A Plea for Fairness for Non-Profit Developers of Open Source Software
isc.org
isc.org
This was much more interesting.
The Cyber Resilience Act would potentially require open source developers to follow a compliance regimen, similar to any EU manufacturer. The concern is that this would place too high of a regulatory burden on item source projects. The act's view of the software world is less nuanced than that of the open source community, making a distinction only between commercial and non-commercial.
I don't fully understand the implications for open source projects, but it also seems like the legislators do not understand the implications for the EU. There is legitimate concern that the EU could be cut off from open source repositories as the entities running them seek to avoid liability.
It would be like holding people responsible if someone got hit on the head by an apple that fell from the tree they planted as a volunteer on earth day.
iirc there is already a carveout for free open-source contributions, it only applies to (the very widely applicable) commercial activity. My understanding is, this letter is about developers organized as non-profits, but who are still paid for their work.
One problem I got are package repositories publishing work and making money through other sources might be liable for all packages they host.
The EU should focus on improving the business environment by standardising and liberalising the payment of payroll and income taxes across the Union (so you could work for a company in one country and live in another), digital ID, international banking, pension and national insurance transfers, and residence registration (so it isn't a months-long bureaucratic process in any new country), companies registration (to make it simple for one company to operate and hire in the whole Union, without dozens of local tax and labour law issues, etc.) and solving issues like the housing crisis, disastrous rent control schemes, etc. that impede economic mobility.
Really what you are describing is a superstate akin to the US Federal Government, which is not the purpose or goal of the union.
Countries within the EU also have vastly different cultural attitudes to many issues. For example, in some countries having a national ID card is mandatory (Germany) and others don't have a national ID card at all (Ireland). Some countries have opted-out of the Euro single currency (Denmark) and others are dragging their heels even though they have an obligation to join (Sweden, Hungary, Poland, etc). Some countries have opted-out of the EU Mutual Defence Clause. One (Ireland again, due to border issues with Northern Ireland) didn't join Schengen.
Trying to force such a diverse set of populations into a single superstate will just lead to the break up of the union.
That depends who you ask.
https://en.wikipedia.org/wiki/Union_of_European_Federalists
"Ever-closer union", the development of a common security and defence policy, and the introduction of a common currency all look quite federalist to me.
It was specifically worded that the union was of the peoples of the bloc, not the countries.
The Union of European Federalists have apparently 100,000 members out of a population of ~450 million. It's beyond a niche organisation.
International banking is already settled, pensioning too. Insurance isn't needed. You can insure yourself in your new country.
> make it simple for one company to operate and hire in the whole Union
Oh, I see. You're only in it for the money.
International banking is not settled. You cannot settle your taxes in Spain with a foreign IBAN, there are similar issues with many other services too (internet, phone and utility contracts, etc.).
I didn't mention income taxes, but payroll taxes i.e. the employer side. But income tax shouldn't exist anyway.
> Insurance isn't needed. You can insure yourself in your new country.
But the employer is usually required to pay it - e.g. national insurance in the UK, social security in Spain, that is a massive barrier to international work even within the EU. There needs to be agreements to split the payment to allow the employer and the employee to reside and operate in different EU member countries.
> Oh, I see. You're only in it for the money.
Making business easier makes us all more money (less friction and overhead = a bigger pie). I'm not even a business owner, but could benefit a lot if I could more easily move somewhere within the EU with a lower cost of living.
Indeed, we're on totally different sides of the isle.
> a massive barrier to international work
There are all kinds of agencies willing to make that easier for you. Sure, it costs, but that's business.
> I ... could benefit a lot if I could more easily move somewhere within the EU with a lower cost of living.
That's a perversion of the system. You want to eat from both sides: where the cost of living is high, the salaries are high, but you don't want to spend the money there. Instead, you'll drive up housing prices in a poorer country. "Some of you may die, but that's a sacrifice I'm willing to make."
