Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Pierre-Elliott Bécue
Santiago Ruano Rincón wrote on 12/11/2023 at 16:10:21+0100: > Dear Debian Fellows, > > Following the email sent by Ilu to debian-project (Message-ID: > <4b93ed08-f148-4c7f-b172-f967f7de7...@gmx.net>), and as we have > discussed during the MiniDebConf UY 2023 with other Debian Members, I > would l

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Aigars Mahinovs
Let me pipe in here. I have been exposed quite a bit with EU legislation in the process of our fight against software patents back in 2012. The EU legislators are quite sensible when the underlying issues are clearly explained to them, bu the legal language of the documents can be quite dense and a

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Luca Boccassi
On Mon, 13 Nov 2023 at 10:55, Aigars Mahinovs wrote: > > Let me pipe in here. I have been exposed quite a bit with EU legislation in > the process of our fight against software patents back in 2012. The EU > legislators are quite sensible when the underlying issues are clearly > explained to th

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Simon Richter
Hi, On 13.11.23 19:54, Aigars Mahinovs wrote: So a commercial company releasing open source software that is *not* part of their commercial activity (for example a router manufacturer releasing an in-house written Git UI) would be "supplied outside the course of a commercial activity" and thu

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Luca Boccassi
On Mon, 13 Nov 2023 at 12:20, Simon Richter wrote: > > Hi, > > On 13.11.23 19:54, Aigars Mahinovs wrote: > > > So a commercial company releasing open source > > software that is *not* part of their commercial activity (for example a > > router manufacturer releasing an in-house written Git UI) wou

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Lisandro Damián Nicanor Pérez Meyer
On Mon, 13 Nov 2023 at 07:55, Aigars Mahinovs wrote: [snip] > Even regardless of the specific legal wording in the legislation itself, the > point 10 > of the preamble would be enough to to fix any "bug" in the legislation in > post-processing via courts. As in - if any interpretation of the word

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Aigars Mahinovs
On Mon, 13 Nov 2023 at 13:29, Lisandro Damián Nicanor Pérez Meyer < perezme...@gmail.com> wrote: > On Mon, 13 Nov 2023 at 07:55, Aigars Mahinovs wrote: > [snip] > > Even regardless of the specific legal wording in the legislation itself, > the point 10 > > of the preamble would be enough to to fi

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Aigars Mahinovs
True, the employment status is irrelevant. However, in this example Microsoft will actually have the liability of providing the security assurances and support for systemd and related systems, because they are providing images of such systems as part of their commercial offering on the Azure cloud

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Luca Boccassi
On Mon, 13 Nov 2023 at 12:57, Aigars Mahinovs wrote: > > True, the employment status is irrelevant. However, in this example Microsoft > will actually have the liability of > providing the security assurances and support for systemd and related > systems, because they are providing > images of s

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Aigars Mahinovs
Correct. And I agree with that effect: * a company paying salary of a developer that contributes to an open source project outside of the commercial activity of the company does *not* expose the company to extra requirements * a company taking *any* software, including open source software, and se

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Holger Levsen
On Mon, Nov 13, 2023 at 02:19:38PM +0100, Aigars Mahinovs wrote: > Correct. And I agree with that effect: same here. > The *one* negative impact I can see of this legislation is impact on small > integrators that were used to being able to go to a > client company, install a bunch of Ubuntu Desk

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Aigars Mahinovs
On Mon, 13 Nov 2023 at 12:31, Luca Boccassi wrote: > > > I am *not* objecting to Debian taking such a vote and expressing the > stance intended. However, I expect that it will be seen by the EU > legislators with mifled amusement, because in their context and > understanding the legislative propo

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Lisandro Damián Nicanor Pérez Meyer
On Mon, 13 Nov 2023 at 09:54, Aigars Mahinovs wrote: > > On Mon, 13 Nov 2023 at 13:29, Lisandro Damián Nicanor Pérez Meyer > wrote: >> >> On Mon, 13 Nov 2023 at 07:55, Aigars Mahinovs wrote: >> [snip] >> > Even regardless of the specific legal wording in the legislation itself, >> > the point

