Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

This does not have to be a GR

1 view
Skip to first unread message

Bill Allombert

unread,
Nov 21, 2023, 4:40:06 PM11/21/23
to
Dear Debian voters,

While Debian has stakes in the CRA, and should issue a statement if
only to show we exists, I am quite sure that a GR is not necessary for Debian
to issue such statement, and I am quite unconvinced the GR process is the best
option for the purpose of drafting such statement.

I note that this is not the first law proposal that impact Debian and we never
did used the GR process for issuing a position statement.

The DPL could delegate to a group of people knowledgeable in EU law to draft
a statement that is congruent with the interest of Debian.

EU law is significantly different from US law and publishing a statement that
either misrepresent the CRA or the current state of EU law is not likely to
be taken seriously, so we need some care.

We have legitimate reasons to feel concerned by the impact of this law, but
all the more reasons to act cautiously.

I advocated previously against using the GR process to issues statements
related to non-technical issues outside of Debian and I reiterate it here.

Cheers,
--
Bill. <ball...@debian.org>

Imagine a large red swirl here.
signature.asc

Gunnar Wolf

unread,
Nov 21, 2023, 6:00:10 PM11/21/23
to
Bill Allombert dijo [Tue, Nov 21, 2023 at 10:26:09PM +0100]:
> Dear Debian voters,
>
> While Debian has stakes in the CRA, and should issue a statement if
> only to show we exists, I am quite sure that a GR is not necessary for Debian
> to issue such statement, and I am quite unconvinced the GR process is the best
> option for the purpose of drafting such statement.
>
> I note that this is not the first law proposal that impact Debian and we never
> did used the GR process for issuing a position statement.

We never did _successfully_ use it. We have _tried_ to use it
(i.e. 2021_002).

I suggesteed we do a GR to give the proposal, in case it gets
accepted, more legitimacy. We can, IMO, express the project opinion
via:

① A personal initiative / delegation from the DPL (that can stem from
a request made to them or can be initiated by the DPL themself),

② The Technical Committee, requested formally by project members, or
speaking of its own initiative (at some point, I argued that one of
the the TC members could be the "Random DD" asking the Tc for their
opinion on a given matter), or

③ The GR process.

At this point, and in part given that GR 2021_003 introduced time
limits, I think the GR process might produce the swiftest results, and
it will yield the best legitimacy-wise (i.e. the whole project is
invited to debate and improve the proposed text, and accept it
above/below the approval threshold.

> The DPL could delegate to a group of people knowledgeable in EU law to draft
> a statement that is congruent with the interest of Debian.

This text was in fact drafted by a lawyer (I don't know if by a _set_
of lawyers) and discussed among DDs at several in-person meetings
before reaching this stage. I strongly advocated using the GR process,
as it has already been subjected to a long discussion, and the
timeframe for it to be usefully considered is drawing to an end.

Please do note that I did not submit the text myself: I thought it
would be better if Santiago, who was the only present DD with European
nationality (French), to be the presenter (and me being "just" a
seconder). But yes, I stand behind arguing for this document to be
GR'ed.

> EU law is significantly different from US law and publishing a statement that
> either misrepresent the CRA or the current state of EU law is not likely to
> be taken seriously, so we need some care.
>
> We have legitimate reasons to feel concerned by the impact of this law, but
> all the more reasons to act cautiously.
>
> I advocated previously against using the GR process to issues statements
> related to non-technical issues outside of Debian and I reiterate it here.

I believe it is the right venue to process and discuss this kind of
arguments. I'm willing to have this discussion as well --- but do note
that the GR proposal has already been submitted.

Of course, seconders can "un-second" it, and the Secretary might
decide to withdraw the process if it happens. But I believe there is
no reason for this to continue its course, maybe in parallel to this
discussion.
signature.asc

Kurt Roeckx

unread,
Nov 21, 2023, 6:40:05 PM11/21/23
to
On Tue, Nov 21, 2023 at 10:26:09PM +0100, Bill Allombert wrote:
> Dear Debian voters,
>
> While Debian has stakes in the CRA, and should issue a statement if
> only to show we exists, I am quite sure that a GR is not necessary for Debian
> to issue such statement, and I am quite unconvinced the GR process is the best
> option for the purpose of drafting such statement.
>
> I note that this is not the first law proposal that impact Debian and we never
> did used the GR process for issuing a position statement.
>
> The DPL could delegate to a group of people knowledgeable in EU law to draft
> a statement that is congruent with the interest of Debian.

