New OSS governance and runtime binary attestation (aka DRM) layers are being defined by the CRA, e.g. only specific attested binaries from open-source trees that follow specific development practices would be allowed to run in critical systems:
Open-source software stewards shall put in place and document in a verifiable manner a cybersecurity policy to foster the development of a secure product with digital elements as well as an effective handling of vulnerabilities by the developers of that product.
… Open-source software stewards shall cooperate with the market surveillance authorities, at their request, with a view to mitigating the cybersecurity risks posed by a product with digital elements qualifying as free and open-source software.
… security attestation programmes should be conceived in such a way that … third-parties, such as manufacturers that integrate such products into their own products, users, or European and national public administrations [can initiate or finance an attestation].
Related:
Dec 2023, "What comes after open source? Bruce Perens is working on it" (174 comments), >>38783500
Important bits (10c and around):
* Libraries/non-end products are fine, unless monetized.
* Employee contributions seem to be fine.
* Foundations seem to be fine.
* Non-core developers are fine
Seems like significantly better version.
If we don't want poor regulation, we had better regulate ourselves first.
Bonus: regulating ourselves might fund Open Source. [1]
[1]: https://gavinhoward.com/2023/11/how-to-fund-foss-save-it-fro...
Courts and regulators, particularily European ones, understand when there's a "will" to follow the law. It's one of the differences between "rules-based" and "principles-based" regulations.
Open source liability is coming - >>38808163 - Dec 2023 (218 comments)
Debian Statement on the Cyber Resilience Act - >>38787005 - Dec 2023 (144 comments)
Can open source be saved from the EU's Cyber Resilience Act? - >>37880476 - Oct 2023 (12 comments)
European Cyber Resilience Act [Discussion] - >>37580247 - Sept 2023 (4 comments)
The CRA requires manufacturers to ensure vulnerabilities are handled effectively for the expected product lifetime or 5 years, whichever is shorter.Not too bad really.
[1] https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-...
Other good takes in recent regulations:
- Unraveling the EU Digital Markets Act https://ia.net/topics/unraveling-the-digital-markets-act
- The truth about the EU AI Act and foundation models, or why you should not rely on ChatGPT summaries for important texts https://softwarecrisis.dev/letters/the-truth-about-the-eu-ac...
[1] https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-...
Your distinction is without meaning
Lots of tiny businesses on that list too. Also a bunch of local governments, weirdly.
Feels like if we’re at kebab shop levels of granularity for 88 pages of rules governing the entire planet, “a lot of work” is unavoidable, no?
A recall was issued therefore there is already regulatory oversight where it counts. The CRA is at best redundant and at worst a prime example of regulatory capture [1].
I wish people would actually read the links they post.
That "poor kebab shop" was fined for this:
--- start quote ---
CCTV was unlawfully used. Sufficient information about the video surveillance was missing. In addition, the storage period of 14 days was too long and therefore against the principle of data minimization. Addendum: Fine has been reduced to EUR 1500 by court,
--- end quote ---
GDPR is there only because of the data storage. Illegal CCTV is covered by different laws that, in a twist that should surprise no one, you shouldn't break even if you are a kebab shop.
The actual first business listed there is a "betting place", and it was fined for illegal use of CCTV, too.
> Also a bunch of local governments, weirdly.
It's not weird. It's how laws are supposed to work: governments are not exempt from them.
You're trying to carve out an exception for you yourself specifically because you assume that your special case is too special.
1. Laws don't usually work that way
2. There are innumerable cases when "innocuous" software is used as an attack vector precisely because "we don't do nothing why would we keep our software secure"
3. In EU you're safe until you really screw up. More discussion in this thread: >>38819780