Re: Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-28 Thread Holger Levsen
On Sun, Nov 19, 2023 at 11:21:47PM +, Luca Boccassi wrote: > Second version, taking into account feedback. Looking for seconds at > this point: > > - GENERAL RESOLUTION STARTS - > > Debian Public Statement about the EU Cyber Resilience Act and the > Product Liability

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-24 Thread Russ Allbery
Seconded. Luca Boccassi writes: > Second version, taking into account feedback. Looking for seconds at > this point: > - GENERAL RESOLUTION STARTS - > Debian Public Statement about the EU Cyber Resilience Act and the > Product Liability Directive > The European Union

Re: Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-24 Thread Kurt Roeckx
On Sun, Nov 19, 2023 at 11:21:47PM +, Luca Boccassi wrote: > Second version, taking into account feedback. Looking for seconds at > this point: So I'm still only counting 4 seconds at this point. Kurt

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-23 Thread Bart Martens
On Thu, Nov 23, 2023 at 10:30:01AM +, Luca Boccassi wrote: > On Wed, 22 Nov 2023 at 20:35, Bart Martens wrote: > > > > On Wed, Nov 22, 2023 at 06:46:06PM +, Luca Boccassi wrote: > > > On Wed, 22 Nov 2023 at 09:28, Bart Martens wrote: > > > > > > > > On Tue, Nov 21, 2023 at 09:14:05AM

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-23 Thread Luca Boccassi
On Wed, 22 Nov 2023 at 20:35, Bart Martens wrote: > > On Wed, Nov 22, 2023 at 06:46:06PM +, Luca Boccassi wrote: > > On Wed, 22 Nov 2023 at 09:28, Bart Martens wrote: > > > > > > On Tue, Nov 21, 2023 at 09:14:05AM +0100, Thomas Goirand wrote: > > > > I feel like we're getting trapped by big

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-22 Thread Bart Martens
On Wed, Nov 22, 2023 at 06:46:06PM +, Luca Boccassi wrote: > On Wed, 22 Nov 2023 at 09:28, Bart Martens wrote: > > > > On Tue, Nov 21, 2023 at 09:14:05AM +0100, Thomas Goirand wrote: > > > I feel like we're getting trapped by big corp and their lobbying > > > power, and we need to use

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-22 Thread Luca Boccassi
On Wed, 22 Nov 2023 at 09:28, Bart Martens wrote: > > On Tue, Nov 21, 2023 at 09:14:05AM +0100, Thomas Goirand wrote: > > I feel like we're getting trapped by big corp and their lobbying > > power, and we need to use stronger words. > > Probably in a different way. I'd rather prefer Debian to

Re: Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-22 Thread Luca Boccassi
On Sun, 2023-11-19 at 23:21 +, Luca Boccassi wrote: > Second version, taking into account feedback. Looking for seconds at > this point: Elbrus spotted a typo, fixed below - that's the only change, "taking taking" -> "taking" in the second paragraph - GENERAL RESOLUTION STARTS -

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-22 Thread Bart Martens
On Tue, Nov 21, 2023 at 09:14:05AM +0100, Thomas Goirand wrote: > On 11/20/23 00:21, Luca Boccassi wrote: > > Second version, taking into account feedback. Looking for seconds at > > this point: [...] > > Thanks a lot for taking the time to word out things this way. > > However, I really think

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-21 Thread Luca Boccassi
On Tue, 21 Nov 2023 at 16:46, Salvo Tomaselli wrote: > > In data martedì 21 novembre 2023 16:13:32 CET, Luca Boccassi ha scritto: > > > Microsoft was not happy with having to unbundle Bing and Edge from > > Windows. > > It is still impossible to uninstall edge...

