The Cyber Resilience Act is Worse than I Thought...

💸💸 Help me contribute to KDE and do these videos: 💸💸
Paypal: paypal.me/nicc...
Patreon: / niccolove
Liberapay: liberapay.com/...
Ko-Fi: ko-fi.com/nicc...
Text version of this video: blog.nicco.lov...
Resources:
news.apache.or...
github.blog/20...
blogs.eclipse....
devops.com/the...
pyfound.blogsp...
• CRA vs Open Source: Lo...
Stay in the loop: t.me/veggeroblog
My website is nicco.love and if you want to contact me, my telegram handle is [at] veggero.

[@yigitorhan7654]

So the bill itself has critical security flaws that need to be reported within a timeframe measured in hours. Better hope the entities behind it get it patched, because it's absolutely proprietary.

[@yigitorhan7654]

If it weren't, we'd fork it.

[@hopelessdecoy]

Is it a flaw if it's just an planned feature though? Just curious if I can use that as a loop hole in the future

[@MNbenMN]

@@hopelessdecoy Well, if you are HP and being sued for the flaw ofrequiring ink cartridges to be installed in order to use scanner functions in AIO printer/scanners, then that's what you might try to defend in court!

[@hopelessdecoy]

@@MNbenMN my comment was a joke in reference to this comment and not HPs printer stuff....

[@MNbenMN]

@@hopelessdecoy Username checks out

[@sirzorg5728]

In the absolutely proprietary cyberpunk dystopia of the future, I will be the shady guy in a trenchcoat, fedora, and penguin mask handing out bootable arch usbs in dark alleyways.

[@dragonowl77]

yup, i hope that future never comes to pass (it probbably will tbh) but that would also be me.

[@bluephreakr]

EndeavourOS would be the better choice once they manage to release a new build of their distro. Shame they've stalled, but they'll pull out of it. The advantage for EndeavourOS is specifically because of a graphical desktop environment over you needing to provide explicit instructions for typing commands.

[@bluephreakr]

Replying to myself: Cassini Nova R3 was released recently, so they're still _very_ active, just not dropping any major changes quite yet.

[@timecubed]

I'm joining you

[@qdaniele97]

Please, keep in stock some with Debian as well. I might need them

[@AQDuck]

I like a lot of EU acts, but they _really_ do not understand technology. I will never forget when Ylva Johansson compared encryption to a travelbag in an airport, and chat control a "sniffing dog" that can detect CP in said "travelbag" during a debate with a security expert.

[@kaotiskhund]

Did you see any member that signed this to have IT degree? I didn't. Maybe I overlooked, but I didn't see.

[@Stopinvadingmyhardware]

That’s basically stating that Corporate Espionage doesn’t exist and isn’t a massive problem for countries that have patent and copyright laws. Bad news, it’s a huge problem for us. The Asian nations for the most part don’t respect Intellectual Property, and they are constantly paying hackers in the West or doing intrusions themselves all over the Western World. This is wealth being stolen from it’s creators directly.

[@LaserBread]

Tech illiterate boomers should not be making tech legislation.

[@RFGSwiss]

@@kaotiskhund since data doesnt emit smell, common sense is enough to realize this is some stupid crap.

[@LTUGang]

Ylva Johansson?? what do you expect from a communist?

[@docopoper]

Even if this is not enforced on open source projects in practice. It will still dissuade a lot of people from getting involved in open source. And worst of all I can imagine companies forbidding their staff from contributing to open source projects.

[@_DarkEmperor]

It will stop innovation in EU. Software development will happened elsewhere, like USA or Asia.

[@mirzu42]

Lol do you actually think that in the EU an employer could even try to stop employees from contributing to open source projects? Maybe in the US they could, but like honestly who cares? American developers are a very small portion of all the devs and out of those devs even smaller portions would theoretically get restricted.

[@docopoper]

@@mirzu42 Hopefully you're right.

[@mirzu42]

@@docopoper wdym hopefully? Its literally a law in most countries anyways and the EU also regulates this heavily. Theres absolutely no way for employers to command someone about what they can or can not do on free time

[@daomingjin]

What you do in your own personal time is not up to the company. It's like my company saying - "you are not allowed to watch Fox news if you work here". Maybe that's a bad example but as long as don't do that at the office on a company network there's nothing they can do about it. The only way to do that is to constantly spy on every single citizen - which becomes very expensive very quickly.

[@DrDiemotma]

Seriously, I cannot imagine a single company - let alone an OSS project - to comply. 25% additional costs is a lot. What will happen then, will the EU reform to an agricultural state, because we cannot use any software at all?

[@kuhluhOG]

the way the Internet works these days, it would impact the whole world it's basically impossible to geoblock these days in practice

[@rayjaymor8754]

I mean I work for an extremely well funded private company and I'd have to imagine even we would wince at some of these restrictions. How do you define a vulnerability exactly as well? I mean, there are some very obscure vulnerabilities out there that nobody takes seriously because you have to have direct physical access to the server. A lot of bug hunters and clout seekers tend to ignore that once someone has your server then you're pretty much done anyway in most cases.

[@DrDiemotma]

@@rayjaymor8754 Yepp, same here. Though we are a machine manufacturer, that comes with software, and I am actually the project lead for a project where this would relate to; so, I had to take care for that. When I say that this would delay the release for three months or so, guess what would happen. So no, I don‘t think it will come to this. We are all in the same boat, commercial and FOSS providers. And as a side note, if I had the amount of influence, I‘s scrape the current Windows-based development and install a Linux or BSD based one, and create the system from scratch, not trying to reduce services to increase the security. But unfortunately, I have to work on this… system.

[@garlet69]

Yes, but without John Deere/others equipments

[@tikkasen_urakointi]

EU is becoming a deindustrialized agricultural state anyway, with or without the Cyber Recilience Act. We are going back to the stone age.

[@Brown_Potato]

Written by people who don’t know what goes into tech. Beaurocracy at its finest, closest to idiocy

[@kaotiskhund]

imagine eu moving to agile/safe 🤣🤣🤣

[@Kaninballen]

They are bought out by WEF.

[@nicholaspeterwilliamjones]

Don't you mean idiocracy?

