The EU's new Cyber Resilience Act is about to tell us how to code
berthub.eu
berthub.eu
Gosh, can you imagine if other industries had to deal with such oppressive requirements, like if the local taco truck had to abide by some minimum standards of food safety, or if engineers would be held accountable for a bad bridge, or if accountants were expected to actually do their job correctly?
What a terrible world that would be.
refusing to quote what you mean is bad faith. and you're not really contributing to the conversation
Service exploit mitigation techniques? Really why didn't I just think about not writing bugs, and vulnerable code.
One example could be limit what the system can and can't do. And don't allow it to communicate with the whole world when your only required endpoints are api.samsung.com, an ntp server, DNS and MQTT.
A shame that he had to write this hit-piece when he could have asked what notified bodies are testing _today_ to meetx requirements for RED.
>(f) protect the availability of essential functions, including the resilience against and mitigation of denial of service attacks;
>Did the EU just require me to make software that can withstand (unspecified) denial of service attacks? Something that is mathematically proven impossible?
That does not seem like the intent of the paragraph. My first thought is that it's a poorly worded (though legalese oftentimes needs to be) way of saying that devices should not easily be turned into DDOS nodes. But it might also just say that even if it's under DDOS attack, there should be a way to operate essential functions still, which is very much possible with some compartmentalization.
Regardless, I can imagine there are some products with 'essential functions' which require the channel that could be DDOSd, no?
My stance here is that it's very broad, and I think it's easy to create an exploitable system from these directives. But unfortunately the problem is real and the mitigations complex. I was buying into this initially because of that, it seems reasonable without much thought on what the exact solutions look like, which I think makes it more dangerous.
If other engineering fields have seen this process, and the involved regulatory bodies have stayed independent of large corporate interests, I guess we should have a good shot. But with my lack of knowledge on that topic, I hold some trepidation for the future of smaller software shops and individual developers.
> (g) minimise their own negative impact on the availability of services provided by other devices or networks;
This is not what has happened with previous regulations. In fact, it's mostly weaponized against US companies, but that's mostly because it's fun and deserved.
It's not dissimilar to how the tax authorities always seem to pick small timers for a random extensive audit.
The idea is good and I'm all for it, but mostly due to said observations I'm not convinced its practical implementation will be very effective at all
It's not like they're the cause of half of regulations or anything due to all the scummy small business owners...
Yes think of smaller entities - which are not all commercial, mind you - just don't think of them more often and more thoroughly than the multinational megacorporations that have been racking up endless violations, most of which they are continuously worsening rather than fixing, and are in many cases actively trying to litigate into oblivion.
The result?
GSK paid $4 bn in fines. They made $11 bn in profits from that drug. Net $7 bn even with the fine.
...
This is the way regulation works in the US. And this is why the Americans dislike it: Small businesses can never risk that. Big businesses dont need to care about that. Its designed to kill the small for the sake of the big.
The Eu used to be different. But judging from how this law is crafted, it might be changing.
I understand that Americans tend to think like this. But proportionality works quite well in Europe: Large companies get more scrutiny and higher fines while small companies get a warning.
All but one of the cases ended in a warning, but it does show the increased scrutiny that smaller entities seem to enjoy.
Edit: just to clarify me or my business were not directly involved with all those cases, but in the one that we were, it was something we had simply overlooked with regards to GDPR and all was good immediately when the auditor determined we had resolved the problem
https://www.enforcementtracker.com/
This trend is similar to how the megacorps block out competition in the US by killing small businesses and making it very difficult to engage in economic or engineering activity through the regulations they sponsor.
This law in particular seems to be the product of the private German interests which at the moment dominate the Euparl. So, yeah, its happening in Europe now too.
The fine is arbitrarily decided. There isnt anything solid governing the amount if the fine is not % of revenue. So it totally depends on the whim of the regulator. Which is totally in lieu of the principles of civil law that Europe uses. Its more like the common law practice in which the authority can interpret things and can act arbitrarily without solid, inviolable, democratically-made laws governing its behavior.
This may look like working today. Tomorrow you may find it disproportionately hitting whichever segment or sector that the interests behind the incumbent regulatory appointees target.
This is wrong. See GDPR article 83, and https://edpb.europa.eu/system/files/2022-05/edpb_guidelines_...
How is 'evaluation' done and who does the 'evaluating' you think...
There is no solid legal directive defined in GDPR regarding static amounts. They hinge on on the regulators' interpretations.