Re: Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-21 Thread Gunnar Wolf
Santiago Ruano Rincón dijo [Tue, Nov 21, 2023 at 01:15:40PM -0300]: > > > I second adding this version to the vote > > > > I'm getting a bad signature on this. > > > > > On Mon, 20 Nov 2023 at 00:22, Luca Boccassi wrote: > > > Second version, taking into account feedback. Looking for seconds at

Re: Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-21 Thread Santiago Ruano Rincón
El 20/11/23 a las 08:53, Kurt Roeckx escribió: > On Mon, Nov 20, 2023 at 12:40:58AM +0100, Aigars Mahinovs wrote: > > I second adding this version to the vote > > I'm getting a bad signature on this. > > > On Mon, 20 Nov 2023 at 00:22, Luca Boccassi wrote: > > Second version, taking into

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-21 Thread Luca Boccassi
On Tue, 21 Nov 2023 at 08:14, Thomas Goirand wrote: > > On 11/20/23 00:21, Luca Boccassi wrote: > > Second version, taking into account feedback. Looking for seconds at > > this point: > > > > - GENERAL RESOLUTION STARTS - > > > > Debian Public Statement about the EU Cyber

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-21 Thread Thomas Goirand
On 11/20/23 00:21, Luca Boccassi wrote: Second version, taking into account feedback. Looking for seconds at this point: - GENERAL RESOLUTION STARTS - Debian Public Statement about the EU Cyber Resilience Act and the Product Liability Directive The European Union

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-20 Thread Michael Biebl
Seconded Second version, taking into account feedback. Looking for seconds at this point: - GENERAL RESOLUTION STARTS - Debian Public Statement about the EU Cyber Resilience Act and the Product Liability Directive The European Union is currently preparing a regulation

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-20 Thread Lucas Nussbaum
Seconded. On 20/11/23 at 17:54 +0100, Chris Hofstaedtler wrote: > I second adding this version. > > * Luca Boccassi [231119 23:22]: > > Second version, taking into account feedback. Looking for seconds at > > this point: > > > > - GENERAL RESOLUTION STARTS - > > > > Debian

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-20 Thread Chris Hofstaedtler
I second adding this version. * Luca Boccassi [231119 23:22]: > Second version, taking into account feedback. Looking for seconds at > this point: > > - GENERAL RESOLUTION STARTS - > > Debian Public Statement about the EU Cyber Resilience Act and the > Product Liability

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-20 Thread Simon Richter
Hi, On 11/20/23 08:21, Luca Boccassi wrote: Therefore, the Debian project asks the legislators to enhance the text of these regulations to clarify beyond any reasonable doubt that Free and Open Source Software developers and contributors are not going to be treated as

Re: Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-20 Thread Aigars Mahinovs
I'll just attach the signed version, it seems like GMail plain text mode is still a bit broken. On Mon, 20 Nov 2023 at 08:53, Kurt Roeckx wrote: > > On Mon, Nov 20, 2023 at 12:40:58AM +0100, Aigars Mahinovs wrote: > > I second adding this version to the vote > > I'm getting a bad signature on

Re: Re: Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-20 Thread Luca Boccassi
> > Second version, taking into account feedback. Looking for seconds > at > > this point: > > Maybe Santiago wants to adopt this text, rather than having 2 > options? Already attempted that last week: https://lists.debian.org/debian-vote/2023/11/msg00051.html Unfortunately time available is

Re: Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-19 Thread Kurt Roeckx
On Mon, Nov 20, 2023 at 12:40:58AM +0100, Aigars Mahinovs wrote: > I second adding this version to the vote I'm getting a bad signature on this. > On Mon, 20 Nov 2023 at 00:22, Luca Boccassi wrote: > Second version, taking into account feedback. Looking for seconds at > this point: Maybe

Re: Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-19 Thread Aigars Mahinovs
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 I second adding this version to the vote On Mon, 20 Nov 2023 at 00:22, Luca Boccassi wrote: Second version, taking into account feedback. Looking for seconds at this point: - GENERAL RESOLUTION STARTS - Debian Public Statement

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-19 Thread Luca Boccassi
On Sun, 19 Nov 2023 at 00:21, Sam Hartman wrote: > > > "Bart" == Bart Martens writes: > >> > >> * A commercial company writes free-software that for all > >> practical purposes can be used only for access to their > >> proprietary web service. I'd rather not allow arguments

Re: Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-19 Thread Luca Boccassi
Second version, taking into account feedback. Looking for seconds at this point: - GENERAL RESOLUTION STARTS - Debian Public Statement about the EU Cyber Resilience Act and the Product Liability Directive The European Union is currently preparing a regulation "on

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-18 Thread Sam Hartman
> "Bart" == Bart Martens writes: >> >> * A commercial company writes free-software that for all >> practical purposes can be used only for access to their >> proprietary web service. I'd rather not allow arguments about >> whether a flaw is on the web service side or the