As for taxes, in theory, you could have a unified system that exposes a bunch of knobs for each country to turn as they wish. Some might even set some of them to 0. You can do much better than the current mess. I guess you can also do much worse, especially for the people who've already found their niche tax-wise.
Everything is an even bigger mess when you are a company (not even an employer). E.g. recycling mess mentioned here: https://www.pcengines.ch/recycle.htm
Is it? I thought open-source was a "business friendly" wording of free software. That is, the source code is made available, independent of what price (perhaps gratis) the author decides to distribute it. "Free as in freedom, not free as in beer" and all that. Am I missing something or did the OSI change the meaning to include that the sale price must be 0?
Even the 2000s “Linux is a cancer” Microsoft chose to invent the term “shared source” rather than attempt to dilute “open source” when they publicly released some source code for academic and noncommercial use. (They still faced accusations of terminology confusion, which might well have been true.) In that respect, the recent attempts at redefinition by Mongo, Elastic, et al. are a truly novel strategy.
> its founder (ESR) invented the phrase
No, Raymond was at the meeting where it was coined, and he enthusiastically helped popularize the term. Christine Peterson invented it.
I wanted to grump about this not being written down, but even the OSI history page[1] mentions it. Huh. Thanks!
> Many people believe that the spirit of the GNU Project is that you should not charge money for distributing copies of software, or that you should charge as little as possible—just enough to cover the cost. This is a misunderstanding.
> Actually, we encourage people who redistribute free software to charge as much as they wish or can.
So this “no selling” talk is defintely a diverging perspective and does not apply to all open source licenses. In fact I think it can’t apply to any, because commercial use is a freedom that would be restricted if it were true.
—-
In the world of pervasive broadband and cheap hosting, I don’t think this business model could work—everybody you release your stuff to will just upload it to a public site. Red Hat will terminate the support contract in that case, which to me feels like a legal exploit I’m kind of conflicted about.
You're also unable to restrict those who purchase your software from redistributing it:
> You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program.
( https://www.gnu.org/licenses/old-licenses/gpl-2.0.html )
That is enough to ensure that open source code is provided to the world for free. This is why we have a distinction between "open source" and "source available".
Not necessarily, the people you distribute the source/binaries to are under no obligation to give them to anyone else.
Programmers want to program, they started sharing code, then corporations started using it, and erasing the authors names. Originally there was no 'License', programmers didn't come together for the fun of creating 'Licenses'. They were forced to create license to cover their code to keep it open for anybody to use. The original licenses were really just to keep it free and provide attribution, so the authors were known.
While both may have been driven by ideals, many of the licenses typically applied by people who call themselves "open source developers" do not contain copyleft. Therefore it is inherently easy for corporations to "steal" the code. "Steal" in quotes, because when the developers chose a license, they should have been aware of that their software can be used in any context without they themselves ever learning about it or seeing any contributions flowing back, so it is not really stealing anything, but the developers short-sighted choice of license.
Sustainability in terms of keeping things open (libre) is more an area of licenses like GPL, AGPL, which contain copyleft. These are more commonly applied by developers calling themselves "free software developers". Most self-respecting free software developers will also call their software free (libre) software, instead of saying open source, even, if many open source licenses are also valid free software licenses.
Edit: I think I misunderstood. This seems to only apply to OSS non profits.
Edit 2: I am not only developing my own software, I am doing it under my LLC, packaging and distributing on itch.io, and in one case charging a low amount. So this likely would apply to me. Since I've made a whopping $200 in donations and sales total over the course of several months, that will be the end of my side business / passive income.
And since I'm in the US this feels unfair. I really shouldn't be bound by EU laws. I'd rather just ban the EU from my software if it comes down to that.
edit 3: ok that last bit is over the top. i understand i have to follow international law... my American-ism is kicking in.
If the EU stays consistent with this stance - and the US sites refusing to deliver content aren't just being overly cautious - then I could see providing a download may already count as providing a service in the most pessimistic interpretation.
If they can't enforce it, then does it matter if they fine you a centillion euros?
