| Re: [open-regulatory-compliance] Is there anything outside the scope of CRA's connection requirement? |
On 2025-01-02 13:35:49 +0100 (+0100), Olle E. Johansson via open-regulatory-compliance wrote: [...] > I am getting a lot of questions and hear discussions about source > code availability not meaning “placing a product on the market”. > This needs to be clarified for both these cases. Same, but also a lot of the projects I'm involved in are implemented in interpreted languages, where the "source code" is what users are often consuming. These projects seek to limit their own liability and clarify their responsibilities to users by explicitly avoiding distributing any artifacts that would bundle third-party code (dependencies and base systems) except where such artifacts are clearly labeled as non-production examples or test configurations. Still, I'm unclear on the extent to which this minimizes user expectations in reality; I hear numerous reports of users operating such "non-production" artifacts in production environments because it's easier for them than actually building their own. To what extent are projects creating an attractive nuisance by making available these sorts of example builds and container images, knowing that users will still frequently disregard warnings and disclaimers for the sake of convenience? -- Jeremy Stanley
Attachment:
signature.asc
Description: PGP signature