I'm not sure that the DPL has such authority, since it's a power
giving to the developers by way of GR.

I would also like to point out that, in the current state, on Saturday
the discussion period is over and a vote is automatically called.


Kurt

Jonathan Carter

unread,
Nov 22, 2023, 2:00:05 AM11/22/23
to
Hi Kurt

On 2023/11/22 01:37, Kurt Roeckx wrote:
>> While Debian has stakes in the CRA, and should issue a statement if
>> only to show we exists, I am quite sure that a GR is not necessary for Debian
>> to issue such statement, and I am quite unconvinced the GR process is the best
>> option for the purpose of drafting such statement.
>>
>> I note that this is not the first law proposal that impact Debian and we never
>> did used the GR process for issuing a position statement.
>>
>> The DPL could delegate to a group of people knowledgeable in EU law to draft
>> a statement that is congruent with the interest of Debian.
>
> I'm not sure that the DPL has such authority, since it's a power
> giving to the developers by way of GR.

I don't think that works, because then it could be argued that any
delegation's decisions can be overridden by a GR and has thenceforth
already been delegated. So, I believe it is possible to have such a
delegation.

Although, whether it would be a good idea is an entirely different issue.

I do think we should have a proper discussion about how we want to treat
comments on legislation (although not during this GR), because we've
refrained from doing so when it affects both free software and Debian in
other regions of the world.

> I would also like to point out that, in the current state, on Saturday
> the discussion period is over and a vote is automatically called.

While I think this could use more discussion, I'm not currently planning
on extending the discussion period for this vote unless there is
sufficient demand for it. If there's more than one person who still
wants to work on a proposal or if there's some aspect we need to explore
further, then it can be extended.

-Jonathan

PS:

While I didn't cite our constitution in this mail, I'm including a link
here for convenience, since I often refer to it myself when I want to
make sure whether I remember some detail correctly:

https://www.debian.org/devel/constitution

Thomas Goirand

unread,
Nov 22, 2023, 3:10:04 AM11/22/23
to
On 11/21/23 22:26, Bill Allombert wrote:
> I note that this is not the first law proposal that impact Debian and we never
> did used the GR process for issuing a position statement.
>
> The DPL could delegate to a group of people knowledgeable in EU law to draft
> a statement that is congruent with the interest of Debian >
> EU law is significantly different from US law and publishing a statement that
> either misrepresent the CRA or the current state of EU law is not likely to
> be taken seriously, so we need some care.
>
> We have legitimate reasons to feel concerned by the impact of this law, but
> all the more reasons to act cautiously.

Excuse me to insist with vocabulary, but since you've use the word "law"
6 times above: the EU isn't a state or a nation, and doesn't make laws.
We're talking about "directives", that eventually will be implemented as
laws in each member state. This is a huge difference that make it
possible to fight the CRA at multiple levels. This also mean that the
CRA wording isn't as important as the wording of its implementation as a
law in each member state.

Also, once the directive is passed, it's still theoretically possible to
fight its wording in each state. Seen the other way around: it's
possible that the implementation as a law in each country is worse than
then directive itself, we must pay attention to it (it's probably even
more difficult for us this way, as there will be 27 implementations to
take care of).

Cheers,

Thomas Goirand (zigo)

Sébastien Villemot

unread,
Nov 22, 2023, 3:50:05 AM11/22/23
to
Le mercredi 22 novembre 2023 à 09:05 +0100, Thomas Goirand a écrit :
> On 11/21/23 22:26, Bill Allombert wrote:
> > I note that this is not the first law proposal that impact Debian and we never
> > did used the GR process for issuing a position statement.
> >
> > The DPL could delegate to a group of people knowledgeable in EU law to draft
> > a statement that is congruent with the interest of Debian >
> > EU law is significantly different from US law and publishing a statement that
> > either misrepresent the CRA or the current state of EU law is not likely to
> > be taken seriously, so we need some care.
> >
> > We have legitimate reasons to feel concerned by the impact of this law, but
> > all the more reasons to act cautiously.
>
> Excuse me to insist with vocabulary, but since you've use the word "law"
> 6 times above: the EU isn't a state or a nation, and doesn't make laws.

Just a minor note: the EU actually issues laws, they’re called
“regulation” in the EU jargon¹. But indeed a “directive” (as in the CRA
case) is something different, and as you say opens up the possibility
of a fight at the national level.

