Re: This does not have to be a GR

[Russ Allbery]

Jonathan Carter  writes:
> On 2023/11/22 01:37, Kurt Roeckx wrote:

>> I would also like to point out that, in the current state, on Saturday
>> the discussion period is over and a vote is automatically called.

> Not so sure how automatic that was meant to be, but for what it's worth,
> I didn't see enough interest in extending the discussion period, so it
> ended on Saturday.

I believe Luca's ballot option reached five sponsors on Friday with my
sponsorship, which may have extended the discussion period because an
additional ballot option was added.

-- 
Russ Allbery (r...@debian.org)  

Re: This does not have to be a GR

[Jonathan Carter]

On 2023/11/22 01:37, Kurt Roeckx wrote:

I would also like to point out that, in the current state, on Saturday
the discussion period is over and a vote is automatically called.


Not so sure how automatic that was meant to be, but for what it's worth, 
I didn't see enough interest in extending the discussion period, so it 
ended on Saturday.


-Jonathan

CRA is effectively a "law", was Re: This does not have to be a GR

[Ilu]

Since this error comes up again and again on this list:

The CRA is a "Regulation" (look at the long title: "REGULATION OF THE
EUROPEAN PARLIAMENT AND OF THE COUNCIL on horizontal cybersecurity
requirements for products with digital elements and amending Regulation
(EU) 2019/1020"), in effect a law which will be directly in force in all
EU member states.

The PLD is going to be a "Directive" which needs to be adapted by the
member states. Member states can change things within certain limits.
Those limits are not very wide. They cannot change the main content of
the directive.

Am 22.11.23 um 09:35 schrieb Sébastien Villemot:

Le mercredi 22 novembre 2023 à 09:05 +0100, Thomas Goirand a écrit :

Excuse me to insist with vocabulary, but since you've use the word "law"
6 times above: the EU isn't a state or a nation, and doesn't make laws.


Just a minor note: the EU actually issues laws, they’re called
“regulation” in the EU jargon¹. But indeed a “directive” (as in the CRA
case) is something different, and as you say opens up the possibility
of a fight at the national level.


We're talking about "directives", that eventually will be implemented as
laws in each member state. This is a huge difference that make it
possible to fight the CRA at multiple levels. This also mean that the
CRA wording isn't as important as the wording of its implementation as a
law in each member state.

Also, once the directive is passed, it's still theoretically possible to
fight its wording in each state. Seen the other way around: it's
possible that the implementation as a law in each country is worse than
then directive itself, we must pay attention to it (it's probably even
more difficult for us this way, as there will be 27 implementations to
take care of).


¹ https://en.wikipedia.org/wiki/Regulation_(European_Union)

Re: This does not have to be a GR

[Bill Allombert]

On Wed, Nov 22, 2023 at 09:05:26AM +0100, Thomas Goirand wrote:
> Excuse me to insist with vocabulary, but since you've use the word "law" 6
> times above: the EU isn't a state or a nation, and doesn't make laws. We're
> talking about "directives", that eventually will be implemented as laws in
> each member state. This is a huge difference that make it possible to fight
> the CRA at multiple levels. This also mean that the CRA wording isn't as
> important as the wording of its implementation as a law in each member
> state.
> 
> Also, once the directive is passed, it's still theoretically possible to
> fight its wording in each state. Seen the other way around: it's possible
> that the implementation as a law in each country is worse than then
> directive itself, we must pay attention to it (it's probably even more
> difficult for us this way, as there will be 27 implementations to take care
> of).

All what you say is correct, but note that it was the same for the EUCD for 
example
and Debian did not issue a statement. 

Debian did not issues statement for similar US laws either, though we
participated to the "web blackout" against SOPA/PIPA but we did not do a GR
beforehand.

Cheers,
-- 
Bill. 

Imagine a large red swirl here. 


signature.asc
Description: PGP signature

Re: This does not have to be a GR

[Bill Allombert]

On Tue, Nov 21, 2023 at 04:54:30PM -0600, Gunnar Wolf wrote:
> Bill Allombert dijo [Tue, Nov 21, 2023 at 10:26:09PM +0100]:
> > Dear Debian voters,
> > 
> > While Debian has stakes in the CRA, and should issue a statement if
> > only to show we exists, I am quite sure that a GR is not necessary for 
> > Debian
> > to issue such statement, and I am quite unconvinced the GR process is the 
> > best
> > option for the purpose of drafting such statement.
> > 
> > I note that this is not the first law proposal that impact Debian and we 
> > never
> > did used the GR process for issuing a position statement.

> We never did _successfully_ use it. We have _tried_ to use it
> (i.e. 2021_002).

Sorry, I meant 'a position statement with respect to a law proposal'.

