultative process, addressing the needs of
           | small players?
        
             | x0x0 wrote:
             | No.
             | 
             | They should have started by competently and carefully
             | thinking through the consequences of the liabilities they
             | were about to impose on open source, rather than obligating
             | open source to expend limited resources explaining the
             | obvious consequences.
             | 
             | These problems were obvious to anyone competent who spent
             | even a second thinking about it: people who give software
             | away cannot accept liability for doing so, and the act of
             | giving software away can't impose obligations to people who
             | receive nothing or they will obviously have to stop.
        
               | wolverine876 wrote:
               | I'd much rather they consult open source people about
               | open source needs, rather than try to guess. IME, you
               | need to talk to the people on the front lines. In fact,
               | unless I talk to people I know best, even family members,
               | I don't really know.
        
               | x0x0 wrote:
               | They didn't consult.
               | 
               | They made open source go lobby them to avoid having to
               | block the EU. That's the exact opposite of asking open
               | source, in advance of legislation, what would happen if
               | they did X.
        
         | sunshine-o wrote:
         | > CRA needs an exemption for small businesses and, at the very
         | least, solo-entrepreneurs.
         | 
         | My guess is even medium size businesses will face enormous risk
         | and cost related to this.
         | 
         | In the end we might see the worst scenario happening: open
         | source is good, but only if sold by a big company who can
         | afford compliance, risks and lawyers.
         | 
         | This will be somehow similar to what happened with GDPR, most
         | small & medium shops cannot spend too much time on this. And
         | ironically it pushed a lot of people in the 3 big public
         | clouds.
        
           | bluGill wrote:
           | I think medium software sized shops - 500 employees are large
           | enough to afford the details and so will be okay. Anything
           | smaller though and this is too much overhead. Of course many
           | projects don't need 500 people. If you use Linux you can buy
           | support from several actors of this size who can afford the
           | overhead (also covering tools like ls that are part of an OS,
           | maybe covering the basic gnome desktop, but not many of the
           | lesser used tools that make linux useful). I'm sure the
           | Apache and FreeBSD foundations will look into this and decide
           | that they are able to handle the overhead by starting
           | (legally this may be finding people to start?) such a
           | company. However I'm not sure OpenBSD is large enough to be
           | worth starting such an organization.
           | 
           | There are a lot of tools that are not large/popular enough.
           | Who will support OpenScad, FreeCad, cppcheck, and all the
           | other open source projects that don't have a large company
           | behind them and probably are not interesting to enough
           | companies to be worth starting something to support them just
           | for legal purposes. There are also projects that are
           | supported by a company today, but the company is not large
           | enough - will enough more customers come in to make it worth
           | hiring a dozen laywers - cmake and sqlite come into mind as
           | projects in this category.
        
           | ashildr wrote:
           | GDPR is easy as a small organization IF you are not greedy
           | for other people's data. Keep your hands clean. I own (part
           | of) a small company that makes software for a small market
           | and we had absolutely no problems with GDPR because we try to
           | not collect any data we don't absolutely need. It's not very
           | complicated if you just invest some thought into your
           | processes and don't spy on your customers. Most of the time
           | you don't need the data but someone wants to sell you a
           | product to gather it.
        
             | nickpp wrote:
             | > we try to not collect any data we don't absolutely need
             | 
             | Do you have analytics/telemetry for your products/websites?
             | Do you include 3rd party fonts, libraries or use a CDN or a
             | anti-DDOS service like CloudFlare?
             | 
             | Do you have data scrubbing capabilities in all your user-
             | interaction software with a default maximum retention
             | period? Do you answer data removal requests?
             | 
             | These are some the requirements for organizations of any
             | size, big or small.
        
               | nottorp wrote:
               | Does your list qualify as 'data you absolutely need'?
               | 
               | Do you assume everything is a web app where you can't
               | control what your 3rd party libraries spy on?
        
           | pjmlp wrote:
           | In every other industry business of all sizes, even people
           | selling stuff on the street, have to obey regulations, with
           | exceptions where obeying regulations comes with certain
           | flexibility.
           | 
           | Open source is no different from anythig else performed by
           | street artists, food trucks.
        
