<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-IE" link="blue" vlink="purple" style="word-wrap:break-word"> <div class="WordSection1"> Maarteen<o:p></o:p> <o:p> </o:p> I think the way they�ve framed commercial activity is problematic.<o:p></o:p> It�s also inconsistent with other EU legislation where they�ve specifically carved out smaller businesses, which they should be doing here as well. <o:p></o:p> TLDR � I�m not going to lose sleep if RedHat have to do something, but I really don�t want a small open source software company with a handful of staff to be forced to meet the same criteria as a multi-billion dollar company.<o:p></o:p> <o:p> </o:p> Regards<o:p></o:p> Michele<o:p></o:p> <o:p> </o:p> <o:p> </o:p> <div> --<o:p></o:p> Mr Michele Neylon<o:p></o:p> Blacknight Solutions<o:p></o:p> Hosting, Colocation & Domains<o:p></o:p> <a href="https://www.blacknight.com/">https://www.blacknight.com/</a><o:p></o:p> <a href="https://blacknight.blog/">https://blacknight.blog/</a><o:p></o:p> Intl. +353 (0) 59 9183072<o:p></o:p> Direct Dial: +353 (0)59 9183090<o:p></o:p> Personal blog: <a href="https://michele.blog/">https://michele.blog/</a><o:p></o:p> Some thoughts: <a href="https://ceo.hosting/">https://ceo.hosting/</a><o:p></o:p> -------------------------------<o:p></o:p> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty<o:p></o:p> Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845<o:p></o:p> </div> <o:p> </o:p> <o:p> </o:p> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"> From: Maarten Aertsen <maarten@nlnetlabs.nl> Date: Tuesday, 29 November 2022 at 11:30 To: Michele Neylon - Blacknight <michele@blacknight.com>, opensource-wg@ripe.net <opensource-wg@ripe.net> Subject: Re: [opensource-wg] concern re: Cyber Resilience Act effects on open source?<o:p></o:p> </div> <div> [EXTERNAL EMAIL] Please use caution when opening attachments from unrecognised sources. hi Michele, Thanks for taking the time to respond, I really appreciate that. On 28/11/2022 18:09, Michele Neylon - Blacknight wrote: > Maybe I�m missing something, but the draft language **excludes** open > source software [..] "Yes*, but with a /very big asterisk/" (quoting from [1]) I am really thankful that an exception, even a limited one, made it at all. And at the same time, this may draw our attention away from the facts that the current proposal: 1. misses an opportunity to actually support the open source work our society depends on (in any way: acknowledgement, incentives to contribute, financial, liability, ..) 2. creates a new barrier to people or projects that move from 100% volunteer-effort to having some income by introducing compliance work that may be hard to be met by small or cash-strapped developers. I'm curious about your thoughts on the concept of "commercial activity" as it applies to software you write or use. I hope my writing on its role in the CRA is of any help. kind regards, Maarten [1] <a href="https://blog.nlnetlabs.nl/open-source-software-vs-the-cyber-resilience-act/#but-wait-isnt-there-an-exception-for-open-source">https://blog.nlnetlabs.nl/open-source-software-vs-the-cyber-resilience-act/#but-wait-isnt-there-an-exception-for-open-source</a> -- Maarten Aertsen senior internet technologist, NLnet Labs<o:p></o:p> </div> </div> </body> </html>