Diverse Open Source uses highlight need for precision in Cyber Resilience Act

As the European Cyber Resilience Act (CRA) is entering into the final legislative phase, it still has some needs arising from framing by the Commission or Parliament that result in breakage no matter how issues within its scope are “fixed”.  Here’s a short list to help the co-legislators understand the engagement from the Open Source …

Modern EU policies need the voices of the fourth sector

Traduit en français. It’s good news that the European Commission is now considering the value and needs of Open Source in its policy deliberations. What’s not as good is that it does so through the wrong lens. The Commission needs to extend its consultations, Expert Groups and other work to include and consider the fourth …

Regulatory language cannot be the same for all software

In reviewing the language and concepts being used in the various draft bills and directives circulating in Brussels at present, it is clear that the experts crafting the language are using their understanding of proprietary software to build the protections they clearly intend for Open Source. This may be the cause of the problems we …

Why open video Is vital For Open Source

The news that the European Commission’s competition directorate (DG COMP) has decided not to conduct a full antitrust investigation into the Alliance for Open Media’s (AOM) licensing policy is to be welcomed, especially for the AV1 CODEC specification (successor to the VP9 CODEC and intended to allow royalty-free, high-quality video streaming). It seems that whispering voices had falsely suggested …

Another issue with the Cyber Resilience Act: European standards bodies are inaccessible to Open Source projects

One of the proposals in the Cyber Resilience Act (CRA) is that European standards bodies should develop suitable standards that help simplify conformance. Bert Hubert explains how this might work in his extensive CRA explainer. There’s a crucial issue here for Open Source. EU policy experts say not to worry about CRA compliance because the …

The Cyber Resilience Act introduces uncertainty and risk leaving Open Source projects confused

What might happen if the uncertainty persists around who is held responsible under the Cyber Resilience Act (CRA)? The global Open Source community is averse to legal risks and generally lacks access to counsel, so it’s very possible offers of source code will simply be withdrawn rather than seeking to resolve the uncertainty. The CRA …

Open Source ensures code remains a part of culture

As Lessig observed in his 1999 book “CODE, and other laws of cyberspace”, a citizen’s practical experience of the law and of society today is through the software that implements the written law. All the computer code that governs our lives and liberty should be open to public scrutiny in this new era. More than just …

Why the European Commission must consult the Open Source communities

A crucial problem with the Impact Assessment of the Cyber Resilience Act (CRA) is that no Open Source communities or community fiduciaries were consulted as stakeholders. The lack of consultation with the Open Source communities would explain the possible origin of a serious defect in terminology. The Impact Assessment Annex 2 (Pdf), sections 2-4 lists …

Why Open Source should be exempt from Standard-Essential Patents

With the European Commission soon to offer the Parliament a bill relating to Standard-Essential Patents (SEPs), it is worth taking time to understand exactly why vendors requiring negotiations to use the patents they have embedded in “open” standards is antithetical to Open Source practice. The value and prosperity generated from Open Source arises from Open Source software licenses seamlessly and …

The ultimate list of reactions to the Cyber Resilience Act

The European Commission’s proposed Cyber Resilience Act (CRA) as drafted may harm Open Source, and perhaps all other non-industrial software. There were 131 responses to the proposed text that the Commission has sent to the Parliament, including one from the Open Source Initiative. Of those, 18 responses – representing a significant proportion of Europe’s software …

What is the Cyber Resilience Act and why it’s important for Open Source

The Cyber Resilience Act (CRA) is an interesting and important proposal for a European law that aims to drive the safety and integrity of software of all kinds by extending the “CE” self-attestation mark to software. And it may harm Open Source. The proposal includes a requirement for self-certification by suppliers of software to attest …