Many large companies are dependent on open-source libraries. With these regulations they now have (more) incentive to get bugs and vulnerabilities in their dependencies fixed
They can't ship with known vulnerabilities, so if a project is suffering from a vulnerability, they might realise they need to provide a financial incentive to maintainers so issues are fixed quickly
Of course there's also a lot of other ways it could play out, but I don't think it's necessarily a given the result will be negative
https://www.forbes.com/sites/jennyodegard/2017/09/06/whats-t...
(this is how it looks in my home state of NY — not only is the requirement outdated but each county has a favored newspaper that you must use so it can charge a large amount for a useless service).
As a left-libertarian, I agree with a lot of arguments from right-libertarians and ancaps, one of them being that regulations are welcomed by the big boys because they provide a government-enforced barrier to entry for all the smaller guys.
Think of Facebook’s threat to “buy or copy” competitors, but now it would be “buy or put out of business with government force”. Sounds a lot more menacing when you put it that way, no?
Overall I don't think EU will go after smaller projects, since that would hurt the economy in an undesirable way. I think it's more likely that they'll use this to go after bigger corporations since that's an actual security risks for member states
That's also why there's a statement about proportionality in the proposal. The more critical the software is, the more you'll need to ensure safety
Sure keeping your head down is always a smart choice. But willfully living at the whims of capricious bureaucrats? Given the choice I'd prefer to not have that sword of Damocles in play.
Taking GDPR as an example, it shows that enforcement is done in proportion to the size of the corporation. Big corporations get fined, smaller companies receive warnings
If there are tangible harms, why have judicial institutions not entertained civil suits? If there are tangible harms, yet the institutions have not entertained civil suits, could it be that malign incentives are already in play?
Would you trust voters in your locality to vote on how you create your next software project? Shall we vote on what you eat for lunch?
Ultimately these discussions boil down to our core premises. Doubtful either of us will convince the other to change those.
I can understand why some people are worried when looking at how many governmental institutions have failed in their duty to serve the public. The EU has definitely got its share off bad decisions, but overall I think it has a good track
Politically I'd probably identify myself as an anarchist, so if I could change the world to look exactly like I thought best, I'd probably get rid of nation states and governments all together
That's however not how the world works and I'd rather work with the tools I have available right now
There's a war going on not far away from where I live and cyber attacks against critical infrastructure are happening almost daily
Even on this site, where I think discussions are generally pretty civilised, I'm starting to see a lot of retoric that's suspiciously similar to the alt-right retoric in many other places of the the web
It makes me think that there's a growing number of users here on this site who are only here to further their political agenda of authoritarianism and violence
That scares me much more than having to make sure that the code I write doesn't have security vulnerabilities
I think it's worth considering what actions can be taken to preserve society the best under these circumstances (society is different from government and states in this context)
>Politically I'd probably identify myself as an anarchist, so if I could change the world to look exactly like I thought best, I'd probably get rid of nation states and governments all together
For me it doesn't matter if the final stop is minarchism or ancaptistan. Steps towards either are an improvement. Bureaucrats regulating software development isn't it.
>Alt-right...
Maybe you could be more specific here? There was recently an article and video submitted here which accused Murray Rothbard of being a "right-wing extremist". It was yet another sloppily argued anti-cryptocurrency hit piece. Similarly we can call anarchists of all flavors extremists. The term alt-right or extremist is mostly a scare word from my perspective. It is hard to find meaning behind it.
>It makes me think that there's a growing number of users here on this site who are only here to further their political agenda of authoritarianism and violence
>Authoritarianism...
Isn't an authority dictating which kinds of software you may publish authoritarian by definition?
>That scares me much more than having to make sure that the code I write doesn't have security vulnerabilities
Agreed 100%, authoritarianism and individual autonomy is a bigger concern. Which is why I'm not a fan of these regulations. Furthermore, I suspect most users here already put forth an effort to avoid security issues.
