Re:EU's Cyber Resilience Act contains a poison pill
by Nocturium on Friday May 12, 2023 @08:35AM
(#35915314)
I disagree. The bill is about securing software.
Companies who earn a lot of money should have a legal obligation to spend money to secure their software. Reverse engineering, debugging, etc.. is already legal in the EU to fix a problem a company isn't able or willing to fix.
We read a lot on this website that someone reported vulnerability. Sometimes it gets accepted and fixed. Sometimes the company threaten the reporter with law suits. If this law gets passed, the reporter can point to this law and say the company is responsible of fixing it.
I get that people are nervous about this "law". But the EU isn't a country. Various countries need to adopt this into their local law. If I take into account how the myriad of laws work in my country, a small open source developer with limited following and resources will not be targeted. And even if they are, judges will throw it out because it's a waste of everyone's time. On the other hand, an open source project, like let's say blender, might receive a request if they refuse to fix a vulnerability.
Companies who earn a lot of money should have a legal obligation to spend money to secure their software. Reverse engineering, debugging, etc.. is already legal in the EU to fix a problem a company isn't able or willing to fix.
We read a lot on this website that someone reported vulnerability. Sometimes it gets accepted and fixed. Sometimes the company threaten the reporter with law suits. If this law gets passed, the reporter can point to this law and say the company is responsible of fixing it.
I get that people are nervous about this "law". But the EU isn't a country. Various countries need to adopt this into their local law. If I take into account how the myriad of laws work in my country, a small open source developer with limited following and resources will not be targeted. And even if they are, judges will throw it out because it's a waste of everyone's time. On the other hand, an open source project, like let's say blender, might receive a request if they refuse to fix a vulnerability.