Cyber Resilience Act - Wikipedia
en.m.wikipedia.org

Since the EU is bringing an act , that needs the products distributed to be flawless , and it applies to open source products too , if a single of their contributor / donor works for a corporate , what will be the future of FOSS in europe with this ?

  • maynarkh@feddit.nl
    492·
    1 year ago

    For all the people not reading the actual law, this is the actual language of the proposal:

    In order not to hamper innovation or research, free and open-source software developed or supplied outside the course of a commercial activity should not be covered by this Regulation. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. In the context of software, a commercial activity might be characterized not only by charging a price for a product, but also by charging a price for technical support services, by providing a software platform through which the manufacturer monetises other services, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software.

    IMO the problem OP mentions does not really exist. You can work for a corp while working on the product, your FOSS project can take donations even from corps, the only thing you can’t do is monetize your FOSS product without caring for security.

    • angrymouse@lemmy.worldPortuguês
      112·
      1 year ago

      Nick from The Linux Experiment youtube channel made a video recently talking about that, for him and for me it’s clear that this quote:

      software developed or supplied outside the course of a commercial activity should not be covered by this Regulation

      means that any open source that gets any work from paid personnel from a company interested in the project in any commercial activity is covered by the regulation.

      Here is the timestamp of his argument, I’m not from EU so I have no idea how this kind of idea could be implemented, but the text seems clear to me and seems bad.

      If that is the case projects would be obligated to reject contributions from any companies.