Anyway, my point was that the fines dispensed nowadays are sensible. As for the future, DPAs know very well that the instant they go rogue, ie. distribute disproportionate fines or misinterpret the law, their decisions will be reversed by an appeal court. It already happened, in fact.
edit: I just read this on the website of my govt:
> The court that sentences the offender is free to set the amount of the fine, but not to exceed the maximum amount set for that offence.
Turns out judges here have even more leeway than my DPA! The finepocalypse should come any day from now. And don't get me started on courts of assizes.
> Anyway, my point was that the fines dispensed nowadays are sensible.
The sensible fines of today do not guarantee the fines of the future. The precedent concept does not apply to civil law. When an authority is given free range interpretation power like this, the next batch of regulators can interpret it in however they want. Which is in itself a violation of civil law principles.
> ie. distribute disproportionate fines or misinterpret the law, their decisions will be reversed by an appeal court
No Open Source contributor will risk getting such a fine, then going through a lengthy court battle to revert it. They will just stop contributing.
Good afternoon.
A speeding ticket has a fixed fine, anything more complex than that has some level of arbitrariness.
This is how things work in pretty much every other country of the world.
And of course fines are appealable, etc
They will come after the little guy with the full force of the state, with their lackeys wearing a pistol belt, and you had better comply, or else. Meanwhile they dont have resources to perform audits on the big guys
> Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith.
> Please don't post shallow dismissals, especially of other people's work. A good critical comment teaches us something.
> When disagreeing, please reply to the argument instead of calling names.
It's okay to disagree with someone, but saying their comments are hypocritical and that they're throwing a fit is not okay.
I would bet that a lot of devs actually want to write high quality, well-tested code and engage in proper project hygiene but simply aren't given the bandwidth required to do so. In my experience everything is so tilted towards "ship now, fix later (maybe)" that any IC's efforts to do things more correctly is a bit like trying to swim upstream.
How many here are confident of writing software as securely as Theo?
edit: I still think this is going in a good direction, but at this stage this kills a lot of small businesses, startups and open source.
Requiring certification for every release means killing off most software, let alone the fees. Forget multiple supported releases or LTS, everything will be rolling release.
Does all public code on GitHub need to be audited?
A lot of the author's criticism is centered on the lack of a designated standards body and software standards. That seems slightly unfair, given the fact that this is still a draft law, so obviously it is still waiting to be implemented and further specified through a standardization process. In general, it should be seen as a positive when a law doesn't set out specific requirements - which might be out of date - a few years later - but rather leaves it up to a body filled with industry representatives and experts to figure out the exact standards.
Secondly, a large percentage of developers do not have a CS degree. There's also a significant number of educations that are not specified as a CS degree, but still teach people skills with the aim of them entering the workforce to work as developers
It's also unclear how domains where software is developed as a tool, but isn't a primary focus (i.e. bioinformatics)
US has next to zero privacy protections, and unlimited investor money with zero expectations for a company to ever turn profitable. E.g. all of YCombinator's "top companies" lose hundreds of millions and billions dollars a year.
China and Russia have cheap labor and yes, zero privacy.
Edit: the same people who clamor for Russia and China-style big companies will immediately shout for government to step in if any company ever gets to the size and influence of Yandex or AliBaba.
No, there are no "zero expectations for a company to ever turn profitable". If you ever tried to get investor money you'll know how hard is to prove to them you have a good path to profitability. Even if all of YCombinat companies except one lose hundreds of millions, the last one can turn into a Facebook, worth hundreds of billions.
And yet, YCombinator's top companies lose billions for years and keep getting the money. What's the "proven path to profitability"? The flimsy belief that "just wait a bit and we'll have a next Facebook?"
Most of the companies that get mentioned as "big innovative companies" in HN threads have been around for 5+ or even 10+ years, lost incalculable amounts of money, never turned a profit, and we're led to believe that there's an expectation to turn a profit in any of these scenarios.
One in five US citizens is protected by a regulation that looks an awful lot like GDPR. And if history is any guide, it won't be long before that number gets a lot closer to 100%.
EU laws apply to all member states and even entities just dealing with EU members (which is why Privacy Shield is dead again, USA lied).
They do, in fact, when it does business in California. (Also, California is less than 1/5 of the country, so the reference is not just to California law.)
Otherwise it's illegal as due to fun laws only FED can regulate interstate commerce.
Physical presence is not a requirement for commerce clause nexus (though it definitely satisfies it.) I’m not sure it ever was viewed as a requirement outside of sales taxes, and the precedent establishing it as a requirement for sales taxes was overturned by the Supreme Court in South Dakota v. Wayfair (2018).
> Otherwise it's illegal as due to fun laws only FED can regulate interstate commerce.