[@forbiddenera]

​@@nicholaspeterwilliamjonesthat world is getting closer every day. BUT IT HAS ELECTROLYTES!

[@peterk6797]

I've worked in industries impacted by new EU regulations. The short version of my complaint is that most of the regulations are almost impossible to meet unless you are a large corporation with a ton of money to meet ridiculous requirements in a short time to meet unrealistic deadlines, and if you don't meet the deadline you need to shut business down or be met with fines so large it will bankrupt you. The conclusion I have come to is that the people making the regulations have no idea what they are doing, or this is intentional.

[@Kaninballen]

It's unfortunately the "You will have nothing and you will be happy" for us except for big companies, central banks, the super rich and the elite and goverments.

[@peterk6797]

@@Kaninballen you veel eat zee bugs mentality indeed

[@Kaninballen]

@@peterk6797 "We have penetrated ze cabinets!" Indeed! X'D

[@joelcarson4602]

Regulatory Capture: Huge conglomerates basically "helping" to write new and improved (Yeah, right.) rules and regulations with the sole purpose of squashing innovation and pricing any new competition out of reach.

[@ped7g]

you have a typo in last sentence, should be "... no idea what they are doing AND this is intentional." ... :) there, I fixed it for you.

[@mner9826]

NO ONE can keep up with this crazy bill. Their goal is noble but it's unattainable. What and how they want to do, it's simply crazy. Every commercial company will have either to lie about the CRA compliance of their software or try to drastically change their development process and commercial cycle releases which most probably send them bankrupt before even achieve the cra goal. For open source entities? Who will even accept this enormous responsibility and liability under law that may result in prison time and fines, imposed by this bill? I bet there is no software project out there, open source or not, that was ever bug free and 100% secure. The bill is just insane, created by people that have no clue how modern software is developed or they simply don't care to draft something that can be achieved.

[@kaotiskhund]

NO ONE can keep up with this crazy bill.

[@paulojose7568]

big daddy State trying to care for us, how noble is that

[@Psychx_]

That's EU politicians for ya. Incompetent, old bags that were cast out to Brussels when they became unbearable on a national level. Now these numbnuts try to regulate stuff they don't understand, nor have any intention of understanding towards. Like holy f*ck, when laws touch technical topics, it should be required that several independent researchers from the field educate the politicians about the topic before the debate even starts and then guide them through the process, answering questions and pointing out unintended side effects. Have a few lawyers specialised towards the EU laws regarding that field present for the process aswell.

[@friedrichhayek4862]

It is no noble, it is demonic, make with the purpose of PR and Tyranny. The user should have the freedom to use and buy insecure software.

[@martenkahr3365]

@@kaotiskhund Nailed it in one. Selective enforcement of rules that nobody is capable of meeting is the name of the game here. Big corporations will simply lie about it and make it too expensive to prove they're lying, while FOSS projects, by their nature, cannot lie without getting caught, nor can they afford to defend themselves in court.

[@OctagonalSquare]

The requirement to notify is the scariest to me because it would require that all software collect data, regardless of if they were before or actually need it. And guess who loves to get data from private companies? The government.

[@joaovmlsilva3509]

the USA government*

[@HenriqueSantAnna]

Free software shouldn't bee seen as a product. First of all it is a collective and shared knowledge. No government should impose rules to sharing knowledge.

[@Ne0Freedom]

"No government should impose rules to sharing knowledge." ...Yet, that is exactly what an intellectual property is ! Copyright is regulation of Creative works; while Patent is regulation of Scientific works. Software can be both Copyrighted & Patented.

[@computerfreakch8912]

​​@@Ne0Freedom IP protection is a privilege of the owner, meaning governments are expected to guard compliance with the license terms, rather than dictate anything to the owner.

[@Ne0Freedom]

@@computerfreakch8912 Copyright is a license for the monopoly of books & Art. Patent is a license for the monopoly for Research & Scientific advancement. These are government tools to control the flow of Knowledge. eternal-entropy.blogspot.com/2014/09/ip-history.html

[@pandapip1]

@@Ne0Freedom As such, we should get rid of Copyright and Patents.

[@artem.boldariev]

They want opensource software to be certified AND they want open source developers pay for it. How disgusting.

[@essenceofdementia]

They want open source to disappear, almost all western governments are in the pocket of mega-corporations.

[@asdfghyter]

yeah, the more reasonable option would be to require that commercial users of the software pays for it, probably with a minimum size of the company to not bankrupt all small companies. it might be possible for small companies too if they are able to pool together, so every commercial user of the product pays a part of the cost

[@Slav4o911]

Certified by whom ?! Are there one billion "certifiers" out there who will certify every snipped of code?! That's just crazy....

[@MauricioSzabo]

Well, Apple already does that on Silicon binaries, they are just following the trend... Yeah, it's infuriating :(

[@paultapping9510]

so they're effectively creating a centralised database of 0day vulnerabilities in business and finance critical softwares? I'm sure that will go well and not be the target of every blackhat on the internet.

[@willi1978]

i guess the info will be sold by some government employee on the black market, making tech illiterate people money

[@merlin9702]

I just hope they won't give it to our secret services. Imho they are worse than blackhats because they can't even be held accountable.

[@Gnomleif]

The video mentioned this could be a ticking time bomb, and if they do end up with a centralised database of 0day vulnerabilities it can indeed become a ticking time bomb in more than one meaning of that sentence. On one hand I can imagine _so_ many ways this can go horribly wrong. On the other hand I'll admit there's a little, dark part of me that wants them to go through with it and then watch it blow up in their faces in a manner that would make the Tsar Bomba look like a gnat's fart in comparison.

[@seanfaherty]

From what I hear if you are willing to take your chances on the dark web that database already exists.

[@rayjaymor8754]

This act WON'T save them this money though. You'll annihilate open source, and then Microsoft, Apple, Oracle, Red Hat, etc will own the whole thing. That eCommerce website you paid a freelancer $2000 for? That will be $25,000 now thank you very much. The freelancer still only keeps a small fraction mind you, they just have to pay exorbitant fees to corporates for basic functionality. It would be the 1990s all over again.

[@utkarshyadav6119]

What makes you think EU will have any problem with that they will be like dont forget to pay the tax on the sale of software

[@johnnoble-ray4223]

Turning back the clock is exactly what they want, because if they do that they can go back to being 90's era corrupt where no one can talk about it because the people in power control the information, equipment, ect.