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-18 Thread Bart Martens
On Sat, Nov 18, 2023 at 11:43:27AM -0700, Sam Hartman wrote: > > "Bart" == Bart Martens writes: > > Bart> On Wed, Nov 15, 2023 at 02:52:31PM +0100, Lucas Nussbaum wrote: > >> I wonder if we should have something like "Free software > >> development by nonprofit organizations"

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-18 Thread Emmanuel Arias
Hi, Sorry I did not note that I did not sign this message. I second this: > On Sun, Nov 12, 2023 at 12:10:21PM -0300, Santiago Ruano Rincón wrote: > > Dear Debian Fellows, > > > > Following the email sent by Ilu to debian-project (Message-ID: > > <4b93ed08-f148-4c7f-b172-f967f7de7...@gmx.net>),

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-18 Thread Sam Hartman
> "Bart" == Bart Martens writes: Bart> On Wed, Nov 15, 2023 at 02:52:31PM +0100, Lucas Nussbaum wrote: >> I wonder if we should have something like "Free software >> development by nonprofit organizations" somewhere. Bart> Are we now drawing a line between profit and

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-18 Thread Bart Martens
On Mon, Nov 13, 2023 at 03:57:44PM +0100, Aigars Mahinovs wrote: > On Mon, 13 Nov 2023 at 15:51, Lisandro Damián Nicanor Pérez Meyer < > perezme...@gmail.com> wrote: > > > On Mon, 13 Nov 2023 at 11:50, Aigars Mahinovs wrote: > > > Whether accepting donations *in general* makes your activity in >

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-18 Thread Bart Martens
On Wed, Nov 15, 2023 at 02:52:31PM +0100, Lucas Nussbaum wrote: > I wonder if we should have something like "Free software development by > nonprofit organizations" somewhere. Are we now drawing a line between profit and nonprofit? In my view, with Free Software it should not matter who produces,

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-16 Thread Ilu
I mixed up one of the links: The first link under (1) should be https://www.europarl.europa.eu/legislative-train/theme-a-europe-fit-for-the-digital-age/file-european-cyber-resilience-act All that talk about cybersecurity at the EU these days got me confused. :-) I think somebody already noticed

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-16 Thread Lisandro Damián Nicanor Pérez Meyer
On Thu, 16 Nov 2023 at 02:54, Simon Richter wrote: [snip] > That would also be a consistent position: "as long as the source code is > public under a DFSG-compliant license, the open source exemption should > apply even to works produced for commercial gain." > > However, I do not think the EU

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-15 Thread Simon Richter
Hi, On 11/15/23 20:27, Aigars Mahinovs wrote: That is exactly why I think this is dangerous: I want GitLab and Proxmox to be responsible for what they release, but it is very difficult to draw a line between their offering and what Microsoft is doing by paying for

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-15 Thread Lucas Nussbaum
On 15/11/23 at 14:13 +, Luca Boccassi wrote: > On Wed, 15 Nov 2023 at 13:53, Lucas Nussbaum wrote: > > > > On 15/11/23 at 11:38 +, Luca Boccassi wrote: > > > On Wed, 15 Nov 2023 at 06:23, Lucas Nussbaum wrote: > > > > > > > > On 15/11/23 at 00:49 +, Luca Boccassi wrote: > > > > >

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-15 Thread Luca Boccassi
On Wed, 15 Nov 2023 at 13:53, Lucas Nussbaum wrote: > > On 15/11/23 at 11:38 +, Luca Boccassi wrote: > > On Wed, 15 Nov 2023 at 06:23, Lucas Nussbaum wrote: > > > > > > On 15/11/23 at 00:49 +, Luca Boccassi wrote: > > > > What do you think? Here's what I came up with: > > > > > > Hi, > >

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-15 Thread Lucas Nussbaum
On 15/11/23 at 11:38 +, Luca Boccassi wrote: > On Wed, 15 Nov 2023 at 06:23, Lucas Nussbaum wrote: > > > > On 15/11/23 at 00:49 +, Luca Boccassi wrote: > > > What do you think? Here's what I came up with: > > > > Hi, > > > > FWIW, I would likely second something along those lines. Some

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-15 Thread Luca Boccassi
On Wed, 15 Nov 2023 at 12:59, Santiago Ruano Rincón wrote: > > El 15/11/23 a las 00:49, Luca Boccassi escribió: > > On Sun, 2023-11-12 at 12:10 -0300, Santiago Ruano Rincón wrote: > > > Dear Debian Fellows, > > > > > > Following the email sent by Ilu to debian-project (Message-ID: > > >