The “fun law” is the Constitution's Commerce Clause, and that’s not actually how it works.
from where I sit being a start-up, or SME that can make quick decisions and consolidate their security debt is a lot easier on them and worse for us big guys.
I don't want to use a phrase as "level the playing field" but the upcoming expectations of RED and CRA means most of us are praying this isn't enforced as quickly as it is written into law.
I'm totally rooting for this because its the only thing that will improve security.
Also, nothing about compliance is actually about "consolidating security debt" or "quick decisions". It's about paying someone to go through checklists and, like a reviewer of a scientific paper, find something, anything, no matter how inane, to criticize, before handing you a certification. Any slightly unconventional new idea to improve security in your product will be suffocated beneath the blanket of compliance.
> I'm totally rooting for this because its the only thing that will improve security.
So does the author. Well, they strongly endorse a sensible version without the vague phrases and open-source-killing blanket statements, and without brain-dead sentences like "your product must be un-DDoS-able". I do wonder, though, why you're rooting for legislation that would kill any open source project that might, conceivably, be used in a commercial setting?
It's already hard enough to hire software engineers, how hard would it be after further restricting to only software engineers with a relevant masters? I know I'd be entirely forced out of the field, and would have to undertake a 4 year course (abroad, because here it would be 6 years) to be eligible for employment again, if that happened in my country.
As it is, I think this is going to be very similar to what is already required for some specific industries like healthcare or finance. Startups that want to operate in these industries already need to go through some certification processes of their products and services. Most startups will probably fall under the "low risk status" category until they are a big enough. If self-assessment is anything similar to what it is already required for things like PCI DSS or GDPR, then most small companies will be fine until they are big enough to care.
And by the way, there is no easy way for the EU to regulate that to write software you need a specific degree.
There is absolutely nothing good with that.
> but the software systems that control power in the hospital do not, even if they would allow hackers to shut down electricity for all ventilators
This is straight out false.
> Almost every other engineering profession needs to adhere to a variety of standards and is subject to certifications and review, except for software engineers.
This isn't a engineer certification process to begin with. This is just government overreach and regulatory capture which is going to siffle innovation because of all the legal liability created by the EU. This will burden open source projects with bureaucracy and effectively kill open source in Europe. Apple, Microsoft, they have the money to comply to all that garbage, and it will also put a huge legal burden on independent developers. Big consultancies are Big Tech are the only one happy to get rid of all the competition.
Imagine if all EU startups, the little that EU has, were forced to run their whole stack products from corporations that have the means to comply to all these regulations, do you really think that any of these startups would use open source projects like Linux, PHP, Ruby, Python, framework X or Z that didn't pay for a compliance review at first place? Startups are a thing because entrepreneurs don't have to pay big bucks to Microsoft, Accenture, Cap Gemini, ...
This is a bureaucratic Diktat under pretense of "cyber security".
"Traditional" engineering never had to deal with this much complexity. We make do, because our tooling (which itself suffers from said complexity) is somewhat decent at catching many classes of problems before they cause IRL harm: a compiler is somewhat likely to yell at you before you push the broken code to production, CI makes sure you actually ran the tests, etc. Working *on* these tools also requires a broadly similar skillset as working *with* them, whereas e.g. an architect needs an incredibly different skillset from someone building CAD software. So the tools get "better", so the software can continue growing more complex.
So all of this (and much more) effectively lets us get away with much more complexity, and I think it's the crucial bit that people calling for more regulation miss. I am a software development professional, 15 years in the industry. I am scared shitless with how all of my tools, libraries, "supply chain" - are so complex, indecipherable, opaque, impossible to understand. I've been working on this one project for over 4 years now, and I'm yet finding bugs that were introduced 3 years ago. How can *you*, as an independent outside reviewer, help me in any capacity, if it takes several months just to onboard someone, and additional domain expert knowledge (video delivery) to fully understand? If you can do it, well, I'm gonna hire you to work for me instead.
But if you can't understand it - what are you certifying? That it didn't break in your lab? We already run a staging system - thanks for double-checking, I guess?
Every other engineering profession has actual physical phenomenon that governs them, leading to concrete standards that can be applied.
Software doesnt. Debates on whether OOP or functional being 'the thing', client-side vs server-side delivery, typing or not typing, TDD or not and many more are still ongoing without any objective resolution. No side of any specific debate can objectively demonstrate their argument. Its all based on preference and biases. Even the concept of 'good practices' in any given field changes every 2 years.
In this environment, attempting to bring concrete standards in software like other engineering fields would just end up in whichever group getting the upper hand in the regulatory body or political parties enforcing their own paradigm on everyone else, at the cost of innovation and productivity.
