Official statement regarding recent Greg’ commit 6e90b675cf942e from Serge Semin

Hello Linux-kernel community,

I am sure you have already heard the news caused by the recent Greg’ commit 6e90b675cf942e (“MAINTAINERS: Remove some entries due to various compliance requirements.”). As you may have noticed the change concerned some of the Ru-related developers removal from the list of the official kernel maintainers, including me.

The community members rightly noted that the quite short commit log contained very vague terms with no explicit change justification. No matter how hard I tried to get more details about the reason, alas the senior maintainer I was discussing the matter with haven’t given an explanation to what compliance requirements that was. I won’t cite the exact emails text since it was a private messaging, but the key words are “sanctions”, “sorry”, “nothing I can do”, “talk to your (company) lawyer”… I can’t say for all the guys affected by the change, but my work for the community has been purely volunteer for more than a year now (and less than half of it had been payable before that). For that reason I have no any (company) lawyer to talk to, and honestly after the way the patch has been merged in I don’t really want to now. Silently, behind everyone’s back, bypassing the standard patch-review process, with no affected developers/subsystem notified - it’s indeed the worse way to do what has been done. No gratitude, no credits to the developers for all these years of the devoted work for the community. No matter the reason of the situation but haven’t we deserved more than that? Adding to the GREDITS file at least, no?..

I can’t believe the kernel senior maintainers didn’t consider that the patch wouldn’t go unnoticed, and the situation might get out of control with unpredictable results for the community, if not straight away then in the middle or long term perspective. I am sure there have been plenty ways to solve the problem less harmfully, but they decided to take the easiest path. Alas what’s done is done. A bifurcation point slightly initiated a year ago has just been fully implemented. The reason of the situation is obviously in the political ground which in this case surely shatters a basement the community has been built on in the first place. If so then God knows what might be next (who else might be sanctioned…), but the implemented move clearly sends a bad signal to the Linux community new comers, to the already working volunteers and hobbyists like me.

Thus even if it was still possible for me to send patches or perform some reviews, after what has been done my motivation to do that as a volunteer has simply vanished. (I might be doing a commercial upstreaming in future though). But before saying goodbye I’d like to express my gratitude to all the community members I have been lucky to work with during all these years.

  • kbal@fedia.io
    link
    fedilink
    arrow-up
    156
    ·
    2 days ago

    Later in that thread:

    Please accept all of our apologies for the way this was handled. A summary of the legal advice the kernel is operating under is

    If your company is on the U.S. OFAC SDN lists, subject to an OFAC sanctions program, or owned/controlled by a company on the list, our ability to collaborate with you will be subject to restrictions, and you cannot be in the MAINTAINERS file.

    Anyone who wishes to can query the list here: https://sanctionssearch.ofac.treas.gov/

    • schizo@forum.uncomfortable.business
      link
      fedilink
      English
      arrow-up
      125
      arrow-down
      12
      ·
      2 days ago

      Which is exactly what anyone who wasn’t wanting to just snort some concentrated outrage knew was the case.

      And you can argue as to if OFAC list should apply to things like this or not, but the problem is that the enforcement options for OFAC violations include ‘stomp you into the ground until you’re powder’, most people are just going to comply.

      • prole@lemmy.blahaj.zone
        link
        fedilink
        arrow-up
        11
        arrow-down
        6
        ·
        16 hours ago

        Oh hey, a reasonable comment here that actually has a decent score… These comments are wild. But given the recent… I’ll just say, conspicuously pro-Russian, turn this site seems to have taken in the run up to the election, it’s not exactly a surprise.

        • schizo@forum.uncomfortable.business
          link
          fedilink
          English
          arrow-up
          8
          arrow-down
          2
          ·
          13 hours ago

          I’m shocked I didn’t get downvoted to shit myself.

          It’s just that it was VERY clearly either sanctions or a NSL, since the Linux Foundation is in the US and the two things that result in a public entity like that making silent, un-explained changes are, well, sanctions and NSLs and you don’t say shit because your lawyer told you not to.

