Hello everyone, as you probably know, both Alex and I are co-organizes in the dev room.
And as we were finishing out the schedule, we started to realize that the entire afternoon
was going to be about CRA, and I said we should have another session on the CRA, in fact.
And I think, by the fact that this individual here is willing to leave their hand up the entire
time between the break, just to get the first question on the next panel, shows we made a good choice to give you a lot of CRA content.
This particular panel, I want to focus on the question exclusively of open source stewards, who is going to be them,
where they're going to do, and in particular speaking as someone who is in the leadership of a US nonprofit,
charity that is the home to many open source and free software projects, we are struggling to figure out what our obligations are going to be.
Should we be an open source store? Should we not as we heard in the last session? It's kind of a choice, but we're afraid if we don't do it, someone else will come in for one of our projects and do it poorly.
So we are just desperately, and I send these frantic emails to Alex with lists of questions.
And he sometimes answers me, which is great. I did send him one earlier this week, and he's not answered yet.
But we're really appreciative of our European colleagues who can explain this to us and help us participate,
because we might have heard my talk this morning, there's some things in the CRA, I don't like, but much of the CRA is a very good policy.
And so we want to do the right thing, but we don't know what to do, and we don't understand what's happening.
And so instead of you all having to email Alex, which we just fill is inbox, I figured I should bring the two of them here and have both of you tell us everything.
So tell us everything.
Before we start telling everything, I think it's also important for you to know who we are.
Gradually in the civil society, but this is pretty interesting for you, is from the market surveillance also, and this is of interesting, they are the ones that ultimately check everything.
So basically, maybe you want to tell us a bit of how your daily work will look like in 2021.
And I apologize for those watching this recording later that we just had a panel with these two America.
So everybody in the audience basically knows who they are, but we should all introduce ourselves to totally right Alex.
Just a bit.
Yeah, I started working at the market surveillance of the BSI, and right now in Germany, it's not clear, it still has to, there still has to be made a decision on who's becoming the market surveillance.
But since time is of importance, we already started to look at the CIA and see what we can get out of it.
And what implications the CIA might have for us is, if we in a certain way get a part in the market surveillance, and then have to look at all the stuff.
So no.
You might as well just say the questions, the hands are flying up.
So we'll go for it.
Well, I saw another hand.
Thank you.
So I've got the question around Stuart.
And I've been working for Android for a long time.
I've led longevity, I've worked with European regulators on digital market sack.
And I've kind of pictured that crazy graph that you showed earlier.
And I was like, there's no way in hell this is going to happen.
So I left Google to build some of the tooling that I think is missing around that space.
So we'd love to connect with you and chat some more about us.
But on the Stuart's aspect, there was a definition earlier version of the CIA of something akin to software underdog.
Banks have this concept.
Where if a company goes past or for whatever reason that company doesn't exist or doesn't want to support some piece of some device,
then there's someone else that has access to that code base.
There are a lot of folks here that are on sort of like linear GIS or versions of Android that run open source software.
A lot of those folks are actually suffering from that concept not existing and not having access to that software.
So is that something that's still in the latest version, the concept of our underdog and how would that come into effect?
It was very, very poorly defining earlier versions.
Is that something that you can answer?
It was from what I could tell, there was a lot of acronyms on your crazy graph slide.
But from what I could tell, there wasn't a software underdog on that size slide.
I have had a more complicated question if you want, but I could read those for you.
It's a problem.
I'm not sure if it's still in the text.
I know that Binder might have to look at it for companies that go out of business.
The commission has the rights to step in in what way we have to find out.
And if it's an important product for the EU market, then they can do some things.
And if that what you just described is still in there.
I can't remember from the last time I've read it, but.
It's one of those things that only works if you do it the head of the enterprise.
Once the company's best software is done, you need to think about that at a time.
Could I get that more of our phones are super important to the EU market?
Because you have millions, tens of millions of millions of millions of millions of millions of millions.
We have to be careful with the mic.
Okay.
Give it one more.
Thank you.
Sorry, I was just saying that it's probably one of those things that you want to define a head of
time, right?