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Aigars Mahinovs
You are mixing up completely unrelated things. Commercial entities and software coming from it have nothing to do with commercial activity. The commercial activity is what *you* are doing with the software. It is completely irrelevant where you got it from or if you wrote it. If you are doing com

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Lisandro Damián Nicanor Pérez Meyer
On Mon, 13 Nov 2023 at 10:37, Holger Levsen wrote: > > On Mon, Nov 13, 2023 at 02:19:38PM +0100, Aigars Mahinovs wrote: > > Correct. And I agree with that effect: > > same here. > > > The *one* negative impact I can see of this legislation is impact on small > > integrators that were used to being

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Lisandro Damián Nicanor Pérez Meyer
On Mon, 13 Nov 2023 at 11:50, Aigars Mahinovs wrote: > > You are mixing up completely unrelated things. Commercial entities and > software coming from it have nothing to do with commercial activity. > > The commercial activity is what *you* are doing with the software. It is > completely irrelev

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Aigars Mahinovs
On Mon, 13 Nov 2023 at 15:51, Lisandro Damián Nicanor Pérez Meyer < perezme...@gmail.com> wrote: > On Mon, 13 Nov 2023 at 11:50, Aigars Mahinovs wrote: > > Whether accepting donations *in general* makes your activity in > providing software a "commercial activity" in the context of > > this direc

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Gunnar Wolf
Aigars Mahinovs dijo [Mon, Nov 13, 2023 at 02:46:06PM +0100]: > By now the EU is actually quite used to dealing with volunteer > projects and open source projects in general. So they would not be > surprised in the slightest. And I do not believe it would tarnish > the image of Debian. > > A lot o

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Emmanuel Arias
Hi! I have been part of the Mini Debconf 2023 in Uruguay and I second this. On Sun, Nov 12, 2023 at 12:10:21PM -0300, Santiago Ruano Rincón wrote: > Dear Debian Fellows, > > Following the email sent by Ilu to debian-project (Message-ID: > <4b93ed08-f148-4c7f-b172-f967f7de7...@gmx.net>), and as we

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Scott Kitterman
On November 13, 2023 12:29:20 PM UTC, "Lisandro Damián Nicanor Pérez Meyer" wrote: >On Mon, 13 Nov 2023 at 07:55, Aigars Mahinovs wrote: >[snip] >> Even regardless of the specific legal wording in the legislation itself, the >> point 10 >> of the preamble would be enough to to fix any "bug"

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Ilu
At the moment - as the official proposals are worded now - everything depends on the meaning of the word "commercial". Please note that the proposals have some examples on this as I mentioned before - but each proposal is worded differently. The software is deemed commercial if - the developer is

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Ilu
The discussion on this list hasn't even touched the subject of Art. 11 CRA which is the most worrysome. Am 13.11.23 um 14:46 schrieb Aigars Mahinovs: "See: https://www.eff.org/deeplinks/2023/10/eff-and-other-experts-join-pointing-out-pitfalls-proposed-eu-cyber-resilience-act Note how the open sou

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Aigars Mahinovs
Thanks for the detailed explanation! It had quite a few details that I was not aware about. Expressing the desired position of Debian and of the community *is* useful, especially when there are multiple variants of the legislation that need reconciliation. I was looking at the specific version that

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Ilu
Marten from NLlabs made a comprehensive flowchart (https://github.com/maertsen/cra-foss-diagram) that shows the state of CRA as we presently (a bit of hope included) understand it. It includes the 4th proposal. Check it out to see where your project possibly might stand if we are able to hold this

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Helmut Grohne
Please Cc me in replies. On Sun, Nov 12, 2023 at 12:10:21PM -0300, Santiago Ruano Rincón wrote: > Following the email sent by Ilu to debian-project (Message-ID: > <4b93ed08-f148-4c7f-b172-f967f7de7...@gmx.net>), and as we have > discussed during the MiniDebConf UY 2023 with other Debian Members, I

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Philip Hands
Lisandro Damián Nicanor Pérez Meyer writes: ... > Just to be clear: I also do agree with the main intention of the > proposal, what I do not like is that the current draft wording might > backfire on us. I'd expect the multinationals, who have large legal teams, and are used to interacting with t