What has (can) the EU Cyber Resilience Act done (do) for you?

16 points by tomhukins 12 hours ago on lobsters | 5 comments

marginalia | an hour ago

Yeah when this goes into force I'm probably shutting down all my software development operations and public services. I can't bare the Damocles sword of risking a random 15 million EUR fine for not developing my software in a fashion that adequately pleases Von Der Leyen. That is not a reasonable risk, nor an acceptable burden for a single person to bear.

Do you even fall into the category of manufacturer/would your operations even be consisidered commerical activity? If so, Ok, fair, might be too much of a risk for you. If not, then there are very clear carve outs in this law for you. Only upstream consumers of your open source software are even affected.

marginalia | 11 minutes ago

Yes, I would fall under commercial activity. I run a search engine with a commercial API offering. I do have non-profit elements of the operation, but operating a search engine costs money, so I can't do the latter without the former.

Depending on specifics, you might still be covered under recital 18, if all revenue is just to operate the engine:

Finally, for the purposes of this Regulation, the development of products with digital elements qualifying as free and open-source software by not-for-profit organisations should not be considered to be a commercial activity provided that the organisation is set up in such a way that ensures that all earnings after costs are used to achieve not-for-profit objectives.

marginalia | 4 minutes ago

Well I got to eat and pay rent somehow too.