I would really appreciate an ELI5, or some examples. For example, would lemmy be regulated by CRA? What about lemmy instances? Is there a difference if there is a fee or a recurrent donations?
First: IANAL, EU law is complicated. This is my understanding as of now:
TL;DR: The EU Cyber Resilience Act (CRA) aims to enhance cybersecurity standards for products with digital elements. It introduces mandatory requirements for manufacturers and retailers to ensure cybersecurity throughout a product’s lifecycle. The CRA excludes open-source software developers unless their software is used commercially as part of a “product with digital elements”.
would lemmy be regulated by CRA?
Lemmy, as an open-source project, would likely not be directly regulated by the CRA. The Act specifically excludes open-source developers from its scope unless their software is used commercially.
Whaz about lemmy instances?
Lemmy instances might be regulated by the CRA if they are operated commercially as part of a “product with digital Elements”. (Is there a pay for access instance or hosting as a service for lemmy? I am not aware of one.) However, since most instances are run non-commercially or for personal use, they would likely fall outside the CRA’s scope.
Is there a difference if there is a fee or a recurrent donations?
Yes:
- A fee is typically a mandatory payment for a service or product, e.g. a feature locked behind a paywall.
- A recurring donation is a voluntary, regular contribution to support an organization or cause, often without receiving goods or services in return.
The key distinction lies in the obligation attached to the payment. Fees come with an expectation of receiving something in return, while donations are given freely without such expectations.
so, if a company decides to, for example, start using some MIT licensed software, does that suddenly materialize extra responsibilities for that software’s dev?
My understanding is that the company would be regulated by CRA and not the developer. However, that does not stop the company from pushing the developer for CRA compliance.
That’s actually pretty reasonable. I’d be happy to make my open source projects compliant for a company - but they can damn well pay me for the effort.
From a corps POV,
FOSS is free as in let 'em starve, not as in funding
Am i wrong?
Indeed, that’s why I use the AGPL license. Corporations hate it because it forces them to give back.
it's free as in go pound sand if you aren't going to fund maintainersit doesn’t force them to do anything until devs refuse to work for any company that doesn’t.
i’m with you on agplv3+. The copyright recognition document comes before the resume.
Wait? Are we pretending the corps are actually the FOSS devs?
A Corp dev, aka a FOSS dev forced into societal job creation servitude making throw away smartphone apps, web sites, and now AI models.
Gets paid to not be a productive person. Is essential what a societal job creation program is. Actually accomplishing anything is a random flaw and not the intent of employing devs.
The alternative would be to fund the dev to concentrate on maintenance efforts of their repos which the entire world depends on.
And if you don’t believe me, just explain one thing. What’s the pip-tools maintainer up to? Cuz it’s definitely not focused on pip-tools maintenance
Would definitely be interested to check in daily to watch what he’s doing. Can throw parties to watch some of the most influential and important people on the planet do the equivalent of digging ditches, refilling them, then doing it again.
I tried talking to them about the notion of breaking the monopoly of GIT & was talking about Fossil They literally went don’t care “Git is good enough” they’re literally talentless monkeys
There is efforts to make the issues and PRs forkable as well. There is some folks jumping ship. Haven’t researched the new platforms like codeberg
I wasn’t talking about Github, I was talking about GIT itself; <u>Look at these Three</u>:
The last 2 are Patch-Based & 2 is basically a modernized-version of 3, eventhough 3 is still being maintained to this day & 1 is a fully-fledged Github-in-a-box
Oh boy I can’t wait for the negative comments about it’s obviois flaws, so let’s hear it