[@earx23]

Indeed, but I also wonder about this stuff. Much like prohibition in the 1920's. The law can be unenforceable. Actually, they often are. Just look at the requirements for paper trail when a company exports products. There's like 5 different documents involved: trackings receipt, invoice, label, and 2 others I forgot. In practice, a company never gets inspected unless they make it onto the taxman's black list. (If you do, you're in deep shit though, and they'll follow you to the South Pole if they need).

[@a46475]

If there is a vulnerability, tell us immediately so we can weaponize it against our enemies; you.

[@matthewdee6023]

Gods, to me this doesn't sound reasonable or awful, it sounds like panicked middle and upper managers covering their collective arses in an area they know next to nothing about. So, ok, it's awful 😞

[@Xankill3r]

If the use of this software is so critical to European SMEs (providing 95% of the code base) then why doesn't the CRA establish a certification authority that is industry funded and pays for all this work instead of simply demanding that the work be carried out? If you're profiting from it (indirectly because the SMEs pay taxes) then you have a responsibility to put your money where your mouth is.

[@weiSane]

They assume there can't ever be bugs in software. Are they fricking dumb. You can't guarantee that there will not be bugs or vulnerability in software. Do they make these laws with input and insight from real experts in the field (programmers and other IT professionals) or is it just a bunch of guys in suits sitting in fancy offices coming up with all these garbage unrealistic goals. I would like to hear Linus' opinion on such ignorant laws.

[@kuhluhOG]

It's the latter. And that's the case for basically every state world-wide.

[@kaotiskhund]

Are they fricking dumb. They are. Remember, they became politicians instead of anything useful.

[@Henry-br1ti]

Sadly the current political system rewards corrupt sneaky liars and double crossing opportunists at the orders of their billionaires masters, that in the end are the ones that takes the key decisions on technology, war and even healthcare.

[@benhetland576]

This is like, so many times before in history, nothing but another "people control mechanism". Since it will never be possible to be 100% certain of compliance to the law, then it ultimately comes down to the authorities how the bill gets applied in practice. They know that! As long as a reasonable leniency is exercised within law enforcement, it may work reasonably well. The problem is, we can never be certain when (or if) that leniency is no longer shown, and therefore we will remain at the mercy of the government. Even if someone states that one complies with the CRA, it can alway be found to be (or "proven") a false claim, thus a punishable act. Consider for example, who gets to decide what constitutes "cyber security".

[@autohmae]

it does say: you need to have security audited all the code and all KNOWN bugs needs to be fixed before being shipped.

[@docopoper]

Reading the act, operating systems are considered critical and thus need independent review by the CAB. Makes you wonder what they'll think of as an OS. Is it the kernel or the desktop environment. Also for some reason hard drives are an example of noncritical. They also say importers can't bring noncomplying software into the single market. Like, how would that even work with SaaSS? Is that importing? If not then this act is going to result in a lot of EU data being held outside of the EU. Honestly the more I read this thing the worse I think it is. I want to make free software. But I also don't want a fine measured in the millions. I'll probably ignore the risk. But I imagine a lot of people won't.

[@kaotiskhund]

They trying to make open source illegal, really

[@C1rnobyl]

Hopefully individual countries can refuse to comply. Go full Poland.

[@cmdr.shurimal8980]

"They also say importers can't bring noncomplying software into the single market." Are they going to ban Github/Codeberg et al in EU? What about developer personal websites that have the code and executables available? Are we going to need to "pirate" Linux from some sketchy warez sites in a few years? Will any device that uses some uncertified FOSS code snippet in its firmware become illegal? Will the prices of computing devices (that is 90% of electronics and home appliances today) in EU double or triple because of the need to certify every single FOSS code snippet and library it uses to function? The way I see it, this act is completely unenforceable and uncompliable, thus should be rejected at once and completely ignored if made into law. Unfortunately, the stupidity of lawmakers makes the former unlikely and the monopoly of violence held by the state makes the latter painful...

[@docopoper]

@@cmdr.shurimal8980 I just read some more. Importers also have to give their name, address and email. Importers have to ensure that the creator of the software is complying with the regulation. The importer has to ensure that the creator wrote up technical documentation about the software. Importers have to keep the certification document and technical documentation on the project for 10 years and be able to hand it over to a "market surveillance authority" in paper or digital form upon their request. If an importer believes the software is no longer in compliance they must "immediately take the corrective measures necessary to bring that product with digital elements or the processes put in place by its manufacturer into conformity with the essential requirements set out in Annex I, or to withdraw or recall the product, if appropriate." The whole thing feels like it's imagining a world where importers are big companies selling CDs.

[@erkinalp]

@@cmdr.shurimal8980 Codeberg is in Germany, it is already in the EU.

[@jazzdirt]

This is what you get if you have people, that know nothing about a subject, make legislation around that subject.... I think Open Source should be exempt because the code is open, you can check and change it yourself... So the responsibility lies with the user... As it should be.. This should only be a thing for non open source, where you cannot see what's in the package for yourself... I think it might be time for a petition before the vote the law in effect...

[@Beryesa.]

If foundations can't keep up and this ends up "pulling off" from Europe in "support & compliance" frame... Well, their plan, and a big portion of tech, is screwed.

[@Evanmarc1981]

Europe is imposing its sanctions on itself for the sake of security. As a US dev, I expect you’re going to see organizations blacklist the EU from using its code.

[@eng3d]

Us did the same with the DMCA. It killed the hackers and cyber security at the same time

[@utkarshyadav6119]

Exactly what i was thinking if they threaten the developer the developer can just switch the licence to something like forbidden to be used in eu and anyone using it agrees to pay 2x the (cost +fines) that eu might impose for rest of the world licence under (gpl,apache,mit etc etc)

[@autohmae]

you do know: you are saying stop selling software into, maybe the biggest or second biggest market for software ?

[@mcarpenter2917]

@@autohmae It's open source software, it's not being sold. so yes, I think a lot of developers will just exclude the EU. I think the EU will have to re-think this.

