Will the cyber resilience act kill open source ?
Will the cyber resilience act kill open source ?
Since the EU is bringing an act , that needs the products distributed to be flawless , and it applies to open source products too , if a single of their contributor / donor works for a corporate , what will be the future of FOSS in europe with this ?
You're viewing a single thread.
For all the people not reading the actual law, this is the actual language of the proposal:
In order not to hamper innovation or research, free and open-source software developed or supplied outside the course of a commercial activity should not be covered by this Regulation. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. In the context of software, a commercial activity might be characterized not only by charging a price for a product, but also by charging a price for technical support services, by providing a software platform through which the manufacturer monetises other services, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software.
IMO the problem OP mentions does not really exist. You can work for a corp while working on the product, your FOSS project can take donations even from corps, the only thing you can't do is monetize your FOSS product without caring for security.
Nick from The Linux Experiment youtube channel made a video recently talking about that, for him and for me it's clear that this quote:
software developed or supplied outside the course of a commercial activity should not be covered by this Regulation
means that any open source that gets any work from paid personnel from a company interested in the project in any commercial activity is covered by the regulation.
Here is the timestamp of his argument, I'm not from EU so I have no idea how this kind of idea could be implemented, but the text seems clear to me and seems bad.
If that is the case projects would be obligated to reject contributions from any companies.
Here is an alternative Piped link(s): https://piped.video/QK0rmOuzSVM?t=87
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source, check me out at GitHub.
The law also keeps it vague enough , that it says employed individual , so they could be waiting tables and this will still apply !!
Please add a link to the source in your comment
This is the actual proposal, it's available in all EU official languages on the EU's website. https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52022PC0454