▲ 215 points
back
203 comments
Seems like the most lucrative part of this proposal is to become the auditor. /s
This reminds me of the Gaia-X / IDSA certification and approval framework blanketing the whole software industry in the EU. I am not sure yet what to think about it.
On one side, it looks a bit like proprietary software vendors trying to cut out SMEs who can match the quality with the same open-source software the big players use, but have no funds to go through the certification. The really funny part of this legislation is: the big players who can afford certification will be able to use ANY open-source component for free but the people who built it will have a tough time to go to the market because they will require the funds they don't necessarily have. Crazy situation.
On the other hand, if this is applied to everyone, well, it will get rolled into the cost of providing a service. You want to buy this from me? Sure, I'll charge you for compliance report.
The really funny part of the "Call for evidence for an impact assessment - Ares(2022)1955751" document (section C.) from https://ec.europa.eu/info/law/better-regulation/have-your-sa... reads:
> The initiative is expected to have positive economic impacts.
That section completely misses to mention that increased compliance cost will inevitably lead to increased software and services pricing, thus will lead to decreased competitiveness of European SMEs on the international market.
Hot take: I can see two options to cripple this: 1) Drown the legislator in compliance requests for minor code. 2) Dual-licensing: AGPLv3 + commercial license.
The cost does not scale with the business' size though, so large players can easily eat it while small ones can't even play :/
Long ago I remember talking with colleague working for big brand anti-burglary alarm manufacturer. They had to obtain CE certification of their equipment releases, and once they have put a hair across box seal taped it. The hair came back uncut...
Original title: "Open-source software vs. the proposed Cyber Resilience Act"
Emphasis on "proposed", the current edited title sounds like it's already in effect.
Judging by the DMA and DSA these EU proposals almost always make it into law with only minor changes.
So yes, this is something to be concerned about.
The edited title also makes it sound like the legislation is specifically aimed at open source projects, which is not the case.
Proposed legislation is mostly offtopic on HN to boot:
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
It seems to be time for this. There's a war on. We're now seeing regular attempts to sneak backdoors into open source code.[1][2] And those are the ones that have been found. There was a Linux kernel bug where someone put a test for root in as "if (uid = 0)" instead of "if (uid == 0)", so that when a rarely used system call was made, the process became root.[3]
The EU is most concerned about "Class II software". The stuff that runs industry.
[1] https://acronisscs.com/blog-open-source-backdoors-in-the-wil...
[2] https://www.zdnet.com/article/open-source-software-how-many-...
> There was a Linux kernel bug where someone put a test for root in as "if (uid = 0)" instead of "if (uid == 0)", so that when a rarely used system call was made, the process became root.[3]
No there was not!
Someone in 2003 submitted a patch. To the wrong repo. The patch was looked at anyway and rejected for this reason. It was never merged. No machine ever had this bug.
The main culprits of those things are the governments making these laws.
Make no mistake this will just be used to implement those backdoors.
Once again, we have dictates and rules based security policy and no solutions provided.
If the EU is so concerned about cyber security they should:
1) provide A LOT of funding and support for Linux / BSD and other operating systems and flavors for testing, hardening, and rapid patch rollout
2) provide infrastructure to support such activities
3) use open source software actively in government with a focus on providing feedback and patches from government IT back to the mainline projects
A founding tenet of security is that open systems and techniques are the ones that will be most battle tested and therefore resilient.
Alas open source has terrible lobbying, so the closed source vendors can lobby politicians and policy to go the opposite way: prescribe closed source solutions and additional onus on open source.
If first world economies were serious about cyberdefense and hardening, there would be 10 billion dollars annually invested into the foundations of open source software: Linux/BSD, databases, webservers, browsers, programming languages, etc. The militaries alone should be dedicating this level of funding to defend our infrastructure, economies, and whatever technological edge we have over China.
And the EU in particular should like Linux: it originated there, and has strong roots throughout the EU, and most importantly isn't controlled by a major US corporation (unlike Apple/Microsoft) and therefore indirectly controlled by the US government.
>A founding tenet of security is that open systems and techniques are the ones that will be most battle tested and therefore resilient.
was it ever proven somehow ? I know that it seems like an axiom here on HN but I doubt anyone did tried to check it.
The EU is a bureaucracy and any bureaucracy's goal is to justify its existence by creating more bureaucracy. I'm personally anti-EU. European countries are way too different so that broad legislations can work with 27+ different countries.
> the legislation and its (unintended) negative effects on developers of open-source software.
The negative effects seem pretty intended to me. The legislators are aware of open source software and have an exception for non-commercial activities, but intentionally penalize OSS related to commercial activities, by leaving them out of that exception.
And, at this point, I don't believe that these legislators are so stupid that they can't see the consequences of their proposals. They probably just don't care about the negative consequences, or the "negative consequences" (negative for us) are actually what they're striving for.
