linux-kernel - Re: Russians in the Kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241105160622.GV1350452@ZenIV>
Date: Tue, 5 Nov 2024 16:06:22 +0000
From: Al Viro <viro@...iv.linux.org.uk>
To: Dylan <falaichte@...lfence.com>
Cc: linux-kernel@...r.kernel.org, gregkh@...uxfoundation.org,
	torvalds@...ux-foundation.org
Subject: Re: Russians in the Kernel

On Tue, Nov 05, 2024 at 04:15:23PM +0100, Dylan   wrote:
> Hello everyone,
> 
> The recent stir about the removal of prominent contributors from the Linux kernel for nothing more than being Russian has prompted me, someone who has absolutely no business being in and around the kernel mailing list to compose a message and hopefully provide the prospective of an end-user of the Linux kernel. Some people feel blanket banning an entire group of people for the wrongdoing of a handful is rather unfair and not in keeping with the spirit of free and open source software. Rather than complain about the change and governmental overreach in community projects, I'd like to offer a technical solution that could ensure things continue as they have while adhering to sanctions.

WTF is "being Russian" and what does that have to do with anything?

> Would it not be possible for the Russian kernel development community to pull together and continue working on the Linux kernel in their own tree and then have any patches sent back upstream by someone that is not a Russian citizen? I feel the solution would definitely help with making things right to the veteran contributors that have been working on the kernel for decades and allow patchsets to be more closely monitored for possible sabotage by having all patch submissions be sent through an intermediary that is easily identified as handling Russian code.

*snort*

For one thing, sanctions are not tied to citizenship.  For another,
any proxy set up to bypass the sanctions that really exist (i.e.
based on employment by sanctioned companies) would fall under the
same sanctions.

For another, you _really_ don't want to set anything with even
the slightest whiff of "that's how to hide patch origin and/or
evade review" - that's an open invitation to any organization
that wants to feed something underhanded into the kernel.
Won't be a healthy place to hang around, to put it very mildly.