FOSS could be an unintended victim of EU crusade to make software more secure

Re:FOSS could be an unintended victim of EU crusade to make ... by oaiey on Friday February 10, 2023 @10:23AM (#34740798)

When I introduce a product to users I have to take care of its post-market cybersecurity. This is healthcare reality for years and now comes to all products.

The interesting here is: What is a product? Most open source is not. The millions of libraries are not products. A product accumulates the various aspects (cybersecurity, license, ....) into a package. If I buy the software from a vendor I will make him responsible for it. If I hack it together on my self, this duty is on me.

Open Source will survive that. But open source owners will get tons of questions and should be better be prepared to answer questions. GitLab and GitHub are already working on the consumer side with their security analysis features.

[ Parent | on HN ]

Re:FOSS could be an unintended victim of EU crusade to make ... by tensor on Friday February 10, 2023 @11:37AM (#34741990)

But the rub is that open source owners have no actual obligation to you. So while you might want them to be "prepared with answers" they don't actually need to be. Some will want to be because they want their software to be used and up-to-date. But others have likely shelved their software, or just don't care to solve your security problems for you but will accept a patch if you provide one.

[ Parent | on HN ]

Re:FOSS could be an unintended victim of EU crusade to make ... by karmicthreat on Friday February 10, 2023 @12:31PM (#34742813)

And its literally what developers that are taking open source software and using it to sell something need to understand. The sellers are adding that value and taking that risk. If I go to the store, buy some wood, build a shelf from the wood and sell the shelf. Then it burns my customers house down, its on me not Home Depot.

[ Parent | on HN ]

Re:FOSS could be an unintended victim of EU crusade to make ... by est31 on Friday February 10, 2023 @12:39PM (#34742950)

That's where OSS companies like Suse or RedHat come in: they do provide support for their distributions. And, unlike Amazon, they also employ many maintainers and if they don't employ them, they sometimes submit patches to upstream so are good OSS citizens.

[ Parent | on HN ]

Re:FOSS could be an unintended victim of EU crusade to make ... by oaiey on Friday February 10, 2023 @02:48PM (#34744772)

That is all fair. The premise is the article headline that open source or Foss is dead. An open source software no one can use is a dead software. So the success of a Foss software might not only depend on functional aspects in Future but also on non functional aspects like the Cybersecurity management.

And do not think that this influence will not happen. There are reason why the non functional requirement licensing has switched to MIT from previously more LGPL constructs.

Having said all that... Yes, no one is obligated to answer.

[ Parent | on HN ]

Re:FOSS could be an unintended victim of EU crusade to make ... by weinzierl on Friday February 10, 2023 @12:07PM (#34742451)

> "But open source owners will get tons of questions and should be better be prepared to answer questions."

...for appropriate pay.

[ Parent | on HN ]

Re:FOSS could be an unintended victim of EU crusade to make ... by oaiey on Friday February 10, 2023 @02:48PM (#34744783)

Ideally

[ Parent | on HN ]

Re:FOSS could be an unintended victim of EU crusade to make ... by 908B64B197 on Friday February 10, 2023 @03:44PM (#34745564)

Not ideally. Without a support contract they should, rightfully so, ignore these support requests.

[ Parent | on HN ]