Hacker News Reader

Comment by w4ffl35 | Hacker News Reader

As a US based developer, would I have the option to ban people in the EU from using my software? It's the only way I would be able to keep distributing.

Edit: I think I misunderstood. This seems to only apply to OSS non profits.

Edit 2: I am not only developing my own software, I am doing it under my LLC, packaging and distributing on itch.io, and in one case charging a low amount. So this likely would apply to me. Since I've made a whopping $200 in donations and sales total over the course of several months, that will be the end of my side business / passive income.

And since I'm in the US this feels unfair. I really shouldn't be bound by EU laws. I'd rather just ban the EU from my software if it comes down to that.

edit 3: ok that last bit is over the top. i understand i have to follow international law... my American-ism is kicking in.

View on HN

As an EU developer i would also like to know how to block the EU from my customer base.

As an EU developer I would also like to know how to block fascists from my customer base, esp. US, Russian and Chinese companies and state orgs.

Somebody please chip in an informed opinion on how much legal exposure a US entity has to EU litigation. Especially if said US entity doesn't really have any paying EU customers.

IANAL but the EU's GDPR also applies to companies providing services "even in the absence of commercial transactions"[0]. I've seen quite a few US news sites that simply refuse to show me any content.

If the EU stays consistent with this stance - and the US sites refusing to deliver content aren't just being overly cautious - then I could see providing a download may already count as providing a service in the most pessimistic interpretation.

[0] https://termly.io/resources/articles/gdpr-in-the-us/

I'd like to think these things are treated differently. Browsing to a web page and getting cookied is different from actively choosing to run some software. Gets more complicated with web apps, but I'm personally willing to accept a disclaimer from sites and software I'm not directly paying for.

I've wondered, how enforceable is a EU court ruling on a company with no assets in the EU?

If they can't enforce it, then does it matter if they fine you a centillion euros?

> I've wondered, how enforceable is a EU court ruling on a company with no assets in the EU?

Article 27 GDPR.

If you are not established in the EU, you must designate, in writing, a representative in the EU:

The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.

this is a good point.

Until you want to holiday in Europe.

never have never will. i strangely have no desire.

they can enforce it when you travel to the EU

In a download situation, is a US site providing data to someone in the EU, or is the person requesting data from someone in the US? ;-)

both, because the server logs potentially store the downloaders ip address

> Especially if said US entity doesn't really have any paying EU customers.

Aah the good old US mentality, everything must revolve around money. :)

My friend, "paying" doesn't come into it. It's all about PII, "Personally Identifiable Information".

To paraphrase Dean Martin....

     Got EU people on your mailing list ?  That's GDPR.
     Silently harvesting telemetry, IP addresses, setting cookies etc. ? That's GDPR.

etc. etc. etc.

You are correct that money doesn't enter into it (at least directly).

The Dean Martin paraphrase however is not quit correct. Having EU people on your mailing list does not necessarily make you subject to GDPR. It depends on where you are, and possibly on your intent.

The territorial rules for GDPR are:

1. It applies if you are in the Union, regardless of where the people on your mailing list are and regardless of whether processing their data takes place in the Union or not.

2. If you are not in the Union, GDPR applies to the processing of data of people in the Union where the processing activities are related to ...

2a. ... the offering of goods or services (regardless of whether payment is required or not) to people in the Union, or

2b. ... the monitoring of the behavior as far as their behavior takes place within the Union.

Whether or not you are offering goods or services to people in the Union depends on whether you envisage to do so. The mere accessibility of your website from the Union is not sufficient.

For example if you were running a mailing list for your small city's chess club and someone in the EU found your site and signed up, you probably would not have any GDPR obligations to them.

If your chess club site also sold chess equipment that still probably wouldn't be enough unless you did something to indicate that you were actually trying to include EU. For example if your site had localization for all major EU languages, gave pricing in both dollars and Euros, and included VAT you would be covered by GDPR.

But if the site is only in English (and maybe Spanish), gives pricing in dollars and only accepts dollars, only collects US sales taxes, only ships via USPS, and doesn't have anything that indicates you might be catering to EU people, you are probably in the clear.

International law is not the same thing as the EU dictating laws that they want to apply internationally.

It think it's totally reasonable to say that you didn't vote for any EU legislators, couldn't even if you wanted to, and they have as much right to tell you what to do as the Kremlin does - zero.

If your own elected representatives want to enter into an enforcement or reciprocity agreement with the EU on this matter, that's fine, but until then extra-territorial regulation of technology is a pretty clear moral overreach.

agreed on all this

> International law is not the same thing as the EU dictating laws that they want to apply internationally

I definitely used the wrong term.

>As a US based developer, would I have the option to ban people in the EU from using my software? It's the only way I would be able to keep distributing.