          I don’t necessarily agree that tossing contributors off an open-source project is in the spirit of the OFAC list, but the problem almost certainly is that they’re employed by some giant tech company in Russia.

          And, in Russia, like in the US, and Israel, and China, and anywhere else you care to mention, tech companies are almost always involved in military supply chains, since shit don’t work without computers at this point.

          Which leads to a cycle of being unable to work with Weapons, Inc. and someone works for Weapons, Inc. so now that person can’t be worked with either and so your choices are… comply with the OFAC list, or take a stupid amount of legal risk up to and including angry people with guns showing up to talk to you.

          We really don’t know the whole story and immediately jumping to “Imperialists bad!” is how certain chunks of Lemmy roll these days.

          I think they’d be much happier if they all moved to North Korea and helped achieve the goal of Juche by becoming dirt farmers.

      • 0x4E4F@infosec.pubOP
        link
        fedilink
        English
        arrow-up
        44
        arrow-down
        33
        ·
        1 day ago

        Also from that thread.

        Again, we’re really sorry it’s come to this, but all of the Linux infrastructure and a lot of its maintainers are in the US and we can’t ignore the requirements of US law. We are hoping that this action alone will be sufficient to satisfy the US Treasury department in charge of sanctions and we won’t also have to remove any existing patches.

        US law CAN’T apply on foreign ground, period. Nothing can. Just because they can bully their way around that, doesn’t mean they are right.

        And it should be only fair that Israeli maintainers be removed as well.

        They should also rethink their infrastructure policy and whether they still want it on US soil.

        This is all wishful thinking, I know, but this just goes to show you how they have absolutely no backbone whatsoever. As if anybody is gonna touch the Linux kernel and jeopardize the safety of millions of systems. We all know that is never going to happen, but they still bent over for the US… so typical… just goes to show you how little backbone everyone has, including Linus.

        Oh, and don’t get me started on the Russia/Finland history comment…

        • Auli@lemmy.ca
          link
          fedilink
          English
          arrow-up
          1
          ·
          edit-2
          30 minutes ago

          Israel is not against the US at this point. Russia and the US are in a war with Ukraine being the middle man. Look at what the US did to Hauwei sanctioned it and forbid any us company from doing business with it. Basically none of the world could use the phones. All the tech the world is using is American so they get to say what any country can do.

        • prole@lemmy.blahaj.zone
          link
          fedilink
          arrow-up
          24
          arrow-down
          3
          ·
          edit-2
          14 hours ago

          Does everyone here just not understand how international sanctions work?

          As someone with a STEM degree in a STEM field, I’m consistently bummed out by how clearly silo’d my colleagues’ educations were. It is so plainly obvious as soon as you try to have a conversation with them about anything outside of their area of expertise.

          And don’t bother trying to correct or teach them anything, because in their minds, they’re smarter than you, and you have nothing worthwhile to teach them.

          This thread is full of software engineers with just no concept of how society functions, or even a basic understanding of the geopolitical context of any of this.

          • 0x4E4F@infosec.pubOP
            link
            fedilink
            English
            arrow-up
            1
            arrow-down
            4
            ·
            6 hours ago

            This thread is full of software engineers with just no concept of how society functions, or even a basic understanding of the geopolitical context of any of this.

            The whole idea of open source is that you can contribute without restrictions and regardless where you live.

            • Auli@lemmy.ca
              link
              fedilink
              English
              arrow-up
              1
              ·
              28 minutes ago

              That is not the whole idea. The whole idea is you can see the source code. There are plenty of Open source projects that are only one person and they don’t except help from anyone.

          • winterayars@sh.itjust.works
            link
            fedilink
            arrow-up
            7
            ·
            14 hours ago

            I mean, if you’re in a STEM field you really should understand how sanctions work because they matter to your work and, thus, to you.

