[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"



Hi,

On 13.11.23 19:54, Aigars Mahinovs wrote:

So a commercial company releasing open source software that is *not* part of their commercial activity (for example a router manufacturer releasing an in-house written Git UI) would be "supplied outside the course of a commercial activity" and thus not subject to this regulation.

That's why I mentioned systemd in my other email, perhaps I should elaborate on that.

The lead developer is employed by Microsoft (who have a certain history with the EU) and pretty obviously working on it full time.

I can see multiple ways this could go:

1. Microsoft are willing to take responsibility for releases made by one of their employees on company time. For this to happen, they will need to formally take control of the release process and the depreciation schedule.

2. Microsoft will claim that the developer time is a donation to the Open Source community, and outside their commercial activity. Project leadership will be transferred. I'm not sure the EU would buy that.

3. Microsoft stop paying for systemd development in order to avoid liability.

As in - if any interpretation of the wording of the directive is indeed found to be hampering open source development, then it is clearly in error and contrary to the stated intent of the legislation.

The conflict I see is with the way a lot of Open Source development actually happens these days -- while I personally would like to see a return of project complexities and scopes to something that is sustainably manageable in a community setting (i.e. not dependent on and steered by full time developers), I know that quite a lot of people on this mailing list disagree with that view.

I don't believe EU legislation is the correct way to get my wish, so I think it is important for us to see what the practical outcome of this legislation would be, and whether it matches the stated intent.

   Simon

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature


Reply to: