Hacker News Reader

Comment by pella | Hacker News Reader

from the proposal:

"(13) In order not to hamper innovation or research, this Directive should not apply to free and open-source software developed or supplied outside the course of a commercial activity. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. However where software is supplied in exchange for a price or personal data is used other than exclusively for improving the security, compatibility or interoperability of the software, and is therefore supplied in the course of a commercial activity, the Directive should apply."

View on HN

Basically they will prevent open/free software producers from commercionalizing it. Like open/free software grows on trees, let's just collect it!

Asking as somebody who does not really get this law jargon - if you distribute your software, which might be a little bit of glue code putting together some freely available open-source libraries, then would you be liable for auditing only this glue code or libraries as well? (since you would have to distribute them with your glue code, otherwise your product would be incomplete)

This is a case-by-case thing to analyse.

However, as I understand it: If it applies (e.g. commercial context) and you distribute the software or offer a product based on the software, you need to show the audit of all, not just a part (e.g. the glue code).

That's precisely what's so deeply troubling. Thanks for sharing.

That kinda sounds like it would apply to something like Linux kernel, as the developers are certainly working for-profit on it

Okay, now RTFM to understand why that paragraph of the proposal is a joke.

What "M" are we supposed to read to understand?

And, maybe since you do understand, you could explain, rather than making 10,000 of us go do the research on our own?

Thank you for providing the whole quote. If indeed all software that is not directly supplied in exchange for a price is excluded, that would be a huge relief for the community.

The fear is that they will proceed with extended definition of "commercial activity" though, out of fear of loopholes.

In what sense is that "the whole quote?"

Here is an excerpt from the article that puts into context why this is concerning. But honestly, just read the article.

> Now, what is a commercial activity? The CRA does not define this term. However, conversations with people more knowledgeable on product legislation pointed me to the EU Blue guide to the implementation of EU product rules:

> Commercial activity is understood as providing goods in a business related context. Non-profit organisations may be considered as carrying out commercial activities if they operate in such a context. This can only be appreciated on a case by case basis taking into account the regularity of the supplies, the characteristics of the product, the intentions of the supplier, etc. In principle, occasional supplies by charities or hobbyists should not be considered as taking place in a business related context.

I mean this part

> This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. However where software is supplied in exchange for a price...

This says that publicly available open-source software that is not supplied in exchange of a price (as in, say, customised versions of software that are not available to general public) is exempt. It doesn't cite any other commercial activity (technical support, donations etc.) from EU Blue guide.

I seem to recall that the heartbeat bug was in a library where the author received (very little) monetary compensation for their work.

Who’s responsible for compliance in that case, the dev or the thousands of companies who used the library in a critical role?

I know this is supposed to fix such a situation but they aren’t going to be taking hundreds of thousands of website operators to court who used the freely provided library without auditing the code.

Reply on news.ycombinator.com