this post was submitted on 16 Jul 2023
65 points (100.0% liked)

Technology

37727 readers
653 users here now

A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.

Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.

Subcommunities on Beehaw:

This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.

founded 2 years ago
MODERATORS
alyaza@beehaw.org
TheRtRevKaiser@beehaw.org
gyrfalcon@beehaw.org
rs5th@beehaw.org
Los@beehaw.org
coldredlight@beehaw.org
SemioticStandard@beehaw.org
TheRtRevKaiser@kbin.social
remington@beehaw.org
65
Will the European Cyber Resilience Act Kill Open Source Software? (fossforce.com)
submitted 1 year ago* (last edited 1 year ago) by bbbhltz@beehaw.org to c/technology@beehaw.org
26 comments fedilink hide all child comments
 

Archive link

Not a big fan of the title (asking question in the title isn't a great idea) but the conclusions give a good summary:

The Cyber Resilience Act (CRA) represents a significant step in Europe’s efforts to enhance cybersecurity. However, its potential implications for the open source software community have raised serious concerns. Critics argue that the legislation, in its current form, could impose undue burdens on open source contributors and inadvertently increase the risk of software vulnerabilities being exploited.

New insights from GitHub’s blog post highlight additional concerns. The CRA could potentially introduce a burdensome compliance regime and penalties for open source projects that accept donations, thereby undermining the sustainability of these projects. It could also regulate open source projects unless they have “a fully decentralised development model,” potentially discouraging companies from allowing their employees to contribute to open source projects. Furthermore, the CRA could disrupt coordinated vulnerability disclosure by requiring any software developer to report to ENISA all actively exploited vulnerabilities within a timeline measured in hours after discovering them.

you are viewing a single comment's thread
view the rest of the comments
[–] xthexder@l.sw0.com 5 points 1 year ago (1 children)

This article seems poorly written and says the same thing over and over again with slightly different wording. I would have liked some more specifics.

The Cyber Resilience Act (CRA) could have several implications for the open source software sector:

  1. Increased legal and financial responsibility
  2. Deterrent effect on the development of open source software
  3. Lack of consideration for the specificities of open source software
  4. Lack of consultation of the open source software community

Only 2 of those are implications of the law. 3 and 4 are redundant and are not caused by the law's wording. They wouldn't even be a problem if not for 1. 2 is also caused by 1 in a fairly obvious way.

[–] bbbhltz@beehaw.org 1 points 1 year ago

I agree, but will say that English is not the author's native language. I thought it was a relevant share because the author has been part of the FOSS movement since the late 90s.