Of course, as per usual, this will come with entirely unfair and unproductive enforcement. Multinational corporate violators will be left alone or get sent on their way with a slap on their wrists, and small one-time hobbyist violators will get prosecuted into dissolution.

Do you have any examples of something like this happening in Europe.

I understand that Americans tend to think like this. But proportionality works quite well in Europe: Large companies get more scrutiny and higher fines while small companies get a warning.

Yes (see my reply to your sibling comment 1) but these are not large cases and I'd rather not connect this HN account to my real life activities.

All but one of the cases ended in a warning, but it does show the increased scrutiny that smaller entities seem to enjoy.

Edit: just to clarify me or my business were not directly involved with all those cases, but in the one that we were, it was something we had simply overlooked with regards to GDPR and all was good immediately when the auditor determined we had resolved the problem

1 https://news.ycombinator.com/item?id=35012128

Not so since GDPR. GDPR is enforced at every level, including the individual. Whereas 10% of the global revenue of a megacorp only upsets the shareholders a little without ever risking the megacorps power, it can literally bankrupt or starve individuals and small businesses, most of which operate with thin margins.

https://www.enforcementtracker.com/

This trend is similar to how the megacorps block out competition in the US by killing small businesses and making it very difficult to engage in economic or engineering activity through the regulations they sponsor.

This law in particular seems to be the product of the private German interests which at the moment dominate the Euparl. So, yeah, its happening in Europe now too.

Per your link, proportionality seems to be working. Big fines are directed towards big companies (cf. Fines Statistics). For individuals (“private person” or “private individual”), it seems they mostly are fined 3-digits amounts, with some in the 4-digits, and 3 at 10-11k.

> proportionality seems to be working

The fine is arbitrarily decided. There isnt anything solid governing the amount if the fine is not % of revenue. So it totally depends on the whim of the regulator. Which is totally in lieu of the principles of civil law that Europe uses. Its more like the common law practice in which the authority can interpret things and can act arbitrarily without solid, inviolable, democratically-made laws governing its behavior.

This may look like working today. Tomorrow you may find it disproportionately hitting whichever segment or sector that the interests behind the incumbent regulatory appointees target.

> The fine is arbitrarily decided. There isnt anything solid governing the amount if the fine is not % of revenue

This is wrong. See GDPR article 83, and https://edpb.europa.eu/system/files/2022-05/edpb_guidelines_...

> This is done by evaluating the classification of the infringement in the GDPR, evaluating the seriousness of the infringement in light of the circumstances of the case, and evaluating the turnover of the undertaking. The third step is the evaluation of aggravating and mitigating circumstances related to past or present behaviour of the controller/processor and increasing or decreasing the fine accordingly

How is 'evaluation' done and who does the 'evaluating' you think...

There is no solid legal directives defined in GDPR regarding static amounts. They hinge on on the regulators' interpretations.

Thankfully, there is still 38 pages left after that quote. You will have a hard time finding a flowchart in a law though…

Anyway, my point was that the fines dispensed nowadays are sensible. As for the future, DPAs know very well that the instant they go rogue, ie. distribute disproportionate fines or misinterpret the law, their decisions will be reversed by an appeal court. It already happened, in fact.

edit: I just read this on the website of my govt:

> The court that sentences the offender is free to set the amount of the fine, but not to exceed the maximum amount set for that offence.

Turns out judges here have even more leeway than my DPA! The finepocalypse should come any day from now. And don't get me started on courts of assizes.

The static fines' maximums are defined in the 'Legal Maximums' section. The other 38 pages are not needed. Next time, do read the reference you are sharing.

> Anyway, my point was that the fines dispensed nowadays are sensible.

The sensible fines of today do not guarantee the fines of the future. The precedent concept does not apply to civil law. When an authority is given free range interpretation power like this, the next batch of regulators can interpret it in however they want. Which is in itself a violation of civil law principles.

> ie. distribute disproportionate fines or misinterpret the law, their decisions will be reversed by an appeal court

No Open Source contributor will risk getting such a fine, then going through a lengthy court battle to revert it. They will just stop contributing.

Good afternoon.

> in which the authority can interpret things and can act arbitrarily without solid, inviolable, democratically-made laws governing its behavior.

A speeding ticket has a fixed fine, anything more complex than that has some level of arbitrariness.

This is how things work in pretty much every other country of the world.

And of course fines are appealable, etc

i can say with quite some confidence that huge companies in europe do not get the same level of scrutiny from the tax department as some regular joe does.

