Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No cyber resilience without open source sustainability

github.blog

Post reply on HN
Print view View original

41–50 of 74 posts

Re: No cyber resilience without open source sustainability

#41

Post by smarx007 »

Vespasian wrote: post #36
smarx007 wrote: post #31

Earlier quoted context omitted.

The full draft is under https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-... , the body starts from page 14. Upd: the amendment from 18.4.2023 is available under https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52...

Thank you very much. That seems to be the original draft of the Commission before the considerable changes added since then by the several committees

Thank you for checking carefully! I updated my original message with the extra link for the 18.4.2023 amendment.

Re: No cyber resilience without open source sustainability

#42

Post by Veserv »

smarx007 wrote: post #30
loup-vaillant wrote: post #7

I find the criteria for inclusion a bit weird: why would any given project should be the object of regulation? The way I see it, they should rather focus on the transaction . Products aren’t commercial by themselves. Selling them is. Distributing the thing for free? Not commercial. Selling support? Commercial, you must provide guarantees even if upstream does not. Selling something that uses non-commercial FOSS softw…

The reason is to make sure that all software that a normal run-the-mill business may use in the "in the course of a commercial activity" and receives regular releases, is reasonably free from known significant vulnerabilities (the last release, at least). Would it be reasonable to use Nginx "in the course of a commercial activity"? Yes, it would. Thus, EU wants to ensure that if you as an SME install Nginx and keep i…

Does Nginx assert it is fit for commercial activity?

If it does, then yes they should be required to meet their promises and keep it fit for commercial purposes.

If it does not, then why the hell are you using it for commercial purposes? They told you it is not fit for that purpose. You do not get to demand they meet your needs because it is convenient for you cheap out by using inadequate dependencys.

Re: No cyber resilience without open source sustainability

#43

Post by smarx007 »

Veserv wrote: post #42
smarx007 wrote: post #30

Earlier quoted context omitted.

The reason is to make sure that all software that a normal run-the-mill business may use in the "in the course of a commercial activity" and receives regular releases, is reasonably free from known significant vulnerabilities (the last release, at least). Would it be reasonable to use Nginx "in the course of a commercial activity"? Yes, it would. Thus, EU wants to ensure that if you as an SME install Nginx and keep i…

Does Nginx assert it is fit for commercial activity? If it does, then yes they should be required to meet their promises and keep it fit for commercial purposes. If it does not, then why the hell are you using it for commercial purposes? They told you it is not fit for that purpose. You do not get to demand they meet your needs because it is convenient for you cheap out by using inadequate dependencys.

As I wrote elsewhere in the thread, if EU didn't word it the way they did, most OSS projects would simply slap "not fit for commercial purposes" in the README next day after CRA became law with a smug smile.

Regarding "cheaping out", I expect EU businesses to begin demanding that every dependency in their SBOM is CRA-compliant in some due time. This will most likely mean paying money. But I disagree on "by using inadequate dependencys": how do you expect a pizza shop owner to think that installing Ubuntu LTS and running "apt-get update && apt-get install nginx && apt-get upgrade" or a latest version of Chrome is somehow inadequate?

Re: No cyber resilience without open source sustainability

#45

Post by smarx007 »

marcinzm wrote: post #16
smarx007 wrote: post #14

Earlier quoted context omitted.

I don't think this legislation will affect hobby projects. The problem is that whether the project is hobby or not is judged from the side of the consumer, i.e. if the software is usable "in the course of a commercial activity" (for the user). I agree that this creates a certain amount of stress, esp. for individual devs, but I think it was necessary to make sure that projects like k8s, kafka, and other OSS projects…

>The problem is that whether the project is hobby or not is judged from the side of the consumer, i.e. if the software is usable "in the course of a commercial activity" (for the user). Have you seen the dependency trees for commercial software? I'd be surprised if there's any non-trivial OSS project that hasn't been used as part of commercial activity.

I've seen many things in my life I'd gladly unsee, including corp IT devs putting programs with "SNAPSHOT" (unstable) dependencies in production. But just merely having a corp use your software would not place the CRA burden on you. Your project needs to make such an impression.

The most negative outcome of this legislation that I can see is that OS projects like Nix, Debian and others will start aggressively pruning their software repositories from packages where there is any indications that devs/packagers are not reacting to CVE reports (or do it too slow).

Re: No cyber resilience without open source sustainability

#46

Post by Veserv »

smarx007 wrote: post #43
Veserv wrote: post #42

Earlier quoted context omitted.

Does Nginx assert it is fit for commercial activity? If it does, then yes they should be required to meet their promises and keep it fit for commercial purposes. If it does not, then why the hell are you using it for commercial purposes? They told you it is not fit for that purpose. You do not get to demand they meet your needs because it is convenient for you cheap out by using inadequate dependencys.