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-15 Thread Santiago Ruano Rincón
El 15/11/23 a las 00:49, Luca Boccassi escribió: > On Sun, 2023-11-12 at 12:10 -0300, Santiago Ruano Rincón wrote: > > Dear Debian Fellows, > > > > Following the email sent by Ilu to debian-project (Message-ID: > > <4b93ed08-f148-4c7f-b172-f967f7de7...@gmx.net>), and as we have > > discussed

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-15 Thread Luca Boccassi
On Wed, 15 Nov 2023 at 06:23, Lucas Nussbaum wrote: > > On 15/11/23 at 00:49 +, Luca Boccassi wrote: > > What do you think? Here's what I came up with: > > Hi, > > FWIW, I would likely second something along those lines. Some comments: > > > The Debian project however notes that not

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-15 Thread Aigars Mahinovs
On Wed, 15 Nov 2023 at 12:14, Simon Richter wrote: > Hi, > > On 11/15/23 15:22, Lucas Nussbaum wrote: > > >> The Debian project however notes that not enough emphasis has been > >> employed in all parts of these regulations to clearly exonerate > Free > >> and Open Source Software

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-15 Thread Simon Richter
Hi, On 11/15/23 15:22, Lucas Nussbaum wrote: The Debian project however notes that not enough emphasis has been employed in all parts of these regulations to clearly exonerate Free and Open Source Software Projects from being subject to the same liabilities as commercial

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-14 Thread Lucas Nussbaum
On 15/11/23 at 00:49 +, Luca Boccassi wrote: > What do you think? Here's what I came up with: Hi, FWIW, I would likely second something along those lines. Some comments: > The Debian project however notes that not enough emphasis has been > employed in all parts of these regulations

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-14 Thread Luca Boccassi
On Sun, 2023-11-12 at 12:10 -0300, Santiago Ruano Rincón wrote: > Dear Debian Fellows, > > Following the email sent by Ilu to debian-project (Message-ID: > <4b93ed08-f148-4c7f-b172-f967f7de7...@gmx.net>), and as we have > discussed during the MiniDebConf UY 2023 with other Debian Members, I >

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-14 Thread Thomas Goirand
On 11/14/23 02:17, Philip Hands wrote: Lisandro Damián Nicanor Pérez Meyer writes: ... Just to be clear: I also do agree with the main intention of the proposal, what I do not like is that the current draft wording might backfire on us. I'd expect the multinationals, who have large legal

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Philip Hands
Lisandro Damián Nicanor Pérez Meyer writes: ... > Just to be clear: I also do agree with the main intention of the > proposal, what I do not like is that the current draft wording might > backfire on us. I'd expect the multinationals, who have large legal teams, and are used to interacting with

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Helmut Grohne
Please Cc me in replies. On Sun, Nov 12, 2023 at 12:10:21PM -0300, Santiago Ruano Rincón wrote: > Following the email sent by Ilu to debian-project (Message-ID: > <4b93ed08-f148-4c7f-b172-f967f7de7...@gmx.net>), and as we have > discussed during the MiniDebConf UY 2023 with other Debian Members,

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Ilu
Marten from NLlabs made a comprehensive flowchart (https://github.com/maertsen/cra-foss-diagram) that shows the state of CRA as we presently (a bit of hope included) understand it. It includes the 4th proposal. Check it out to see where your project possibly might stand if we are able to hold

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Aigars Mahinovs
Thanks for the detailed explanation! It had quite a few details that I was not aware about. Expressing the desired position of Debian and of the community *is* useful, especially when there are multiple variants of the legislation that need reconciliation. I was looking at the specific version

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Ilu
The discussion on this list hasn't even touched the subject of Art. 11 CRA which is the most worrysome. Am 13.11.23 um 14:46 schrieb Aigars Mahinovs: "See: https://www.eff.org/deeplinks/2023/10/eff-and-other-experts-join-pointing-out-pitfalls-proposed-eu-cyber-resilience-act Note how the open

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Ilu
At the moment - as the official proposals are worded now - everything depends on the meaning of the word "commercial". Please note that the proposals have some examples on this as I mentioned before - but each proposal is worded differently. The software is deemed commercial if - the developer

