• 0 Posts
  • 6 Comments
Joined 2 years ago
cake
Cake day: June 12th, 2023

help-circle

  • Open source software is also notably lacking from the impact assessment documents, but I suspect this is because it was intended to not impact open source software at all. It seems the legislation intends to exclude open-source software, but doesn’t clearly and unambiguously exclude open source software that is developed or contributed to in a commercial setting (e.g by paid contributors).

    I think the wording seems clear enough to determine the intent, but the ambiguity surrounding the “commercial activity” part might necessitate trial (which nobody wants to risk), or might lead to poor implementation of this directive in the laws of member states. I think we should be campaigning to improve the wording, not reject it outright.


  • Ah, OK. So it seems it’s a case of the spirit of the text not matching the precise technical wording used. IMO, the legislation clearly intends to exclude freely-distributable open-source software, but the issue lies with what constitutes a commercial activity. (I’ve not yet checked the rest of the document to see if it clearly defines “commercial activity” in relation to the legislation.)

    TBH, it seems that what is needed here is a clarification and tightening up of definitions, not wholesale rejection of the legislation.


  • Why is everyone up in arms about this?

    The legislation specifically excludes open source software. Has nobody in this discussion actually read the proposed legislation?

    From the current proposal legislation text:

    In order not to hamper innovation or research, free and open-source software developed or supplied outside the course of a commercial activity should not be covered by this Regulation. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable.

    There is also a clause that states those using open source software in commercial products must report any vulnerabilities found to the maintainer.