They will come after the little guy with the full force of the state, with their lackeys wearing a pistol belt, and you had better comply, or else. Meanwhile they dont have resources to perform audits on the big guys

Source: I made it up

This is not what has happened with previous regulations. In fact, it's mostly weaponized against US companies, but that's mostly because it's fun and deserved.

Source I have experienced this with my own business, and saw it happen to other commercial as well as non-commercial entities with previously implemented acts and directives.

It's not dissimilar to how the tax authorities always seem to pick small timers for a random extensive audit.

Won't someone think of the poor oppressed small business owners.

It's not like they're the cause of half of regulations or anything due to all the scummy small business owners...

You are missing the point entirely.

Yes think of smaller entities - which are not all commercial, mind you - just don't think of them more often and more thoroughly than the multinational megacorporations that have been racking up endless violations, most of which they are continuously worsening rather than fixing, and are in many cases actively trying to litigate into oblivion.

there is nothing in history that could be used as a precedent to predict how this will be enforced. big companies will be in the news very hard for violating these laws. no-name small timers might get a slap on the wrist. but pretty sure fines will be proportional. about time companies are held accountable

As previously implied this does not conform to my own observations

The idea is good and I'm all for it, but mostly due to said observations I'm not convinced its practical implementation will be very effective at all

That is the modus operandi of US regulatory apparatus. Example: Glaxo Smith Klein !knowingly! killed ~150,000 Americans by pushing Avandia for a purpose that it was not approved for. They knew that it would kill a lot of people before they launched it, and they started bribing and coercing medical professionals and institutions, including top names in the US to lie about it. They kept an information siege of lies up until whistleblowers protected by Qui Tam principle blow the cover, protected by the government.

The result?

GSK paid $4 bn in fines. They made $11 bn in profits from that drug. Net $7 bn even with the fine.

...

This is the way regulation works in the US. And this is why the Americans dislike it: Small businesses can never risk that. Big businesses dont need to care about that. Its designed to kill the small for the sake of the big.

The Eu used to be different. But judging from how this law is crafted, it might be changing.

this is "GOOD BUSINESS" and bad (evil) everything else. oh the humanity

Yep. One person among the US authority that led this prosecution explained very well what GSK was did in an Al Jazeera documentary. He said: "This wasn't a mistake. This was a good business plan."

That's not how regulations work. Big corporations are targeted first, because they're big obvious targets and have auditable paper trails. Small-time hobbyists are the ones who fly under the radar.

The distribution of consequences rather than discovery of violations is what I expressed my cynicism about.

You didn't read the article, right? Go check it out, it brings up some good points. There's definitely stuff in that Act that's more than "absolute minimum legal standards", some even impossible to achieve.

Here's one part:

>(f) protect the availability of essential functions, including the resilience against and mitigation of denial of service attacks;

>Did the EU just require me to make software that can withstand (unspecified) denial of service attacks? Something that is mathematically proven impossible?

That does not seem like the intent of the paragraph. My first thought is that it's a poorly worded (though legalese oftentimes needs to be) way of saying that devices should not easily be turned into DDOS nodes. But it might also just say that even if it's under DDOS attack, there should be a way to operate essential functions still, which is very much possible with some compartmentalization.

Would be nice, but I think since (a-e) weren't in that line and that (g) is directly addressing that, that would be incredibly bad wording.

Regardless, I can imagine there are some products with 'essential functions' which require the channel that could be DDOSd, no?

My stance here is that it's very broad, and I think it's easy to create an exploitable system from these directives. But unfortunately the problem is real and the mitigations complex. I was buying into this initially because of that, it seems reasonable without much thought on what the exact solutions look like, which I think makes it more dangerous.

If other engineering fields have seen this process, and the involved regulatory bodies have stayed independent of large corporate interests, I guess we should have a good shot. But with my lack of knowledge on that topic, I hold some trepidation for the future of smaller software shops and individual developers.

> (g) minimise their own negative impact on the availability of services provided by other devices or networks;

can you paste one that you feel goes beyond minimum or even "impossible"? otherwise this comment is just he said she said.

> The CRA describes ’essential cybersecurity requirements’ which are well intended, and mostly ok, but leave a lot of room for interpretation. These requirements tell us to implement adequate denial of service & exploit mitigation techniques, for example, and no one can be certain what that means

Service exploit mitigation techniques? Really why didn't I just think about not writing bugs, and vulnerable code.

a shame that he is unfamiliar with RED. It's meaning is literally just system hardening as it is also defined in RED (CRA is just an expansion of RED to the rest of the ecosystem), which is in this contexts outgoing firewalls rules on devices, system hardening, anomaly detection, ... It is not a definitiv list of things because this would change based on what makes sense on a system. Instead you need to demonstrate that you've considered a threat model when applying the mitigation. And the mitigation is sufficient for the intended purpose.