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Scott Kitterman
On November 13, 2023 12:29:20 PM UTC, "Lisandro Damián Nicanor Pérez Meyer" wrote: >On Mon, 13 Nov 2023 at 07:55, Aigars Mahinovs wrote: >[snip] >> Even regardless of the specific legal wording in the legislation itself, the >> point 10 >> of the preamble would be enough to to fix any "bug"

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Emmanuel Arias
Hi! I have been part of the Mini Debconf 2023 in Uruguay and I second this. On Sun, Nov 12, 2023 at 12:10:21PM -0300, Santiago Ruano Rincón wrote: > Dear Debian Fellows, > > Following the email sent by Ilu to debian-project (Message-ID: > <4b93ed08-f148-4c7f-b172-f967f7de7...@gmx.net>), and as

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Gunnar Wolf
Aigars Mahinovs dijo [Mon, Nov 13, 2023 at 02:46:06PM +0100]: > By now the EU is actually quite used to dealing with volunteer > projects and open source projects in general. So they would not be > surprised in the slightest. And I do not believe it would tarnish > the image of Debian. > > A lot

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Aigars Mahinovs
On Mon, 13 Nov 2023 at 15:51, Lisandro Damián Nicanor Pérez Meyer < perezme...@gmail.com> wrote: > On Mon, 13 Nov 2023 at 11:50, Aigars Mahinovs wrote: > > Whether accepting donations *in general* makes your activity in > providing software a "commercial activity" in the context of > > this

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Lisandro Damián Nicanor Pérez Meyer
On Mon, 13 Nov 2023 at 11:50, Aigars Mahinovs wrote: > > You are mixing up completely unrelated things. Commercial entities and > software coming from it have nothing to do with commercial activity. > > The commercial activity is what *you* are doing with the software. It is > completely

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Lisandro Damián Nicanor Pérez Meyer
On Mon, 13 Nov 2023 at 10:37, Holger Levsen wrote: > > On Mon, Nov 13, 2023 at 02:19:38PM +0100, Aigars Mahinovs wrote: > > Correct. And I agree with that effect: > > same here. > > > The *one* negative impact I can see of this legislation is impact on small > > integrators that were used to

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Aigars Mahinovs
You are mixing up completely unrelated things. Commercial entities and software coming from it have nothing to do with commercial activity. The commercial activity is what *you* are doing with the software. It is completely irrelevant where you got it from or if you wrote it. If you are doing

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Lisandro Damián Nicanor Pérez Meyer
On Mon, 13 Nov 2023 at 09:54, Aigars Mahinovs wrote: > > On Mon, 13 Nov 2023 at 13:29, Lisandro Damián Nicanor Pérez Meyer > wrote: >> >> On Mon, 13 Nov 2023 at 07:55, Aigars Mahinovs wrote: >> [snip] >> > Even regardless of the specific legal wording in the legislation itself, >> > the point

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Aigars Mahinovs
On Mon, 13 Nov 2023 at 12:31, Luca Boccassi wrote: > > > I am *not* objecting to Debian taking such a vote and expressing the > stance intended. However, I expect that it will be seen by the EU > legislators with mifled amusement, because in their context and > understanding the legislative

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Holger Levsen
On Mon, Nov 13, 2023 at 02:19:38PM +0100, Aigars Mahinovs wrote: > Correct. And I agree with that effect: same here. > The *one* negative impact I can see of this legislation is impact on small > integrators that were used to being able to go to a > client company, install a bunch of Ubuntu

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Aigars Mahinovs
Correct. And I agree with that effect: * a company paying salary of a developer that contributes to an open source project outside of the commercial activity of the company does *not* expose the company to extra requirements * a company taking *any* software, including open source software, and

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Luca Boccassi
On Mon, 13 Nov 2023 at 12:57, Aigars Mahinovs wrote: > > True, the employment status is irrelevant. However, in this example Microsoft > will actually have the liability of > providing the security assurances and support for systemd and related > systems, because they are providing > images of

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Aigars Mahinovs
True, the employment status is irrelevant. However, in this example Microsoft will actually have the liability of providing the security assurances and support for systemd and related systems, because they are providing images of such systems as part of their commercial offering on the Azure cloud

