Has anyone in the EU tech policy space considered just making it illegal for services to charge more for MFA, SSO, audit log streaming, and break-glass/split privilege accounts?
If y'all are serious about improving SME security, that's an easy win.
@dymaxion isn't SSO and MFA the only features some OSS applications bundle into their "please support us" enterprise licenses?
@ilidur
Yes. The fact that the business model for supporting FOSS is completely fucking broken is not fixed by sabotaging the security of the people who would be using it. We *also* need to fix that. See the piece on registry-intermediary charges as about the only viable option I've seen there.
That said, orgs that have the "charge for SSO" model are usually a) offering a SaaS version, which would still be chargeable, and b) selling support for both the SaaS and on-prem versions, similarly. Would this have an impact? Yes. Is it absolutely the right thing to do anyway? Also yes.
An EU that can do this can also accelerate EU-level funding of the Germany free software infrastructure fund and add a couple of zeros to the total.