Open Source Policy Summit: Where FOSS and government meet

The Open Source Policy Summit is an annual event which attempts to explain the importance of software freedom to governments and policy makers. The Policy Summit is an annual event organized by the Open Forum Europe, a Brussels nonprofit which describes itself as an "independent think tank which explains the merits of openness …

[Pascal Monett]

"how European laws should not apply to open source companies"

Not going to happen. Closed source has to obey the laws of the countries where it sells, there is no reason to exempt open source from the same obligations simply because the sale price is zero.

Besides, it's not like it's a problem for the developers. You don't want your code to be GDPR-compliant ? Not a problem, your code won't be used in the EU. I don't think there are many non-EU developers who are bothered by that.

EU-centric developers, of course, will have to ensure that their code is GDPR-compliant, meaning that they'll have to amend whatever FOSS code they decide to use to ensure proper compliance. The burden is on them (apply to other countries/law structures as applicable).

But all code should be compliant with the laws of the country in which it operates.

[Zolko]

Re: "how European laws should not apply to open source companies"

Isn't GDPR about user data ? Most FOSS programs don't collect user data, therefore this stinks of FUD.

[elsergiovolador]

Loophole

Why government is again colluding with big corporations to help them facilitate going around employment law?

In the UK if you want to get cheap labour - the easiest way is to get an apprentice. They can get paid minimum wage.

But if you want to get lower than that you can source free labour in open source community and this is a gray area.

It's illegal to hire someone to do work for for profit company without remuneration (exception is hiring under IR35 where it is legal to pay below minimum wage).

So if a company doesn't want to pay for R&D, employment taxes and wages, they can seed an open source project and then find fools willing to work on it for free.

Then when it is mature enough, just appropriate it and make billions, while not paying any wages to the people working on it.

[Anonymous Coward]

More Misdirection In El Reg....Yes.....I Thought So!!!

@Liam_Proven

Quote: "...Few ... are keen to just hand over a copy for you to run in your own jurisdiction, or on your own servers..."

Ever heard of networks? Or about the internet?

No?......then let me let you into a secret.......

IF YOUR "SERVERS" ARE ON A NETWORK, IT DOES NOT MATTER WHERE THOSE SERVERS ARE LOCATED!

This "location" logic is just more misdirection.......from people who have no interest in "jurisdiction".......but plenty of interest in other people's data!!!

[Liam Proven]

Re: More Misdirection In El Reg....Yes.....I Thought So!!!

[Author here]

> IF YOUR "SERVERS" ARE ON A NETWORK, IT DOES NOT MATTER WHERE THOSE SERVERS ARE LOCATED!

This is not true.

If, for example, company A discloses confidential trade secrets to company B, and company B then puts that data into a cloud database, then the data is held by company C who hosts that database.

If co. A said "for use in Czechia only" and co. B is in Czechia, but the data is held by c. C in the UK, but kept on AWS in the USA, then B has violated its contract with A.

If instead of companies, we are talking national actors, such as governments, military forces, etc., then for instance an ally of Ukraine might well want data about the war not to be hosted in the territory of Russia or any Russian ally.

This is not hard to follow, and _yes_ it matters very much where it's hosted.

What if you store your data in a friendly company in the EU but the main internet links to that country pass through hostile territory? Or in war your company loses external Internet access? Or a former friendly country becomes hostile by allying with a hostile country?

"We want our data back, please."

"Nyet."

Or they ship you a tape of unreadable files and you've lost critical intelligence because you don't have access to the tools that created it.

Yes, it matters. A lot.

[Zolko]

Re: More Misdirection In El Reg....Yes.....I Thought So!!!

If co. A said "for use in Czechia only" and co. B is in Czechia, but the data is held by c. C in the UK, but kept on AWS in the USA, then B has violated its contract with A ...

Yes, it matters. A lot.

no, it doesn't. Not in real life. It matters for lawyers who think they can wrestle some money out of loopholes, but if you put your data on Internet then it's on Internet. If you want to keep secrets don't count on contracts to keep them secret. This is the first rule of "secret" : don't talk about "secret".

[Anonymous Coward]

The Law, Legal Contracts.....They Need Monitoring....They Need Enforcement......Not Mentioned!

@Liam_Proven

Thanks for your comment.......but you are arguing from an essentially legal point of view. But.....

There's almost NO enforcement going on. It's all very well to say there are "laws" or there are "contracts"........but when there's absolutely no enforcement we get stuff like this:

Link: https://www.theguardian.com/technology/2017/jul/03/google-deepmind-16m-patient-royal-free-deal-data-protection-act

What would you say about GDPR or about "legal contracts" in this case?.....What would you say to 1.6 million people who have NO IDEA what happened to their medical records?

What would you say to the 1.6 million people who DON'T EVEN KNOW that their medical records have been slurped?

....Are these records actually in the UK? Or maybe somewhere in the USA? Or for sale on the dark web?

Quote (William Burroughs): "The paranoid is a person who knows a little about what is going on."

[Anonymous Coward]

"The hope is that both the open source players and eventually the commercial players will interop via ...

The only way commercial players will interop is if their users are all disappearing to interoperable alternatives. Unless such an existential threat happens, then it's commercially essential to avoid interoperability at all costs - interoperability means user choice, and if the user has choice then they might choose not to use your tools.

That's largely behind the way MS makes all it's shirubbish so tightly bound, with closed file formats, closed proprietary protocols, etc., etc. It's so that once you've stepped inside the walled garden, there's no windows to allow you to see outside. If you don't like one of the tools (and do I "dislike" some of the tools inflicted on us at work where it decided to irretrievably wed itself to the MS ecosystem) then it's deliberately impractical to rip it out and use something else.

And of course, if all the businesses you deal with are stuck in the MS walled garden, then it's deliberately difficult for you to work with them if you don't also step inside. Thus alternatives are excluded, and non-interoperability is a key, nay vital, part of this.

So while I'd agree with "never say never", I think it's safe to say that commercial vendors will not interoperate unless something seismic happens and they face an existential thread if they don't.