CRA?

I like that :-) I don't think it works quite the way you describe, though :-)

> Let's say a vendor were to release a (perhaps vast, perhaps obfuscated) patch against e.g. the kernel, that makes their hardware run faster than the competition, I think a court might well agree that even though the software is free, it's being released for reasons of commercial gain and so when the patch turns out to be buggy, the CRA should apply.

So they're releasing it to encourage people to buy their hardware? From what you say, it's unlikely to be upstreamed, so the patch will be abandon-ware. If it is upstreamed, there's no contract, no formal relationship, the CRA does not apply, and upstream is on the hook (even more reason for upstream to reject it).

> If that's correct, then it's wise to switch to working exclusively upstream, and if vendors learn that lesson it will be better than all the unmaintainable vendor patches we've seen in the past, so that would be a symptom of the CRA doing its job.

Very much so! Because as soon as Red Hat, or Dell, or whoever start selling hardware with linux installed, or support contracts, they now have a contractual relationship, and they ARE on the hook under the CRA, and they will not want to touch this junk with a bargepole!

So this hypothetical vendor, instead of *gaining* by releasing this obfuscated mess, has just given the hardware guys every reason to *avoid* buying their hardware, and given all the distos even more reason to patch their software *out* of their distro in order to avoid liability.

As I keep saying, "follow the contract", which is why big companies can release and support FLOSS, and avoid liability, but because the only way they can avoid liability is also to avoid any contracts, they are forced to be *full* members of the FLOSS community (as far as that software is concerned).

Cheers,
Wol