?!?!?!?!??! No, just tell the EU to go fuck itself. If like me you're in the US they don't have any jurisdiction! It's not our problem. How the hell did the entire concept of sovereignty apparently evaporate on HN? The EU is absolutely no different than China, Russia, Iran, or North Korea in this regard. They can pass whatever domestic laws they want. They can also setup a Great Firewall and block off countries they don't like. But if you don't live there and you have no operating presence there then it doesn't matter if their people come and access our sites and services, anymore than if they flew over to the US and access it from here. It is Not Our Problem. Software is protected by the First Amendment. I don't respect blasphemy laws or any of that other crap either.

>edit 3: ok that last bit is over the top. i understand i have to follow international law... my American-ism is kicking in.

That's not "Americanism" nor over the top in the slightest bit. There is no such thing as "international law" in any way that's the same as domestic law. Countries can agree upon treaties, which they then translate into domestic laws for their own citizens same as any other law. But there is no World Government, and what the EU passes matters only to the extent you wish to have a physical presence in EU jurisdiction or the US agrees to the same thing and passes domestic law to that effect. Big Tech players and such obviously fall into the first bucket, at their scale and for what they offer physical presence is vital, which naturally puts them in the jurisdiction of wherever they are up to the limit of being willing to leave.

For those of us who are just single devs putting out software, free or commercial, if someone from the EU wants to go after us for liability they'd have to do so in US court under US law.

> If like me you're in the US they don't have any jurisdiction!

They do if you do business in Europe, for example by serving users in Europe.

this is where my confusion is:

i am writing software and adding to github, compiling on github and pushing to itch.io. lots of people from EU have downloaded my software and even donated.

am i serving customers in the EU? IMO no, but i could see how others would argue that I am.

edit: i think itch.io and github are serving customers in the EU, not me.

>They do if you do business in Europe, for example by serving users in Europe.

Nope, that's not doing business in Europe. If EU users come to my American-located site (or git repo or wherever) and grab my code that's theirs and the EU's business. Again, same as if some Iranian came and posted a comment deemed insulting to muhammad under their law or a Chinese citizen with a picture of Xinnie the Pooh genociding Uyghurs or used my software in some way to do the same or evade local censorship or something. Chinese or Iranian or EU government are then free to tell me to change my ways or give them info on the user or block them or whatever. Or demand I pay fines and go to jail. And I'm free to tell them to kiss my red white and blue ass.

If it's against the law in the US too, including treaties we've signed with other countries binding us as a matter of domestic law as well, then absolutely of course Americans have to respect that. Or again, if somebody wanted to maintain assets and presence in another country. Otherwise explain to me the exact mechanics by which you expect one of the courts from the other 194 countries in the world to enforce their own laws in the US contrary to US law?

Also, obviously if I make use of a large site that has physical presence in the EU, then the EU will have some level of sway over that site in turn, and could demand they block me to all EU citizens, or for that matter demand that they ban me and anyone else and enforce EU law worldwide. And then they would have to decide if it was worth staying under EU jurisdiction or not, and the US Government would have to decide whether to retaliate and demand EU companies enforce US law in the EU or be banned from the US market and it'd spiral off into far higher office and diplomacy. But none of that is the problem of those of us on the ground floor beyond convenience and our dependence (or not) on multinational mega entities. Can always fallback to our own local stuff.

Your license wouldn't count as open source any more if you discriminate against Europeans in it. Sounds like it already isn't FOSS though? You did mention GitHub further down so hmm.

In the license add a section that prohibits people from the EU using it.

Not feasible to do license changes on larger projects.

Why not?

Because every contributor has to be contacted and agree to the change. If one can't or won't your only option is to revert their changes and everything derived from them.

This is yet another way the OSI was a bad idea. For a while they approved a bunch of open but incompatible licenses that couldn't be changed

Yeah, i just read the proposal, there is a lot of holes, but, from general to specific:

First: even if you piss off a EU member state and they direct their watchdog to your product (i trust my country's watchdog wouldn't listen 99% of the time, but we are 28, so it could potentially happen), this has to go to the court. You won't have to pay for a lawyer and still have competent representation, and likely win because the ECJ dislike state entities going after small business. It's the same for GDPR btw. The watchdog would rather needle you to implement changes than go to court. And it's the same for trade laws (I know an irish business importing to France that have production facilities in Scotland, who kinda broke import laws multiple time since brexit and is still fine, even received a procedure on "how to fill you paperwork).

Second: Not sure how this will apply. From what i got, this can either go "internationnal treaty", and in this case it will apply to all europe the same way, or the "each country implement the idea however they want, this is the baseline" way. If its the second, the baseline will be much lower because...

