Re: Call for vote: public statement about the EU Legislation "Cyber Resilience Act and Product Liability Directive"
Seconded Second version, taking into account feedback. Looking for seconds at this point: - GENERAL RESOLUTION STARTS - Debian Public Statement about the EU Cyber Resilience Act and the Product Liability Directive The European Union is currently preparing a regulation "on horizontal cybersecurity requirements for products with digital elements" known as the Cyber Resilience Act (CRA). It's currently in the final "trilogue" phase of the legislative process. The act includes a set of essential cybersecurity and vulnerability handling requirements for manufacturers. It will require products to be accompanied by information and instructions to the user. Manufacturers will need to perform risk assessments and produce technical documentation and for critical components, have third-party audits conducted. Security issues under active exploitation will have to be reported to European authorities within 24 hours (1). The CRA will be followed up by an update to the existing Product Liability Directive (PLD) which, among other things, will introduce the requirement for products on the market using software to be able to receive updates to address security vulnerabilities. Given the current state of the electronics and computing devices market, constellated with too many irresponsible vendors not taking taking enough precautions to ensure and maintain the security of their products, resulting in grave issues such as the plague of ransomware (that, among other things, has often caused public services to be severely hampered or shut down entirely, across the European Union and beyond, to the detriment of its citizens), the Debian project welcomes this initiative and supports its spirit and intent. The Debian project believes Free and Open Source Software Projects to be very well positioned to respond to modern challenges around security and accountability that these regulations aim to improve for products commercialized on the Single Market. Debian is well known for its security track record through practices of responsible disclosure and coordination with upstream developers and other Free and Open Source Software projects. The project aims to live up to the commitment made in the Debian Social Contract: "We will not hide problems." (2) The Debian project welcomes the attempt of the legislators to ensure that the development of Free and Open Source Software is not negatively affected by these regulations, as clearly expressed by the European Commission in response to stakeholders' requests (1) and as stated in Recital 10 of the preamble to the CRA: 'In order not to hamper innovation or research, free and open-source software developed or supplied outside the course of a commercial activity should not be covered by this Regulation.' The Debian project however notes that not enough emphasis has been employed in all parts of these regulations to clearly exonerate Free and Open Source Software developers and maintainers from being subject to the same liabilities as commercial vendors, which has caused uncertainty and worry among such stakeholders. Therefore, the Debian project asks the legislators to enhance the text of these regulations to clarify beyond any reasonable doubt that Free and Open Source Software developers and contributors are not going to be treated as commercial vendors in the exercise of their duties when merely developing and publishing Free and Open Source Software, with special emphasis on clarifying grey areas, such as donations, contributions from commercial companies and developing Free and Open Source Software that may be later commercialised by a commercial vendor. It is fundamental for the interests of the European Union itself that Free and Open Source Software development can continue to thrive and produce high quality software components, applications and operating systems, and this can only happen if Free and Open Source Software developers and contributors can continue to work on these projects as they have been doing before these new regulations, especially but not exclusively in the context of nonprofit organizations, without being encumbered by legal requirements that are only appropriate for commercial companies and enterprises. == Sources: (1) CRA proposals and links: https://www.europarl.europa.eu/legislative-train/theme-a-europe-fit-for-the-digital-age/file-proposal-for-cybersecurity-regulation PLD proposals and links: https://www.europarl.europa.eu/legislative-train/theme-a-europe-fit-for-the-digital-age/file-new-product-liability-directive Response from the European Commission to a question from the
Re: Amendment to RMS/FSF GR: Option 5
Am 03.04.21 um 20:16 schrieb Kurt Roeckx: On Sat, Apr 03, 2021 at 08:12:50PM +0200, Michael Biebl wrote: On Sat, Apr 03, 2021 at 10:56:45AM +1100, Craig Sanders wrote: Short and simple: TEXT OF OPTION 5 Debian refuses to participate in and denounces the witch-hunt against Richard Stallman, the Free Software Foundation, and the members of the board of the Free Software Foundation. I think this option should be on the ballot as well for a fair representation off all sides. So seconded. This mail wasn't signed. There are more than enough seconds already. Grrh, sorry. Thanks Kurt! OpenPGP_signature Description: OpenPGP digital signature
Re: Amendment to RMS/FSF GR: Option 5
On Sat, Apr 03, 2021 at 10:56:45AM +1100, Craig Sanders wrote: > Short and simple: > > TEXT OF OPTION 5 > > > Debian refuses to participate in and denounces the witch-hunt against Richard > Stallman, the Free Software Foundation, and the members of the board of the > Free Software Foundation. > > I think this option should be on the ballot as well for a fair representation off all sides. So seconded. Regards, Michael
Re: "rms-open-letter" choice 3: do not, as the project itself, sign any letter regarding rms