[@Evanmarc1981]

@@autohmae Yes I’m aware of that. And a lot of small projects and companies won’t stop right away. But when enough projects and companies are facing fines for failing to complete security verifications, people will start blacklisting the EU. In addition, companies will start using it as a tool the keep out their competitors. The result, the EU will lose out.

[@tonyd4151]

I wonder if even one tech person was in the room when they drafted this silly bill. It's impossible to report a security issue within hours, you're still mitigating the breach.

[@stupidburp]

It would be simpler to just report a presumed possible breach to them at least once an hour, using an automatic email. That way you can say it was reported even if the vast majority of the reports are false positives. They are begging to be spammed.

[@alemur4983]

I would recommend just not having the optimism you had at the end. The consequences can be massive from something like this, we should be as pessimistic as possible. If something *can* happen under the law and it’s bad, we should assume that it *will* happen. Some miser somewhere will find and pull that trigger when it suits them. Also, they’re rationale is “oh small companies can’t absorb the cost of vetting the other 95% of the codebase” - so instead you put the cost onto the open source developers whom may not even be paid for their open source contributions? To put it simply, that’s hypocritical and stupid. It’s on the same level of hypocrisy and stupidity as a US law, I expect better from the EU. They should instead instate an audit funding pool rule for downstream commercial entities. If you have 10 entities that add 5% on top of some open source project, those 10 entities are responsible for together funding a security audit for the remaining 95%, 9.5% each. Also reporting security vulnerabilities to people not involved in a fix is pretty stupid. That totally violates the principle of least privilege, and it provides a perfect place for bad actors to worm their way in to catch wind of security vulnerabilities for *all* open source projects that report to that organization which compromises security for *all* of them, rather than having to worm their way into each individual project (which I would imagine numbers in the thousands, minimum).

[@anon_y_mousse]

Oh sure, all US laws are stupid, and then the EU keeps on making these absolutely stupid laws and all you can do is say "I expect this of the US". Well, we don't have this here, and even though we're still not free here, at least not anymore, we still have more freedom than you guys.

[@seanfaherty]

yes but I think that if this passes as written it will shoot them in the foot. too many commercial projects are based on open source. Last year didn't some guy quit some java project because he wasn't getting financial support by literally thousands of companies using the project ? Then everybody got their knickers in a twist when their stuff was about to crash. I'm not sure how it worked out. I think I remember Brodie Robertson talking about that. To be fair though I didn't pay that much attention.

[@brendanmurphy8727]

Sounds to me like a classic case of regulatory capture. The big boys get the government to write regulations that the smaller players cannot afford to comply with in order to keep them out of the market.

[@necuz]

I think the key question is what happens if you certify that your software has no vulnerabilities and then it inevitably does, because the answer to that will determine everything. If there is a punishment, it encourages being dishonest about newly discovered vulnerabilities. If there is no punishment, then there is no reason to exercise rigor when doing the security audit.

[@chri-k]

a purely case-by-case basis would be the most reasonable answer

[@233kosta]

That's not *saving* billions, it's only shifting the burden for the spending.

[@langdons2848]

I'm definitely torn over this issue. The insecurity of software and systems is a *huge* problem socially and economically. And it's only getting worse as every aspect of our lives go online. Most people have no idea about security, so it need to be provided for them for - especially when they are required to use online services by government and businesses. At the same time implementing these sorts of rules will drive small developers out of business. I am planning two commercial projects that involve software and complying with this would be impossible for me. So that means software, and hardware that runs software can only be developed by large organisations. That's some serious dystopia right there.

[@Redhotsmasher]

I guess we better hope Google are still scared enough of being labeled anticompetitive that they're willing to bankroll an audit to certify Firefox, otherwise RIP free and open Internet. OTOH, forcing publication of exploits in "Operating Systems" (embedded OSes are OSes too) and "boot managers" (bootloaders?) way before any device vendor could realistically deploy a patch could start a whole new era of device jailbreaking, so I guess there's that. :/ Has the EP voted on this yet?

[@OcteractSG]

11:46 Yes, it can mean that. If the developers are employed (employed anywhere by anyone to do anything, even if all different from each other and unrelated) and the developers make decisions on the project, it becomes commercial. Completely insane!

[@derekboyt3383]

These processes are designed to increase barriers of entry. Large organization with lots of money are already engaged in processes to mitigate 0day vulnerabilities. What this does is place legal liabilities on people for innovating. I see some companies pulling in tremendous profits by eliminating competition.

[@MePeterNicholls]

They do not realise how much of the world is based on open source too. And there’s absolutely no way to know ALL the insecurities in software or hardware until they’re discovered.

[@condellmaurice8597]

1 How does certification guarantee the software is secure? 2 If a problem is found in certified software does that not leave them open to lawsuits? 3 What about the principle that states you cannot create bug free software, especially in large projects? 4 How does this change the design and layouts of chips and their performance? 5 One more point many of the definitions we use in computing are not fixed. The law will have a huge problem with that. Example what is the difference between information and data? 6 If all the software and hardware fall under one security umbrella that is unanimous we then fall into the Apple inc. problem. 7 The largest producers of security vulnerabilities and hackers is the governments and if the bill cant fix that it is useless.

[@kaotiskhund]

don't even trip bro. they are just doing the worse they can

[@condellmaurice8597]

@@kaotiskhund Funny till they cant get software to do their work.

[@kaotiskhund]

@@condellmaurice8597 i feel like the ultimate goal is to throw people out with AI and take back the means of technology by making it impossible to do what you want. Giants that previously tried to enforce how we should use their products could be proud for EU's progress. And don't forget the stolen code for profit and the ditching to developers after that. It's a giant middle finger from their part.

[@condellmaurice8597]

@@kaotiskhund Yes I can see how we can think that. This is going to hurt them even more than us. The time to fix and certify software will be immense. That is alot of money. Many software productions which are time dependent or even did not have to think about this will be badly hurt, example video games. The EU can build their own division to review software but even then time becomes an issue. It will never work not even for the co operations, too much money.

[@hanelyp1]

Old timers in linux remember as a regular feature in man pages and other software documentation a list of known bugs, the better to enable the end user to work around these bugs. This would include configuration settings to avoid vulnerabilities.