Article 27 GDPR.
If you are not established in the EU, you must designate, in writing, a representative in the EU:
The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.
Aah the good old US mentality, everything must revolve around money. :)
My friend, "paying" doesn't come into it. It's all about PII, "Personally Identifiable Information".
To paraphrase Dean Martin....
Got EU people on your mailing list ? That's GDPR.
Silently harvesting telemetry, IP addresses, setting cookies etc. ? That's GDPR.
The Dean Martin paraphrase however is not quit correct. Having EU people on your mailing list does not necessarily make you subject to GDPR. It depends on where you are, and possibly on your intent.
The territorial rules for GDPR are:
1. It applies if you are in the Union, regardless of where the people on your mailing list are and regardless of whether processing their data takes place in the Union or not.
2. If you are not in the Union, GDPR applies to the processing of data of people in the Union where the processing activities are related to ...
2a. ... the offering of goods or services (regardless of whether payment is required or not) to people in the Union, or
2b. ... the monitoring of the behavior as far as their behavior takes place within the Union.
Whether or not you are offering goods or services to people in the Union depends on whether you envisage to do so. The mere accessibility of your website from the Union is not sufficient.
For example if you were running a mailing list for your small city's chess club and someone in the EU found your site and signed up, you probably would not have any GDPR obligations to them.
If your chess club site also sold chess equipment that still probably wouldn't be enough unless you did something to indicate that you were actually trying to include EU. For example if your site had localization for all major EU languages, gave pricing in both dollars and Euros, and included VAT you would be covered by GDPR.
But if the site is only in English (and maybe Spanish), gives pricing in dollars and only accepts dollars, only collects US sales taxes, only ships via USPS, and doesn't have anything that indicates you might be catering to EU people, you are probably in the clear.
Rightfully so if you assume certain engineering standards. "Made by a nameless guy in a shack in oregon" is something you never want your auditor to hear.
I used to work for an ISO-9000 company.
As long as the for profits and governments that use OSS are paying for the process and regulations, otherwise you are putting undue burden on OSS developers.
I think that anyone that includes anyone else’s work, is responsible to do due diligence on the library/module/code they import.
That applies to free or paid software/work.
Some companies I have known, have refused to use any free work; even when donated (I tried donating, once). Instead, they insist on paying a small sum (in the US, a single dollar is customary), and having a legally-binding contract.
Having the supplier sign a contract may suffice for “due diligence,” as it puts the supplier “on the hook” for the quality of their work.
It could also absolve the supplier, and place the burden on the consumer.
In any case, I don’t have any “right” to just fart out some junk, and expect it to become crucial infrastructure. If I want my work to be used at that level -whether paid, or not-, then it’s incumbent on me to test, document, and support that work.
I have written systems that have become infrastructure; both as paid work, and for free. This is something I have some experience in.
https://github.com/Capsize-Games/aihandler/blob/master/setup...
There are hundreds if not thousands of developers who have contributed to those libraries and the dependencies of those libraries.
Are you saying that you feel it is up to someone (myself or some service) to track down and verify the identity of each of these developers, and that I shouldn't use these libraries or distribute them until that happens?
That’s the theory behind efforts like ISO-9000, but I find them pretty “top-heavy.”
A good example might be Linux. There are thousands of contributors, but Linux is backed by one of the best (and harshest) developers on Earth. He puts his personal stamp on it, and has trained a bunch of others to be equally insistent on Quality.
Git is the same (I believe that you may find some "relation" to Linux). In fact, Git has probably had a bigger impact on the world than Linux, and he put that out in ten days, as a side project.
The deal is, that he is used to developing software to be used as infrastructure, and that takes some serious Discipline. That kind of Discipline is actually fairly rare, these days. If someone has it, you can rely on almost anything they do.
The quality of the guarantor is an important component of almost any working relationship. Standards bodies try to avoid that, but I'm not confident it works. The one thing that I remember from working in ISO-9000 environments, was myriad ways to work around the requirements. They end up actually causing more problems than they solve.