> We're talking about "directives", that eventually will be implemented as
> laws in each member state. This is a huge difference that make it
> possible to fight the CRA at multiple levels. This also mean that the
> CRA wording isn't as important as the wording of its implementation as a
> law in each member state.
>
> Also, once the directive is passed, it's still theoretically possible to
> fight its wording in each state. Seen the other way around: it's
> possible that the implementation as a law in each country is worse than
> then directive itself, we must pay attention to it (it's probably even
> more difficult for us this way, as there will be 27 implementations to
> take care of).

¹ https://en.wikipedia.org/wiki/Regulation_(European_Union)

--
⢀⣴⠾⠻⢶⣦⠀  Sébastien Villemot
⣾⠁⢠⠒⠀⣿⡁  Debian Developer
⢿⡄⠘⠷⠚⠋⠀  https://sebastien.villemot.name
⠈⠳⣄⠀⠀⠀⠀  https://www.debian.org

signature.asc

Bill Allombert

unread,
Nov 22, 2023, 4:50:05 AM11/22/23
to
On Wed, Nov 22, 2023 at 12:37:54AM +0100, Kurt Roeckx wrote:
> On Tue, Nov 21, 2023 at 10:26:09PM +0100, Bill Allombert wrote:
> > Dear Debian voters,
> >
> > While Debian has stakes in the CRA, and should issue a statement if
> > only to show we exists, I am quite sure that a GR is not necessary for Debian
> > to issue such statement, and I am quite unconvinced the GR process is the best
> > option for the purpose of drafting such statement.
> >
> > I note that this is not the first law proposal that impact Debian and we never
> > did used the GR process for issuing a position statement.
> >
> > The DPL could delegate to a group of people knowledgeable in EU law to draft
> > a statement that is congruent with the interest of Debian.
>
> I'm not sure that the DPL has such authority, since it's a power
> giving to the developers by way of GR.

The project has published a number of statements across its history without
them following a GR, see the archive of debian-announce and debian-news, so
this is the precedent.

> I would also like to point out that, in the current state, on Saturday
> the discussion period is over and a vote is automatically called.

I understand. I regret that the current system is such that the GR proposal
is announced to debian-devel-announce only after the vote is called.
signature.asc

Ansgar

unread,
Nov 22, 2023, 5:00:03 AM11/22/23
to
Hi,

On Tue, 2023-11-21 at 16:54 -0600, Gunnar Wolf wrote:
> At this point, and in part given that GR 2021_003 introduced time
> limits, I think the GR process might produce the swiftest results,
> and
> it will yield the best legitimacy-wise (i.e. the whole project is
> invited to debate and improve the proposed text, and accept it
> above/below the approval threshold.
[...]
> > The DPL could delegate to a group of people knowledgeable in EU law
> > to draft
> > a statement that is congruent with the interest of Debian.
>
> This text was in fact drafted by a lawyer (I don't know if by a _set_
> of lawyers) and discussed among DDs at several in-person meetings
> before reaching this stage.

If we don't know if it was written by one or more people, we don't know
their persuasion either, or what the diff between the original draft
and the proposed version is. Maybe a lawyer only rubber stamped the
initial draft in the end.

It is nice that this was discussed by a small group of people in
private, but the first time I (for example) heard about this was on
2023-11-12 when the GR started. I plan to vote it below FD for that.

It also only reached d-d-a@ only on 2023-11-19, after half the
discussion period was already over.

> I strongly advocated using the GR process, as it has already been
> subjected to a long discussion, and the timeframe for it to be
> usefully considered is drawing to an end.

Well, that is the case for pretty much everything. It even could be a
legitimate reason to suggest to dissolve the tech ctte and replace it
with GRs ;-)

(Most things that get escalated to the tech-ctte were discussed among
DDs at several occasions in private or public too, and having swifter
decisions would probably be good looking back at issues that were
reopened several times without much new arguments and took a long time
to get closed again...) 

Ansgar

Bill Allombert

unread,
Nov 22, 2023, 5:40:05 AM11/22/23
to
On Tue, Nov 21, 2023 at 04:54:30PM -0600, Gunnar Wolf wrote:
> Bill Allombert dijo [Tue, Nov 21, 2023 at 10:26:09PM +0100]:
> > Dear Debian voters,
> >
> > While Debian has stakes in the CRA, and should issue a statement if
> > only to show we exists, I am quite sure that a GR is not necessary for Debian
> > to issue such statement, and I am quite unconvinced the GR process is the best
> > option for the purpose of drafting such statement.
> >
> > I note that this is not the first law proposal that impact Debian and we never
> > did used the GR process for issuing a position statement.