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Aigars Mahinovs
On Mon, 13 Nov 2023 at 13:29, Lisandro Damián Nicanor Pérez Meyer < perezme...@gmail.com> wrote: > On Mon, 13 Nov 2023 at 07:55, Aigars Mahinovs wrote: > [snip] > > Even regardless of the specific legal wording in the legislation itself, > the point 10 > > of the preamble would be enough to to

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Lisandro Damián Nicanor Pérez Meyer
On Mon, 13 Nov 2023 at 07:55, Aigars Mahinovs wrote: [snip] > Even regardless of the specific legal wording in the legislation itself, the > point 10 > of the preamble would be enough to to fix any "bug" in the legislation in > post-processing via courts. As in - if any interpretation of the

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Luca Boccassi
On Mon, 13 Nov 2023 at 12:20, Simon Richter wrote: > > Hi, > > On 13.11.23 19:54, Aigars Mahinovs wrote: > > > So a commercial company releasing open source > > software that is *not* part of their commercial activity (for example a > > router manufacturer releasing an in-house written Git UI)

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Simon Richter
Hi, On 13.11.23 19:54, Aigars Mahinovs wrote: So a commercial company releasing open source software that is *not* part of their commercial activity (for example a router manufacturer releasing an in-house written Git UI) would be "supplied outside the course of a commercial activity" and

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Luca Boccassi
On Mon, 13 Nov 2023 at 10:55, Aigars Mahinovs wrote: > > Let me pipe in here. I have been exposed quite a bit with EU legislation in > the process of our fight against software patents back in 2012. The EU > legislators are quite sensible when the underlying issues are clearly > explained to

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Aigars Mahinovs
Let me pipe in here. I have been exposed quite a bit with EU legislation in the process of our fight against software patents back in 2012. The EU legislators are quite sensible when the underlying issues are clearly explained to them, bu the legal language of the documents can be quite dense and

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-13 Thread Pierre-Elliott Bécue
Santiago Ruano Rincón wrote on 12/11/2023 at 16:10:21+0100: > Dear Debian Fellows, > > Following the email sent by Ilu to debian-project (Message-ID: > <4b93ed08-f148-4c7f-b172-f967f7de7...@gmx.net>), and as we have > discussed during the MiniDebConf UY 2023 with other Debian Members, I > would

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-12 Thread Simon Richter
Hi, On 11/13/23 02:47, Lisandro Damián Nicanor Pérez Meyer wrote: Similarly, where the main contributors to free and open-source projects are developers employed by commercial entities and when such developers or the employer can exercise control as to which modifications are accepted in the

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-12 Thread Kurt Roeckx
On Sun, Nov 12, 2023 at 01:03:38PM -0600, Simon Quigley wrote: > Just for good measure, seconded. This is the 5th second. Kurt

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-12 Thread Simon Quigley
Just for good measure, seconded. If this does go through, I am curious about the wider impact this has on the free software and open source community, outside the EU. As a United States citizen, I fear fragmentation in software availability and licenses that could potentially "wall off" the

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-12 Thread Ilulu
"Art. 3 (1) ‘product with digital elements’ means any software or hardware product ... (18) ‘manufacturer’ means any natural or legal person who develops or manufactures products with digital elements ... and markets them under his or her name or trademark, whether for payment or free of charge;

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-12 Thread Luca Boccassi
On Sun, 12 Nov 2023 at 18:11, Ilulu wrote: > Am 12.11.23 um 19:01 schrieb Luca Boccassi: > > Yes - if it's "made available on the market", which is in the first > > bit that was snipped. Pushing a repository on Gitlab is not "making > > available on the market". > > You are wrong. It is. That's

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-12 Thread Ilulu
Am 12.11.23 um 19:01 schrieb Luca Boccassi: Yes - if it's "made available on the market", which is in the first bit that was snipped. Pushing a repository on Gitlab is not "making available on the market". You are wrong. It is. That's why the proposal has: "(10d) The sole act of hosting

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-12 Thread Luca Boccassi
On Sun, 12 Nov 2023 at 17:47, Lisandro Damián Nicanor Pérez Meyer wrote: > > Hi, > > On Sun, 12 Nov 2023 at 14:35, Ilulu wrote: > > > [snip] > > (10a) For example, a fully decentralised development model, where no > > single commercial entity exercises control over what is accepted into > > the