[@AlainPaulikevitch]

Thank you very much for explaining this. My current understanding of this (which comes only from your presentation) leads me to believe this will not have any effect on the software publishers. I guess almost nobody will bother with this certification and publishers will simply add to their license that this software is not suitable for use in Europe. Individuals will most likely still be able to use any open source software they want (through vpn if it comes to that). It is the enterprises, government institutions, and, more importantly academic institutions that will loose access to any concerned open source software they were using and end up having to pay huge amounts of money for the commercial alternatives. So this is an economic catastrophy for an enconomy that is struggling to retain some competitivity and it feels very much like intentional internal sabotage but it is of no concern to the software world.

[@whukriede]

Yes, I think this analysis is on spot.

[@KangoV]

Apache should amend the License and add "This software is illegal to use within the EU". Nginx should also add the same thing. Them sit back and watch the fallout!

[@xGinOkamix]

For a law that can affect so many people and so much of the internet it doesn't feel like they really researched its impact or even considered hearing from the industry at all on this matter.

[@Henry-br1ti]

The sad thing is open source, thanks to its nature has developed awesome software, the most downloaded and used in the world, like Blender, Krita, Git, LibreOffice, etc, and the OS running critical servers for the Internet.

[@Spencer-wc6ew]

Don't forget web browsers. Firefox is open source. Chrome, Safari, and Edge both rely on open source engines. Netscape and Opera moved to open source engines after being created (with Netscape 5.0 and on also being open source.) The only browser that didn't rely on an open source engine is Internet Explorer.

[@benhetland576]

Might we also assume that some of this software is running critical servers for the EU beaurucrats themselves?

[@TheShorterboy]

All I hear is "so lets raise the barrier of entry because we worked for decades to stop effective end to end security in every product so we can spy on people, so now lets make a bill so convoluted and arbitrary only some corporation will be able to comply". Oh and "reporting to us within hours lets us exploit those bugs before they are fixed so we can get our stuff installed".

[@NecrosTheDark]

That would be awesome. If you want to tarpit an open source project as a company just donate 1€ monthly and they have to comply to the CRA ^^

[@_framedlife]

not if they don't operate in the EU. they can't for example gave someone who operates from Canada to comply

[@mrcvry]

In the future all open-source projects will be by anonymous.

[@MNbenMN]

The sound of European developers keyboards as they are typing their new usernames to make anonymous alias github accounts en masse must be deafening!

[@PieterHarvey]

or all open source projects / foundations will move out the EU and their use inside the EU by the user will be purely at the peril of the user. Basically if the foundation exists outside the EU how is this even enforceable.

[@jakubrogacz6829]

Right, where are those guys, they actually killed some dumb laws in past.

[@tcurdt]

The EU is where good ideas go to die because of bad implementations. The level of incompetence is so very frustrating.

[@Daijyobanai]

It not just them, it's government in general. The UK has had similar idiotic govt. attempts at "controlling" the populace. As have other countries, hell I can't get to the SeaRoversInlet site without a VPN or using a different DNS to my ISP, because they banned a site that does exactly what google also do. BS.

[@seanfaherty]

yup, proportional representation looks good on paper but it don't take long to realize what you want is a ranked ballot

[@earx23]

I've really hated the EU because of their incomprehensible VAT laws.. Then I got used to them, and I also accept environmental laws because they're generally good for everyone. This cybersecurity stuff seems like Damocles' sword at the moment. I really don't know what's going to happen, and I'm sure many other small businesses feel exactly the same.

[@tcurdt]

​@@earx23 They sure want to do good. But even good intentions do not mix well with incompetence.

[@fantasypvp]

Brexit is beginning to make a bit more sense now XD

[@thecrow3461]

They will be the winners in the End. The EU is killing itself at an insane rate.

[@seanfaherty]

is it ? You like the Rwanda plan ? How about British Rail not being allowed to be owned by the British people but publicly owned European companies currently own British Rail companies ? The state of your public water systems ? After years of taking fees these companies did not upgrade infrastructure and the British public are now on the hook . And you are still paying the same companies who stole the money in the first place ( if the contract said they would be responsible for infrastructure and now the money is gone to shareholder dividends it is theft. I don't care what the law says. The laws were written by the people getting lobbied by the thieves) . The NHS falling apart before your eyes ? You like that too ? If this shit makes sense to you you must be in Rishi's cabinet because everybody else in the country can tell Brexit is the stupidest thing the British people have done since they destroyed their economy on Black Wednesday. What is best for Britain is what is best for the majority of British citizens, not the top 1%.

[@noktelfa]

When my current school project comes due, I have to provide the source via Github. And I work for a corporate entity. Does this mean that if I keep my (project) web page online after the course ends, I have to ensure that it can't be accessed in Europe?

[@utahnl]

This is just plainly ridiculous, i'd say politicians should also be held to this same level of standard.

[@earx23]

There are actually laws for that. Laws like openness, that stuff shouldn't be decided in back rooms without recording devices. But they circumvent that shit with old nokia phones from which they delete the text messages.

[@JoeJoeTater]

Why don't they just put the liability on companies selling a software or service? That way, the actual companies put money and dev time into certifying upstream code.

[@JuhanaSiren]

One thing here is that having all software automatically notify users of updates would tangle badly with the GDPR. Not to mention the fact that you can't just go updating things randomly. It can break stuff even worse and create more vulnerabilities through various integrations. Updates have to be tested, and users may want to allocate specific time slots for updates to avoid outages. They could have simply asked any sysadmin in Brussels...

[@forbiddenera]

I miss the days when governments didn't take the internet seriously

[@stupidburp]

Add a line to all of the standard open source licenses: “Due to legal changes that are not feasible to comply with completely this product is banned in the EU and no users within the legal jurisdiction of the EU are authorized to use it”. Just blacklist the entire EU from all open source software. Watch them panic as the web servers shut down. Finger pointing and then the bad law is quickly repealed.

[@virkony]

I would like to see it in form that any commercial product that uses open-source project is responsible to help getting CRA certification for that project.

