FOSS could be an unintended victim of EU crusade to make software more secure

The Register appears to have bought into the FUD being spewed by a bunch of people being paid a lot of money to run “non-profits”.

With the current writing it might be that a distributor different from the commercial entity might be liable for vulnerabilities and reporting.

https://blog.sonatype.com/eu-cyber-resilience-act-good-for-s...

Could be an unintended side benefit given that as it stands FOSS is basically free labor for SaaS with the latter delivering a user experience that is significantly less open and free than the old closed source paradigm FOSS intended to replace.

FOSS + SaaS = less freedom than old closed source.

It's specifically an important feature of libre software that others are free to resell or to make money from support of your own software : this is seen as a good thing because distribution (and support) are not free for the distributor (though I guess much less relevant in a world with widespread high speed Internet and peer to peer distribution software ?) (and supporter).

If you directly or indirectly (support contracts) sell some software sure it should apply, but the regulation isn't well defined (in it's draft state) and includes much more.

A lot of FOSS is based around the idea:

- provide software components as FOSS on a as is-basis, components you do not sell directly or indirectly but plan to use, or used, or planed to use until things changed etc.

- the consumer of the software (other programmers/companies) are expected to do _their own_ risk assessment, reviews etc. IF they decide to use the software (but only if, i.e. not needed for prototyping)

- if they use the software (hopefully) you get feedback from their review and assessment leading to bug fixes and improvements

- in some cases projects are evaluated by enough other parties that not everyone needs to do their risk assessment

- you don't make profit from the release, but you do get feedback which could safe cost and do get publicity and trust, so it has a commercial benefit so it's commercial in a certain way

Now you probably can already spot the problem, in many cases companies do _not_ do their do due diligence in reviewing software and blindly assume "someone" did it.

So an regulating which requires you to have made sure that someone did due diligence for all software you include in a product, including SaaS(!) is reasonable IMHO.

But because the regulation is based on the concepts/ideas of a physical supply chain it is instead requiring anyone which is publishing software components (instead of using them) to do the due diligence if it's commercial. But due to OSS leading to feedback, publicity and trust _ANY_ OSS done by a company can be classified as "commercial", even if it's a tech demo explicitly not meant to be used in production or a early pre-pre-pre release version.

Another problem is the definition of what I called due diligence but to comment on that I had to read the draft again.

So IMHO the problem is not the regulation by itself, it might even make OSS better, but the exact formulation which either show a deep missing understanding of software development or bribed politicians, probably a bit of both. Ah I mean lobby influence politicians, it's practically the same, but not legally so better clarify that.

EDIT: I.e. a lot of OSS software is more like sharing (potential prototype) technical blue prints in an informal shared development/research agreements then it is selling "parts" in a supply chain.

It all depends. There are plenty of people who have hobbies and engage in some sort of low-level commerce in order to fund them. They aren't intending to profit by them (and don't), but are looking to reduce their loss.

...for appropriate pay.

That's not true at all, and I don't see which interest there would be in hampering FOSS development.

TFA this thread is based on is low quality. It’s breathless in its criticism of the legislation but uses hyperbole instead of calmly laying out the issues.

The Maven Central guy puts it plainly - the proposed legislation doesn’t penalise OSS developers, unless they distribute software they also get a commercial benefit from. But that describes the operator of Maven Central, who publishes software and has some commercial interests tied to it. However they cannot possibly take on liability for every published package. In that case they would be left with no choice but to block EU users.

Because it's not a business. Health regulations for restaurants also don't apply to your kitchen at home, even if you are inviting friends for dinner.

Holly bushes grow berries that you shouldn't eat.

Should government destroy all holly bushes? No. All berries? Certainly not.

Speech is a natural right and software is speech, so it can't be meaningfully viewed any other way, unless you're mindlessly parroting representative government deliberations.

Imagine you were making cookies for your friends, and Nabisco happened to get one of the cookies somehow. Should you be responsible if they decide to use the ability, conferred from having one cookie, to create an infinite number of copies of that cookie (without checking it for defects or even really investigating it much) and start selling them across the country? I’d say probably not. But our legal framework doesn’t cover it, because physical objects don’t work like that, unlike software.

We could also look at software as more like a recipe. If Nabisco decided to copy my cookie recipe, they’d unambiguous be responsible for checking it and making sure it wasn’t actually poisonous. We also have cook books, I guess if you put a poisonous recipe in a cookbook you’d have some responsibility. But this is all manageable because cooking recipes are pretty short and easy enough to verify, and the foot-guns of the hobbyist cooking field are mostly well known.

A closer recipe analogy is probably — Nabisco probably gets their bulk supplies from a network of suppliers, who have to manage things like contamination levels and fitness for a given purpose. But now we’re hitting the point where the analogy is at least as complicated as the software supply network; I’m sure there are lots of shared responsibilities and regulations in that network, and it is all professionalized and for-profit.

It's one of the smartest laws I've seen in this area. Want to run a small coffee shack with some cakes, cookies etc? No need for a certified kitchen, "fully trained" cook, etc. The only thing you have to do is take a course that helps differentiate between refrigeration-required and no-refrigeration required food.

Interesting to think how this model would apply in the software context...

Well, I'm pretty sure that these same US software companies are still there lobbying in their own interest, in a complete absence of transparency.

Except those regulations hurt the little guys more than the big companies.

Even if the big companies can't buy their way out of compliance, compliance inherently costs less for them and regulatory bodies are more willing to work with a big company than a small group of hobbyists, leading to the big company being able to follow the law with nary a hiccup whereas the hobbyists get destroyed by zealous enforcement.