Because if you're an undertaker, you need to define that from the beginning of a product.
You could define, you could make it claim that mobile phones and some of these devices are
super important, right?
You have all sorts of data on it.
Very critical to our usage.
Anyway, I can take that to find.
It sounds like more clarity.
Maybe like in between, we can, as well.
Okay, good, good.
So then I'll take the next break.
I have two questions and I'm using the mic now to ask them, but they are very much related.
So if my company opens or sees something as a new open project, which is not part of any of
products, is my company becomes a steward automatically or the related question.
Are there any open projects without steward?
I'd say yes, so I mean, there's no, there's not really a rule that says you need to be a steward
and even then there are also not that many rules that tell you what to do as a steward.
So this is a bit like what for coming to it to say, you can even pick as a steward specific
roles, activities you follow, but there's nothing in the law where clearly says you will be the steward.
Yeah, and on the point of the applications for steward, the steward has the obligation to
cooperate with the market surveillance also, Richie.
And he has to provide technical documentation if the market surveillance has a reasonable request.
He has to report vulnerabilities and severe incidents.
And he has to do the policy on how to develop secure products and how to do vulnerability handling effectively.
So there aren't that many applications, the manufacturers reporting and working together with the market surveillance.
That's the main applications.
Because Mark is next to that he's my friend.
He won't be mad that I ask my question.
But one of the reasons we put this panel together was a reason I wanted to put this panel together.
I want our Alex and ask him questions.
And one of the questions that is burning in our mind at the charities in the United States who are homes to open source and free software projects is that we don't
want to be an open store star steward and we do.
And what I mean by that is what I look at the CRA, my fear, and this is the fear I don't know, is that there's going to be kind of a libertarian
of free market of stewards running around pitching to projects saying, oh, we can be your steward.
We know how to do it all for you.
We're going to raise money for you and so forth.
And there's to be quite fine about it.
There are organizations in the US right now making those kinds of pitches to projects, including projects that are already affiliated with software freedom
Conservancy where I work.
And so we feel like most of you jump in and being open source steward, but we're not commercial.
It seems like all the open source steward requirements are regarding commercialization.
So we're in a weird situation.
And Alex, you tell us what to do, we'll do it.
So I don't believe that normally you want to be a steward.
So I would recommend to become a steward, but not just do it, so you should learn.
And this is, I mean, if I would be in your position, I would talk to the market surveillance also.
And what ask this person, how me as a steward could make sure that there is not that pressure coming from the manufacturer on the one hand.
And that I'm also sure that I'm like capable of fulfilling the obligations and that maybe we come even to a point that the manufacturer is supporting the steward.
To support the manufacturer.
And this is basically, I'd say it's a possible thing to achieve in the next year that we can manage it to bring.
So at the moment, I'd say there are manufacturers that just like take free software and don't contribute back.
But this is here, we have the possibility to bring the pressure to the manufacturer to contribute back to these projects or code that they are coming from.
And this is possible, and that's why I'd say it's a good idea to become a steward.
So maybe we have this discussion again in the next year.
And then we have a bit more like guidance, a bit more text, and then it's a bit more clearer.
Really a good idea, but at the moment, in general, I'd say for us as the free software community, we should go in the direction to have steward.
And that we have a good relationship between manufacturers and steward's written in guidance that we can make sure steward will never be under pressure and happy to fulfill the obligations that are there.
And the good thing that the guidance right now isn't there, and has to be written, somebody has to write it, and somebody has to contribute to the guidance which will be written.
So if we figure, or if the open source community figures out how they want to use this steward, or how they want act as a steward.
And in an even better way, if they can get together with the manufacturers and figure together out a way to interact with one another, so that everybody benefits from that.
And that gets into the guidance, then we do have a really good chance to get something good out of this.
And maybe if you ask yourself, how to contribute to such text, there is a project by the BSI and the FSI where we are trying to get questions from the audience and best practices of communities working together with manufacturers that we could use as a blueprint for such text, for example.