        • BCsven@lemmy.ca
          link
          fedilink
          arrow-up
          12
          ·
          edit-2
          18 hours ago

          If the company is in the USA they can restrict who you colloborate with. They also can control what you export as a oftware product under ITAR/EAR rules. It is why when some encryotion work had to be done the devs crossed the border into Canada to work on development, because under USA law encryption code is a controlled export product even if opensource

          • 0x4E4F@infosec.pubOP
            link
            fedilink
            English
            arrow-up
            3
            arrow-down
            3
            ·
            7 hours ago

            Then why in the hell was the LF founded in the US? That is something that clearly needs explaining. For example, Sweden is a much better place to do these sorts of things, their software laws are very liberal.

            Some of these things need to be rethought if you ask me, this is not something that should be left like this. If no one in the kernel, including Linus, doesn’t see a serious problem with “we have to move people around to code”, then most of these people are probably braindead… I’m sorry, but if it was me, once I found out I had to move devs around to code, I would have been “fuck this we’re moving the foundation”.

            • Auli@lemmy.ca
              link
              fedilink
              English
              arrow-up
              1
              ·
              27 minutes ago

              Don’t know if it would help as there are international sanctions against Russia.

            • kattfisk@lemmy.dbzer0.com
              link
              fedilink
              arrow-up
              6
              ·
              5 hours ago

              You might be surprised to learn that Sweden also has sanctions against Russia, together with the rest of the EU, Norway, Switzerland, Japan, Australia, South Korea and a bunch of other countries. Because this is not about the US being an ass, it’s about Russia being an ass.

              • 0x4E4F@infosec.pubOP
                link
                fedilink
                English
                arrow-up
                1
                ·
                4 hours ago

                I wasn’t saying that Russia is not an ass, I was just saying that the whole point of open source is that it’s above borders and nationalities, religion, sexual orientation, etc. It should be an imperative to keep these core values, not bend over backwards when even no warning has been issued, which I’m fairly certain it would have never happened. And on top of that, Linus’es reaction to them being Russian, I mean… come on!

                • Auli@lemmy.ca
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  25 minutes ago

                  Where does this idea the open source is not political and above boarders. Open source is very political in its nature.

            • BCsven@lemmy.ca
              link
              fedilink
              arrow-up
              1
              ·
              4 hours ago

              I agree it might be better elsewhere. (Like how my preference is Protonmail being hosted by a neutral country based company) But so I don’t mislead, my encryption example was generic, not specific to linux kernel…however any novel encryption does have to be noted to NSA and other organizarions in the USA. Canada has something similar but it appeared less strigent, and adjustments have been made between the bordering countries. I personally diaagree that encryption should have government hand in it, it solves nothing. A foreign state actor wanting to send encrypted communications to overthrow another entity isn’t going to follow software laws anyway.

              • 0x4E4F@infosec.pubOP
                link
                fedilink
                English
                arrow-up
                2
                ·
                edit-2
                4 hours ago

                Like how my preference is Protonmail being hosted by a neutral country based company

                I also use Protonmail because of this. Sure, the free plan is not really great, but I only keep important stuff, so I don’t get over the 500MB limit, I delete or archive the rest.

                kernel…however any novel encryption does have to be noted to NSA and other organizarions in the USA

                That may be true, but only if you’re a US citizen. For example, my country doesn’t have such regulations. In the end, if it’s open source, it shouldn’t matter whether I report stuff like that to any organization. It’s open source, look it up, it’s on a git repo online freely for everyone to review the code.

                A foreign state actor wanting to send encrypted communications to overthrow another entity isn’t going to follow software laws anyway.

                Exactly. As if hacking and DDOSing are legal 😒. It’s just throwing money away on some people doing pointless things.

                On the other hand, having a ln encryption technologies taskforce makes sense IMO. Watching over what’s going on in the open source world regarding cryptography, yeah, that is something that can actually be useful… for the country’s cyber-security I mean.

            • IrritableOcelot@beehaw.org
              link
              fedilink
              arrow-up
              2
              ·
              6 hours ago

              Thats a good point. I think its probably because most of the corporations who fund and contribute to the kernel are American, and coordinating financial and physical contributions would be complicated across borders. Just a hypothesis though.

