Hacker News Reader

Comment by 2Gkashmiri | Hacker News Reader

is there a explainer of what the legislation is supposed to do and how does it harm foss?

i have had trouble with understanding the push for EVERYONE doing https even in localhost because "security". boo.

i live in a place where by law ISPs need to have DPI. they can access any communication regardless of SSL or https or anything in between so why should i bother with the added nonsense of "much security" when it is not supposed to even work?

i understand there are attempts to make https to be as transparent when it works but why should that not be restricted to banking transactions or login pages and payment links? again, DPI.

now this cyber resillience act which i am assuming wants to "security".

what kind of security?

View on HN

This post by the The Apache Software Foundation is fairly complete:

> And what makes matters worse is that the type of open source organizations most affected are also exactly those that, today, tend to have very mature security processes, with vulnerabilities getting triaged, fixed, and disclosed responsibly with CVEs to match. While it generally is further downstream; with the companies that place the product on the market — that the CRA needs to drive significant improvement. It now risks doing the reverse.

But all organizations (ECLIPSE, LINUX, ...) raised alarms

https://news.apache.org/foundation/entry/save-open-source-th...

Edit: https://nitter.kavin.rocks/search?f=tweets&q=cyber+Resilienc...

Very good description, and if the protections from OSS are not enough I expect more noise in the next weeks/months

> There is of course an elephant in the room: the well-oiled mechanism that “The internet treats censorship as a malfunction and routes around it” (John Perry Barlow).

The parliament position reads:

> Only free and open-source software made available on the market in the course of a commercial activity should be covered by this Regulation

> Whether a free and open- source product has been made available as part of a commercial activity should be assessed on a product-by-product basis, looking at both the development model and the supply phase of the free and open-source product with digital elements.

> (10a) For example, a fully decentralised development model, where no single commercial entity exercises control over what is accepted into the project’s code base, should be taken as an indication that the product has been developed in a non-commercial setting.

The corresponding HN submission: https://news.ycombinator.com/item?id=36783445

> i live in a place where by law ISPs need to have DPI.

Which law? I know ISPs in India are mandated to record session information but I haven't heard of DPI being mandatory.

> they can access any communication regardless of SSL or https or anything in between

No, DPI can't magically break encryption. Your ISP can't access encrypted content.

> No, DPI can't magically break encryption. Your ISP can't access encrypted content.

they can if they require you to install a certificate and they man in the middle everything.

> they can if they require you to install a certificate and they man in the middle everything.

Not exactly relevant because no ISP outside Kazakhstan is doing that.

you should ask before making that statement -- I suspect you will be surprised at the answers

I don't know how the US ISPs run things but this doesn't happen in the EU.

Nobody in the US would comply with forced root CAs. It breaks 4A.

And nobody in the US could ever break that and get away with it! Not one Single American!

No Such American

Reply on news.ycombinator.com