Not a big fan of the title (asking question in the title isn’t a great idea) but the conclusions give a good summary:
The Cyber Resilience Act (CRA) represents a significant step in Europe’s efforts to enhance cybersecurity. However, its potential implications for the open source software community have raised serious concerns. Critics argue that the legislation, in its current form, could impose undue burdens on open source contributors and inadvertently increase the risk of software vulnerabilities being exploited.
New insights from GitHub’s blog post highlight additional concerns. The CRA could potentially introduce a burdensome compliance regime and penalties for open source projects that accept donations, thereby undermining the sustainability of these projects. It could also regulate open source projects unless they have “a fully decentralised development model,” potentially discouraging companies from allowing their employees to contribute to open source projects. Furthermore, the CRA could disrupt coordinated vulnerability disclosure by requiring any software developer to report to ENISA all actively exploited vulnerabilities within a timeline measured in hours after discovering them.
Why is everyone up in arms about this?
The legislation specifically excludes open source software. Has nobody in this discussion actually read the proposed legislation?
From the current proposal legislation text:
There is also a clause that states those using open source software in commercial products must report any vulnerabilities found to the maintainer.
The “developed or supplied outside the course of a commercial activity” condition is part of why people are up in arms about this. If I’m at work and I run into a bug and submit a patch, my patch was developed in the course of a commercial activity, and thus the project as a whole was partially developed in the course of a commercial activity.
How many major open-source projects have zero contributions from companies?
It also acts as a huge disincentive for companies to open their code at all. If I package up a useful library I wrote at work, and I release it, and some other person downloads it and exposes a vulnerability that is only exploitable if you use the library in a way that I wasn’t originally using it, boom, my company is penalized. My company’s lawyers would be insane to let me release any code given that risk.
Ah, OK. So it seems it’s a case of the spirit of the text not matching the precise technical wording used. IMO, the legislation clearly intends to exclude freely-distributable open-source software, but the issue lies with what constitutes a commercial activity. (I’ve not yet checked the rest of the document to see if it clearly defines “commercial activity” in relation to the legislation.)
TBH, it seems that what is needed here is a clarification and tightening up of definitions, not wholesale rejection of the legislation.
99% of open source software development is part of a commercial activity.
As I understand it - the act essentially makes contributors to open source software legally responsible for any security flaws. If it passes into law, I’ll stop contributing to open source. I’m not going to risk having to defend myself in court — it’s just not worth it.
No it doesn’t. It makes IBM responsible for what it ships in Red Hat, it doesn’t apply to someone that made some library in their weekend that somehow ended up on all Linux distributions.
Hows does the limitation of liability section in basically every open source license factor into this? It seems like you’d be fine as long as you aren’t personally using the code commercially? Or would this new law somehow override the open source license?
The latter. The law always takes precedence over contract terms.
Wow this thing is a huge mess of text @.@ That’s in there, though. (10) under the “whereas” at the top of the proposal bit. Not mentioned in the “scope” part, where I’d expected. Maybe others expected it there too, and not mixed in with seventy other things up top? I’m just guessing here; presumably someone familiar with these sorts of documents would know to look there or would just bust out the Ctrl+F magicks and find this :-\
Open source software is also notably lacking from the impact assessment documents, but I suspect this is because it was intended to not impact open source software at all. It seems the legislation intends to exclude open-source software, but doesn’t clearly and unambiguously exclude open source software that is developed or contributed to in a commercial setting (e.g by paid contributors).
I think the wording seems clear enough to determine the intent, but the ambiguity surrounding the “commercial activity” part might necessitate trial (which nobody wants to risk), or might lead to poor implementation of this directive in the laws of member states. I think we should be campaigning to improve the wording, not reject it outright.