...
This is before the fact that German business interests dominate the Euparl at this moment, and this law seems to have been crafted to cater to their interests - crippling and pushing out Open Source and private small software producers by ambiguous, brutal fines that they can never afford but the big business can. The users of these Open Source and private small software producers will have to go and become the users of the software and SaaS of these big corporations when those Open Source and small private software producers are bankrupt or pushed out.
The biggest and most evil attack on Open Source in decades.
Whether we like it or not, it seems legislation is forming on how to code and ship software.
https://www.whitehouse.gov/briefing-room/statements-releases...
The ,,rewrite in Rust'' crowd was mocked here, but there are just too many cyber attacks with growing damage and targeting politicians in power that memory unsafe code shouldn't be accepted anymore.
Excerpt: When they had reached the other side, Kaimu asked the first monk: “What have you learned from the bridge-builder?”
The first monk said: “The determination of a true engineer is an enviable thing. But if we were to work in such an inflexible fashion, the Emperor would surely drown us in our own Waterfalls.”
Kaimu asked the second monk: “What have you learned from the bridge-builder?”
The second monk said: “The frugality of a true engineer is an enviable thing. But if we were to cling so hard to yesterday’s technology, the Web would not exist for another thousand years.”
Kaimu asked the third monk: “What have you learned from the bridge-builder?”
The third monk said: “The predictability of a true engineer’s world is an enviable thing. But ours is a world always in flux, where the laws of physics change weekly. If we did not quickly adapt to the unforeseen, the only forseeable event would be our own destruction.”
The first monk asked: “Master... what has the bridge-builder learned from us?”
Said Kaimu: “Nothing yet. But when I touch a lit candle to the oil I sprinkled from my lantern during our crossing, he will learn the reason to plan for the absurd, the virtue of rebuilding in stone, and the wisdom of not insulting your customers.”
But who am I kidding, it'll be mandatory Java, Waterfall, and a metric ton of "Requirements analysis" documents for everybody.
How can anybody here not see where this is going and what is going to happen? We'll be back to the 80's/90's IT era where free software was deemed a legal liability. This isn't scare mongering, this is precisely what is going to happen. Who was in their 20's in the 80's here, working in IT? Not a lot of people it seems...
Not even mention all the crates that need to be certified too.
And you're right, that' it's this way so as not to break existing code. It's easy to add a feature to a language, but removing a mistake usually can't be done without breaking backward compatibility.
Legislator: "I don't understand all this stuff what does pointers and registers mean?"
Helpful Industry Partner (Also rep of massive corp): "Well here this is what we consider "secure development practices". Also did you know Firefox is a tool used by hackers, using Firefox is insecure.
"New Bill Requires Standardization in Web Browsers to Ensure Europe's digital security and to protect the children."
jwz was wrong: instead of being able to send mail, all software will now include its own networked update mechanism.
Unfortunately the EU has no understanding of technology, and is just trying to regulate to protect the establishment aristocrats from disruption.
But then there's a whole industries of middle-men who don't build and by most accounts don't add any value (other than keeping you out of jail due to the laws they themselves pushed) -- who love the boring and start licking their lips at the possibilities. Combine with revolving door, regulatory capture, lawfare etc to take your competitors out.
So that's what this article is about. We need details to know which side of the line we're walking on. Maybe this was better not as a response to you but I already started typing it lol.
So this is a good step.
The only criticism I have is that the carve out for Open Source needs to be well-defined. I agree that FOSS like mine, where it's the basis of my business, should be required to be certified.
That said, I'm not sure I'll be able to afford the required certification. Will Curl or SQLite?
I think SQLite might, since it's already certified for flight. Curl might since it's been used in NASA flight.
But in both cases, the cost of certification, if it happened, was borne by the "customer." In the case of SQLite, it was Airbus. In the case of Curl, it would've been NASA. In both cases, the original authors did enough testing to make it possible, which would be a major cost for them.
I want my software to reach the same quality, but I couldn't, by myself, get it certified. It would take an outside entity that wanted my software certified for their use in Europe.
Edit: I also only have a Bachelor's degree. If I needed a Master's, that would be untenable.
It's already happening with the massive adoption of Mypy/Pyre, the JS -> TS switch, etc.; but if we can use the power of government / the force of law to hurry up the extinction of dynamic typing as an industry practice, that would be a huge huge thing.
The next step after it would be requiring the nullability be an explicit part of the type (like in Kotlin, TypeScript, etc), or mandating the use of Optionals everywhere that nullability is needed in languages like Java.
The death of dynamic typing and default-nullability would probably save the industry society billions of dollars in the long run.
