Kroah-Hartman: Linux kernel security work

> In addition to California, I may want to make it a triple play by blocking New York and Florida, too, to avoid being sued by the human skid marks who abuse the ADA to suck settlement money out of random small businesses: [link]

The ADA is a federal law. Lawsuits under the ADA may be brought in any state, if there is personal jurisdiction over the defendant and venue is proper in that state. The Second Circuit case Bensusan Restaurant Corp. v. King suggests that merely having a website accessible from the forum state is probably not enough for personal jurisdiction, but it was decided in 1997, so things may have changed since then. See also International Shoe Company v. Washington.

Regardless, geoblocking one state will not prevent lawsuits from other states. If geoblocking is necessary (contrary to the Second Circuit's ruling), then you have to block the whole US (and avoid doing business in the US, which probably has implications for hosting etc.).

I really hope we can avoid a massive discussion CRA here again. This horse has been quite beaten to death. Especially since the whole discussion tends to get mired in the fundamentally different way Europe and the US regulate markets. Europe tends to write out a description of how they want the market to work and then rely on the market participants to keep each other honest. The US tends to be more prescriptive and sets the government up as judge, jury and executioner, and the market participants spend their time trying to figure out how to avoid scrutiny.

Case in point: open source stewards. Who decides who is one? No-one. Don't give yourself that label and you're all set. That text is largely aspirational, it describes how the EP expects open source to work within the CRA framework. Its value is largely in making clear to the CxOs that all those people doing unpaid open-source work are not responsible for their bonuses. For extra clarity, Article 64.10b says stewards can't be fined, even if you could figure out who they are.

European law is largely written by people with no legal training, which means you get a lot of text of dubious legal value. A significant chunk of the Parliament and Council are very careful to make sure the EU (and governments in general) don't actually gain any powers that aren't strictly required. Concentrated executive power (we know from experience) is very risky. Read any contracts before you sign them, that's the most important lesson.

But I can say from personal experience that CRA also has for me also made it way easier to get time for security and software maintenance. Suddenly SBOMs are on the agenda, after years of being summarily dismissed.

Yes and no. Consider the definition of a steward:

> (14) ‘open-source software steward’ means a legal person, other than a manufacturer, that has the purpose or objective of systematically providing support on a sustained basis for the development of specific products with digital elements, qualifying as free and open-source software and intended for commercial activities, and that ensures the viability of those products;

It's a long list of conditions that all have to be true for the article to come into play. For the vast majority of small projects using stewards to just host their secrets, a donation account and similar, the criteria won't be met.

> (14)

> ‘open-source software steward’ means a legal person, other than a manufacturer, that has the purpose or objective of systematically providing support on a sustained basis for the development of specific products with digital elements, qualifying as free and open-source software and intended for commercial activities, and that ensures the viability of those products;

Which pretty much describes a business that supports open source as its business ... like Red Hat, SUSE or Ubuntu

And your reference basically says they have to have a security policy, which they have to provide to the regulator on request.

To my mind, it's not at all clear what the liabilities of a steward are, beyond providing the said security policy.

> (24) 3. The obligations laid down in Article 14(1) shall apply to open-source software stewards to the extent that they are involved in the development of the products with digital elements. The obligations laid down in Article 14(3) and (8) shall apply to open-source software stewards to the extent that severe incidents having an impact on the security of products with digital elements affect network and information systems provided by the open-source software stewards for the development of such products.

So what happens if the Open Source Steward provides support services but not development resources for Open Source Projects? Take Apache for example, it doesn't look as if they're affected by this ... from what little I know, Apache projects all have their own teams, and Apache just provides an umbrella - which this clause appears NOT to catch.

I'll need to read it again, but I don't see what difference a project joining a foundation would make to the project. It might make a difference to the foundation ...

> There is no such thing as a CRA mark. Sorry.

My bad - but it must have something. There must be some sort of B2B agreement in place which I've taken to calling a CRA mark. The CRA will not look kindly on a business - selling software as part of their product - that does not have a formal agreement in place for its maintenance.

I'll read the CRA again ...

Cheers,
Wol

> I should add that the legislative _intent_ of the CRA was not really known until later drafts came out that positively incorporated this feedback.

The legislative intent of legislation is determined by the Parliament/Council on the basis of the amendments that are approved. There is no gatekeeping, the Commission cannot control which way the legislation evolves.

If anything, the process demonstrated (to me anyway) that the Open source/Free software movement has a wide base of support and the process works as designed. Even the Council amendments were largely pro-open source.

We (collectively) have more influence than we realise IMHO.

> I should add that the legislative _intent_ of the CRA was not really known until later drafts came out that positively incorporated this feedback.

I've come to believe that legislative intent is a myth and legal fiction that tries come up with the least damaging theory for why the law ended up the way it did.

Basically, any time you have three or more people voting for something, this is in play. We have the intents of the three people, and the output of the process, which at best reflects a found acceptable compromise that allowed two of the three people to say "I prefer that to no law; it does look a bit schizophrenic and I don't know what it means, but seems low-risk".

By no means applies only to law.