[transpute]

  liability

> Sounds like a good way to kill off open source entirely. This is luckily unlikely to happen.

It has already happened in the EU CRA, i.e. the law has passed. Implementation details still being negotiated.

https://hn.algolia.com/?query=cyber%20resilience

[LtWorf]

That only covers for profit software.

[transpute]

Scope fine print details are still being negotiated.

Second HN story from the link above, Dec 2023, https://news.ycombinator.com/item?id=38787005

  The Debian project has completed a general-resolution vote, adopting a statement expressing concern about the Cyber Resilience Act (CRA) pending in the European Union.

  Even if only "commercial activities" are in the scope of CRA, the Free Software community - and as a consequence, everybody - will lose a lot of small projects. CRA will force many small enterprises and most probably all self employed developers out of business because they simply cannot fulfill the requirements imposed by CRA. Debian and other Linux distributions depend on their work. If accepted as it is, CRA will undermine not only an established community but also a thriving market. CRA needs an exemption for small businesses and, at the very least, solo-entrepreneur.

[LtWorf]

Yes, other stuff happened since then.