Timo Weingärtner: Updated text: ---8<---8<---8<--- The Debian Project will not issue a public statement on whether Richard Stallman should be removed from leadership positions or not. Any individual (including Debian members) wishing to (co-)sign any of the open letters on this subject is invited to do this in a personal capacity. ---8<---8<---8<--- Seconded An alternative would be removing the last sentence all together, how do you think about that? Fwiw, I'd keep that sentence. Regards, Michael OpenPGP_signature Description: OpenPGP digital signature
Re: "rms-open-letter" choice 3: do not, as the project itself, sign any letter regarding rms
Hi Gunnar Am 27.03.2021 um 01:48 schrieb Gunnar Wolf: Michael Biebl dijo [Fri, Mar 26, 2021 at 06:08:36PM +0100]: ---8<---8<---8<--- The Debian Project will not issue a public statement on whether Richard Stallman should be removed from leadership positions or not. Any individual (including Debian members) wishing to (co-)sign any of the open letters in question is invited to do this in person. ---8<---8<---8<--- Language quip: Not "invited to do this in person" (personally flying to wherever signatures are being gathered), but "in a personal capacity" or "as an individual action"... ? I think the intention was clear, but I'm fine with a version which changes that part as suggested above and my seconds extends to such a version. Regards, Michael OpenPGP_signature Description: OpenPGP digital signature
Re: "rms-open-letter" choice 3: do not, as the project itself, sign any letter regarding rms
---8<---8<---8<--- The Debian Project will not issue a public statement on whether Richard Stallman should be removed from leadership positions or not. Any individual (including Debian members) wishing to (co-)sign any of the open letters in question is invited to do this in person. ---8<---8<---8<--- seconded OpenPGP_signature Description: OpenPGP digital signature
Re: Proposal: Focus on systemd
Am 29.11.19 um 21:16 schrieb Martin Michlmayr: > I'd like submit the following proposal: > > Proposal: Focus on systemd to promote standardization and cross-distribution > cooperation > > This resolution is a position statement under section 4.1 (5) of the > Debian constitution: > > Cross-distribution standards and cooperation are important factors in > the choice of core Debian technologies. It is important to recognize > that the Linux ecosystem has widely adopted systemd and that the level > of integration of systemd technologies in Linux systems will increase > with time. > > Debian is proud to support and integrate many different technologies. > With everything we do, the costs and benefits need to be considered, > both for users and in terms of the effects on our development community. > An init system is not an isolated component, but is deeply integrated in > the core layer of the system and affects many packages. We believe that > the benefits of supporting multiple init systems do not outweigh the > costs. > > Debian can continue to provide and explore other init systems, but > systemd is the only officially supported init system. Wishlist bug > reports with patches can be submitted, which package maintainers should > review like other bug reports with patches. As with systemd, work > should be done upstream and in cooperation with other Linux and FOSS > distributions where possible. The priority is on standardization > without the reliance on complicated compatibility layers. > > Integrating systemd more deeply into Debian will lead to a more > integrated and tested system, improve standardization of Linux systems, > and bring many new technologies to our users. Packages can rely upon, > and are encouraged to make full use of, functionality provided by > systemd. Solutions based on systemd technologies will allow for more > cross-distribution cooperation. The project will work on proposals and > coordinate transitions from Debian-specific solutions where appropriate. > Thank you Martin. Seconded. -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth? signature.asc Description: OpenPGP digital signature
Re: Please wait a bit longer before calling for a vote
Hi Am 29.11.19 um 14:46 schrieb Sam Hartman: >> "Simon" == Simon Richter writes: > > Simon> While I generally agree with Sam here that it is rather > Simon> disingenious to add a new option right at the end of the > Simon> discussion period, I think that having something proposed by > Simon> the systemd maintainers on the ballot will be worthwhile > Simon> because they have one of the best vantage points to see > Simon> future points of contention and whether the GR is likely to > Simon> guide us through them. > > Martin Pit has publically stated he's one of the people I reached out > to in developing my proposals. > As I understand, he's been active in maintaining systemd both in Ubuntu and > Debain. > I was and am very grateful for Martin stepping in to engange in those discussions, even if he is not that active anymore in Debian/systemd since he moved to RedHat. When the initial options for the ballot were proposed, I contacted Martin privately, that I was not happy with the existing options (I think that was roughly two weeks ago). I did not follow debian-vote, because I find those Debian politics very emotionally draining. I was hoping given my feedback, that Martin would engage in further discussions to refine the proposals. This apparently did not happen and was probably too naive from me. During this week I was contacted via IRC by people who were concerned about the state of the existing options, as they didn't feel represented there. While I was trying to get a text together during the week, I failed to do so, for which I apologize. So I asked Ansgar, if we could ask you, Sam, for one week delay. The reason being, that I did *not* want to propose an option the last minute. I completely agree with Simon here, this didn't feel right. Michael -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth? signature.asc Description: OpenPGP digital signature
