> It is of particular importance for manufacturers to ensure that their products do not contain vulnerable components developed by third parties.
> Manufacturers shall, upon identifying a vulnerability in a component, including in an open source component, which is integrated in the product with digital elements, report the vulnerability to the person or entity maintaining the component.
EDIT: Also, I concur the poster below. It's developers who oppose against management to allocate time for bugs and technical debt instead of new features.
First, I like how you included “popular” adjective. That alone disqualifies 99% of projects. These are the projects “hacked” by non-paid devs.
Second, some proof would be nice. I live in .net/nugget ecosystem and other than libraries backed by MS, most popular projects are not (at least ones I know of).
TBF there is a lot of things “free of charge” connected to commercial activity, e.g. Android, .NET Core, MongoDb, ElasticSearch, even RedHat with Linux …
I understand need to somehow include them, but the line should be at the for-profit companies and exclude non profits and individual developers.
How to formulate it without easy loopholes is no easy task.
You are asking how requiring open source with no money to satisfy plethora of regulations along with legal liability (I.e. making it a commercial grade) makes it less likely for open source be made?
There is some hope for individual developers in EP amended version https://www.europarl.europa.eu/meetdocs/2014_2019/plmrep/COM... article 10c:
> Developers contributing individually to free and open-source projects should not be subject to obligations pursuant to this Regulation.
Actually it’s an improved version. Hopefully it will make it through consolidation with EC version.
Professional does for money, by definition. That doesn’t apply for most open source. RedHat employee contributing to Linux kernel is an exception, not a rule.
To put it bluntly, it means a significant risk when creating any open source project. It’s a common knowledge that there is no money in open source, but suddenly I am liable. Half of open source licenses is disclaimer of liability. Also a lot of other yet to be defined requirements (harmonised regulations it is called I believe).
Linux, World Wide Web… not worth the risk.
So I am making something in my free time, as a hobby, no monetary gain and suddenly I can easily get sued to oblivion. I need to at least buy insurance. My library is used left and right in commercial activity.
The impact assessment for CRA is a total lie. It assumes 100% decrease in cyber damages and laughably low compliance cost and very small amount of impacted entities (only companies, not individuals and each company makes one product).
TBF, version amended by EP explicitly excludes individual developers, hopefully it makes it through trialogue.
Edit: basically imagine authors of log4j. Remember that security flaw that impacted half the internet? That is what’s called liability. Did they use ‘ apply effective and regular tests and reviews of the security of the product with digital elements;’? Better make it industrial grade product, with no money, in their free time.
1. Reproduction is already heavily subsidized in many countries, be it direct grants, tax breats and so on. This is nothing new.
2. Most people actually want children. Getting someone to actually procreate with that will share burden.
3. Investing in children should hel to fund future pension payments. There is pretty good case for self-interest.
4. China won't care, neither will Russia or other parts of world.
5. Countries that will do that will have a better outcome than countries full of retirees. Unless AI takes over, natural selection will take care of rest
That assumes that new humans can be only by women.
There is no reason, why artificial womb, possibly with multiple selection box for genes, is not a very realistic possibility, along with state funded child rearing services. (see Norway)
Maybe, but normal developer interracts with sane parts.
Honestly, the biggest problem with git is sane environment for merge conflicts and that is out of scope of git CLI. In most cases, imposing rule for small PRs/feature branches will solve it.
git add, git commit, git log, git blame, git push, git rebase -i --onto. That is 95+% of what developers use (maybe an option here or there, like -m or --amend). Merges are done on CI after it passes.
There are a lot of arcane parts and switches. git-send-email is likely used a lot on kernel development, but very rarely in the rest of the world.
> I've got 10 years in it and it still bites me in the ass.
Can you give some examples? I had some problems in the beginnings, but it was because i tried to be "smart".
After I embraced KISS, everything works nicely. As long as I keep "public" branches protected, any splash zone is very small and at worst, just redo it(synergy with small PRs).
I don't really see a benefit of having all code of an org in a single repo. Single product, sure. But whole company? Why. Not to mention, these are serious outliers.
From security standpoint, it doesn't seem great, from practical side, it's not great (bandwidth cost ect).
Important bits (10c and around):
* Libraries/non-end products are fine, unless monetized.
* Employee contributions seem to be fine.
* Foundations seem to be fine.
* Non-core developers are fine
Seems like significantly better version.