         | Certhas wrote:
         | That statement was based on the old text, correct? The revised
         | law seems to address this in the opinion of experts OSI spoke
         | to:
         | 
         | "In particular, "digital artisans" using Open Source software
         | at small scale - the main concern of Debian - will need
         | guidance from the European Commission. While the experts we
         | have met have all said that using an Open Source software
         | distribution as part of a commercial activity is unlikely to
         | require CE marking of the distribution itself, the
         | interpretation of the key phrase "making available on the
         | market" will need careful clarification."
        
           | DCKing wrote:
           | > That statement was based on the old text, correct?
           | 
           | Yes it has. The updated text was published on December 20th
           | [1], and does a lot to address these concerns. See also Bert
           | Hubert's analysis [2].
           | 
           | The amount of knee jerking in the comments for this law
           | really brings down the quality of discussion and detracts
           | from remaining issues.
           | 
           | [1]: https://eur-lex.europa.eu/legal-
           | content/EN/TXT/PDF/?uri=CONS...
           | 
           | [2]: https://berthub.eu/articles/posts/eu-cra-what-does-it-
           | mean-f...
        
             | diggan wrote:
             | > The amount of knee jerking in the comments for this law
             | really brings down the quality of discussion and detracts
             | from remaining issues.
             | 
             | Sadly, there are topics that sometimes come up on HN that
             | makes people have these knee-jerk reactions. Anything
             | related to EU, unions, Tesla, Israel and more tend to bring
             | out the worse from normally reasonable people. I'm probably
             | guilty of it sometimes too, we're all humans after all.
        
       | snowpid wrote:
       | I think, the CRA might create an incentive for companies not free
       | loading Open Source Software but instead putting money in the
       | open source eco system (though mainly on Security) and that is
       | somehow great!
        
         | hcfman wrote:
         | Very optimistic. Call me a cynic.
        
           | snowpid wrote:
           | so what would happen instead? The only alternative is using
           | close source (which does have disadvantage, being not cheaper
           | etc.),
        
             | narag wrote:
             | Outsourcing any function that needs software outside the
             | EU.
        
               | snowpid wrote:
               | Moving out your business out of EU is somehow a non
               | solution.
        
               | narag wrote:
               | I didn't say it's a solution.
        
               | bluGill wrote:
               | If you live in the EU it is hard to move. You have to
               | find a country that will let you in. Most countries
               | restrict immigration and so you are likely to only file a
               | country that is dangerous to live in. You also leave your
               | friends and extended family behind, which is difficult.
               | 
               | That assumes it is your company to move in the first
               | place. Which is unlikely. So add find a new job to the
               | list of things you need to do.
        
               | lars_francke wrote:
               | The CRA still applies as soon as it is first brought onto
               | the EU market. It might just be the distributor or
               | importer having to do some things instead of the
               | manufacturer.
        
               | narag wrote:
               | I mean the software is never used inside the EU. The
               | final product is built outside and later imported, so you
               | don't know what software was used.
               | 
               | An example: EU is approving very restrictive legislation
               | about pesticides _for use inside the EU_ but it happily
               | allows importing food grown in other countries using the
               | very same forbidden substances.
        
               | snowpid wrote:
               | still CRA applies.
        
               | FredPret wrote:
               | This is the weirdest form of colonization. In bygone
               | days, we had to accept European monarchs; now we have to
               | live with the diktats of their bureaucrats.
        
               | narag wrote:
               | Maybe you're misunderstanding what I said. Otherwise it
               | would be ridiculous.
               | 
               | If I buy a screw made in the USA, no EU authority can
               | know what's the software used in the machine tool. They
               | can control physical properties, packaging,
               | information... but the process used is opaque.
        
               | lars_francke wrote:
               | If you import a product the CRA applies.
               | 
               | And I personally think that's a good thing
        
             | pjc50 wrote:
             | As with CE marking: there's very little enforcement, so
             | people would carry on downloading solutions from outside
             | the EU and ignoring the rules. See the entire Aliexpress
             | market.
        