I wonder where would be the boundaries in case such legislation was pushed through. If my software is python-based then would python itself would have to be audited too? If I run my software in Podman containers then should Podman be audited too? What about operating system I execute my software on? Lets say thousand of companies use dependency X - would that dependency have to be audited 1000 times independently? That would be huge waste in my opinion..
Usually only the original producer of each component has to do the certification and apply the CE stamp. Any conglomerate doesn't need to reevaluate all the components themselves, only their interactions in the conglomerate.
So for your Python software you are fine either just providing the software alone, without an interpreter, having the customer get a Python-standard-compliant (if there were such a thing...) interpreter for themselves. Or you could provide a CE-certified Python interpreter that you got somewhere else along with your software, provided you do not change the interpreter you got and the interaction between your software and the interpreter is standard, run-of-the-mill, unsurprising normal use as intended and certified.
Random thoughts while reading the post:
1) commendable, but
2) the EU shooting in its foot, because
3) large rich American closed source companies will very happy to comply
4) where will they find all the auditors to check the zillion of small open source projects inside node_modules for a commercial project? And who's going to pay them? Again, closed source companies are very happy.
HN crowd is completely missing the intent. Nobody wants to chase open source developers. The problem is that right now a person can go buy a smartphone or WiFi router which uses obsolete software components already and will never receive any updates. Hopefully it gets fixed through this legislation.
Not sure if it's literally regulatory capture, but it certainly has the same effects, as you've mentioned. Except I think it's actually the established, non-tech EU companies that benefit more than big US tech but I could see them benefiting too.
edit: apparently there is a similar bill in the US. So that does sound like regulatory capture.
It worked with GDPR
The level of vitriol from the commenters here is honestly frightening.
If the Commission was proposing a law mandating that cars have seat-belts, people would be jumping in to shout "Europe is destroying free enterprise, they're trying to destroy small car-makers!"
Seriously, when you look at the list of concerned software, you have password managers, operating systems, certificate infrastructure, remote access software, industrial IoT, etc. For any software in these categories, it's not completely insane to think that "This software is provided as-is with no warranty whatsoever, good luck!" doesn't quite cut it.
And yes, open-source is concerned as well, when it's part of a commercial activity. Again, if you're being paid to provide software, it seems fair to say you're leaving the "lobbyist" category and entering the "paid professional" category and you have to worry about security requirements. Especially given that, outside of the critical projects mentioned above, you're allowed to display the CE mark if you self-audit.
Are there deeper discussions to be had here, concerns to be addressed, etc? Absolutely. I think a critical point is how "commercial activity" is defined. A threshold of gross revenue could be an interesting solution.
Are these deeper discussion happening in this thread? No. It's all "Europe hates innovation" and "I hate the EC and cookie banners so much!" Most commenters seem to automatically assume that any level of regulation is automatically going to drown small businesses and favor FAANG-scale corporations, which is more extreme than even the article calling out the regulation.
I think the fundamental problem here is that it's all about avoiding mistakes, not about doing good things. This attitude in general is a pox on humanity. Once you start to see the pattern it's everywhere. Schools, science funding, hospitals, building codes, policing, banking, aerospace, and on and on.
No one cares if you improve anything. They just care if you make a mistake. This attitude is a disaster.
As an european I do believe that the European Comission really hates innovation and they believe everyting should be regulated as if only the politicians know what's best for every one. Like they're trying to regulate what kind of chargers we can use, the maximum speed cars can reach, what you can say on the internet and so on. All in the name of safety, terrorism and all other buzzwords politicians throw around to make it sound important. If we'd had the EC 30-40 years ago, most probably would all still be using dial-up for internet or maybe DSL at best and still have BBSs.
And PoignardAzure, yes, I do believe seatbelts and motorcycle helmets should be optional. If you die because you're too cool for them, you die - simple as that.
I'm an American that sells software to clients in the EU that this legislation considers a Class I critical product (https://vuplex.com). If this law is passed, what would be the consequence of not hiring an auditor to comply with it? Depending on the cost of an auditor, compliance may cost more than the revenue generated from the EU. If that's the case, it may no longer be economical for me to sell to clients in the EU.
> I'm an American that sells software to clients in the EU that this legislation considers a Class I critical product (https://vuplex.com).
For more context, a "critical" product cannot be self-assessed. He would have to hire the auditor.
Usually CE regulations do not care if you hired an auditor or not. They only care about the regulations being obeyed. My understanding is that warning the users of the level of security they can expect, and handling security flaws reasonably is probably going to be enough.
I am not an author of popular OSS project so my view is probably distorted, but as OSS develpper would you give a dime about legislation like this?
Edit: It made me thinking, how would legislator ensure legislation is implemented? Would they start requiring escrow so they can check by themselves if software is developed to the correct security standard?
Given that a similar thing was introduced to the US senate[1] I will have to wonder who is behind this.
It's interesting that EC is not looking at addressing the obvious loophole big corporations are using - that is they are saving on R&D and tax by using open source software without paying the developers for their time.