> This text was in fact drafted by a lawyer (I don't know if by a _set_
> of lawyers) and discussed among DDs at several in-person meetings
> before reaching this stage. I strongly advocated using the GR process,
> as it has already been subjected to a long discussion, and the
> timeframe for it to be usefully considered is drawing to an end.

Was it drafted by a lawyer familiar with EU law ?
We should have started by having a EU lawyer explaining what the CRA
actually mean and proceed from that.

> At this point, and in part given that GR 2021_003 introduced time
> limits, I think the GR process might produce the swiftest results, and
> it will yield the best legitimacy-wise (i.e. the whole project is
> invited to debate and improve the proposed text, and accept it
> above/below the approval threshold.

But this might as well degenerate into a political referendum having little
to do with Debian. As it stands we have two ballots which are similar in intent
except that one is worded to be more EU-optimistic than the other. So at the
end of the day, the GR will be a referral whether DDs are more EU-pessimistic or
EU-optimistic. I repect my fellow DD political views, but this is not the 
purpose
of Debian to query its members opinions about a topic¹ unrelated to the social
contract. This will only fracture the project.

If we want a GR, we should focus on having a single ballot option, that strive 
to
be neutral and straight to the point.

Maybe a ballot option delegating the issuing of a statement to the DPL ?

¹ especially one when we are bound to have widely different but valid 
views depending on where we live.

Cheers,
-- 
Bill. 

Imagine a large red swirl here.


signature.asc
Description: PGP signature

Re: This does not have to be a GR

[Ansgar]

Hi,

On Tue, 2023-11-21 at 16:54 -0600, Gunnar Wolf wrote:
> At this point, and in part given that GR 2021_003 introduced time
> limits, I think the GR process might produce the swiftest results,
> and
> it will yield the best legitimacy-wise (i.e. the whole project is
> invited to debate and improve the proposed text, and accept it
> above/below the approval threshold.
[...]
> > The DPL could delegate to a group of people knowledgeable in EU law
> > to draft
> > a statement that is congruent with the interest of Debian.
> 
> This text was in fact drafted by a lawyer (I don't know if by a _set_
> of lawyers) and discussed among DDs at several in-person meetings
> before reaching this stage.

If we don't know if it was written by one or more people, we don't know
their persuasion either, or what the diff between the original draft
and the proposed version is. Maybe a lawyer only rubber stamped the
initial draft in the end.

It is nice that this was discussed by a small group of people in
private, but the first time I (for example) heard about this was on
2023-11-12 when the GR started. I plan to vote it below FD for that.

It also only reached d-d-a@ only on 2023-11-19, after half the
discussion period was already over.

> I strongly advocated using the GR process, as it has already been
> subjected to a long discussion, and the timeframe for it to be
> usefully considered is drawing to an end.

Well, that is the case for pretty much everything. It even could be a
legitimate reason to suggest to dissolve the tech ctte and replace it
with GRs ;-)

(Most things that get escalated to the tech-ctte were discussed among
DDs at several occasions in private or public too, and having swifter
decisions would probably be good looking back at issues that were
reopened several times without much new arguments and took a long time
to get closed again...) 

Ansgar

Re: This does not have to be a GR

[Bill Allombert]

On Wed, Nov 22, 2023 at 12:37:54AM +0100, Kurt Roeckx wrote:
> On Tue, Nov 21, 2023 at 10:26:09PM +0100, Bill Allombert wrote:
> > Dear Debian voters,
> > 
> > While Debian has stakes in the CRA, and should issue a statement if
> > only to show we exists, I am quite sure that a GR is not necessary for 
> > Debian
> > to issue such statement, and I am quite unconvinced the GR process is the 
> > best
> > option for the purpose of drafting such statement.
> > 
> > I note that this is not the first law proposal that impact Debian and we 
> > never
> > did used the GR process for issuing a position statement.
> > 
> > The DPL could delegate to a group of people knowledgeable in EU law to draft
> > a statement that is congruent with the interest of Debian.
> 
> I'm not sure that the DPL has such authority, since it's a power
> giving to the developers by way of GR.

The project has published a number of statements across its history without
them following a GR, see the archive of debian-announce and debian-news, so
this is the precedent.

> I would also like to point out that, in the current state, on Saturday
> the discussion period is over and a vote is automatically called.

I understand. I regret that the current system is such that the GR proposal
is announced to debian-devel-announce only after the vote is called.

Cheers,
-- 
Bill. 