I'm not sure a ban on software coded using PHP, plain Javascript, legacy Python, C/C++ or assembler would be cheap for "society"...
How do you define static typing? Is TS `Any` allowed? Is C# `dynamic` allowed? Are you allowed to use reflection?
How are you going to enforce this at scale?
Do you also know that there are disadvantages to type systems? And advantages to dynamically type languages?
It's not all black and white.
You want the government to start dictating what language developers can choose? And before you say "just static typing" the fact of the matter is that there can be different interpretations of "static typing" what if I use a library that forces static typing in a non statically typed language? What about when they extend this to other features of programming languages. I guarentee you that the Sun and MS execs would've been jizzing their paints at the thought of forcing everyone to use OOP Languages, because "They are secure and supported."
Technical excellence should win out in the end not government fiat, that's one of the worst things that could happen.
Do you want Ada? That's how you get Ada.
Obviously some student in his bedroom is not going to be thanklessly maintaining some piece of software people rely on if it comes with a huge administration burden and the possibility of mega fines.
Referring to this kind of thing: https://xkcd.com/2347/
But indeed, it's all very very vague.
With that said, I think this is overall a step in the right direction. Security is in many places still a secondary concern, so regulation is in my opinion needed to improve the status quo
30 years ago the electronic warfare was not seen as much of a security risk. Today these kinds of attacks against critical infrastructure are regular occurrences
This has become a very real safety risk for citizens and needs to be addressed
Because that would create a certified profession like doctors and lawyer have to be and that would be bad for 98% of coders out there who don't know the difference between compiler and interpreter.
"But muh startups, muh innovations!" If the price we have to pay for some fucking accountability in the field is no more techbro startups the contribute to the ruin of society, good. The certification requirements would be doing their jobs.
A lot of the industry is self-regulating. Self-regulation is more vulnerable to corruption than government regulation. Most startup self-regulation is essentially "does it work? did you get paid/acquired?". If so, you did the software right.
For those who will not bother reading the article :
> I think having a CRA is long overdue, but I hope we can get to something that doesn’t further clamp down on innovation in Europe.
GDPR had the same warning label, and yet, today, it's wholeheartedly accepted as a great improvement over the previous status quo.
But again, it seems people are overreacting (not the author). Yes, I think the warnings are valid, especially for the perception
You might go and check how many companies did get those 10Mi euro "scary" GDPR fines before panicking again. Did any of the 'we value your privacy (not)' popups get big fines?
> Products with digital elements shall be delivered without any known exploitable vulnerabilities;
This sound more like the equivalent of not releasing a Digital Ford Pinto than an Inquisition tribunal on open source developers
> In terms of liabilities, it is not clear where those lie. Are the opportunities for that ’exhausted’ (a legal term) when you hit the vendor who marketed the product? Or could the author of an open source security library be exposed to bugs shipped by a vendor of IP cameras?
> We really should know, but it appears that we don’t.
Yeah this seems to be the main detail
The EU has levied over 2.7 BILLION euros worth of GDPR fines in the past 5 years alone, and possibly much more as not all fines are made public. It is distributed over more than 1,500 separate fines. That is a staggering amount of money that went straight into its own treasury based on the enforcement of a very vague law, for example the top category of fine is "Non-compliance with general data processing principles".
More relevant to the CRA, there have been over 375 million EUR worth of fines for "Insufficient technical and organisational measures to ensure information security".
There's background to all this. The EU is incredibly hungry for money which it can then use to expand its own power. Historically it was restrained by the member states refusal to give it more, as they were wary of exactly that outcome. In recent years the Commission has found ways around the treaties to unlock new revenue sources, specifically:
- Megafines that are impossible to avoid. How much money do you think the big tech firms spent on GDPR compliance? A massive effort. All for nothing because the EU can simply declare your efforts "inadequate" in their subjective estimation and please hand over a few hundred million more.
- Issuing debt. This is a plain-as-day treaty violation but the EU does not have the rule of law, so the institutions and member states just ignore it. Dystopically the EU Council website was even updated after they started doing this to remove the references to Commission debt issuance being illegal.
You do not want to hand these people even more ways to tax the software industry, because they will use it regardless of what the written rules appear to say.
> How much money do you think the big tech firms spent on GDPR compliance?
A lot. They spent more in pretending they were compliant with it though
Here's a better idea, don't actually capture data you don't need and it will be very cheap
Meanwhile I have little sympathy for those who abuse user data collection
There is no amount of money or business changes these firms can ever make that will stop them being fined because using them as piggy banks to evade the treaties is the goal. The EU doesn't give a crap about your privacy and never has, see how keen it is on vaccine passports for just one example of how quickly their rhetoric vanishes the moment it gets in the way of more power.