         | hyperpape wrote:
         | You haven't given any mechanism that would make this happen.
         | Specifically, some reason that the company would see
         | contributing be beneficial to it. Of course, it benefits from
         | the existence of open-source as a whole, but what material
         | difference does its contribution make?
         | 
         | Take a small-medium sized business (say 5 - 50EUR million
         | annual revenue). Perhaps it can fund one library that is
         | critical to it, but no contribution it makes will make a
         | material difference to the trajectory of major products like
         | Linux, or Python.
        
           | Certhas wrote:
           | The mechanism is clear: If you use Open Source software
           | commercially, you are now liable if the software misbehaves.
           | Thus, you have an incentive to make sure the software is
           | correct. For (A)GPL software, you have to publish your
           | contributions.
           | 
           | Not a lawyer, but it also seems to me that if you are a small
           | shop, you might decide to pay, e.g. RedHat for taking on the
           | liability. RedHat can pool these resources to make sure their
           | software behaves as advertised.
        
             | pabs3 wrote:
             | (A)GPL don't require publication, just giving code to your
             | users, who may or may not elect to further distribute the
             | code.
        
             | hightrix wrote:
             | > If you use Open Source software commercially, you are now
             | liable if the software misbehaves. Thus, you have an
             | incentive to make sure the software is correct.
             | 
             | As a software developer at a non-tech firm, I can gaurantee
             | this means we will not be able to use _any_ open source
             | software. If we are granted an exception, it will be such
             | that we must maintain a _private_ version of the open
             | source software.
             | 
             | This is simply a no-go for many companies of all sizes. The
             | risk associated here is not something many (any?) legal
             | department will be willing to take on.
        
             | hcfman wrote:
             | With a fifteen million euro penalty if you don't. Yeah
             | nice. If only we could also make fifteen million euros.
             | 
             | That's clear.
        
             | hcfman wrote:
             | What is due to some health condition they are incapable of
             | fixing it anymore. Tough! Now the law is discriminating
             | against old people because the risk of health deterioration
             | is higher. Let me guess, tough. Old people shouldn't be
             | programming anyway and they don't deserve to earn anything
             | with it.
        
           | snowpid wrote:
           | Of course, an SME company will not hire a developer to
           | constantly perform security checks and apply patches for an
           | important library libImportant.
           | 
           | What will happen is that company A will hire company B to do
           | this and assume liability for it. If we set the annual cost
           | of this at 100k, the monthly cost is about 8333 EUR. Let's
           | say company B has 20 customers to protect the security of
           | libImportant, that is 416 EUR per month and SME can afford
           | that. There are OS that are of course used more frequently
           | and that scales much better (i.e. cheaper per month). I
           | actually see a new market niche here and perhaps they will
           | find resourceful entrepreneurs.
        
             | bluGill wrote:
             | Only if there are enough companies interested in the
             | project. Will company B support cppcheck like that? I
             | prefer kde to gnome, but my company won't pay for kde
             | support when gnome already comes from some contract they
             | have - at least kde is large enough that I expect someone
             | to offer support - there are other desktops that are not
             | popular and now have even less hope of breaking in.
        
             | FredPret wrote:
             | Entrepreneurs are meant to solve real problems, not self-
             | inflicted bureaucratic ones.
        
           | bluGill wrote:
           | Most users of open source don't really care to make a
           | difference to the trajectory. Someone else made the linux
           | drivers I need, that is good enough for me.
           | 
           | For linux you will probably be able to buy a certified Linux
           | distribution for similar costs to Windows which is affordable
           | to a medium sized company that needs certification. However
           | that will only cover your basic OS: linux, ls, basic gnome
           | desktop (but not many applications, just the window manager,
           | a file management, and email client) - probably not a web
           | browser.
           | 
           | However there are a lot of small projects that are not
           | popular enough for anyone to certify like that.
        
