<story><title>EU&apos;s Cyber Resilience Act contains a poison pill</title><url>https://www.theregister.com/2023/05/12/eu_cyber_resilience_act/</url></story><parent_chain></parent_chain><comment><author>jeroenhd</author><text>I think some of these reactions are rather overstated. I can&amp;#x27;t find language that states that you&amp;#x27;re on the hook for software support and fines just because you pushed a patch to Github that one time. The text mostly objected to is:&lt;p&gt;&amp;gt; In order not to hamper innovation or research, free and open-source software 
developed or supplied outside the course of a commercial activity should not be 
covered by this Regulation. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. In the context of software, a commercial activity might be characterized not only by charging a price for a product, but also by charging a price for technical support services, by providing a software platform through which the manufacturer monetises other services, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software.&lt;p&gt;From context it reads like open source is excluded unless the company developing software is selling services in the EU, in which case I don&amp;#x27;t see why open source software would need to be treated any differently from closed source software.&lt;p&gt;I think it&amp;#x27;s very valid to object to the lack of a definition of what &amp;quot;free and open source&amp;quot; means (free as in speech or free as in mattress, for one). However, that doesn&amp;#x27;t seem to be the part that most of these companies object to.&lt;p&gt;&amp;quot;If we post the source, we don&amp;#x27;t have to follow the CRA&amp;quot; would probably just lead to source dumps of crapware so that the law can be ignored. The cynic in me says that many of these objections are from people who don&amp;#x27;t want to be forced to patch the software they sell.&lt;p&gt;Luckily, this is just a proposal for now. I see a lot of things I like in this proposal. Putting pressure on manufacturers to patch their shitty hardware might finally do something about the botnets of media players and security cameras that plague the modern internet.</text></comment>
<story><title>EU&apos;s Cyber Resilience Act contains a poison pill</title><url>https://www.theregister.com/2023/05/12/eu_cyber_resilience_act/</url></story><parent_chain></parent_chain><comment><author>friendzis</author><text>Author implicitly raises a question, but fails to articulate it and then answer it clearly. The question is whether open source software is to be considered a product and somewhat related whether downloading&amp;#x2F;using open source software creates a transaction.&lt;p&gt;I can safely say that I don&amp;#x27;t now the answer to the question and therefore I cannot draw conclusions as far reaching as the article author does. Effectively, the CRA is going to impose certain security standard on software products. People in medical, automotive, aviation, military fields were &lt;i&gt;already&lt;/i&gt; subject to certain security standards, so GitHub&amp;#x27;s claim regarding unobtainability is demonstrably misleading if not outright false, depending on definitions of safety&amp;#x2F;security standards.&lt;p&gt;As it pertains to open source, it all depends on whether mere publication of open source software would be considered product release. I can agree with the author here that clarification may be needed. An important note here is that such regulation (OS is not affected) would have tremendous effect on open source. The companies using open source software in products would essentially be forced to either take open source under their belt with proper controls in place or be effectively forced to properly support open source development by at least providing security oversight. Sincerely, I have no idea what effect that would have as a whole.</text></comment>