[froh]

there needs to be regulation of for profit services, so when you _buy_ software, there is a baseline that you can rely on, as a buyer.

we do not need regulation limiting distribution of volunteer work.

and the vague language for the delineation line is what's problematic with this proposal.

volunteers have no resources (time, money) to defend themselves or their products against false accusations of lack of compliance. likewise companies that happen to provide foss components might be approached about compliance even for their github content.

[GuB-42]

The problem with giving a pass to volunteer work and not to commercial activity is that there is a lot of potential for loopholes. Like by having a nonprofit tied to a for-profit company.

Getting the spirit of the law into writing is tricky, and it will most likely improve over time. Closing loopholes and making exceptions when merited.

[Ekaros]

Also many non-profits are big enough that you should absolutely apply rules to them. Think of Mozilla... It has very big and expensive products. And somehow just because they are non-profit and open source they should get away with murder...

[froh]

well you could easily put regulations on whatever is delivered to paying customers.

so if you do pay for software you know which cybersecurity scrutiny is in place --- while no cost software comes at no warranties whatsoever.