One example could be limit what the system can and can't do. And don't allow it to communicate with the whole world when your only required endpoints are api.samsung.com, an ntp server, DNS and MQTT.

A shame that he had to write this hit-piece when he could have asked what notified bodies are testing _today_ to meetx requirements for RED.

Yeah, literally the entire 2nd half of the article. Go read it, I'm not your tldr bot.

I'm deeply familiar with the actual draft proposal of the law and no person working in security would consider these outrageous. this shit really is just best practice and good security hygiene.

refusing to quote what you mean is bad faith. and you're not really contributing to the conversation

So you didn't read the article, you have no idea what you're talking about and you call me "being in bad faith". Is this Reddit now?

The real question is if execs and management are going to allocate the extra time and resources required to make consistently meeting these standards reasonably achievable or if they're just going to squeeze harder and expect more without any adjustments.

I would bet that a lot of devs actually want to write high quality, well-tested code and engage in proper project hygiene but simply aren't given the bandwidth required to do so. In my experience everything is so tilted towards "ship now, fix later (maybe)" that any IC's efforts to do things more correctly is a bit like trying to swim upstream.

Ill place my bet that the squeeze will get harder on developers and there will be new "compliance officers" in the office that dont actually do anything but make silly demands to waste peoples time. So pretty much the same as every other security regulation...

Yeah just like the complete ISO bullshit we have to deal with already.

How many story points is that

This. It's about time software is treated like any other engineering: lives depend on it. Not enough heads are rolling.

All software or just important software?

All software storing user details that would be a problem if they were leaked, I'd assume. That would include basically all software with a login.

Until proven irrelevant I'd say.

Proven irrelevant by actual de facto use or by the license? In other words, would adding "this software is not certified or fit for medical, aviation, nuclear, etc…" suffice to exempt it (assuming it is not then sold to medical or airplane manufacturers)?

This article points out that this doesn't just apply to companies. If you maintain an open-source project and accept donations, then you're potentially affected as well.

Adoption of open source, most open source licenses already come with broad waivers so compliance would fall mostly on the adopters.

that's not how the act works, sorry.

Article 6, Numeral 2 "In determining the level of cybersecurity risk, one or several of the following criteria shall be taken into account" seems very reasonable in scope and wouldn't include most open source/free software.

The negative comments are indeed a bit hypocritical. It's as if the profession that ships faulty products almost by definition throws a fit because a (legal) product might not be perfect on the first attempt.

Why is this downvoted? Did it hurt someone's ego?

It violates HN guidelines [0]:

> Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith.

> Please don't post shallow dismissals, especially of other people's work. A good critical comment teaches us something.

> When disagreeing, please reply to the argument instead of calling names.

It's okay to disagree with someone, but saying their comments are hypocritical and that they're throwing a fit is not okay.

0: https://news.ycombinator.com/newsguidelines.html

That's all fantastic, but this guy actually has a point. Software quality at large is pathetic, anybody who uses technology knows this, and especially those who develop it for a living. The lack of regulation plays a big role in this. The field can barely call itself engineering. Yet the guy's comment also just happens to make the fanboys uncomfortable, so he gets immediately down-voted (didn't even last two minutes). On the other hand, look at that motherfucker up there who dismissed my comment saying that all I do is type too fast. Now that is clearly against the guidelines, yet no down-votes? Fascists, too, are very good at applying double standards.

A lot of people's paycheck on this forum depends on having zero standards of quality in the entire industry.

Unimaginable horror can come from stopping the endless pursuit of profit and the cutting of costs at the expense of quality in engineering. And to hold companies accountable? That is just over the top. Can you imagine if, next, people had... the right to repair? Or the right to look at source code? Terrible consequences.

Can you imagine if taco trucks gave away food for free, or if engineers built and maintained some of the biggest bridges in the world out of their own pockets and didn’t ask for a dime, or if accountants did their job without charging any fees?

You might have missed the part where this is already scaring Theo de Raadt, to the point of recommending EU users not use openSSH anymore.

How many here are confident of writing software as securely as Theo?

edit: I still think this is going in a good direction, but at this stage this kills a lot of small businesses, startups and open source.

Requiring certification for every release means killing off most software, let alone the fees. Forget multiple supported releases or LTS, everything will be rolling release.

I guess I’ll use telnet instead. It’ll be fine.

Sure: https://www.oreilly.com/library/view/linux-security-cookbook...

And who gets to say what these good practices are? Until recently everyone thought Clean Code was a wonderful book full of great coding advice, now we see that it's full of really crap examples.

Does all public code on GitHub need to be audited?