[@Psychx_]

What will EU do if open-source projects are suddenly registered as legal entities from outside of the EU, or anonymously hosted on Tor, with the addition of maintainers being paid in Monero (whose transactions cannot be traced from person to person, even if it was aqquired at an exchange in the first place)? What if open-source projects chose a dual-licensing model, that forbids commercial use unless these users pay regular fees into a funds dedicated to certification? What I want to say with this, is that there are still options to circumvent this BS. However, I don't think that CRA would pass legal review, and even if it did, it's open wide to being challenged at court due to conflicting a plethora of preexisting laws. Funnily enough, it's an EU law that new legislation must not conflict existing legislation - the whole thing would be overruled/suspended, until EU politicians came up with a compatible version - this is also happened with the EU directive on telecommunications data retention, which is now thankfully in a state of eternal limbo due to essentially being unimplementable.

[@niccoloveslinux]

as a quick note, none of the options you mentioned at the beginning of comment are feasible / make sense :p

[@jakubrogacz6829]

@@niccoloveslinux Dude, you just pull down old versions, do sneaky patch of new versions to comply but not work at tall and funnily enough it's goverments of countries in EU who use open source a lot ;) Imagine if their printers stopped working, half the computers shut down and sites became inoperable. You just have to put a tiny bug in SSL to kill their comunications. Hell if you are especially vengefull you can just check if the traffic comes from EU and make patch only there

[@guss77]

Regarding the GDPR reference - this is much much much more onerous than the GDPR: the GDPR is (mostly) about things you shouldn't do - don't store such and such information; let users know when you're about to store that information. It was also about operators that interact with users. The CRA is not really about users - it says "users" a few times, but in its extensive (40 items) list of definitions, there's no definition of "user". The CRA is all about "manufacturer" where its basically - if you create software or make something that has something to do with software - you are a manufacturer, and then there's tons of red-tape you have to do, from documentation to having "systematic" processes in place to notifying government agencies to being available for questions by government agencies. You aren't even allowed to stop being a manufacturer without notifying an agency using an arduous process. Under GDPR you can always just delete the database and close the servers, and you are off the hook.

[@niccoloveslinux]

I'm not sure I fully agree here; especially since I think GDPR wasn't much of a 'don't do this' but rather a set of things you have to do to comply with it, e.g. offering the users the ability to download and delete all of their data on any website. That's an extra work that developers had to put

[@guss77]

@@niccoloveslinux I am currently operating a commercial service that is GDPR compliant, and theres no requirements to allow users to download their data. The requirement to allow users to be "forgotten" is not much more than requiring a user to be able to send you a request, which can be as simple as "here's my email address".

[@muellerhans]

@@guss77 Article 15 of the GDPR rules access of personal user data. If you don't have such data due to the way your service works, you still need to inform the user that you don't have such data.

[@guss77]

@@muellerhans notification is important. It usually amounts to having a "privacy policy" linked on your website - definitely not a requirement to communicate with a government body. Even the most basic documentation requirements of the CRA are much more arduous than GDPR article 15. That being said, I'm troubled by article 15 p3 and I'm going to need to have a talk with our CISO.

[@jigsound]

Thanks for sharing this important news! What a shame. Looks like we're not taking the risk of putting our custom proprietary software out there in public after all, at least not before this mess of a directive is unambiguously sorted out. 🤔

[@AndrewS-fe8ng]

At 12:00, when you are talking about the commercial companies--what everyone seems to have missed is the evil companies do. Say I have an interest in stopping Apache. Well, I hire one of the main fork devs, and I now have control over the code base by telling that dev what to do. It allows commercial entities to insert themselves into the open-source world in a way we can never allow--by buying their way into controlling and ultimately destroying any open source project they wish. Without limit. Brilliant.

[@FraggleH]

The endgame here is to make necessary parts of the tech stack beholden to government for its existence and thus compliant to requests for backdoors/user data/etc. The government power of licensure is, and always will be, a net detriment to the public.

[@Lupinicus1664]

This is an excellent, important and well explained video. So if the open source software foundations simply published explanations for potential users within the EU that use of their software may be 'illegal' for commercial purposes within the EU what would the users of the 95% OSS do (especially if the foundations were outside the EU)? Would they suddenly need to find paid for versions of Apache etc.? The EU creating laws for companies operating within the EU is fine but with something as universal as software, in todays highly interconnected world, it's harder to see how such laws could be enforceable. All OSS foundations need to apply for charitable status to avoid appearing as commercial (or perhaps a religion...if Scientology can do it...). Also the initial drafting of laws is usually appalling anyway and takes years or decades to knock into shape through spending huge amounts to test things in court. We can hope that common sense causes changes to the initial act but I don't suppose any of us are holding our breath.

[@ewinbarnett9411]

Where a liberty oriented community collides with a bureaucratic socialist oriented community.

[@mcarpenter2917]

You do realise that open source is basicly a socialist idea?

[@nielsvanaert4746]

I think that a part of the issue (related to a lot of open source networking packages) could be resolved if companies like ASUS, MSI MikroTik, Netgear, Synology, Ubiquiti (these are just some of the examples, which I came to think of) etc. would step up and support these projects (if they don't already do so). A lot of these companies make SOHO routers and sell them to end users. Most of the software being used on these devices is open source, but some of these companies do not contribute a lot (if at all) to the software itself.

[@gokhanersumer2273]

This will end badly, for EU. What will they do when OSS foundations start banning their software be used in EU ? Writing everything which runs internet from scratch ?

[@kaotiskhund]

I am waiting to see the annihilation that will come from hackers that are opposing EU. It will be fun. But we will need as a collective to maintain our infrastructure despite EU leaders' stupidity.

[@flarebear5346]

Yeah we are fucked, guess I should start learning agriculture

[@kaotiskhund]

@@flarebear5346 Make sure though when you sell your plants that your moisture controllers/sensors run certified software or invest 25% at this 🤣🤣🤣🤣

[@fgsaramago]

how would they ban it?

[@gokhanersumer2273]

​@@fgsaramago Of course it would take a real lawyer to write this but something like "You have no permission to use this software where any contributors may held liable to any damages by any legislation".

[@nosotrosloslobosestamosreg4115]

War is Peace, Slavery is Freedom, Ignorance is Wisdom, Poverty is Wealth, Hunger is Satisfying, Bugs are delicious, And so on....

[@blinking_dodo]

Europe should just certify it itself. Or if this gets trough, i would want to "patch" and "disassemble" whoever put this in it.

