Hacker News Reader

Comment by occamrazor | Hacker News Reader

The regulation looks reasonable: if someone is selling software, or products containing software components, they have to certify the security of their products.

OSS developers who don’t charge for the software have no obligations. If their software is used in a commercial product, the seller of that product is responsible.

View on HN

Yeah, but me going from making $0/month to $20/month changes it to commercial, and suddenly introduces a heavy compliance burden.

I’m not getting an auditor over to audit my $20 program.

Technically you have to do it at $0/month because once it changes to $20/month you're not in compliance. It's a minor distinction - your point is the important one. You have to do it way before you have the means.

> I’m not getting an auditor over to audit my $20 program.

Self-assesment is an option. The problem is that now you're responsible for the bugs, no matter whether the user uses it for securing his cafe or bank...

Self-assessment is not an option if your program is on the "critical" list.

a list which you have now have to keep up-to-date on at all times because suddenly your project might be included even if it initially wasn't.

No, CE markings are normally for finished products, not components. (in many cases the software is a component). Most open sourced projects are not user-facing finished software products.

No, the regulation explicitly includes components:

> For the purposes of this Regulation, the following definitions apply: (1) ‘product with digital elements’ means any software or hardware product and its remote data processing solutions, including software or hardware components to be placed on the market separately

https://ec.europa.eu/newsroom/dae/redirection/document/89543

Oh my, I need to update my understanding of CE markings if it's like this in this instance. This is going to be complete chaos.

So, I think this new legislation might be bad, as the distinction between a component vs a finished product is a lot less clear in software, and particularly open-source projects. I'm not sure the lawmakers will consider this carefully.

yep, and accepting donations are not charging for a product, much like my tipping a bartender isn't paying for a drink.

Reply on news.ycombinator.com