Hacker News Reader

Comment by snowpid | Hacker News Reader

I think, the CRA might create an incentive for companies not free loading Open Source Software but instead putting money in the open source eco system (though mainly on Security) and that is somehow great!

View on HN

I very much doubt it, and it’s probably going to do the opposite.

CRA just brings the kind paperwork that physical products have always had to be licensed in the EU (CE marking) to software. Have you seen european companies investing in Open source hardware?

The path of least resistance will be to use homegrown alternatives and sell them to potential investors and shareholders as valuable intellectual property that puts them ahead of competitors.

Not only because that makes perfect business sense, but because this kind of IP is very hard to value fairly, so it will allow for a variety of accounting and tax avoidance shenanigans.

For a useful comparison you need to show if open source hardware is more common / more invested in other parts of the world. E. G. Risc V has a growing momentum https://riscv.org/blog/2023/07/the-growing-momentum-of-risc-...

Really? Specific security requirements for iot devices “have always” been in existence? I’d really like to know the source for that. I sound snarky because I work in security and am unfamiliar with what you describe. I could also not be very good at my job.

I think they were speaking more generally: the requirements in the legislation are similar in structure to the kind of safety/serviceability requirements that already exist for hardware being sold in the EU (much of which is just self-certifying you have implemented the relevant standards). Having security requirements and applying them to pure software products is what's new.

No, but devices have strict regulations and paperwork intended to keep people safe.

Keeping people safe when it comes to software means first and foremost having good security.

> Have you seen european companies investing in Open source hardware?

Arduino and RepRap are poster children of open source hardware, and originated in the EU, I think.

They are, but both were born out universities not companies, so I’m not sure how this goes against my statement.

One more of the reasons I don’t make hardware.

And the people who don't get electrocuted by your non-CE-compliant hardware are thankful for that. Good thing the equivalent is coming to software.

Most people over estimate how effective CE marking is.

For example, CE only prevents people from selling products. For example, I’ve done pilot tests (city wide installations of urban equipment) with devices that, while I knew they’d be compliant, we had done 0 tests.

It’s also fairly trivial and common to cheat at the tests. Most EMC testing is done in conditions that aren’t necessarily the normal operating conditions and with “accessories”.

If anything else fails, aside from medical or safety critical devices, you could always self certify and roll the dice, it’s way more common than what people think.

You haven't given any mechanism that would make this happen. Specifically, some reason that the company would see contributing be beneficial to it. Of course, it benefits from the existence of open-source as a whole, but what material difference does its contribution make?

Take a small-medium sized business (say 5 - 50€ million annual revenue). Perhaps it can fund one library that is critical to it, but no contribution it makes will make a material difference to the trajectory of major products like Linux, or Python.

The mechanism is clear: If you use Open Source software commercially, you are now liable if the software misbehaves. Thus, you have an incentive to make sure the software is correct. For (A)GPL software, you have to publish your contributions.

Not a lawyer, but it also seems to me that if you are a small shop, you might decide to pay, e.g. RedHat for taking on the liability. RedHat can pool these resources to make sure their software behaves as advertised.

(A)GPL don't require publication, just giving code to your users, who may or may not elect to further distribute the code.

> If you use Open Source software commercially, you are now liable if the software misbehaves. Thus, you have an incentive to make sure the software is correct.

As a software developer at a non-tech firm, I can gaurantee this means we will not be able to use any open source software. If we are granted an exception, it will be such that we must maintain a private version of the open source software.

This is simply a no-go for many companies of all sizes. The risk associated here is not something many (any?) legal department will be willing to take on.

You just ignored the second part of my message?

If your company is not willing to pay someone (another company ) for making sure the open source software used is actually working properly (and for assuming liability if it doesn't), then it can't use open source software. But then, what does open source lose when losing for profit users that are not willing to contribute back?

With a fifteen million euro penalty if you don’t. Yeah nice. If only we could also make fifteen million euros.

That’s clear.

What is due to some health condition they are incapable of fixing it anymore. Tough! Now the law is discriminating against old people because the risk of health deterioration is higher. Let me guess, tough. Old people shouldn’t be programming anyway and they don’t deserve to earn anything with it.

Of course, an SME company will not hire a developer to constantly perform security checks and apply patches for an important library libImportant.

What will happen is that company A will hire company B to do this and assume liability for it. If we set the annual cost of this at 100k, the monthly cost is about 8333 EUR. Let's say company B has 20 customers to protect the security of libImportant, that is 416 EUR per month and SME can afford that. There are OS that are of course used more frequently and that scales much better (i.e. cheaper per month). I actually see a new market niche here and perhaps they will find resourceful entrepreneurs.

Only if there are enough companies interested in the project. Will company B support cppcheck like that? I prefer kde to gnome, but my company won't pay for kde support when gnome already comes from some contract they have - at least kde is large enough that I expect someone to offer support - there are other desktops that are not popular and now have even less hope of breaking in.

Entrepreneurs are meant to solve real problems, not self-inflicted bureaucratic ones.

Security is a real problem.

Most users of open source don't really care to make a difference to the trajectory. Someone else made the linux drivers I need, that is good enough for me.

For linux you will probably be able to buy a certified Linux distribution for similar costs to Windows which is affordable to a medium sized company that needs certification. However that will only cover your basic OS: linux, ls, basic gnome desktop (but not many applications, just the window manager, a file management, and email client) - probably not a web browser.

However there are a lot of small projects that are not popular enough for anyone to certify like that.

Very optimistic. Call me a cynic.

so what would happen instead? The only alternative is using close source (which does have disadvantage, being not cheaper etc.),

Outsourcing any function that needs software outside the EU.

Moving out your business out of EU is somehow a non solution.

I didn't say it's a solution.

If you live in the EU it is hard to move. You have to find a country that will let you in. Most countries restrict immigration and so you are likely to only file a country that is dangerous to live in. You also leave your friends and extended family behind, which is difficult.

That assumes it is your company to move in the first place. Which is unlikely. So add find a new job to the list of things you need to do.

The CRA still applies as soon as it is first brought onto the EU market. It might just be the distributor or importer having to do some things instead of the manufacturer.

I mean the software is never used inside the EU. The final product is built outside and later imported, so you don't know what software was used.

An example: EU is approving very restrictive legislation about pesticides for use inside the EU but it happily allows importing food grown in other countries using the very same forbidden substances.

still CRA applies.

This is the weirdest form of colonization. In bygone days, we had to accept European monarchs; now we have to live with the diktats of their bureaucrats.

No colonization happening. If you don't want to follow the CRA, then don't make a product that gets into the EU market. If you want in the EU market, you have to follow EUs rules.

Maybe you're misunderstanding what I said. Otherwise it would be ridiculous.

If I buy a screw made in the USA, no EU authority can know what's the software used in the machine tool. They can control physical properties, packaging, information... but the process used is opaque.

If you import a product the CRA applies.

And I personally think that's a good thing

As with CE marking: there's very little enforcement, so people would carry on downloading solutions from outside the EU and ignoring the rules. See the entire Aliexpress market.

Reply on news.ycombinator.com