Hacker News Reader

Comment by sunshine-o | Hacker News Reader

> CRA needs an exemption for small businesses and, at the very least, solo-entrepreneurs.

My guess is even medium size businesses will face enormous risk and cost related to this.

In the end we might see the worst scenario happening: open source is good, but only if sold by a big company who can afford compliance, risks and lawyers.

This will be somehow similar to what happened with GDPR, most small & medium shops cannot spend too much time on this. And ironically it pushed a lot of people in the 3 big public clouds.

View on HN

I think medium software sized shops - 500 employees are large enough to afford the details and so will be okay. Anything smaller though and this is too much overhead. Of course many projects don't need 500 people. If you use Linux you can buy support from several actors of this size who can afford the overhead (also covering tools like ls that are part of an OS, maybe covering the basic gnome desktop, but not many of the lesser used tools that make linux useful). I'm sure the Apache and FreeBSD foundations will look into this and decide that they are able to handle the overhead by starting (legally this may be finding people to start?) such a company. However I'm not sure OpenBSD is large enough to be worth starting such an organization.

There are a lot of tools that are not large/popular enough. Who will support OpenScad, FreeCad, cppcheck, and all the other open source projects that don't have a large company behind them and probably are not interesting to enough companies to be worth starting something to support them just for legal purposes. There are also projects that are supported by a company today, but the company is not large enough - will enough more customers come in to make it worth hiring a dozen laywers - cmake and sqlite come into mind as projects in this category.

In every other industry business of all sizes, even people selling stuff on the street, have to obey regulations, with exceptions where obeying regulations comes with certain flexibility.

Open source is no different from anythig else performed by street artists, food trucks.

Sure it is different:

- not a business

- not on a street where people bump into it

- doesn't sell physical goods, doesn't know beforehand the number of customers, cannot (by design) limit impact

Nothing of that is specific to FOSS,

- Everyone is liable by their actions on the eyes of the law, regardless of what they are doing is a business, that is why civil insurance is a thing in many countries

- Not everything that people do happens on the street

- Handling with physical goods doesn't mean one knwos before hand the number of customers, and as for impact, it depends on how wrong it happens to go

Maybe liability is finally a way to get people to pay for open source, instead of feeling entitled with stuff they leech on (including big corps).

> Handling with physical goods doesn't mean one knwos before hand the number of customers

Sure it does? You can resell them, but if you produce X items, there'll be X items. You can't be sued into oblivion after producing one and then learning that it was used by a billion people and 100 of them got cancer.

GDPR is easy as a small organization IF you are not greedy for other people‘s data. Keep your hands clean. I own (part of) a small company that makes software for a small market and we had absolutely no problems with GDPR because we try to not collect any data we don‘t absolutely need. It‘s not very complicated if you just invest some thought into your processes and don’t spy on your customers. Most of the time you don‘t need the data but someone wants to sell you a product to gather it.

> we try to not collect any data we don‘t absolutely need

Do you have analytics/telemetry for your products/websites? Do you include 3rd party fonts, libraries or use a CDN or a anti-DDOS service like CloudFlare?

Do you have data scrubbing capabilities in all your user-interaction software with a default maximum retention period? Do you answer data removal requests?

These are some the requirements for organizations of any size, big or small.

Does your list qualify as 'data you absolutely need'?

Do you assume everything is a web app where you can't control what your 3rd party libraries spy on?

Reply on news.ycombinator.com