zlacker

[return to "EU Cyber Resilience Act: What does it mean for open source?"]
1. greatg+2b[view] [source] 2023-12-30 21:34:43
>>ahuber+(OP)
This regulation is so shitty. I'm quite sure that it is supported by big actors in the end, because the end goal is to ensure to have a regulatory barrier that will avoid small actors to be able to strive in the software field.

Also, to avoid "dangerous" not yet professional amateurs having a chance against big editors.

◧◩
2. Etienn+lf[view] [source] 2023-12-30 22:03:41
>>greatg+2b
This was the first question on my mind as well. How will this affect the one-man webshop owner or software developer? Seems only big established firms will be able to conform to this?
◧◩◪
3. EMIREL+Sg[view] [source] 2023-12-30 22:12:19
>>Etienn+lf
This question was asked a lot when GDPR came around, and it's essentially an implication that the regulator will act in bad faith.

Courts and regulators, particularily European ones, understand when there's a "will" to follow the law. It's one of the differences between "rules-based" and "principles-based" regulations.

>>17100541

◧◩◪◨
4. Etienn+wi[view] [source] 2023-12-30 22:24:48
>>EMIREL+Sg
I don’t understand? So you should only in principle audit your Wordpress blog?
◧◩◪◨⬒
5. troupo+hk[view] [source] 2023-12-30 22:38:18
>>Etienn+wi
Questions:

- If you run a commercial kitchen on your own (or, let's say, with a staff of 2-3 people), can you ignore the food safety regulations? The fire regulations?

- If you run a one-man plumbing company, can you ignore safety regulations? Water regulations? Sewage regulations?

etc.

Why is it than when it comes to "commercial software" it is inevitably "oh my god these laws are so hard, why should I as one-man company be forced to comply with them". Because that is literally your job.

◧◩◪◨⬒⬓
6. galdor+Pm[view] [source] 2023-12-30 23:01:33
>>troupo+hk
In kitchens as in plumbings:

- There are rules, and clear established practices that allow you to follow these rules. In software the rabbit hole goes so deep that your average developer cannot even be aware of all the risks.

- You do not have to rely on millions of lines of code you have no control on.

As a simple example, if you are using network communications, you are probably using OpenSSL, GnuTLS or one of the few other TLS implementations. All of them have regular security issues, and simply selling support on an Open Source software you built using one of them will make you liable for these issues. There is no choice: you need TLS, and you're not going to implement it yourself. What are you supposed to do?

The fact that a solo developer selling 100€/month of support is treated the same way than a billion dollar company demonstrates the complete insanity of this act.

◧◩◪◨⬒⬓⬔
7. EMIREL+Un[view] [source] 2023-12-30 23:08:41
>>galdor+Pm
> The fact that a solo developer selling 100€/month of support is treated the same way than a billion dollar company demonstrates the complete insanity of this act.

But they're not treated the same way. Both by the law itself and the standards courts and regulatory agencies use throught Europe.

◧◩◪◨⬒⬓⬔⧯
8. galdor+fo[view] [source] 2023-12-30 23:13:24
>>EMIREL+Un
The text of this act treat them the same way unless I'm missing something (feel free to point me the text saying otherwise). A sane legal text would put in place thresholds with different levels of expectations and liability depending on the size of the company, who you are selling to (companies or individuals) and its revenues, respecting the principle of proportionality.
[go to top]