The reason is to make sure that all software that a normal run-the-mill business may use in the "in the course of a commercial activity" and receives regular releases, is reasonably free from known significant vulnerabilities (the last release, at least). Would it be reasonable to use Nginx "in the course of a commercial activity"? Yes, it would. Thus, EU wants to ensure that if you as an SME install Nginx and keep it updated, it's reasonably free from CVEs (e.g. that Nginx Plus does not contain CVE fixes that were not released in the latest versions of the OSS version of Nginx).

Bottom line: the criteria is written from the viewpoint of a software user, not the developer or vendor.

Does Nginx assert it is fit for commercial activity?

If it does, then yes they should be required to meet their promises and keep it fit for commercial purposes.

If it does not, then why the hell are you using it for commercial purposes? They told you it is not fit for that purpose. You do not get to demand they meet your needs because it is convenient for you cheap out by using inadequate dependencys.

As I wrote elsewhere in the thread, if EU didn't word it the way they did, most OSS projects would simply slap "not fit for commercial purposes" in the README next day after CRA became law with a smug smile.

Regarding "cheaping out", I expect EU businesses to begin demanding that every dependency in their SBOM is CRA-compliant in some due time. This will most likely mean paying money. But I disagree on "by using inadequate dependencys": how do you expect a pizza shop owner to think that installing Ubuntu LTS and running "apt-get update && apt-get install nginx && apt-get upgrade" or a latest version of Chrome is somehow inadequate?

I agree they would slap “not fit for commercial purposes” since they did not sign up for this.

I also agree the EU businesses would start requiring it which means they would not be allowed to use software that smugly slapped it into their README. If developers actually want commercial users then they need to meet the standards. If they are hobbyists or do not care to support those use cases, then they do not need to do that.

Any business still using the software that asserts it is not fit for commercial purposes is then clearly using inadequate dependencys. The developers said it was unfit or did not want to bother with it; so this is a perfectly true and proper characterization.

>As I wrote elsewhere in the thread, if EU didn't word it the way they did, most OSS projects would simply slap "not fit for commercial purposes" in the README next day after CRA became law with a smug smile.

So? Seems an amazingly cut and dry case for the EU to go after any business using software with that clause (directly or indirectly). Isn't that exactly the goal here? To prevent businesses from using this software? If that is achieved why do you act like this is a bad outcome? Why do you act like punishing open source projects is the goal versus preventing commercial use of unsafe software? If businesses require some non-compliant OSS then they can pay for maintenance and compliance.

The goal of the EU is not to "go after any business", but instead to help them stay secure online (I know, people outside EU find it hard to believe that EU makes regulations to actually help people). EU considered various ways (see Section 3 "RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS" of the Memo that precedes the regulation text) but concluded that putting the burden on users to check the software (and all transitive dependencies) is secure and is fit for commercial use is too big. This is also consistent with the regulations on construction experts to make sure bridges are safe and on doctors to make sure the prescribed meds are relatively safe to take, instead of putting the burden on pedestrians and patients.

I hope you'd agree that we'd all be laughing right now if EU instead mandated businesses to use only commercial-grade software, joking about how are they going to run cloud VMs without the Linux kernel, GCC etc. EU fully understands that the world of software is thoroughly built on OSS, whether we like it or not.

It's also not a secret that many companies rely on OSS as a springboard for adoption, e.g. MongoDB. EU does not want to allow Mongo the company to avoid compliance merely by saying that their product is open-source(ish). And by the way, the regulation would require software to come with a secure by default configuration (page 2 of https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-... ), wink wink ( https://snyk.io/blog/mongodb-hack-and-secure-defaults/ ).

> As I wrote elsewhere in the thread, if EU didn't word it the way they did, most OSS projects would simply slap "not fit for commercial purposes" in the README next day...

Pretty much all software already has this in the license/EULA since forever. It's just worded slightly differently as "there's no guarantee of fitness for any purpose" and disclaimer of all warranties.

> I find the criteria for inclusion a bit weird: why would any given project should be the object of regulation? The way I see it, they should rather focus on the transaction.

I asked them directly. There is no direct reason whatsoever. They just rushed it and fucked up. Nobody ever thought about FLOSS besides vaguely excluding it in the "noncommercial" way.

There were more landmines in the original draft. Like the requirement for any known-vulnerable device not be put on the market. Well guess what? All those phones and laptops sitting on the shelves are having exploits discovered every month.

Red Hat chimed in; apparently they have potential vulnerabilities on containers they publish sometimes in 15 minutes. Potential. How exactly are they supposed to act?

The legislation just plain sucked and now it's being "fixed" behind closed doors.

I'm pretty sure at least some of the lobbyists who wrote this were aware of the negative effects on FLOSS software.

The head of the Eclipse foundation said that they are aware, but that they thought that it would be too expensive for small businesses to get the verification. So the open source devs should do it for free.

Related timestamp: https://youtu.be/AmsM5_5QO5A?t=1528

You give EU bureaucrats too much credit. Incompetence, lack of involvement and a general feeling of doing fake work reign there.

Exactly this. To extend this further, the requirement should actually be on the receiver of the transaction to verify their dependencys are fit for purpose either by consuming a guarantee from upstream or by providing the guarantee if upstream does not.

This is what literally every other industry does. They vet that their dependencys meet their requirements. It is literally ridiculous that this most basic of practices is still not standard in software development.

It is insane to burden OSS developers by requiring them to assert commercial guarantees because the lazy bums who want to use their software for free can not even be bothered to check if it actually meets their needs.

That would probably be better at providing funding for OSS. For projects that aren't backed by a company that sells support, customers could pay a third party company like Red Hat, Canonical, Tidelift, Collabora, etc. to certify the security of dependencies.

Isn't Tidelift a bit of a joke?

https://tidelift.com/lifter/search/npm/d3 offers $25/mo.

https://tidelift.com/lifter/search/maven/org.apache.jena:apa... is not covered despite being an Apache project with 1k stars and quite a lively mailing list with some corp users.