Or if you have any ideas what should be there, then it's a good idea to tell this to us and we will ventilate this in the project and it has good chances to end up somewhere.
I'm trying to reformulate my question based on all this, but basically my question was about fear of somebody else becoming a software steward, to me that sounds fantastic.
But really, I'm not packaging my own software, someone else does, let that person be the software steward.
Why are you afraid of somebody else becoming the software steward?
I would love somebody else to step in and say, oh, I'll do all the bureaucratic European marketing stuff.
So I can address why we're afraid for basically two reasons where a US-based organization, and we did a lot of work to comply with GDPR.
GDPR is a great law and we are glad to comply with it, but as a small charity, it's difficult.
I literally didn't, I was handling somebody's GDPR requests when I was supposed to be prepping my talk for this morning, because they write in and then there's like, oh, what day, where is their stuff stored and so forth.
So our concern about the CRA is, it's first of all that, we need experts like these folks in Europe to explain to us what to do.
The other concern we have, and I'm going to say something slightly annoying to developers in the crowd, but developers have a tendency to want to work on the things that are interesting to them, and exactly how you feel mark is like, oh, you're going to take care of this for me.
Great, I don't want to think about it because I just want to be hacking.
The problem is it's going to be very difficult, I'm worried, that it's going to be very difficult for you to figure out who to trust, because you will probably, if your project is important, get pitched by a lot of organizations saying they can be your steward, and they might be bad at it.
And the relationships with your users are really important to you, so even though you're non-commercial, you know, free software or volunteer hacker, the people who use your project are doing it commercially, they need an open sort of steward in between, and what if they screw up, and then they hate your project because the open source steward grew up.
Those are things I'm worried about, whether I see no in the crowd, we don't know whether we should worry about it, and it sounds like we just have to help you write the wigs so that we don't have to be worried anymore.
Hi, thank you, I'm not sure if this is relevant, but yeah, it's okay if you cannot answer it.
So this is about the scope of the area. I mean, there was a mention that cars are not automotive industry are exempted.
I'm just wondering if they're exempted outright fully because the referencing in CRA refers to UN regulation, UN R155, which is about type of rule, like manufacturers getting their product like cars approved before releasing it to the market.
So I mean, this regulation doesn't really say much about software and security used in cars, and then comes CRA, and it also references like, there's remote access, which creates vulnerabilities, but more specific regulations should be applied, that then comes CRA.
So there's a gap when CRA is exempting this industry, but in reality it's not really sure, so I'm just wondering if you have any thoughts on that.
Yeah, so I'd say, so even if cars are exempted, it's, so if you're, there will be still parts in the car that have a CE label, so for example, if you put the fridge in the car, the fridge.
There's a rules covering cars, help on the trim system.
Yeah. They already have rules, so they're covered by those rules.
The CRA explicitly covers, and I think that there's a lot of everybody watching the video, can't anything right now.
Yeah, the thing is, in those other regulations, there are a very specific on what's the car, and what's the medical device, and what device, force under that directive or that law, so they know what to do, and there are cyber security, or there is cyber security stuff in those regulations.
That's why they're out of scope from the CE, and every part in the car, which doesn't fall under those other regulations, then they have to comply to the CE.
Quickly, one request again, if you lower your hand in between, it's somehow for me assuming it's gone, and if I'm next to you, I will leave you from doing it, but else it really helps me if you keep it up to have the order.
Yeah, I just want to add good news from Mark, actually, I am your steward.
So, whether that's a joke, but who has something to be steward, and can they be multiple steward, and can anybody be the steward from anyone?
Well, that's something we have someone in the audience who knows the answer.
Otherwise, that's...
So, the principal of the CERA says that if somebody like you decides that you just want to be a country,
pushing your code out there and have no responsibility for it, multiple people can fork your code and do whatever they want.
And then, if somebody multiple different organizations decide that they want to be steward for those things, they can keep forking your code.
You will lose control over anything that you're doing, but that will be the consequence for this.
If you don't decide to have a relationship and assert some level of sovereignty, because you can just fork the open source projects, that's what will happen.
