Being alarmist and pedantic about specific language of legal text is precisely what is needed to point out flaws. The only thing more terrifying than a governing body making laws about things they fundamentally do not understand is having the courts, with their own incomplete understanding, decide their own interpretation of them.

Agreed, and that is also a good advice for those submitting responses to open consultations. Yet, Vaughan-Nichols certainly was not pedantic in this piece.

I'd argue a small group of people on an obscure mail list defining things so as to best suit them is an even worse form of governance, despite its relative popularity in this forum compared to more standard methods.

I disagree. The bill is about securing software.

Companies who earn a lot of money should have a legal obligation to spend money to secure their software. Reverse engineering, debugging, etc.. is already legal in the EU to fix a problem a company isn't able or willing to fix.

We read a lot on this website that someone reported vulnerability. Sometimes it gets accepted and fixed. Sometimes the company threaten the reporter with law suits. If this law gets passed, the reporter can point to this law and say the company is responsible of fixing it.

I get that people are nervous about this "law". But the EU isn't a country. Various countries need to adopt this into their local law. If I take into account how the myriad of laws work in my country, a small open source developer with limited following and resources will not be targeted. And even if they are, judges will throw it out because it's a waste of everyone's time. On the other hand, an open source project, like let's say blender, might receive a request if they refuse to fix a vulnerability.

> lobbying (which he oddly calls "education")

Looks like he has lobbying experience :)