Imagine a large red swirl here. 


signature.asc
Description: PGP signature

Re: This does not have to be a GR

[Sébastien Villemot]

Le mercredi 22 novembre 2023 à 09:05 +0100, Thomas Goirand a écrit :
> On 11/21/23 22:26, Bill Allombert wrote:
> > I note that this is not the first law proposal that impact Debian and we 
> > never
> > did used the GR process for issuing a position statement.
> > 
> > The DPL could delegate to a group of people knowledgeable in EU law to draft
> > a statement that is congruent with the interest of Debian >
> > EU law is significantly different from US law and publishing a statement 
> > that
> > either misrepresent the CRA or the current state of EU law is not likely to
> > be taken seriously, so we need some care.
> > 
> > We have legitimate reasons to feel concerned by the impact of this law, but
> > all the more reasons to act cautiously.
> 
> Excuse me to insist with vocabulary, but since you've use the word "law" 
> 6 times above: the EU isn't a state or a nation, and doesn't make laws.

Just a minor note: the EU actually issues laws, they’re called
“regulation” in the EU jargon¹. But indeed a “directive” (as in the CRA
case) is something different, and as you say opens up the possibility
of a fight at the national level.

> We're talking about "directives", that eventually will be implemented as 
> laws in each member state. This is a huge difference that make it 
> possible to fight the CRA at multiple levels. This also mean that the 
> CRA wording isn't as important as the wording of its implementation as a 
> law in each member state.
> 
> Also, once the directive is passed, it's still theoretically possible to 
> fight its wording in each state. Seen the other way around: it's 
> possible that the implementation as a law in each country is worse than 
> then directive itself, we must pay attention to it (it's probably even 
> more difficult for us this way, as there will be 27 implementations to 
> take care of).

¹ https://en.wikipedia.org/wiki/Regulation_(European_Union)

-- 
⢀⣴⠾⠻⢶⣦⠀  Sébastien Villemot
⣾⠁⢠⠒⠀⣿⡁  Debian Developer
⢿⡄⠘⠷⠚⠋⠀  https://sebastien.villemot.name
⠈⠳⣄  https://www.debian.org



signature.asc
Description: This is a digitally signed message part

Re: This does not have to be a GR

[Thomas Goirand]

On 11/21/23 22:26, Bill Allombert wrote:

I note that this is not the first law proposal that impact Debian and we never
did used the GR process for issuing a position statement.

The DPL could delegate to a group of people knowledgeable in EU law to draft
a statement that is congruent with the interest of Debian >
EU law is significantly different from US law and publishing a statement that
either misrepresent the CRA or the current state of EU law is not likely to
be taken seriously, so we need some care.

We have legitimate reasons to feel concerned by the impact of this law, but
all the more reasons to act cautiously.


Excuse me to insist with vocabulary, but since you've use the word "law" 
6 times above: the EU isn't a state or a nation, and doesn't make laws. 
We're talking about "directives", that eventually will be implemented as 
laws in each member state. This is a huge difference that make it 
possible to fight the CRA at multiple levels. This also mean that the 
CRA wording isn't as important as the wording of its implementation as a 
law in each member state.


Also, once the directive is passed, it's still theoretically possible to 
fight its wording in each state. Seen the other way around: it's 
possible that the implementation as a law in each country is worse than 
then directive itself, we must pay attention to it (it's probably even 
more difficult for us this way, as there will be 27 implementations to 
take care of).


Cheers,

Thomas Goirand (zigo)

Re: This does not have to be a GR

[Jonathan Carter]

Hi Kurt

On 2023/11/22 01:37, Kurt Roeckx wrote:

While Debian has stakes in the CRA, and should issue a statement if
only to show we exists, I am quite sure that a GR is not necessary for Debian
to issue such statement, and I am quite unconvinced the GR process is the best
option for the purpose of drafting such statement.

I note that this is not the first law proposal that impact Debian and we never
did used the GR process for issuing a position statement.

The DPL could delegate to a group of people knowledgeable in EU law to draft
a statement that is congruent with the interest of Debian.

>

I'm not sure that the DPL has such authority, since it's a power
giving to the developers by way of GR.


I don't think that works, because then it could be argued that any 
delegation's decisions can be overridden by a GR and has thenceforth 
already been delegated. So, I believe it is possible to have such a 
delegation.


Although, whether it would be a good idea is an entirely different issue.

I do think we should have a proper discussion about how we want to treat 
comments on legislation (although not during this GR), because we've 
refrained from doing so when it affects both free software and Debian in 
other regions of the world.



I would also like to point out that, in the current state, on Saturday
the discussion period is over and a vote is automatically called.


While I think this could use more discussion, I'm not currently planning 
on extending the discussion period for this vote unless there is 
sufficient demand for it. If there's more than one person who still 
wants to work on a proposal or if there's some aspect we need to explore 
further, then it can be extended.