I don't understand why people want more bureaucracy, it never works out well. Now the established companies like SAP will just pay expensive lawyers to check boxes for the certification, and European startups will face another massive obstacle (just like the GDPR, Cookie law, etc.)
A better law would be pushing for repairability - ban locked down bootloaders and closed firmware, force published schematics, component lists and replacements, open bootloaders, etc. - this would help solve a lot of electronic waste and also drive a new sector for startups.
I don't think I even need to list counter-examples to falsify this statement. Sure, we all remember examples of bureaucracy gone wrong, and get amnesia when we step onto an airplane.
As to the topic at hand, I dunno, a mostly-unregulated industry as it is now has such egregious examples that I'd be willing to see how this goes.
This will just kill innovation and startups in the EU. It's already a nightmare of bureaucracy for taxes and permits, etc.
Everyone here seems to forget that we regulate these industries so finely because they are in a uniquely dangerous position to harm people, and act as if this is a blanket statement that's true for any kind of software development. This is most definitely not true, and we should think hard and long before regulating a thriving industry out of the world in order to feel superior to all those rubes over there obviously doing it wrong.
Regulation is a necessary evil, not a positive good in itself.
If customers could make more informed decisions about these risks, i.e. if they could get access to company intellectual property and privileged information about operations, maybe we wouldn't need to consider this type of of legislation. But customers continue to be on the end of information asymmetry about company operations, so now customers need other ways to find protection. Maybe it's the case that there are economies of scale to resilience, and we have to accept some level of difficulty to disrupt because of that.
Meanwhile, large corporations who can easily afford the lawyers will further entrench their monopolies.
There's also a dichotomy between employees and entrepreneurs. This one is a bit simpler in that it can be evaluated from first principles. There are no private employees without entrepreneurship.
Used to work in the Department for International Trade - not a single one of their international trade experts tought Brexit is even remotely a good idea, long, medium of short term.
https://www.euractiv.com/section/digital/news/new-uk-governm...
It's one of the things that came up relatively early.
> The banners are not required at all
Yet every site disagrees with you.
Having voted just a few years ago to create it.
> Yet every site disagrees with you.
There's no banner on this site. You don't need a banner if you aren't trying to use take peoples private data.
Exactly. Customers need to be safe, but there also need to be paths for the mom-and-pop shops, the equivalents of your local farmer's market or grocery store.
Indiscriminate regulation can crush smaller players. Think of the indive dev accepting donations or the bootstrapped startup founder. Not everyone can get VC funding and hire a team of lawyers to keep up with it.
We need to protect small businesses AND consumers. Revenue thresholds are a good start.
As many well-known open source foundations have warned, this will bring unintended consequences.
This means Europe will cut itself off from a lot of software as an unintended consequence. The whole point of open source software, a lot of the time, is that contributions are done incrementally by people without the means to certify this software to the level they want.
Given enough time and distribution, open source software often becomes much more resilient than its closed counterparts, not due to any government regulations, but because it is run in so many environments and there are so many critical eyes on the project, able to submit a patch. In fact, most of the infrastructure on the Internet runs on open source software.
That said, the package managers we use do have a problem — they rely on packages maintained by individual developers, and gradually update hundreds of versions, opposed to, say, the way operating systems are released.
Commercial releases like RedHat etc. can be certified! They should go after companies that make actual promises.
Having said that, a robust process in place for peer review in open source projects is good, same as in science or Wikipedia.
For the longest time, software development has grown by leaps and bounds, and software security is hardly the most costly thing to society. Proprietary software behind large Big Tech companies externalizes cost to society. Consider how the world looked for instance before the open Web: we had AOL, MSN, etc. and everyone had to pay to play.
Yes, it’s easy to regulate, but also increases the dependency on giant, centralized corporations and governments.
Many people felt that networked software and technology empowers people and frees people up to organize in ways that don’t rely on institutions. For example:
E-Mail vs the post office
The Web vs newspapers, radio
Ethereum vs banks, corporations
MY BIGGEST WORRY IS THAT THEY WILL REPURPOSE AND EXPAND THIS LICENSING REGIME TO EXCLUDE SOFTWARE THEY DON’T LIKE, SUCH AS FILE SHARING SOFTWARE OR END-TO-END ENCRYPTED MESSAGING SOFTWARE BECAUSE THEY WILL SAY THE “SECURITY” OF THE STATE WILL BE COMPROMISED.