There's really no way to avoid the need for personal and institutional Integrity.
who cares if some nameless guy in a shack contributed to your third-party libraries? anon people contribute to open source software all the time, its irrelevant, as is their living situation.
https://github.com/Capsize-Games/aihandler/blob/master/setup...
On top of that, there are dependencies for each of those libraries.
i don't know the names of any of the people that wrote any of that code and I don't intend to dig into it.
i'm not? how are you using the term "software vendoring" specifically? I am packaging with pyinstaller and distributing as an app.
... if you tell them that he is actually a living man in rural Nebraska, presently mixing dehydrated macaroni on one hand, holding his crude manuscript in the other hand, actively adding fixes to fundamental errors in it, and that multiple copies of that manuscript is used to control anything from lightbulbs to government communications to fission reactors, right now, that is not going to let them sleep better at nights. And they ARE starting to get uncomfortable with that.
If you are a business buying software from a business, sure. But if you are anyone getting your OSS from the guy in Oregon, sure.
The goal here seems to be shielding larger companies when they use 3rd party OSS. Exploitation at its finest.
Besides, what about EULAs and other liability limiting license terms?
This is yet another way the OSI was a bad idea. For a while they approved a bunch of open but incompatible licenses that couldn't be changed
First: even if you piss off a EU member state and they direct their watchdog to your product (i trust my country's watchdog wouldn't listen 99% of the time, but we are 28, so it could potentially happen), this has to go to the court. You won't have to pay for a lawyer and still have competent representation, and likely win because the ECJ dislike state entities going after small business. It's the same for GDPR btw. The watchdog would rather needle you to implement changes than go to court. And it's the same for trade laws (I know an irish business importing to France that have production facilities in Scotland, who kinda broke import laws multiple time since brexit and is still fine, even received a procedure on "how to fill you paperwork).
Second: Not sure how this will apply. From what i got, this can either go "internationnal treaty", and in this case it will apply to all europe the same way, or the "each country implement the idea however they want, this is the baseline" way. If its the second, the baseline will be much lower because...
Third: this isn't even the final proposition. Even if it was, it has to go through the parliement and will be changed. I would love having a diff tool to show people how much the parliement change the law from the initial proposition (either european or my country, sometime the final law can be on the opposite of the proposed law (or at least orthogonal)).
It think it's totally reasonable to say that you didn't vote for any EU legislators, couldn't even if you wanted to, and they have as much right to tell you what to do as the Kremlin does - zero.
If your own elected representatives want to enter into an enforcement or reciprocity agreement with the EU on this matter, that's fine, but until then extra-territorial regulation of technology is a pretty clear moral overreach.
> International law is not the same thing as the EU dictating laws that they want to apply internationally
I definitely used the wrong term.
?!?!?!?!??! No, just tell the EU to go fuck itself. If like me you're in the US they don't have any jurisdiction! It's not our problem. How the hell did the entire concept of sovereignty apparently evaporate on HN? The EU is absolutely no different than China, Russia, Iran, or North Korea in this regard. They can pass whatever domestic laws they want. They can also setup a Great Firewall and block off countries they don't like. But if you don't live there and you have no operating presence there then it doesn't matter if their people come and access our sites and services, anymore than if they flew over to the US and access it from here. It is Not Our Problem. Software is protected by the First Amendment. I don't respect blasphemy laws or any of that other crap either.
>edit 3: ok that last bit is over the top. i understand i have to follow international law... my American-ism is kicking in.
That's not "Americanism" nor over the top in the slightest bit. There is no such thing as "international law" in any way that's the same as domestic law. Countries can agree upon treaties, which they then translate into domestic laws for their own citizens same as any other law. But there is no World Government, and what the EU passes matters only to the extent you wish to have a physical presence in EU jurisdiction or the US agrees to the same thing and passes domestic law to that effect. Big Tech players and such obviously fall into the first bucket, at their scale and for what they offer physical presence is vital, which naturally puts them in the jurisdiction of wherever they are up to the limit of being willing to leave.