-Jonathan

PS:

While I didn't cite our constitution in this mail, I'm including a link 
here for convenience, since I often refer to it myself when I want to 
make sure whether I remember some detail correctly:


https://www.debian.org/devel/constitution

Re: This does not have to be a GR

[Kurt Roeckx]

On Tue, Nov 21, 2023 at 10:26:09PM +0100, Bill Allombert wrote:
> Dear Debian voters,
> 
> While Debian has stakes in the CRA, and should issue a statement if
> only to show we exists, I am quite sure that a GR is not necessary for Debian
> to issue such statement, and I am quite unconvinced the GR process is the best
> option for the purpose of drafting such statement.
> 
> I note that this is not the first law proposal that impact Debian and we never
> did used the GR process for issuing a position statement.
> 
> The DPL could delegate to a group of people knowledgeable in EU law to draft
> a statement that is congruent with the interest of Debian.

I'm not sure that the DPL has such authority, since it's a power
giving to the developers by way of GR.

I would also like to point out that, in the current state, on Saturday
the discussion period is over and a vote is automatically called.


Kurt

Re: This does not have to be a GR

[Gunnar Wolf]

Bill Allombert dijo [Tue, Nov 21, 2023 at 10:26:09PM +0100]:
> Dear Debian voters,
> 
> While Debian has stakes in the CRA, and should issue a statement if
> only to show we exists, I am quite sure that a GR is not necessary for Debian
> to issue such statement, and I am quite unconvinced the GR process is the best
> option for the purpose of drafting such statement.
> 
> I note that this is not the first law proposal that impact Debian and we never
> did used the GR process for issuing a position statement.

We never did _successfully_ use it. We have _tried_ to use it
(i.e. 2021_002).

I suggesteed we do a GR to give the proposal, in case it gets
accepted, more legitimacy. We can, IMO, express the project opinion
via:

① A personal initiative / delegation from the DPL (that can stem from
  a request made to them or can be initiated by the DPL themself),

② The Technical Committee, requested formally by project members, or
  speaking of its own initiative (at some point, I argued that one of
  the the TC members could be the "Random DD" asking the Tc for their
  opinion on a given matter), or

③ The GR process.

At this point, and in part given that GR 2021_003 introduced time
limits, I think the GR process might produce the swiftest results, and
it will yield the best legitimacy-wise (i.e. the whole project is
invited to debate and improve the proposed text, and accept it
above/below the approval threshold.

> The DPL could delegate to a group of people knowledgeable in EU law to draft
> a statement that is congruent with the interest of Debian.

This text was in fact drafted by a lawyer (I don't know if by a _set_
of lawyers) and discussed among DDs at several in-person meetings
before reaching this stage. I strongly advocated using the GR process,
as it has already been subjected to a long discussion, and the
timeframe for it to be usefully considered is drawing to an end.

Please do note that I did not submit the text myself: I thought it
would be better if Santiago, who was the only present DD with European
nationality (French), to be the presenter (and me being "just" a
seconder). But yes, I stand behind arguing for this document to be
GR'ed. 

> EU law is significantly different from US law and publishing a statement that
> either misrepresent the CRA or the current state of EU law is not likely to
> be taken seriously, so we need some care.
> 
> We have legitimate reasons to feel concerned by the impact of this law, but
> all the more reasons to act cautiously.
> 
> I advocated previously against using the GR process to issues statements
> related to non-technical issues outside of Debian and I reiterate it here.

I believe it is the right venue to process and discuss this kind of
arguments. I'm willing to have this discussion as well --- but do note
that the GR proposal has already been submitted.

Of course, seconders can "un-second" it, and the Secretary might
decide to withdraw the process if it happens. But I believe there is
no reason for this to continue its course, maybe in parallel to this
discussion.


signature.asc
Description: PGP signature

This does not have to be a GR

[Bill Allombert]

Dear Debian voters,

While Debian has stakes in the CRA, and should issue a statement if
only to show we exists, I am quite sure that a GR is not necessary for Debian
to issue such statement, and I am quite unconvinced the GR process is the best
option for the purpose of drafting such statement.

I note that this is not the first law proposal that impact Debian and we never
did used the GR process for issuing a position statement.

The DPL could delegate to a group of people knowledgeable in EU law to draft
a statement that is congruent with the interest of Debian.

EU law is significantly different from US law and publishing a statement that
either misrepresent the CRA or the current state of EU law is not likely to
be taken seriously, so we need some care.

We have legitimate reasons to feel concerned by the impact of this law, but
all the more reasons to act cautiously.

I advocated previously against using the GR process to issues statements
related to non-technical issues outside of Debian and I reiterate it here.

Cheers,
-- 
Bill. 

Imagine a large red swirl here. 


signature.asc
Description: PGP signature