<div dir="auto">My understand is that the time to influence has largely passed (but at least some good feedback is now going to be included).</div><div dir="auto"><br></div><div dir="auto">We will be in a better position to plan after November 8th, and then again when the law goes into effect. </div><div dir="auto"><br></div><div dir="auto">Some personal notes and observations:</div><div dir="auto"><br></div><div dir="auto">* The public feedback understandably focuses on liability for individuals and organizations that contribute to free and open source. It is my hope that projects can be sheltered by OSGeo, with the foundation allowing risk to be shared, rather than simply excluding contributors from Europe (or having contributors from Europe exclude themselves). </div><div dir="auto"><br></div><div dir="auto">* I am curious if this will be like GPDR and have a world wide impact on service providers, software and websites (just because they can be accessed from Europe and are thus "published" into the european market and subject to regulation). </div><div dir="auto"><br></div><div dir="auto">* To be successful in helping projects face CRA requirements OSGeo will have revise our project incubation requirements. It is rare for OSGeo to play such an active role. The last time this was done was done to implement code-of-conduct policies (which was also a response to liability risk).</div><div dir="auto"><br></div><div dir="auto">* I expect OSGeo benefit from better funding/participation to help projects meet CRA requirements. As a community, for whatever reason, we struggle to talk plainly about money.</div><div dir="auto"><br></div><div dir="auto">* It is awkward that service providers / organizations / companies do not have great representation in our community. Collaborating on topics like the CRA may be an opportunity for OSGeo to strengthen these relationships (and to strengthen relationships between service providers).</div><div dir="auto"><br></div><div dir="auto">* It is interesting that the CRA is strongly aligned with one of OSGeo's cherished beliefs: that project governance is best shared. The revised text appears to acknowledge projects with a decentralized decision making, while projects managed by a single developer or company require full compliance. Having shared governance is also a requirement for OSGeo projects (part of our history of being adverse to vendor lock-in).</div><div dir="auto"><br></div><div dir="auto">* Many FOSS4G projects are managed by a single individual or organization. Seeking out partnerships to avoid being governed by a single entity, or joining the OSGeo foundation as a project to take advantage of reduced requirements, may be a sensible response.</div><div dir="auto"><br></div><div dir="auto">* OSGeo community projects are endorsed by OSGeo, but do not have a formal leadership relationship with OSGeo. We may need to revisit this program in 2024 strictly from a liability perspective.</div><div dir="auto"><br></div><div style="background-color:rgba(0,0,0,0)!important;border-color:rgb(255,255,255)!important;color:rgb(255,255,255)!important" dir="auto"><div style="color:rgb(255,255,255)!important;background-color:rgba(0,0,0,0)!important;border-color:rgb(255,255,255)!important"><div dir="auto" style="font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;background-color:rgba(0,0,0,0);border-color:rgb(0,0,0);color:rgb(0,0,0)">* I<span style="background-color:rgba(0,0,0,0);border-color:rgb(0,0,0);color:rgb(0,0,0)"> feel that this regulation is what success looks like for free and open-source. Regulation in Europe is not isolated, as there is also regulation taking shape in the US and other markets.</span></div><div dir="auto" style="font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;background-color:rgba(0,0,0,0);border-color:rgb(0,0,0);color:rgb(0,0,0)"><br></div><div dir="auto" style="font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;background-color:rgba(0,0,0,0);border-color:rgb(255,255,255)"><span><div><div dir="auto" style="font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;background-color:rgba(0,0,0,0);border-color:rgb(0,0,0);color:rgb(0,0,0)">* It looks like some of the more annoying regulations may be required only for vulnerabilities that are actively under attack. Security experts are already speaking up on why ideas like informing the government within 24 hours is a terrible idea.</div><div dir="auto" style="font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;background-color:rgba(0,0,0,0);border-color:rgb(0,0,0);color:rgb(0,0,0)"><br></div><div dir="auto" style="font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;background-color:rgba(0,0,0,0);border-color:rgb(0,0,0);color:rgb(0,0,0)">We will learn more next week,</div><div dir="auto" style="font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;background-color:rgba(0,0,0,0);border-color:rgb(0,0,0);color:rgb(0,0,0)">Jody</div></div></span></div></div></div><div dir="auto"><br></div><div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Nov 3, 2023 at 12:35 AM Luís Moreira de Sousa <<a href="mailto:luis.de.sousa@protonmail.ch">luis.de.sousa@protonmail.ch</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;padding-left:1ex;border-left-color:rgb(204,204,204)"><div style="font-family:Menlo,Consolas,"Courier New",monospace;font-size:14px">Hi there,</div><div style="font-family:Menlo,Consolas,"Courier New",monospace;font-size:14px"><br></div><div style="font-family:Menlo,Consolas,"Courier New",monospace;font-size:14px">thank you to the board for going through with this initiative. While it may seem there is little time left to influence the process, it is still very important to let your MEPs know of your concerns. We all benefit if the open source community at large makes it clear it is sentient of legislative initiatives and willing to engage.<br></div><div style="font-family:Menlo,Consolas,"Courier New",monospace;font-size:14px"><br></div><div style="font-family:Menlo,Consolas,"Courier New",monospace;font-size:14px">Regards.</div><div style="font-family:Menlo,Consolas,"Courier New",monospace;font-size:14px"><br></div>
<div style="font-family:Menlo,Consolas,"Courier New",monospace;font-size:14px">
<div style="font-family:Menlo,Consolas,"Courier New",monospace">
<div style="font-family:Menlo,Consolas,"Courier New",monospace"><br></div><div style="font-family:Menlo,Consolas,"Courier New",monospace">-- <br></div><div style="font-family:Menlo,Consolas,"Courier New",monospace">Luís</div><div style="font-family:Menlo,Consolas,"Courier New",monospace"><br></div>
</div>
<div style="font-family:Menlo,Consolas,"Courier New",monospace;font-size:14px"><br></div>
<div style="font-family:Menlo,Consolas,"Courier New",monospace">
Sent with <a href="https://proton.me/" rel="noopener noreferrer" target="_blank" style="font-family:Menlo,Consolas,"Courier New",monospace">Proton Mail</a> secure email.
</div>
</div>
<div style="font-family:Menlo,Consolas,"Courier New",monospace;font-size:14px"><br></div><div>
------- Original Message -------<br>
On Thursday, November 2nd, 2023 at 8:17 PM, Jody Garnett via Discuss <<a href="mailto:discuss@lists.osgeo.org" target="_blank">discuss@lists.osgeo.org</a>> wrote:<br><br>
<blockquote type="cite">
<div dir="ltr">Dear All,</div><div dir="ltr"><br></div><div dir="ltr">A short statement from OSGeo is now available to share: <a href="https://www.osgeo.org/foundation-news/eu-cyber-resilience-act/" rel="noreferrer nofollow noopener" target="_blank">https://www.osgeo.org/foundation-news/eu-cyber-resilience-act/</a></div><div dir="ltr"><br></div>
Thanks to OSGeo board and Simone Giannecchini for working on this statement. <div><div><div data-smartmail="gmail_signature" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div>--</div><div>Jody Garnett</div></div></div></div></div></div></div>
</blockquote><br>
</div></blockquote></div></div>