Third: this isn't even the final proposition. Even if it was, it has to go through the parliement and will be changed. I would love having a diff tool to show people how much the parliement change the law from the initial proposition (either european or my country, sometime the final law can be on the opposite of the proposed law (or at least orthogonal)).

They are not expecting the xkcd “Dependency” comic situation to be possible in the first place, and trying to pressure commoners to sort it out by an “or else,” threat, which isn’t working well.

0: https://xkcd.com/2347/

> They are not expecting the xkcd “Dependency” comic situation to be possible

Rightfully so if you assume certain engineering standards. "Made by a nameless guy in a shack in oregon" is something you never want your auditor to hear.

I think that having some kind of "supply chain accreditation" might be something to look at. However, this kind of thing can become a nightmare.

I used to work for an ISO-9000 company.

> some kind of "supply chain accreditation"

As long as the for profits and governments that use OSS are paying for the process and regulations, otherwise you are putting undue burden on OSS developers.

now that I am fine with, but i still think this is nutty overall. there's nothing wrong with anon contributions to software.

It all depends on the final use of the software.

I think that anyone that includes anyone else’s work, is responsible to do due diligence on the library/module/code they import.

That applies to free or paid software/work.

Some companies I have known, have refused to use any free work; even when donated (I tried donating, once). Instead, they insist on paying a small sum (in the US, a single dollar is customary), and having a legally-binding contract.

Having the supplier sign a contract may suffice for “due diligence,” as it puts the supplier “on the hook” for the quality of their work.

It could also absolve the supplier, and place the burden on the consumer.

In any case, I don’t have any “right” to just fart out some junk, and expect it to become crucial infrastructure. If I want my work to be used at that level -whether paid, or not-, then it’s incumbent on me to test, document, and support that work.

I have written systems that have become infrastructure; both as paid work, and for free. This is something I have some experience in.

I mentioned this in an above comment - here is a repo that I use in two of my apps that I compile with pyinstaller and distribute:

https://github.com/Capsize-Games/aihandler/blob/master/setup...

There are hundreds if not thousands of developers who have contributed to those libraries and the dependencies of those libraries.

Are you saying that you feel it is up to someone (myself or some service) to track down and verify the identity of each of these developers, and that I shouldn't use these libraries or distribute them until that happens?

Like I said, if I use someone else’s stuff in my work, it’s my responsibility to assure myself, and anyone upstream, of the veracity of that work.

That’s the theory behind efforts like ISO-9000, but I find them pretty “top-heavy.”

A good example might be Linux. There are thousands of contributors, but Linux is backed by one of the best (and harshest) developers on Earth. He puts his personal stamp on it, and has trained a bunch of others to be equally insistent on Quality.

Git is the same (I believe that you may find some "relation" to Linux). In fact, Git has probably had a bigger impact on the world than Linux, and he put that out in ten days, as a side project.

The deal is, that he is used to developing software to be used as infrastructure, and that takes some serious Discipline. That kind of Discipline is actually fairly rare, these days. If someone has it, you can rely on almost anything they do.

The quality of the guarantor is an important component of almost any working relationship. Standards bodies try to avoid that, but I'm not confident it works. The one thing that I remember from working in ISO-9000 environments, was myriad ways to work around the requirements. They end up actually causing more problems than they solve.

There's really no way to avoid the need for personal and institutional Integrity.

> Rightfully so

who cares if some nameless guy in a shack contributed to your third-party libraries? anon people contribute to open source software all the time, its irrelevant, as is their living situation.

People who will have to vendor that code.

look at all these libraries that i package with my distributed software:

https://github.com/Capsize-Games/aihandler/blob/master/setup...

On top of that, there are dependencies for each of those libraries.

i don't know the names of any of the people that wrote any of that code and I don't intend to dig into it.

You don't vendor anything. You only name it as dependency. I'd fail my audits if i did that.

> You don't vendor anything. You only name it as dependency

i'm not? how are you using the term "software vendoring" specifically? I am packaging with pyinstaller and distributing as an app.

Simplified: locally-stored forks of all dependencies where we also commit our own patches to.

No one cares that your equipment is based on early works by young Isaac Newton. But;

... if you tell them that he is actually a living man in rural Nebraska, presently mixing dehydrated macaroni on one hand, holding his crude manuscript in the other hand, actively adding fixes to fundamental errors in it, and that multiple copies of that manuscript is used to control anything from lightbulbs to government communications to fission reactors, right now, that is not going to let them sleep better at nights. And they ARE starting to get uncomfortable with that.

"Made by a nameless guy in a shack in oregon" is something you never want your auditor to hear.

If you are a business buying software from a business, sure. But if you are anyone getting your OSS from the guy in Oregon, sure.

The goal here seems to be shielding larger companies when they use 3rd party OSS. Exploitation at its finest.

Besides, what about EULAs and other liability limiting license terms?

Reply on news.ycombinator.com