> We never did _successfully_ use it. We have _tried_ to use it
> (i.e. 2021_002).

Sorry, I meant 'a position statement with respect to a law proposal'.

> This text was in fact drafted by a lawyer (I don't know if by a _set_
> of lawyers) and discussed among DDs at several in-person meetings
> before reaching this stage. I strongly advocated using the GR process,
> as it has already been subjected to a long discussion, and the
> timeframe for it to be usefully considered is drawing to an end.

Was it drafted by a lawyer familiar with EU law ?
We should have started by having a EU lawyer explaining what the CRA
actually mean and proceed from that.

> At this point, and in part given that GR 2021_003 introduced time
> limits, I think the GR process might produce the swiftest results, and
> it will yield the best legitimacy-wise (i.e. the whole project is
> invited to debate and improve the proposed text, and accept it
> above/below the approval threshold.

But this might as well degenerate into a political referendum having little
to do with Debian. As it stands we have two ballots which are similar in intent
except that one is worded to be more EU-optimistic than the other. So at the
end of the day, the GR will be a referral whether DDs are more EU-pessimistic or
EU-optimistic. I repect my fellow DD political views, but this is not the purpose
of Debian to query its members opinions about a topic¹ unrelated to the social
contract. This will only fracture the project.

If we want a GR, we should focus on having a single ballot option, that strive to
be neutral and straight to the point.

Maybe a ballot option delegating the issuing of a statement to the DPL ?

¹ especially one when we are bound to have widely different but valid
views depending on where we live.
signature.asc

Bill Allombert

unread,
Nov 22, 2023, 6:00:03 AM11/22/23
to
On Wed, Nov 22, 2023 at 09:05:26AM +0100, Thomas Goirand wrote:
> Excuse me to insist with vocabulary, but since you've use the word "law" 6
> times above: the EU isn't a state or a nation, and doesn't make laws. We're
> talking about "directives", that eventually will be implemented as laws in
> each member state. This is a huge difference that make it possible to fight
> the CRA at multiple levels. This also mean that the CRA wording isn't as
> important as the wording of its implementation as a law in each member
> state.
>
> Also, once the directive is passed, it's still theoretically possible to
> fight its wording in each state. Seen the other way around: it's possible
> that the implementation as a law in each country is worse than then
> directive itself, we must pay attention to it (it's probably even more
> difficult for us this way, as there will be 27 implementations to take care
> of).

All what you say is correct, but note that it was the same for the EUCD for example
and Debian did not issue a statement.

Debian did not issues statement for similar US laws either, though we
participated to the "web blackout" against SOPA/PIPA but we did not do a GR
beforehand.
signature.asc

Ilu

unread,
Nov 22, 2023, 10:40:06 AM11/22/23
to
Since this error comes up again and again on this list:

The CRA is a "Regulation" (look at the long title: "REGULATION OF THE
EUROPEAN PARLIAMENT AND OF THE COUNCIL on horizontal cybersecurity
requirements for products with digital elements and amending Regulation
(EU) 2019/1020"), in effect a law which will be directly in force in all
EU member states.

The PLD is going to be a "Directive" which needs to be adapted by the
member states. Member states can change things within certain limits.
Those limits are not very wide. They cannot change the main content of
the directive.

Am 22.11.23 um 09:35 schrieb Sébastien Villemot:

Jonathan Carter

unread,
Nov 27, 2023, 10:00:04 AM11/27/23
to
On 2023/11/22 01:37, Kurt Roeckx wrote:
> I would also like to point out that, in the current state, on Saturday
> the discussion period is over and a vote is automatically called.

Not so sure how automatic that was meant to be, but for what it's worth,
I didn't see enough interest in extending the discussion period, so it
ended on Saturday.

-Jonathan

Russ Allbery

unread,
Nov 27, 2023, 5:00:04 PM11/27/23
to
I believe Luca's ballot option reached five sponsors on Friday with my
sponsorship, which may have extended the discussion period because an
additional ballot option was added.

--
Russ Allbery (r...@debian.org) <https://www.eyrie.org/~eagle/>
0 new messages