In the US there is a bureau called the EPA. When polluters pollute within the guidelines, they have no liability. Perhaps now that software development is regulated we will see similar protections for incompetence.
You seem to mix the purpose of the Commission with that of the Council of the European Union, which is a body that has the power to make decisions. It consists of elected representatives from member states
The European Parliament, which is again all elected representatives, makes decisions that the Commission must implement, not the other way around
The Commission are the ones who draws up proposals and that they hope the Parliament will pass
Please educate yourself on this, as this kind of misinformation is undermining trust in the democratic process
The EU institutions pretty regularly do things that hurt the economy in order to prioritize their own political or social goals, so that doesn't mean much.
That is a very rose-tinted view of EU regulators. Europeans are people like everywhere else on the planet, we're not somehow immune to regulatory capture (though I feel it might help the institutions that we haven't yet powerful blocs like the GOP that set out to destroy any kind of regulation in order to prove it's infeasible). Heck, German industry giants are practically married to the state here, there's absolutely no fucking way a company like VW or Opel will go under if a rich government like Germany can do anything about it.
More to the point, the author themself is pro-CRA for a range of things that seem to have purely positive effects, as they spell out quite clearly in the article. The points brought up are nevertheless important: we shouldn't be okay with legislator making objectively shitty laws devoid of any technical comprehension or economical realism and hope it'll kinda be fine when the bureaucracy and courts actually implement it. Just having the danger of having to pay 15M€ for my open source project because it might be used commercially is a horrendous imposition.
Looking at the history of GDPR fines, big corporations have been fined large amounts, small companies have gotten warnings
Given that legal precedence I think saying that open-source maintainers risk 15M euro fines is blowing things out of proportion
And for a small open source project, a 500€ fine is enough to make development and publication unattractive, a percentage of a devs yearly income is painful, and tens of thousands of Euros would be dangerous to the long-term financial well-being of the developers. Even if the fines are a lot lower than 15M€, this proposal stays shit as written.
This is not what is going to happen, what is going to happen is that open source will be deemed a legal liability and every institution will turn to Microsoft proprietary solutions. Nobody is going to put more money into hiring people to fix bugs or vulnerabilities in open source projects.
Germany has for instance transitioned to using significantly more open-source software in the governmental institutions, as has many other EU member states
They would not support this proposal if it would result in an expensive reversal of these efforts
Imposing gatekeepers on the rest of the public with penalties even in private use cases is not.
Could you expand on that?
This is the first time the developers of such free software can be hit with massive fines.
And frankly, even if that wasn’t the case, I care about human beings elsewhere.
As many well-known open source foundations have warned, this will bring unintended consequences.
This means Europe will cut itself off from a lot of software as an unintended consequence. The whole point of open source software, a lot of the time, is that contributions are done incrementally by people without the means to certify this software to the level they want.
Given enough time and distribution, open source software often becomes much more resilient than its closed counterparts, not due to any government regulations, but because it is run in so many environments and there are so many critical eyes on the project, able to submit a patch. In fact, most of the infrastructure on the Internet runs on open source software.
That said, the package managers we use do have a problem — they rely on packages maintained by individual developers, and gradually update hundreds of versions, opposed to, say, the way operating systems are released.
Commercial releases like RedHat etc. can be certified! They should go after companies that make actual promises.
Having said that, a robust process in place for peer review in open source projects is good, same as in science or Wikipedia.
For the longest time, software development has grown by leaps and bounds, and software security is hardly the most costly thing to society. Proprietary software behind large Big Tech companies externalizes cost to society. Consider how the world looked for instance before the open Web: we had AOL, MSN, etc. and everyone had to pay to play.
Yes, it’s easy to regulate, but also increases the dependency on giant, centralized corporations and governments.
Many people felt that networked software and technology empowers people and frees people up to organize in ways that don’t rely on institutions. For example:
Now you will only be able to run things approved by the government. Because people won’t be able to develop or update anything else.