Once you have an effective licensing regime in place, you tighten the noose. They are doing this with rolling out DIGITAL IDs for everyone too… https://m.youtube.com/watch?v=uwRSzNTp2ko
It’s a process that can take 10 years but you’re like the proverbial frogs in the pot.
Many large companies are dependent on open-source libraries. With these regulations they now have (more) incentive to get bugs and vulnerabilities in their dependencies fixed
They can't ship with known vulnerabilities, so if a project is suffering from a vulnerability, they might realise they need to provide a financial incentive to maintainers so issues are fixed quickly
Of course there's also a lot of other ways it could play out, but I don't think it's necessarily a given the result will be negative
https://www.forbes.com/sites/jennyodegard/2017/09/06/whats-t...
(this is how it looks in my home state of NY — not only is the requirement outdated but each county has a favored newspaper that you must use so it can charge a large amount for a useless service).
As a left-libertarian, I agree with a lot of arguments from right-libertarians and ancaps, one of them being that regulations are welcomed by the big boys because they provide a government-enforced barrier to entry for all the smaller guys.
Think of Facebook’s threat to “buy or copy” competitors, but now it would be “buy or put out of business with government force”. Sounds a lot more menacing when you put it that way, no?
Overall I don't think EU will go after smaller projects, since that would hurt the economy in an undesirable way. I think it's more likely that they'll use this to go after bigger corporations since that's an actual security risks for member states
That's also why there's a statement about proportionality in the proposal. The more critical the software is, the more you'll need to ensure safety
Sure keeping your head down is always a smart choice. But willfully living at the whims of capricious bureaucrats? Given the choice I'd prefer to not have that sword of Damocles in play.
Taking GDPR as an example, it shows that enforcement is done in proportion to the size of the corporation. Big corporations get fined, smaller companies receive warnings
If there are tangible harms, why have judicial institutions not entertained civil suits? If there are tangible harms, yet the institutions have not entertained civil suits, could it be that malign incentives are already in play?
Would you trust voters in your locality to vote on how you create your next software project? Shall we vote on what you eat for lunch?
Ultimately these discussions boil down to our core premises. Doubtful either of us will convince the other to change those.
I can understand why some people are worried when looking at how many governmental institutions have failed in their duty to serve the public. The EU has definitely got its share off bad decisions, but overall I think it has a good track record
Politically I'd probably identify myself as an anarchist, so if I could change the world to look exactly like I thought best, I'd probably get rid of nation states and governments all together
That's however not how the world works and I'd rather work with the tools I have available right now
There's a war going on not far away from where I live and cyber attacks against critical infrastructure are happening almost daily
Even on this site, where I think discussions are generally pretty civilised, I'm starting to see a lot of retoric that's suspiciously similar to the alt-right retoric in many other places on the web
It makes me think that there's a growing number of users here on this site who are only here to further their political agenda of authoritarianism and violence
That scares me much more than having to make sure that the code I write doesn't have security vulnerabilities
I think it's worth considering what actions can be taken to preserve society the best under these circumstances (society is different from government and states in this context)
>Politically I'd probably identify myself as an anarchist, so if I could change the world to look exactly like I thought best, I'd probably get rid of nation states and governments all together
For me it doesn't matter if the final stop is minarchism or ancaptistan. Steps towards either are an improvement. Bureaucrats regulating software development isn't it.
>Alt-right...
Maybe you could be more specific here? There was recently an article and video submitted here which accused Murray Rothbard of being a "right-wing extremist". It was yet another sloppily argued anti-cryptocurrency hit piece. Similarly we can call anarchists of all flavors extremists. The term alt-right or extremist is mostly a scare word from my perspective. It is hard to find meaning behind it.
>It makes me think that there's a growing number of users here on this site who are only here to further their political agenda of authoritarianism and violence
>Authoritarianism...
Isn't an authority dictating which kinds of software you may publish authoritarian by definition?
>That scares me much more than having to make sure that the code I write doesn't have security vulnerabilities
Agreed 100%, authoritarianism and individual autonomy is a bigger concern. Which is why I'm not a fan of these regulations. Furthermore, I suspect most users here already put forth an effort to avoid security issues.
In the US there is a bureau called the EPA. When polluters pollute within the guidelines, they have no liability. Perhaps now that software development is regulated we will see similar protections for incompetence.
You seem to mix the purpose of the Commission with that of the Council of the European Union, which is a body that has the power to make decisions. It consists of elected representatives from member states
The European Parliament, which is again all elected representatives, makes decisions that the Commission must implement, not the other way around
The Commission are the ones who draws up proposals and that they hope the Parliament will pass
Please educate yourself on this, as this kind of misinformation is undermining trust in the democratic process
The EU institutions pretty regularly do things that hurt the economy in order to prioritize their own political or social goals, so that doesn't mean much.