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-12 Thread Luca Boccassi
On Sun, 12 Nov 2023 at 17:35, Ilulu wrote: > > Am 12.11.23 um 18:09 schrieb Luca Boccassi: > > We do know whether something is commercial or not though ... > > I sincerely doubt that. Just to illustrate this I'm citing a part (only > a part) of one of the regulation drafts which are presently

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-12 Thread Lisandro Damián Nicanor Pérez Meyer
Hi, On Sun, 12 Nov 2023 at 14:35, Ilulu wrote: > [snip] > (10a) For example, a fully decentralised development model, where no > single commercial entity exercises control over what is accepted into > the project’s code base, should be taken as an indication that the > product has been developed

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-12 Thread Ilulu
Am 12.11.23 um 18:38 schrieb Luca Boccassi: Which definitions does the proposal use? Could you please quote them? The first two links do not provide any, as far as I can see. The third link (a blog post, not a piece of legislation) explicitly says: "the Cyber Resilience Act does not define

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-12 Thread Luca Boccassi
On Sun, 12 Nov 2023 at 17:29, Scott Kitterman wrote: > On November 12, 2023 5:09:26 PM UTC, Luca Boccassi wrote: > >On Sun, 12 Nov 2023 at 15:10, Santiago Ruano Rincón > > wrote: > >> > >> Dear Debian Fellows, > >> > >> Following the email sent by Ilu to debian-project (Message-ID: > >>

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-12 Thread Ilulu
Am 12.11.23 um 18:09 schrieb Luca Boccassi: > We do know whether something is commercial or not though ... I sincerely doubt that. Just to illustrate this I'm citing a part (only a part) of one of the regulation drafts which are presently considered in trilogue. "(10) Only free and open-source

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-12 Thread Scott Kitterman
On November 12, 2023 5:09:26 PM UTC, Luca Boccassi wrote: >On Sun, 12 Nov 2023 at 15:10, Santiago Ruano Rincón > wrote: >> >> Dear Debian Fellows, >> >> Following the email sent by Ilu to debian-project (Message-ID: >> <4b93ed08-f148-4c7f-b172-f967f7de7...@gmx.net>), and as we have >>

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-12 Thread Luca Boccassi
On Sun, 12 Nov 2023 at 15:10, Santiago Ruano Rincón wrote: > > Dear Debian Fellows, > > Following the email sent by Ilu to debian-project (Message-ID: > <4b93ed08-f148-4c7f-b172-f967f7de7...@gmx.net>), and as we have > discussed during the MiniDebConf UY 2023 with other Debian Members, I > would

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-12 Thread Nicolas Dandrimont
Hi, Thanks for pushing this forward. Seconded. Cheers, Nicolas On Sun, Nov 12, 2023 at 12:10:21PM -0300, Santiago Ruano Rincón wrote: > Dear Debian Fellows, > > Following the email sent by Ilu to debian-project (Message-ID: > <4b93ed08-f148-4c7f-b172-f967f7de7...@gmx.net>), and as we have >

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-12 Thread Lisandro Damián Nicanor Pérez Meyer
I have also been part of the discussion on the Mini DebConf and I second this. On 12/11/23 12:10, Santiago Ruano Rincón wrote: Dear Debian Fellows, Following the email sent by Ilu to debian-project (Message-ID: <4b93ed08-f148-4c7f-b172-f967f7de7...@gmx.net>), and as we have discussed during

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-12 Thread Mattia Rizzolo
On Sun, Nov 12, 2023 at 12:10:21PM -0300, Santiago Ruano Rincón wrote: > I > would like to call for a vote about issuing a Debian public statement > regarding > the EU Cyber Resilience Act (CRA) and the Product Liability Directive > (PLD). I also second this vote, reporter verbatim hereafter. >

Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-12 Thread Gunnar Wolf
We discussed the text quoted below (that is, the full text that Santiago just sent), and I find its wide discussion and, at least, understanding of utmost importance to the free software community as a whole. I wholeheartedly second the call for votes with this text. Santiago Ruano Rincón dijo

Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"

2023-11-12 Thread Santiago Ruano Rincón
Dear Debian Fellows, Following the email sent by Ilu to debian-project (Message-ID: <4b93ed08-f148-4c7f-b172-f967f7de7...@gmx.net>), and as we have discussed during the MiniDebConf UY 2023 with other Debian Members, I would like to call for a vote about issuing a Debian public statement regarding