[@nadtz]

This is one of those ideas that seems good until you realize the people writing how to implement it have no idea how "stuff works". Having spent more time than I care to think about explaining to decision makers with no tech expertise the how and why of things it only makes me wonder how much worse that must be when dealing with bureaucrats and politicians. I really hope they realize how damaging this would be and rewrite it.

[@syriuszb8611]

Will games go under this act? If yes, it will destroy 90% of indie game dev studios... Edit: unless it will be possible to say: "steam is certified, our game is not online except for interaction with steam, and as such, we consider the game safe" and that would comply?

[@benhetland576]

7:44 Note that this "provided as is" statement is ubiquious with most if not all commercial software as well.

[@Avigorus]

I'm pretty sure that employment line was saying if the employer has control over the project, not just control over the employee, so no a pizza job wouldn't have any impact whatsoever and a game dev working on a linux distribution where the gaming company they work for is not legally able to tell their employee "hey we need you to change xyz in that linux distro for us". Granted, there maybe some semantic gibberish someone might be able to pull in a court of law but that would be scum of the worst order and result in mass rebellion at the sheer stupidity... kinda like say D&D 3.5's drowning rules not including a means of stopping the process and also resetting negative HP to 0, neither of which no sane DM should allow.

[@blinking_dodo]

All software source files and EULA's will contain the following line: "This software may NOT be used in the European Union" Solves the problem for the developer, and would be a death stab to the EU if implemented in large software projects. (Imagine the Linux kernel no longer being allowed inside Europe... 🙃 *Poof* to all datacenters, routers, entire internet and all android phones.)

[@VitholumTech]

You do realize, that EULA/License's and etc are only relevant if it is enforced by the governing body right? You can say anything that you want, if the country doesn't feel like enforcing it, nothing will happen. I mean just look at china .-. In other words, that will never happen the most likely outcome is that linux will be forked to be compliant with the CRA, whether the forked linux version will be better or worse, that I don't know. EDIT: Changed "feel like respecting it" for "feel like enforcing it".

[@jakubrogacz6829]

@@VitholumTech Just remove old repositories and have only available version that don't work ( while in USA you actually show whole history ). Eu based open sourcers won't risk going against law just to deliver software, especially unlicensed one. And EU doesn't keep it's mirrors of originals so as soon as they update there is no going back. And then they can figure out perfectly secure EU approved version, in say 20-50 years maybe, to get to level of MSDOS

[@fgsaramago]

except EULAs have never had any legal validity here in Portugal so that will change nothing...

[@OctagonalSquare]

The scary thing is that, with the nature of the internet, this will affect anyone who makes software anywhere. I have a music looping software I’m developing and have available through my Patreon, but since people in the EU could get it, does that mean I have to do all this bull crap too?

[@trippvanmunch]

I'm going to add a clause to my license that says if you live, work, or reside in the EU you are unauthorized to use my software.

[@OctagonalSquare]

@@trippvanmunch yeah I’m going to need to actually write out a license. As well as find a better way to distribute it

[@vanessag.1419]

I worried about whether the CRA would affect the open-source foundations. This act doesn't target independent developers as they may not function as economic operators, but what about charities, they usually receive donations for their open-source projects and most of their projects may have one primary commercial entity behind them...

[@EdgarJordan-hl1sy]

EU does something stupid. I'm shocked.

[@nostromza3433]

First Lesbian Nana, now ban Open Source

[@Psychx_]

The CRA cannot be enforced either way, nor can its goals be achieved with reasonable amounts of human and monetary resources.

[@Daijyobanai]

Film trailer voice:" In a world run by MBAs, where a certificate means more than a brain, no-one can stop the infinite stupidity of bureaucrats... " That's it, there is no second act.

[@patrickprucha5522]

Sorry i don't know where to directly leave some information on kde. I noticed that the splash screen section of the system setting has the button (get new splash .....) on the top and all other items have the button on the bottom. Where could i go to submit these type of things? cheers

[@Gnomleif]

I'll admit a small, dark part of me wants this to go through, and then have it blow up in their faces in spectacular fashion. Will they actually learn if that happens? Probably not. But I'd still bring the popcorn.

[@peterbeer8657]

A product is the item offered for sale. A product can be a service or an item. It can be physical or in virtual or cyber form. Every product is made at a cost and each is sold at a price. The price that can be charged depends on the market, the quality, the marketing and the segment that is targeted. Open Source software that is not being sold is not a product even if there are donations. "Security requirements relating to the properties of *products* with digital elements" does not apply.

[@davidaustin5622]

Inform the voters, and then let the People vote on it. Otherwise I will rescind my protection of politicians in the EU parliament. They are outnumbered. We don't need them.

[@MrDoboz]

can't wait to publish a CRA certified Hello World software. that just says Hello World lol

[@scsirob]

Two options: 1. Don't comply and expose yourself to the wrath of these bureaucrats with infinite money 2. Comply vigorously and flood the system with each and every trivial 'breach' you can possibly imagine. Do the latter across all open source projects and you basically DDOS their process.

[@gethriel]

Tyrants will be tyrants. Make no mistake: government interference IS the WORST CYBER SECURITY THREAT.

[@m12652]

As with everything… along come the clowns to bleed it dry and mess everything up. Yay for politicians, may the all hold their collective breath for 30 minutes 😊

[@supersimon4922]

Shifting responsibility, eh? A tale as old as time

[@mirzu42]

If this actually goes through VPN companies are gonna have a blast. Theres no way most companies commercial or not would comply and just decided to not operate in the EU at all.

[@ghosthunter0950]

Great video man. really explains everything that is going on with it. I think the way to solve the issue with smaller companies that use open source software is to have all of them contribute together to improving the security of upstream open source software, I mean there is no way around it, if they ship a product they're at least partially responsible for the security of it. although the cyber Resilience act would be difficult to comply with still. but I do believe this going off this train of thought is a lot more workable while still achieving better security.

[@BiscuitBobby]

That will not work out, they would have to audit it before they use it, which means there is going to be little to no chance that any new open source software can get off the ground

[@Jacob6853]

The day I can no longer use Linux to compute or web browse if the day I stop using PC's. Between this crap and the Google Web DRM crap its not looking good. They want only MicroSucks and Apple Cult to survive. I refuse both!

