Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"
On Sun, 12 Nov 2023 at 18:11, Ilulu <ilulu@gmx.net> wrote:
> Am 12.11.23 um 19:01 schrieb Luca Boccassi:
> > Yes - if it's "made available on the market", which is in the first
> > bit that was snipped. Pushing a repository on Gitlab is not "making
> > available on the market".
>
> You are wrong. It is. That's why the proposal has:
>
> "(10d) The sole act of hosting free and open-source software on open
> repositories does not in itself constitute making available on the
> market of a product with digital elements. As such, most package
> managers, code hosting and collaboration platforms should not be
> considered as distributors under the meaning of this Regulation."
>
> ... which means that GITHUB is not responsible for the repo you pushed.
Sure, it would be very strange if it was.
> But you are. You are the manufacturer of that software product, you make
> it available, and whether this is "on the market" = commercial depends
> on a lot of things: how many donations you get and from whom, who your
> employer is, or who else is working on that repo ... and so on,
> depending on how the wording of CRA-Recital 10 will turn out in the end.
> You better ask your lawyer.
But this is a non-sequitur. I don't see how the fact that Github is
not responsible for software hosted on its platform goes to imply that
ever such software is a product. Whether something is or is not a
product on the market is already quite clear, and the sources cited in
the original mail themselves say that the CRA does not change this
aspect. There are many, many, many regulations affecting products put
on the single market - I've already cited one that should be familiar
to everyone, warranties. Are you responsible for the warranty for
software you push to Github if someone git clones it? Of course not.
Because repositories on Github are not products on the single market.
Reply to: