Hacker News Reader

Comment by canadiantim | Hacker News Reader

If true and enforced that would be the death of the open-source community as we know it

It would also absolutely destroy the EU economy. Developers in the EU would be blocked from PyPi, GitHub, NPM, Stack Overflow and much much more. Pretty much every single commercial software product contains at least one open source package. You wouldn't even be able to use Java or .Net. There's also no way in hell that commercial companies like Oracle or Microsoft will assume any kind of responsibility for errors their code would result in in a customers code base. At least not without massive compensation.

And how about Linux, or Android... or iOS, they contain open source software as well. Could you go after some random kernel developer for a bug that affects Android?

This hasn't been tought through in any way, the ramifications could be enormous.

At some point would be cheaper to just block access from whole Europe than complying with their laws. The worst part is that a lot of politicians in other countries are just copying the EU tech legislation, instead of trying to produce something better.

So every 2 weeks i read posts like this, 'Company X will just quit" if they have to pay tax/comply with some law/ follow basic decency

But it never happens. The only example is Google leaving China because of authoritarianism. And now they are back.

Maybe it can happen to a tiny country. But do you actually imagine that the entire 17 trillion economy of EU will be left without software?

Companies do not 'just quit' huge markets. They don't leave money on the table.

Big companies obviously no. But a bootstrapped startup? Probably yes, at least initially.

And here we are not talking about "basic decency" or taxes. The audit requirements by the new EU law are extremely expensive. They assume that every software developer is BigCo. I don't see that the EU is requesting every tabloid article to be fully audited to remove false claims or that each medical decision must be audited. The requirement is disproportional.

This is by design.

The regulatory burden is so disproportionate that only a few large companies can operate following all the regulations and arbitrary rules set by the Europeans unelected bureaucrats. In turn, large companies raise their prices, but it doesn't matter because they are the only game in town left since smaller companies simply can't compete.

So the European consumer ends up paying for all the extra compliance through less competition while the bureaucrats pat themselves on the back and politicians keep getting "big victory" against the "evil foreing tech giants".

> Developers in the EU would be blocked from PyPi, GitHub, NPM, Stack Overflow

Being blocked from PyPi and npm would probably catapult EU software quality ahead of America... and without them hosting it on GitHub to feed into our LLMs to circumvent their IP? Oof we'd be in trouble...

In the EU at least. No doubt disclaimers would go up on all source repositories that access from the EU is forbidden.

How many more laws like this one need to get passed for people to stop saying Brexit was the worst thing that could have happened to the UK?

Depends on the people you want to stop saying it.

There's people like me, who moved from the UK to Germany as a direct reaction to Brexit. I don't have a Boolean heaven-or-hell (Devon-or-Hull?) attitude to any of this — Brexit itself was stupid, but not (yet) the worst thing the Westminster government did to United Kingdom people. Sure, a repeat of the Potato Famine may happen, but probably not.

Then you've got people who have made it part of their identity. On both sides, they're never going to admit the possibility of Team Them making the slightest of mistakes.

For example, the specific mistake of the government passing a law that allowed a regional ambulance service to find out the preceding 6 months of internet domains accessed by any person, without any need for a warrant; something that was obviously not compatible with the Human Rights obligations but which the government passed anyway, and as that government was loudly conflating the EU with the human rights courts, I just assumed they'd force it into effect regardless of any objection I could bring, when they actually managed to leave the EU.

https://en.wikipedia.org/wiki/Investigatory_Powers_Act_2016

"Less bad" isn't automatically perfect (the topic of this discussion may be an example of such an imperfection), but it is less bad.

> the government passing a law that allowed a regional ambulance service to find out the preceding 6 months of internet domains accessed by any person, without any need for a warrant

Wow. And people voted in favor of that?

No wonder we're flooded with resumes from the UK over here...

I still don't know why they even asked for that power; the arguments given at the time were predicable clichés that had about as much connection to reality as the average stock photo of a hacker — if I assume they were sincere then they must have been incompetent, and if competent then insincere.

https://votes.parliament.uk/Votes/Commons/Division/80

The only reason there's a possibility Brexit isn't the worst thing is the large pool of competitively bad things.

In case you hadn't noticed, this law hasn't been passed. It is currently out for consultation through a relatively transparent process. Certainly more transparent than the, let's all meet at the club and thrash it out between us, what what, process that takes place in Westminster under the current lot. This is how democracy is supposed to work, but alas very few people take the time to learn that or engage in the actual process.

Maybe don't base your opinion of the EU on some speculative HN comments about a non-voted law proposal?

If the EU is willing to hold you financially liable for something you provided for free with no promise of it functioning or being safe to use, might they also hold you financially liable even though you said it shouldn't be used by anyone in the EU?

Maybe the safest approach is to firewall them off of the internet. They can have their own bureaucratic paradise without involving the rest of us in their mad schemes.

I mean, the newspapers already do that with the GDPR regulations, so it may be inevitable

Personally I modified my (paid service) project's EULA to make it unavailable to EU residents, citizens, and people currently located there just to be safe.

First it was fonts and cookies, now this; I don't want to see where this jaw-dropping progression ends up.

In 2016 I thought Britain was absolutely mad, but they're starting to look smarter and smarter

I wonder how much collective time the world would save not having to click on cookie permissions every time they visit a website.

MaxMind has a free utility called GeoIpLite that has an explicit field which tells you if an IP address should be considered part of the EU.

I initially thought to geoblock them, but the trouble is - their laws apply to their citizens even in my country, and I'm unclear as to what happens when a regular person visits the EU.

Add a TOS clause saying that EU data subjects aren't allowed.

I suppose you could write into your license that EU users have a licensing fee of $x where $x is large enough to capture your lawsuit risk.

What about extradition treaties? Do I need to be concerned about someone in Europe misusing my mathematical expression parser library in a medical device, people die, and then I get extradited?

I heard a third-hand story about a Boeing engineer held responsible for an aircraft crash in China, and the US was going to extradite him to China. He committed suicide. Don't know if it was true, although it was a Boeing employee who told me about it, and she certainly thought it was true.

The US doesn't have an extradition treaty with China, so that's probably an urban legend or someone pulling your leg or trying to put the fear of god (China?) into her and other engineers so they take the job seriously.

Pretty much that. After GDPR many small shops refused to work with EU IP addresses and just redirect to a page with some disclaimer.

But big players (who were consulting politicians when GDPR regulations were written) only won from GDPR, they don't need to show the cookies banner all the time on their platforms and still have a lot of power over your private data.

Certification of software is always expensive, so expect new open source licenses: "Open source as usual, but if you are from EU, you are not allowed to use that code".

Or expect Amazon to take an open source product, close source their fork, do certification and provide SAAS.

Again, there are companies who can do some commercial support for their code, but they are really could not be interested in adopting all the EU regulations.

I'm sure repos would just block access to European IP address if the maintainer requests it.

Reply on news.ycombinator.com