<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-IE" link="blue" vlink="purple" style="word-wrap:break-word"> <div class="WordSection1"> Maarten<o:p></o:p> <o:p> </o:p> Maybe I�m missing something, but the draft language *excludes* open source software:<o:p></o:p> �In order not to hamper innovation or research, free and open-source software<o:p></o:p> developed or supplied outside the course of a commercial activity should not be<o:p></o:p> covered by this Regulation. This is in particular the case for software, including its<o:p></o:p> source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. In the context of software, a commercial activity might be characterized not only by charging a price for a product, but also by charging a price for technical support services, by providing a software platform through which the manufacturer monetises other services, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software.�<o:p></o:p> <o:p> </o:p> Regards<o:p></o:p> Michele<o:p></o:p> <o:p> </o:p> <div> --<o:p></o:p> Mr Michele Neylon<o:p></o:p> Blacknight Solutions<o:p></o:p> Hosting, Colocation & Domains<o:p></o:p> <a href="https://www.blacknight.com/">https://www.blacknight.com/</a><o:p></o:p> <a href="https://blacknight.blog/">https://blacknight.blog/</a><o:p></o:p> Intl. +353 (0) 59 9183072<o:p></o:p> Direct Dial: +353 (0)59 9183090<o:p></o:p> Personal blog: <a href="https://michele.blog/">https://michele.blog/</a><o:p></o:p> Some thoughts: <a href="https://ceo.hosting/">https://ceo.hosting/</a><o:p></o:p> -------------------------------<o:p></o:p> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty<o:p></o:p> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845<o:p></o:p> </div> <o:p> </o:p> <o:p> </o:p> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"> From: opensource-wg <opensource-wg-bounces@ripe.net> on behalf of Maarten Aertsen <maarten@nlnetlabs.nl> Date: Monday, 28 November 2022 at 14:59 To: opensource-wg@ripe.net <opensource-wg@ripe.net> Subject: [opensource-wg] concern re: Cyber Resilience Act effects on open source?<o:p></o:p> </div> <div> [EXTERNAL EMAIL] Please use caution when opening attachments from unrecognised sources. good afternoon list, I would like to understand the number of people/organisations on this list who are concerned about the European Commission's Cyber Resilience Act proposal effects on open source software development. This topic was presented at RIPE85 [1] and covered in a recent blog (see below, should have cross-posted), which was republished at RIPE Labs last week: <a href="https://labs.ripe.net/author/maarten-aertsen/open-source-software-vs-the-proposed-cyber-resilience-act/">https://labs.ripe.net/author/maarten-aertsen/open-source-software-vs-the-proposed-cyber-resilience-act/</a> You would help both me and RIPE NCC staff that are tracking the proposal by speaking up on list. Answers by both developers and users are valuable. A simple +1 is fine. Thanks. kind regards, Maarten -------- Forwarded Message -------- Subject: Re: [cooperation-wg] Cyber Resilience Act effects on OSS on agenda of open source-wg Date: Mon, 14 Nov 2022 09:38:00 +0100 From: Maarten Aertsen <maarten@nlnetlabs.nl> To: cooperation-wg@ripe.net Good morning, I just published an extended, written version of my RIPE talk in the open-source wg [1] with NLnet Labs' perspective on the European Commission's proposal for a Cyber Resilience Act vs. Open Source: <a href="https://blog.nlnetlabs.nl/open-source-software-vs-the-cyber-resilience-act/">https://blog.nlnetlabs.nl/open-source-software-vs-the-cyber-resilience-act/</a> We feel the current proposal misses a major opportunity. The CRA could bring support to open-source developers maintaining the critical foundations of our digital society. But instead of introducing incentives for integrators or financial support, the current proposal will overload small developers with compliance work. At the same time, this is only the Commission's proposal. I hope there is opportunity to raise awareness and influence the coming positions and negotations. I'm very grateful to the many people in the RIPE community that talked to me after my presentation. I feel my understanding of the issue is improving. Curious to hear what you think, how you feel this affects the projects you rely on and what we have yet to learn about the implications. kind regards, Maarten [1] <a href="https://ripe85.ripe.net/archives/video/911">https://ripe85.ripe.net/archives/video/911</a> -- To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: <a href="https://lists.ripe.net/mailman/listinfo/cooperation-wg">https://lists.ripe.net/mailman/listinfo/cooperation-wg</a> _______________________________________________ opensource-wg mailing list opensource-wg@ripe.net <a href="https://lists.ripe.net/mailman/listinfo/opensource-wg">https://lists.ripe.net/mailman/listinfo/opensource-wg</a> To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: <a href="https://lists.ripe.net/mailman/listinfo/opensource-wg">https://lists.ripe.net/mailman/listinfo/opensource-wg</a><o:p></o:p> </div> </div> </body> </html>