If these big corporations were paying up the fair share of profit generated by the open source software they use, I am sure the developers behind it would have funds essential to ensure the security of the software they make.
That being said, even if above was not feasible (shame!), then it should be up to corporation using the software to ensure it is secure (and possibly contributing any fixes back to the software).
This kind of reminds me of when encryption became a munition in some countries—development moved to countries where encryption wasn’t outlawed. Something tells me a bit of a brain drain will happen if this comes to fruition as groups will go out of their way to develop software outside of the EU. Either that or the EU will be full of undesirable software that has been audited, but is still vulnerable.
I think this is long overdue and virtually all posts in this thread seem to be generic, entirely contentless 'EU bureaucracy' rants. From the article:
(i) it is designed to run with elevated privilege or manage privileges; (ii) it has direct or privileged access to networking or computing resources; (iii) it is designed to control access to data or operational technology; (iv) it performs a function critical to trust, in particular security functions such as network control, endpoint security, and network protection. (b) the intended use in sensitive environments, including in industrial settings[...]
There's a clear distinction here between what the EU labels 'critical products' and non-critical software. Seeing the increasingly insecure global situation, the importance of software in infrastructure and the potential threats I think it's wild that something like this hasn't passed a decade ago. Digital infrastructure needs to be as secure as physical infrastructure.
I wonder what would happen if some Heartbleed-esque bug that went undiscovered for years took out a huge chunk of a nation's electricity grid in a military conflict. What the EU needs in addition is if course also more funding for software security, but they're already doing a halfway decent job. If you didn't know, if you fix open source bugs in the EU you can get paid for doing just that: https://ec.europa.eu/info/news/european-commissions-open-sou...
Government are good at many things, but building towards ideal societies is not one of them.
The OSS community thought that Microsoft would destroy OSS, but the real danger is throwing some legislators in the game.. I always thought that the way that we would destroy OSS was making it political, but making it bureaucratic is a easier and cheaper way to destroy OSS.
It is for your own good. And for insurance companies.
This generally smells like the work of deep pockets vested in proprietary software.
I was hoping we could legislate nuclear fusion first. Or at least antigravity
Red Hat has been providing indemnification for patents for RHEL. This seems like another regulatory bag they will have to carry. Everybody will just use Red Hat, because it is already certified so they can just pass the certification along.
"outside the course of a commercial activity should not be covered by this Regulation" Is this kind of wording normal In EU laws? Why use "Should" in the law, since we are in the middle of defining what is going to happen shouldn't it be "is"?
Would this spell the end of SerenityOS?
It sucks they should just set up a fund for fundamental projects - Linux, LibreSSL, OpenSSL, etc. and then make companies of a certain size contribute. It could even be a way of boosting the European Tech industry by funding FOSS consultancies within Europe.
Instead we just get more bureaucratic anti-innovation makework - just like the Link Tax, Cookie law and GDPR, etc.
The regulation looks reasonable: if someone is selling software, or products containing software components, they have to certify the security of their products.
OSS developers who don’t charge for the software have no obligations. If their software is used in a commercial product, the seller of that product is responsible.
Another garbage idea out of Brussels. Given the fact that we're lacking in the system engineering space for more than a decade, this will only curb some of the decent innovations people have began expanding upon in the last couple of years. (See the various talks & ideas from usenix for example, amongst other events)
On the "bright side", this will realistically be impossible to enforce. Any national court who deems such industry important will probably use a local constitutional amendment to reinforce that CODE easily falls under freedom of expression, just like any other craft.
EU showing once again how desperate it is for money. Let's strangle out all our industries until nobody can make anything anymore: See agriculture, energy, manufacturing, and "now" even a bigger range of the IT spectrum.
“Governments of the Industrial World, you weary giants of flesh and steel…”
I keep reading bills from the EU that make me feel like someone would be crazy to ever start a (tech) company there.
Yes! Another German biurocracy-inspired bill to outlaw problems in the society.
Why they just don't release a law that forbids people from making bugs?
This reminds me of an aphorism: "When you owe the bank a million dollars, that's your problem. When you owe the bank a billion dollars, it's the bank's problem."
What happens when/if core technologies like SSL, BIND, and even the Linux kernel fail to meet these requirements? Will EU entities have to stop using noncompliant open source software? As someone who is not a fan of bureaucracy, the consequences of this could be almost hilarious.
Edit: TFA is writing about this as legislation to be concerned about. I'd wonder if the best response to this is malicious compliance: "sorry $EU_ENTITY, we never certified, so you can't use our tech that happens to be fundamental to the security/networking/OS stack."
from the proposal:
"(13) In order not to hamper innovation or research, this Directive should not apply to free and open-source software developed or supplied outside the course of a commercial activity. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. However where software is supplied in exchange for a price or personal data is used other than exclusively for improving the security, compatibility or interoperability of the software, and is therefore supplied in the course of a commercial activity, the Directive should apply."