         | xondono wrote:
         | I very much doubt it, and it's probably going to do the
         | opposite.
         | 
         | CRA just brings the kind paperwork that physical products have
         | always had to be licensed in the EU (CE marking) to software.
         | Have you seen european companies investing in Open source
         | hardware?
         | 
         | The path of least resistance will be to use homegrown
         | alternatives and sell them to potential investors and
         | shareholders as valuable intellectual property that puts them
         | ahead of competitors.
         | 
         | Not only because that makes perfect business sense, but because
         | this kind of IP is _very_ hard to value fairly, so it will
         | allow for a variety of accounting and tax avoidance
         | shenanigans.
        
           | snowpid wrote:
           | For a useful comparison you need to show if open source
           | hardware is more common / more invested in other parts of the
           | world. E. G. Risc V has a growing momentum
           | https://riscv.org/blog/2023/07/the-growing-momentum-of-
           | risc-...
        
           | demondemidi wrote:
           | Really? Specific security requirements for iot devices "have
           | always" been in existence? I'd really like to know the source
           | for that. I sound snarky because I work in security and am
           | unfamiliar with what you describe. I could also not be very
           | good at my job.
        
             | rcxdude wrote:
             | I think they were speaking more generally: the requirements
             | in the legislation are similar in structure to the kind of
             | safety/serviceability requirements that already exist for
             | hardware being sold in the EU (much of which is just self-
             | certifying you have implemented the relevant standards).
             | Having security requirements and applying them to pure
             | software products is what's new.
        
           | riffraff wrote:
           | > Have you seen european companies investing in Open source
           | hardware?
           | 
           | Arduino and RepRap are poster children of open source
           | hardware, and originated in the EU, I think.
        
           | hcfman wrote:
           | One more of the reasons I don't make hardware.
        
       | orwin wrote:
       | > In particular, "digital artisans" using Open Source software at
       | small scale - the main concern of Debian - will need guidance
       | from the European Commission.
       | 
       | Sadly I don't think it will move, the commission doesn't want to
       | weaken the legislation because they don't want to much
       | discrepancy between member states.
       | 
       | It will once again be up to individual countries to set up this
       | law with their own interpretation.
       | 
       | In my experience with Rgpd, the watchdogs in at least 3 countries
       | (France, Italy, Germany) are extremely helpful in navigating
       | regulations, especially if you are incidentally its target (As a
       | PaaS that hosted health data, we were).
       | 
       | I understand that this is both unclear, unknowable and a pretty
       | huge risk (not really factually, but it feels like one): I'm not
       | saying Debian people are wrong to want to clarify, I'm not saying
       | people should take this as a victory, or that EU is perfect : I'm
       | just saying that as a complex federation, with current rules,
       | this law will probably be the best we will get, and sadly, local
       | 'forgiveness' and loose execution is the only thing you can count
       | on.
       | 
       | Because in the EU eyes, the law being loose is way, way worse
       | than the local executive power being loose.
        
         | robertlagrant wrote:
         | > the watchdogs in at least 3 countries (France, Italy,
         | Germany) are extremely helpful in navigating regulations
         | 
         | This is a bad dependency to have. For example, for the new EU
         | medical device regulation, IVDR, a lot of the regulatory
         | infrastructure just isn't ready[0], and many bodies are bowing
         | out due to the complexity. Ironically, the British Standards
         | Institute is one of the few notified bodies to take it on!
         | 
         | And that's medical devices, which are a tighter form of
         | software. Regulating software in general seems like a very
         | difficult task.
         | 
         | [0]
         | https://www.degruyter.com/document/doi/10.1515/cclm-2021-097...
        
           | orwin wrote:
           | Yes, I think I was unclear: depending on local governmental
           | watchdogs/agencies goodwill isn't a good solution. It's the
           | one EU choose however.
           | 
           | It's weird for Anglo countries, or countries with the Anglo
           | law system, where the legislation might have holes and weak
           | points, but decree and case law fill those holes (the French
           | system work like that too). EU can't do that because it's a
           | federation of countries with different culture and interest.
           | 
           | Again, not saying it's good, I'm saying that's how it works.
        
