Sidebar on the CRA, which was mentioned

Posted Oct 6, 2025 8:03 UTC (Mon) by farnz (subscriber, #17727)
In reply to: Sidebar on the CRA, which was mentioned by Wol
Parent article: F-Droid and Google's Developer Registration Decree

By your standard, all suppliers incur CRA liabilities, since all downloaders incur a liability towards the supplier on download to not breach the copyrights in the app.

That's not the CRA's standard, because the CRA has exceptions where the monetized product on the market is independent and unrelated to the product you're claiming incurs CRA liability, and where the monetization neither exceeds nor is intended to exceed the costs incurred in creating the product and putting it on the market.

The whole reason there's been such a fuss in open source circles around the CRA is that those exceptions didn't appear originally in the CRA, and that meant that it was completely impossible for an open source developer who makes a profit from some other activity (e.g. jam-making) to provide a product for free without incurring liability for security fixes in the future under the CRA. The exceptions have been added to protect people who are doing this "for the love of open source", while not providing wiggle room for someone like Google or Facebook to say "our products are provided for free, therefore we're not liable for keeping them secured".

Sidebar on the CRA, which was mentioned

Posted Oct 6, 2025 10:56 UTC (Mon) by Wol (subscriber, #4433) [Link] (1 responses)

> The whole reason there's been such a fuss in open source circles around the CRA is that those exceptions didn't appear originally in the CRA,

Because of terms like "place on the market", and "commercial activity" weren't made clear in the act itself.

Saying "but if I sell jam, my software falls under the CRA" is *clearly* crying wolf. Supplying software clearly has nothing to with selling jam, and once you look up those terms, that's extremely clear. The issue was, is, and always has been companies who both sell and give away software - to what extent does selling software (or hardware that needs software) bleed over into giving stuff away.

How do we make sure that giving software away "no strings attached" does not trigger the CRA - I think you're far too eager to make it trigger when it shouldn't.

But if I can't use the hardware I paid you for, without software (free or not, provided by you or not), then the CRA needs to kick in (likewise if the software I paid you for requires other 3rd-part software to work, the CRA needs to kick in).

Cheers,
Wol

Sidebar on the CRA, which was mentioned

Posted Oct 6, 2025 10:58 UTC (Mon) by farnz (subscriber, #17727) [Link]

Those are standard terms of art in EU law; they have a very clear meaning, and in the original drafts, where the exceptions to the CRA did not exist, would have resulted in liability for all software placed on the market in the EU.

This was not the intention of the Act's drafters, and they resolved this once it was brought to their attention - it would, however, have been a disaster for open source if the original wording had been intended, since it covered most software in the EU (MSDN samples would have been an exception, since they're not supplied as a product, but as documentation).