That is a very rose-tinted view of EU regulators. Europeans are people like everywhere else on the planet, we're not somehow immune to regulatory capture (though I feel it might help the institutions that we haven't yet powerful blocs like the GOP that set out to destroy any kind of regulation in order to prove it's infeasible). Heck, German industry giants are practically married to the state here, there's absolutely no fucking way a company like VW or Opel will go under if a rich government like Germany can do anything about it.
More to the point, the author themself is pro-CRA for a range of things that seem to have purely positive effects, as they spell out quite clearly in the article. The points brought up are nevertheless important: we shouldn't be okay with legislator making objectively shitty laws devoid of any technical comprehension or economical realism and hope it'll kinda be fine when the bureaucracy and courts actually implement it. Just having the danger of having to pay 15M€ for my open source project because it might be used commercially is a horrendous imposition.
Looking at the history of GDPR fines, big corporations have been fined large amounts, small companies have gotten warnings
Given that legal precedence I think saying that open-source maintainers risk 15M euro fines is blowing things out of proportion
And for a small open source project, a 500€ fine is enough to make development and publication unattractive, a percentage of a devs yearly income is painful, and tens of thousands of Euros would be dangerous to the long-term financial well-being of the developers. Even if the fines are a lot lower than 15M€, this proposal stays shit as written.
This is not what is going to happen, what is going to happen is that open source will be deemed a legal liability and every institution will turn to Microsoft proprietary solutions. Nobody is going to put more money into hiring people to fix bugs or vulnerabilities in open source projects.
Germany has for instance transitioned to using significantly more open-source software in the governmental institutions, as has many other EU member states
They would not support this proposal if it would result in an expensive reversal of these efforts
Imposing gatekeepers on the rest of the public with penalties even in private use cases is not.
Could you expand on that?
This is the first time the developers of such free software can be hit with massive fines.
And frankly, even if that wasn’t the case, I care about human beings elsewhere.
Not that the majority of Open Source projects have any revenue. Only the biggest ones that are like Linux etc, who are sponsored by major corporations that use them can be at ease with this law.
And in that you can understand how evil this law is:
Its carefully crafted to avoid risking the major software that megacorps are using. But it cripples & bankrupts all Open Source and also private small software producers. Whose users will have to turn to big corp apps and SaaS as a result. Whereas the large Open Source projects that are sponsored by corporations as a foundation will become totally beholden to those corporations as if they were external product organizations of those corporations because they cant risk funding themselves in any other way...
It looks like something that is crafted by the German private interests that currently dominate the Euparl.
> Non-adherence comes with Significant Fines (15 million euros or 2.5% of annual turnover, whichever is higher)
I don't know where you got the idea that this proposal suggest unbounded fines. Do you have a source for it?
It can never be higher than either 15M euro or 2.5% of global annual revenue depending on the size of the company
Which Open Source software project or small software producer has the funds to fork out from tens of thousands to millions of Euros? That's as unbounded as it gets.
Its a great risk to take. Solely this law going out would kill a lot of Open Source projects or move them out of the Eu. Considering how most projects are just collection of a few people without any organization and the individuals would be legally responsible, it would definitely kill any participation in an Open Source project by a Eu resident.
Claiming that open-source maintainers will get fined 15M euro is scaremongering and is not supported by legal practice in the EU
"Precedent" is not a concept that applies to civil law. Its a common law tenet.
> Claiming that open-source maintainers will get fined 15M euro is scaremongering
Read the actual legal document. The static, non % amounts are totally left to the interpretation of the regulator in the 'legal maximums' section of the draft law.
It doesnt need to be full 15 million. No Open Source contributor would risk getting fined a few dozen thousand euros. Even a few thousand is too much for anyone who contributes to Open Source.
What I'm worried about is not that. As a non-European who doesn't live in Europe I'm worried about what it's happening over there. The non-elected EU bureaucrats will soon control and regulate every aspect of your lives, and I can forsee the future: cash will be banned (terrorists use it!), the internet will be severily restricted and monitored (think of the children!), hate speech laws will dictate what you can or what you cannot say (this already happens). Everything else will be done in the name of regulation for regulation's sake, banning sales of new fossil fuel cars due to "climate change" (and they will eventually ban your existing car), and so much more.
I think this is the result of extended peace and prosperity, it leads to people acting weirdly and relying too much on abstractions. Weird results ensue and eventually it all crumbles under its own weight. And yes, the same will happen to the US.