           | WA wrote:
           | I still wonder who enforces the MDR if a company from outside
           | the EU offers their app/software to EU citizens without any
           | certification.
           | 
           | There are quite a few health apps that are considered medical
           | devices under MDR, but not in other countries. The EU
           | companies must comply with the regulations, but nobody seems
           | to be responsible for removing non-certified apps made by
           | non-EU companies. That is a huge competitive disadvantage for
           | EU companies.
        
       | rmbyrro wrote:
       | If you want to entrepreneur in the software industry, move fast,
       | folks.
       | 
       | They're closing in and the level of freedom we have today isn't
       | likely to exist in years to come.
        
         | esarbe wrote:
         | With "freedom", you mean the ability to exploit customers and
         | disregards any responsibility when it comes to protecting
         | customer's private data?
         | 
         | Yeah, let's hope so.
        
         | sofixa wrote:
         | > level of freedom
         | 
         | There are freedoms _to_ and freedoms _from_. The Cyber
         | Resilience Act is giving freedoms _from_ to consumers that
         | never had them before, at the expense of some freedoms _to_
         | abuse from software vendors.
        
       | PaulKeeble wrote:
       | This reminds me very much of the warnings by people like Robert C
       | Martin over a decade ago that unless the software industry
       | adopted better practices for quality and regulated itself
       | regulators would step in. Regulators understand very little about
       | the software process so the laws they are pass are unlikely to be
       | the best way to solve it. Years after those lectures little has
       | changed and now the regulation is coming at an increasing pace.
       | 
       | None of this will be good for small software companies, this sort
       | of regulation will entrench the big players as it always does.
        
         | mouse_ wrote:
         | "Big tech must regulate itself lest it become an unstoppable
         | monopoly and crush any new competition."
         | 
         | This sounds less like a warning and more like a playbook.
        
       | tzs wrote:
       | OT: Anyone have a more useful link to the Apache Foundation's
       | statement?
       | 
       | All the links to the other statements in the article go to the
       | sites of the organizations they are quoting, but the one for the
       | Apache Foundation goes to something called sandbox-pad.webm.ink.
       | 
       | That just gives me an error dialog in Chrome, Firefox, and Safari
       | that says "sframe-boot.js must only be loaded in a nested
       | context" then a shield with a keyhole image fads in over it along
       | with "Loading..." text, and nothing more happens (at least in the
       | 30 minutes I've had that tab open).
        
         | legobmw99 wrote:
         | https://news.apache.org/foundation/entry/update-on-eu-softwa...
         | 
         | This appears to be the article intended. At the very least it
         | contains the quoted sentence
        
       | mistrial9 wrote:
       | there are improvements but please, the implementations are the
       | test. Regulators, senior politicians and others can and do change
       | the course in implementation phase.
       | 
       | this is not over, in any way
        
       | max_ wrote:
       | I don't understand what's going on. Could someone give me a birds
       | eye view of what this is about?
       | 
       | - What is the regulation aimed at?
       | 
       | - What did the open source community communicate?
        
         | sofixa wrote:
         | The legislation (Cyber Resilience Act) aims to enforce some
         | standards and add liability around software products, to
         | enforce that vendors don't just throw something out, never
         | touch it again and it becomes a problem (customers stuck with
         | paperweights, security holes exploited). The problem is that if
         | you enforce that sort of thing on random open source projects,
         | many will be simply incapable of even trying to follow the
         | legislation because they're a small one-two dev team that
         | cannot navigate complex laws. So, progressively, more and more
         | exceptions have been added to who does the regulation apply to.
        
         | matheusmoreira wrote:
         | Liability for software developers and vendors. The only problem
         | is they forgot to make an exception for free and open source
         | software developers. It simply makes no sense for me to publish
         | free software out there for free if that can get me sued.
        
           | legobmw99 wrote:
           | TFA is about how they did make those exceptions in the final
           | text
        
             | Nostromos wrote:
             | Did they though? The article says that the final text
             | mitigated "pretty much all" of the issues. What wasn't
             | mitigated?
        
       ___________________________________________________________________
       (page generated 2024-02-02 23:02 UTC)