linux-kernel - Re: linux: Goodbye from a Linux community volunteer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241024193729.GP3204734@mit.edu>
Date: Thu, 24 Oct 2024 15:37:29 -0400
From: "Theodore Ts'o" <tytso@....edu>
To: Hantong Chen <cxwdyx620@...il.com>
Cc: ajhalaney@...il.com, allenbh@...il.com, andrew@...n.ch,
        andriy.shevchenko@...ux.intel.com, andy@...nel.org, arnd@...db.de,
        bhelgaas@...gle.com, bp@...en8.de, broonie@...nel.org,
        cai.huoqing@...ux.dev, dave.jiang@...el.com, davem@...emloft.net,
        dlemoal@...nel.org, dmaengine@...r.kernel.org, dushistov@...l.ru,
        fancer.lancer@...il.com, geert@...ux-m68k.org,
        gregkh@...uxfoundation.org, ink@...assic.park.msu.ru,
        james.bottomley@...senpartnership.com, jdmason@...zu.us,
        jiaxun.yang@...goat.com, keguang.zhang@...il.com,
        kory.maincent@...tlin.com, krzk@...nel.org, kuba@...nel.org,
        linux-edac@...r.kernel.org, linux-hwmon@...r.kernel.org,
        linux-ide@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-mips@...r.kernel.org, linux-pci@...r.kernel.org,
        linux-renesas-soc@...r.kernel.org, linux-serial@...r.kernel.org,
        linux-spi@...r.kernel.org, linux@...linux.org.uk, linux@...ck-us.net,
        manivannan.sadhasivam@...aro.org, netdev@...r.kernel.org,
        nikita.shubin@...uefel.me, nikita@...n.ru, ntb@...ts.linux.dev,
        olteanv@...il.com, pabeni@...hat.com, paulburton@...nel.org,
        robh@...nel.org, s.shtylyov@....ru, sergio.paracuellos@...il.com,
        shc_work@...l.ru, siyanteng@...ngson.cn, tsbogend@...ha.franken.de,
        xeb@...l.ru, yoshihiro.shimoda.uh@...esas.com
Subject: Re: linux: Goodbye from a Linux community volunteer

On Thu, Oct 24, 2024 at 06:19:16PM +0000, Hantong Chen wrote:
> 
> I wonder some of Ukrainian misiles and drones might also be using
> the embedded Linux controllers, and why aren't there any sanctions.
> This cannot be used as an excuse.

The question of whether there are any sanctions is up to governments
and legislatures of those countries that have enacted the relevant
laws and regulations.  This is not up to the Linux development
community.  But given that we are citizes of our respective countries,
we are obliged to follow the laws of our countries --- and if we
don't, we can be subject to enforcement actions of our countries'
governments.  For someone who is a Chinese citizen, the same would
apply to any rules and regulations promulgated by the Chinese
government, no?

The question of why a particular country has decided to sanction
Russia and not Ukraine, and why a country has decided to support one
country versus another, whether it's Germany, France, and Poland
sending tanks and armored vehicles to Ukraine, or North Korea sending
artillary shells to Russia, is not up to the Linux development
commuity.  As individuals we may have our own opinions of the
appropriatness one one versus another, but the fact remains that there
are sanctions imposed on one set of countries, but not the against the
other set.

Hypothetically, if someone was a Russian Citizen, and there was a
Russian Law forbidding them to provide technical assistance to US
entities, then that person would be obliged to respect that law, and
not send any patches to US-based open source projects.  Depending on
how that law was worded, a Russian-based open source project might not
be allowed to accept changes from US entities, and again, if you were
a Russian open source project maintainer, you would be obliged to
follow that law --- or maybe you would be thrown into a Russian jail.
Whether you are a Russian patriot and are 100% behind the Russian law,
or think that perhaps it's not the best policy, doesn't really matter;
you are still obliged to follow the law one way or another.

(Personally, my sympathies are entirely with Ukraine, but my opinions
really don't matter for the purposes of this discussion, because I
don't make my country's foreign policy.)

> What LF and Linus done will inevitably create a climate of fear where
> contributors and maintainers from the *Countries of Particular Concern*
> feels endangered.

In the ideal world, one country would't be invading another conutry,
and we wouldn't have these sanctions regimes.  But they were not
*caused* by the decisions of the LF and Linus.  The sanctions regimes
were enacted by multiple countries' legal governmnts, and now the
question is how can we best protect the Linux development comunity,
the operators of web and git servers that are redistributing Linux
kernel sources. etc.

The Linux community may be an international open source project.  But
it is composed of individuals who have to respect the rule of law of
their individual country; and many countries have spoken quite clearly
on this subject.

Cheers,

					- Ted