For those of us who are just single devs putting out software, free or commercial, if someone from the EU wants to go after us for liability they'd have to do so in US court under US law.
They do if you do business in Europe, for example by serving users in Europe.
i am writing software and adding to github, compiling on github and pushing to itch.io. lots of people from EU have downloaded my software and even donated.
am i serving customers in the EU? IMO no, but i could see how others would argue that I am.
edit: i think itch.io and github are serving customers in the EU, not me.
Nope, that's not doing business in Europe. If EU users come to my American-located site (or git repo or wherever) and grab my code that's theirs and the EU's business. Again, same as if some Iranian came and posted a comment deemed insulting to muhammad under their law or a Chinese citizen with a picture of Xinnie the Pooh genociding Uyghurs or used my software in some way to do the same or evade local censorship or something. Chinese or Iranian or EU government are then free to tell me to change my ways or give them info on the user or block them or whatever. Or demand I pay fines and go to jail. And I'm free to tell them to kiss my red white and blue ass.
If it's against the law in the US too, including treaties we've signed with other countries binding us as a matter of domestic law as well, then absolutely of course Americans have to respect that. Or again, if somebody wanted to maintain assets and presence in another country. Otherwise explain to me the exact mechanics by which you expect one of the courts from the other 194 countries in the world to enforce their own laws in the US contrary to US law?
Also, obviously if I make use of a large site that has physical presence in the EU, then the EU will have some level of sway over that site in turn, and could demand they block me to all EU citizens, or for that matter demand that they ban me and anyone else and enforce EU law worldwide. And then they would have to decide if it was worth staying under EU jurisdiction or not, and the US Government would have to decide whether to retaliate and demand EU companies enforce US law in the EU or be banned from the US market and it'd spiral off into far higher office and diplomacy. But none of that is the problem of those of us on the ground floor beyond convenience and our dependence (or not) on multinational mega entities. Can always fallback to our own local stuff.
I'm wondering if my source-available work under non-commercial licenses (nevertheless permitted to be used by public / government institutions) would be automatically exempted (as it's outside the commercial realm)?
I literally just today published the source (not under an OSS license) of a major product in the remote browser isolation space: https://github.com/dosyago/BrowserBoxPro
PS: I am reading through the requirements and these seem unreasonable for projects netting less than 100,000€ annually.
Parliament with barely a democratic mandate, executive with handpicked non-elected bureaucrats who strut around the world stage pretending to have some sort of mandate.
It's original intention was to join EU countries to avoid another World War
I just want more local rule and less mandate from the kingdom of heaven like this crap about open source.
Who stands to make money from this grift ?
Also you completely disregarded the human rights component which is a founding principle of EU and beyond (Council of Europe). What is democracy with strong mandate good for when there's no strong independent court involved in human rights?
no more free digital assets. the logic of the market is imposing itself over the digital realm (the inside of the internet?)
this logic wants us to pay to copy. just imagine if you had to pay every time digital information gets copied!
I don't think anybody would be able to afford to run their own computers. how many times are bits getting copied all over the place during normal operation? all routers would have to be shut down to avoid litigation!
I know I am taking this to an extreme, but where does it end? does it ever stop? why should only some get to keep the enormous advantage unlocked by digital information while the rest are forced to pay?
to be fair this is also in reaction to https://torrentfreak.com/brazils-ministry-of-justice-asks-go...
Afaik I can't just plant trees anywhere I want and might be liable for damage I do while planting trees or if I plant it unsafely so it falls on someone.
Can someone correct me on that? It came up at least one other time in this thread already.
Maybe I misread, but the article seems to be specifically not about volunteers. (The only mention about volunteers is "[Writing secure and stable software] cannot be accomplished long-term by the efforts of volunteers alone")
> The tree example is on earth day as part of a group, planting in an approved area
Thank you for the context that was not obvious to me.