As I wrote elsewhere in the thread, if EU didn't word it the way they did, most OSS projects would simply slap "not fit for commercial purposes" in the README next day after CRA became law with a smug smile. Regarding "cheaping out", I expect EU businesses to begin demanding that every dependency in their SBOM is CRA-compliant in some due time. This will most likely mean paying money. But I disagree on "by using inad…

I agree they would slap “not fit for commercial purposes” since they did not sign up for this.

I also agree the EU businesses would start requiring it which means they would not be allowed to use software that smugly slapped it into their README. If developers actually want commercial users then they need to meet the standards. If they are hobbyists or do not care to support those use cases, then they do not need to do that.

Any business still using the software that asserts it is not fit for commercial purposes is then clearly using inadequate dependencys. The developers said it was unfit or did not want to bother with it; so this is a perfectly true and proper characterization.

Re: No cyber resilience without open source sustainability

#47

Post by gavinhoward »

Vespasian wrote: post #34
gavinhoward wrote: post #17

This is exactly why my FOSS licenses have a provision making them null and void if there is any legal duty for the programmer to the user. It is also one part of why I don't want to deal with Europe.

In this case I would assume it's void almost anywhere because I don't know of a single place in the world that does not require developers to avoid putting intentionally malicious software into their foss with the ultimate goal to harm users. That requirement is something you usually can't waive with a LICENSE file either.

Fair. In truth, I worded it wrong in my first comment.

Suffice to say that I am paying a lawyer right now to avoid problems like that. Of course, the usual typical legal duties will still exist. But anything beyond that, such as fuduciary duty, will not exist.

Re: No cyber resilience without open source sustainability

#48

Post by thayne »

smarx007 wrote: post #14
jauer wrote: post #10

Earlier quoted context omitted.

> it will open up a path for devs to get paid for the extra burden. The thing is, being paid for an extra burden doesn't make it any less of an imposition on devs limited energy. Basically, if you want to accept donations so people can show their appreciation for what you share freely with the world, you open yourself up to demands that you do work that you don't enjoy on a hobby. That's really shit.

I don't think this legislation will affect hobby projects. The problem is that whether the project is hobby or not is judged from the side of the consumer, i.e. if the software is usable "in the course of a commercial activity" (for the user). I agree that this creates a certain amount of stress, esp. for individual devs, but I think it was necessary to make sure that projects like k8s, kafka, and other OSS projects…

So from what I understand, this means:

- you can't accept donations, or other small payments for your side project anymore, unless you take on a substancial burden

- you can't give commit access to, or possibly even accept contributions from employees of entities that use your side project in a commercial setting. And what if you work for a software company, but contribute to OSS on your own time, does the project need to comply with CRA then?

Re: No cyber resilience without open source sustainability

#49

Post by smarx007 »

thayne wrote: post #48
smarx007 wrote: post #14

Earlier quoted context omitted.

I don't think this legislation will affect hobby projects. The problem is that whether the project is hobby or not is judged from the side of the consumer, i.e. if the software is usable "in the course of a commercial activity" (for the user). I agree that this creates a certain amount of stress, esp. for individual devs, but I think it was necessary to make sure that projects like k8s, kafka, and other OSS projects…

So from what I understand, this means: - you can't accept donations, or other small payments for your side project anymore, unless you take on a substancial burden - you can't give commit access to, or possibly even accept contributions from employees of entities that use your side project in a commercial setting. And what if you work for a software company, but contribute to OSS on your own time, does the project ne…

I’ve heard this reading of CRA and I think it’s overzealous on purpose to rile individual devs (well done). But we will have the courts decide and I think they will draw a much more clear line than “any project that received 1 EUR donation or accepted a single corporate committer”. For example, Facebook was claiming that violating users’ privacy was a “legitimate business interest” under GDPR until courts ruled otherwise. I am not expecting projects that merely accept some patches or donations to be on the hook. But https://squidfunk.github.io/mkdocs-material/, for example, would fit the bill (see "Trusted in the industry" on the homepage and https://squidfunk.github.io/mkdocs-material/insiders/).

At the same time, I think the rules laid out in Annex 1 [1] are quite reasonable to comply with for any production-grade software. Interested to see if it would accelerate adoption of Rust/Zig, as [1] requires the software "be designed, developed and produced to reduce the impact of an incident using appropriate exploitation mitigation mechanisms and techniques;"

[1]: https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-...

Re: No cyber resilience without open source sustainability

#50

Post by thayne »

tremon wrote: post #32
bonzini wrote: post #19

Earlier quoted context omitted.

I have not yet fully made up my mind, but notice that there is a lot of nuance in the actual text. For example "Accepting donations without the intention of making a profit should not count as a commercial activity, unless such donations are made by commercial entities and are recurring in nature".

That doesn't sound like nuance, just a quagmire of uncertainty. That means that if I have a Patreon account, and any business decides to fund me for a couple of months (let's say, for the duration of a Summer of Code), my project is now commercial? Is it only commercial during those months? Will such a donation affect all projects I'm working on at the same time?

Or what if a business funds you for like $5 a month? Are you then required to comply with the regulations?
Post reply on HN