Now, in a very small project where nobody cares, this is not relevant.
But somebody's going to come along and say, I, some manufacturers going to want security from somebody, and they're going to look for somebody that they can have a commercial relationship with.
If you don't want to be that thing, if it's important enough and there's enough money, somebody else will fork your stuff.
If it isn't important, then nobody's going to touch it, and there's going to be a band gap created,
where there will be projects which people will run after, and there may be multiple of them, and they may fork them in different areas.
So red hat may say, we'll do the red hat flavor, and Susan will say, we'll do the Susan flavor, and they'll all do their thingy.
And you're still doing stuff, maybe, maybe they just keep taking your updates and you're living where you are, and that's okay.
And maybe you like that.
Or you feel unloved because nobody appreciates the work you're doing.
You need to make a call, right?
There's a consequence that's going to be driven into the market because of this.
So if you submit a talk and we forgot to accept it, I apologize, or we did try to invite people on the panels who submitted talks about it,
and you should definitely submit a talk about this next year.
I think we have people in the queue for the question.
Yeah, so this is going to be the elephant in the room, I think.
Last year, I was in Johnson where there are an ounce that's serious stuff, and I was so surprised, I didn't raise my hand.
And well, it's probably more for the commission, but the room is full.
Free software exists just because hardware vendors and software vendors were not held accountable for not publishing the documentation of their hardware for 30 years.
And now we are supposed to be held accountable for stuff rewards that is based on stuff that's not known to us.
So first question, did anybody waste entire nights reversing engineering things to write specs, to write drivers for free software staff?
And then do you know how many drivers there are in Linux, just Linux alone that are based on reversing engineering that absolutely nobody can certify that they will not burn your computers or just burn your car for the matter.
So yeah, how dare they held us accountable for stuff we cannot be held accountable.
So my question is sort of related to that, from the point of view of a developer, is there a conflict, a licensing conflict between an open source license,
and the downstream beneficiary, because most open source licenses are give the software without a warranty.
And now it feels like the CRA is imposing a warranty, which is a conflict.
I'll form it in the as a as a question, is that a conflict of the software license open source software license or and or is it a conflict of the social contract as Bradley would like to say, is it altering the deal.
Looking upstream, potentially a project might have a hundred upstreams and now what do I do as a developer if you know 50 of them are abandoned.
So if you call me out, I'll start. I think I don't have any, I don't see any problem as the resident copy left expert with selling warranties.
In fact, for years, it's been made clear that selling warranties was a was a useful practice to engage as a free software business.
So to the extent to which open source stewards are selling warranties of some sort of a fashion, no problem there.
My bigger concern in what you're asking, which you didn't actually ask, so I'm going to do the thing where I turn the question into the one I want to ask, which is I'm very concerned about the other issue of the fact that many of the manufacturers who need an open source steward are also the same manufacturers who refuse to comply with copy left.
So we have this weird situation, especially for us, it's all for freedom conservancies, since we are both going to say open source steward not by defined by CRA, but we were on the root of corner solves that before the CRA was written.
But we also enforce copy left for our projects. So we have this weird situation where what if we end up at open source steward and we have a manufacturer who is relying on us as open source steward who is violating copy left.
I have no, what am I supposed to do then?
I mean documentation can also be.
And that's what it is. So to be honest, I'm not sure if this will be a real problem.
So I don't know, but at the moment I couldn't imagine.
So at the moment, I think this is one of the problems.
And again, I mean, we are basically talking about workflows.
So you end the C-label. So it's about you have some workflows and you check, do you have a secure product, you put the C-label bank.
So I mean, you can really compare it from the physical product world.
And how we use C-label's there and what we do is the C-label.
So there's still a lot of crap on our market.
It gives us a bit more in the direction of cybersecurity.
And it's also not the market surveillance authority that these are 5,000 people just checking everything.
So I mean, you can even compare it to the data protection.
I mean, it's not that we have data protection all over Europe.
Now just because we have data protection law.
So we are just going with this thing in a direction of more cybersecurity.
And ultimately, just it's the E-label and the time is up.
Thank you all.