[@ShiroAisu10]

I'm not worried about this bill at all. It's pretty clear to anyone who knows the first thing about software development in general that this is simply not viable for a number of reasons. It will be dropped or changed, and if for some freak accident reason it actually goes through the way it is currently, I give it a month or two before they simply have to backpedal on it because of how it completely destroys the software and library ecosystems.

[@MrSquishles]

or let it sit unenforced until they feel like using it as a selective weopon.

[@whukriede]

They would probably (1) not to able to perceive the problem and (2) they would not care.

[@vitalydushkin]

Open source won't die. Although with this act in place it would be much easier NOT to run a business out of EU. Ones they count how much money they loose in taxes, I bet the act will be reverted in a day.

[@parsarnblad1107]

Well, this is quite easy. We'll have to remove all opensource from a lot of production environments and replace them with closed variants. That will bring the internet down along with everything. I think the intention is good but the way to do it is not. There is a good system in use of reporting bugs and security issues in place already. It is also in everyones interest to keep things secure unless the source is hidden and flaws can be kept in a hidden repo somewhere. The recent Tetra hacks is a good example of how closed solutions is less secure than open. Again, prepare versions of open licences that prohibits production use and apply them if EU chooses to implement the rules. Nothing will work after that.

[@AndrewEddie]

Yes. I was thinking "just don't certify". Sorry EU, but you can't use Linux for anything anymore ...

[@RavenWoodsDE]

They're getting more anti-social every time they touch anything..

[@Cyberstormxiii]

Maybe suggest the following change to the CRA : every company that uses a an open source project must share the cost and responsibility of the certification of the 95% of the software stack, that way making the open source developers free from that certification cost. This of course would require some formal way of knowing which companies uses which open source software, and a certification body, that can do the certification or make sure that the companies involved, indeed has certified the software, and how to split the certification cost, and possibly making a CVS system that can control/show which parts of the software has been certified (This should be able to be done rigorously, so that you don’t have to recertify everything at every revision - but rather if all parts of a project is certified, it should be a routine call to the certify it all).

[@Elliandr]

Couldn't a company just decide to stop marketing to EU countries? If people in the EU want the product they could just import it themselves and/or use a VPN. I really don't like it when EU laws impair my own use of technology. They are the reason why literally every website has a cookie popup that defaults to consent for tracking so you can't even block them. They never think things through.

[@JuhanaSiren]

The whole proposal is ridiculous. They're barking up the wrong tree here. You can certify software till kingdom come, but make one mistake in configuration and your systems are wide open. And what if you simply won't accept updates? What if your production depends on an obsolete version of _______ (insert any software) that is full of vulnerabilities? (A nightmare, sure, but an unfortunate reality for many.) My proposal: take the proposed budget, split it, put some in security research and development with the goal of publishing practical advice and instructions for developers, and some in sponsoring bug bounties or actual security fixes (i.e. development projects).

[@richpaul4083]

It's time to form the Unorganized Militia Signal Corps.

[@poisonshroom64]

I think the decentralized nature of open source ultimately makes these acts not apply to oss. What exactly is stopping these projects from just going "no, lol"?

[@seanfaherty]

If I can finger print servers I'm pretty sure the smart kids at the EU can too.

[@trueleowdeo]

there are alot of projects that have in their terms of use "Don't use in North Korea". The terms can be updated to add "and EU"

[@june012006]

That should be the disclaimer on all OSS software "don't use in North Korea, or EU", never excluding either, so there will always be the association between the two.

[@hhf39p]

People who make laws so seldom reflict on who the powers stipulated can be turned around to do the opposite of what is desired. Automatic updates are themselves a security problem. It looks like what they are doing here is trying to do here is to make sure that all software has interfaces that allows the good guys to take control or watch what is being done with it. I.e. to integrate all software into existing good guy systems that have convenient UIs.

[@233kosta]

Did no one tell these idiots that YOU CANNOT LEGISLATE SECURITY?!

[@kapytanhook]

Hard enough being a small developer, not going to comply. I also deliver my products as is. I try make it it secure but I don't want to answer to some third party. If customers demanded more security and paid for it, it would happen due to market pressure

[@asdfghyter]

the fact that the law is in direct conflict with the GPL is insane. it’s impossible to comply with both. i do think that we need more vetting of open source projects, but this is clearly not the way to do it. the responsibility should if anything fall on the commercial users, preferably in a way that encourages them to pay the open source developers for doing the vetting. that might discourage companies from using small OSS projects, but i’m not even sure that that is entirely a bad thing

[@richpaul4083]

What we need is a dark web, open source, github, and a bunch of open source dark web AI. And the hard part ... they gotta be distributed.

[@agsilverradio2225]

So, open source software makers have no power to regulate what goes into their code, (because if they did it wouldn't be "open,") yet they are personally responsible for any malware that slips in?!

[@The3rdAyin]

Basically, TLDR... the EU is making sure that all companies move their data centers and offices outside the EU. Thankfully, this will speed up the process of the EU as a dying entity. By the end, the entire Euro zone will be a deindustrialized wasteland with no tech companies or farming. The EU just keeps shooting themselves in the legs over and over again, I love it... keep it up.

[@thecrow3461]

I live in Europe and you are absolutely right. I despise the EU because of stupid things like this.

[@The3rdAyin]

@@thecrow3461 For every 1 good thing the EU does it follows up immeadtly with 3 other bad things... Its amaizng how the EU survived this long. But it's not the EU itself you should despise, but the clowns running it and their American overlods who are purposely destroying the European Union as a whole. Borell, Scholtz, Macron, Von der lyen, Biden, Victoria Nuland.. And other neo con libtard circus monkeys.

[@LTUGang]

as a Lithuanian I totally agree. EU is becoming very toxic.

[@jakubrogacz6829]

@@LTUGang Germans and French, Poland and all other states like us should have gone away during Brexit, which would have helped England avoid the massive problems it had and left Basically Germany and France supplying their holiday spots in Greece and Italy alone. I wonder how fast their economy would crash and burn

[@LTUGang]

@@jakubrogacz6829 exactly. EU is a union which works only for German and French interests.

[@manuelpires5368]

Just add a clause to the SW license that forbides the usage of Open Source in the EU. Problem solved.