The title really undersells it, it seems like under a Biden Executive Order, free/open-source software will have to ban all Russian contributions. Its unclear if American developers would be allowed to contribute to Russian software like Nginx

  • enkers
    link
    fedilink
    24
    edit-2
    1 month ago

    From the other phoronix article:

    UPDATE: When asked whether Linus Torvalds was under any sort of NDA around this, he responded:

    "No, but I’m not a lawyer, so I’m not going to go into the details that I - and other maintainers - were told by lawyers.

    I’m also not going to start discussing legal issues with random internet people who I seriously suspect are paid actors and/or have been riled up by them."

    I don’t love this decision, but I think if you’re willing to read between the lines here, it sounds like maybe he didn’t have much of a choice. Then again, Torvalds also seems pretty happy to comply.

    In other areas, sanctions don’t always mean a complete ban. For example, Ian Nepomniachtchi is still allowed to play chess internationally, just not under the Russian flag. This seems needlessly putative unless there are legitimate security concerns.

    • @[email protected]
      link
      fedilink
      English
      181 month ago

      In other areas, sanctions don’t always mean a complete ban. For example, Ian Nepomniachtchi is still allowed to play chess internationally, just not under the Russian flag. This seems needlessly putative unless there are legitimate security concerns.

      This is absolutely not an absolute ban, they can contribute code, they simply can’t be named maintainers with full commit authority.

      Also apparently they are intending to re-add those who can be confirmed as unaffiliated with the Russian government.

      • @[email protected]OP
        link
        fedilink
        91 month ago

        Also apparently they are intending to re-add those who can be confirmed as unaffiliated with the Russian government.

        Do you have a source for this? Because that would be really good news.

        • @[email protected]
          link
          fedilink
          English
          141 month ago

          In the patch.

          Remove some entries due to various compliance requirements. They can come back in the future if sufficient documentation is provided.

          It was vague, but this seems the clear intent.

    • @[email protected]OP
      link
      fedilink
      51 month ago

      Yep, my reading of the law is the ban is specifically to do with “providing software services to Russians” and somehow collaborating on open-source software would be that. But I don’t entirely understand how.

  • @[email protected]
    link
    fedilink
    English
    111 month ago

    I haven’t gone through all their work, but some of the delisted maintainers were working on driver support for Baikal, a Russia based electronics company. Their work includes semiconductors, ARM processors. Given the sanctions against Russia, especially for dual use stuff like domestic semiconductors, I would expect that Linus and other maintainers were told or concluded that by signing off and merging their code they’d be personally violating sanctions.

  • UnfortunateShort
    link
    fedilink
    101 month ago

    I mean, it’s on Phoronix to take this kinda out of context, but on Linus how he phrases things. You would think after years at the forefront of one of the most important FOSS projects, he’d know better.

    So to add some missing context: We are talking 11 maintainers, it’s not like hundreds have been removed. Im addition, it seems like most of them are employed by russian companies, not private individuals. Their code on the other hand has not been removed.

    What bothers me is that it’s unclear whether future pull-requests would be rejected as well, or whether this is a matter of association.

    IMO it would have been nice if Linus focused on some details regarding this action in his response, or alternatively not responding at all. Even if all he can say is that currently he can’t comment on it, it’s definitely better than borderline xenophobic rambling and getting mad at supposed trolls, feeding trolls if anything.

  • @[email protected]
    link
    fedilink
    English
    01 month ago

    I wonder if there is any merit to this or if the government actually suspects or believes there is a large risk giving certain maintainers access.

    I could actually see NSA protecting Linux with reasonable intentions, but I could also just see the whitehouse making dumbass moves because some shmuck wants credit for “securing” something.

    Either way, I don’t think it’s large enough that it’s much of an issue.

    • @[email protected]OP
      link
      fedilink
      21 month ago

      I don’t think this is about security implications, but I may be wrong. My understanding is this is related to the export sanctions, meant to hamper the Russian economy.

      • @[email protected]
        link
        fedilink
        English
        41 month ago

        That seems weird considering anyone can easily access and fork it if they want.

        Reminds me of the old crypto algorithm export laws which fell apart for the same reason. Now curve25519 is even in FIPS as the default next to the NIST curve.

  • @[email protected]
    link
    fedilink
    01 month ago

    The social engineering on open source maintainers that create lesser understood security implications are basically toast.

    :(

    I really don’t know what the answer is other than HEY EVERYONE PLEASE HELP but like, glhf.

    Sux.