              • 0x4E4F@infosec.pubOP
                link
                fedilink
                English
                arrow-up
                1
                ·
                6 hours ago

                But moving people around to code isn’t 🤨? I’m sure it far easier to justify a donation than to book plane tickets and find places for the devs where to stay. And to be perfectly honest, the whole point of open source is “you can contribute from anywhere”. The first time I would’ve encountered the move people around problem, I would have been “this is not the point of open source, it goes against the very spirit of it, we have to do something about this”.

    • Snot Flickerman@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      58
      arrow-down
      40
      ·
      2 days ago

      But folks who work for US companies building weapons for Israel are totes okay?

      It’s honestly fucking wild that an internationally developed open source project has to play by the US government’s rules when the US government is out here helping commit genocide right the fuck now.

      Like, look in the fucking mirror on this why don’t you.

      Maybe the better rule is that if you work for a company that produces weaponry for war you shouldn’t be allowed to contribute, period.

      • prole@lemmy.blahaj.zone
        link
        fedilink
        arrow-up
        7
        arrow-down
        1
        ·
        16 hours ago

        But folks who work for US companies building weapons for Israel are totes okay?

        Who here said this?

              • prole@lemmy.blahaj.zone
                link
                fedilink
                arrow-up
                4
                arrow-down
                4
                ·
                14 hours ago

                Yes. I am a bot for not paying attention to user names and assuming that the commentor who defended the comment I replied to, was the same person that made the original comment.

      • SplashJackson@lemmy.ca
        link
        fedilink
        arrow-up
        1
        ·
        14 hours ago

        You want the World Bank to bail out your economy post-pandemic, you gotta accede to some tough demands

      • Orygin@sh.itjust.works
        link
        fedilink
        arrow-up
        54
        arrow-down
        7
        ·
        1 day ago

        Wow, I didn’t know that being a Linux/open source contributor meant you don’t have to follow your country’s laws.

        It’s developed internationally but devs still reside somewhere and have to abide by the rules at that place. Linux in this case being represented by an US entity means they have to follow the gov’s sanctions. If you want more or less of those, that’s where (the government) you act.

      • 0x4E4F@infosec.pubOP
        link
        fedilink
        English
        arrow-up
        10
        arrow-down
        2
        ·
        edit-2
        1 day ago

        Maybe the better rule is that if you work for a company that produces weaponry for war you shouldn’t be allowed to contribute, period.

        This is something I can actually get behind on.

        But, you see, there is just one teeency weeency tiny problem with that. They spend trucks of cash on whatever they deem will give them what they want, including funding organizations that they profit from.

      • kbal@fedia.io
        link
        fedilink
        arrow-up
        35
        arrow-down
        10
        ·
        2 days ago

        You may be amazed to learn that there aren’t many international sanctions against the USA at this time, but I imagine you could probably get into legal trouble for collaborating with Americans if you’re in, I don’t know, North Korea maybe.

        • prole@lemmy.blahaj.zone
          link
          fedilink
          arrow-up
          5
          ·
          16 hours ago

          What are you even trying to say here?

          Do you think you’ve unraveled some massive conspiracy simply by learning about the existence of Western hegemony?

        • davel [he/him]@lemmy.ml
          link
          fedilink
          English
          arrow-up
          33
          arrow-down
          15
          ·
          2 days ago

          You may be amazed to learn that the reason there aren’t many international sanctions against the USA at this time is not because the USA is a beacon of peace, freedom, democracy, and national sovereignty. Because the US is very much not that.

        • AbidanYre@lemmy.world
          link
          fedilink
          English
          arrow-up
          21
          arrow-down
          5
          ·
          2 days ago

          It’s crazy how the US Treasury isn’t sanctioning companies for working on US government approved contracts. /s

          • kbal@fedia.io
            link
            fedilink
            arrow-up
            19
            arrow-down
            9
            ·
            2 days ago

            Address your complaints to the government of the USA. Or, if you have the right to do so, cast a vote in the upcoming election there to prevent it taking a big step in the opposite direction from a world in which it might consider anything like similar sanctions against Israel.

            • davel [he/him]@lemmy.ml
              link
              fedilink
              English
              arrow-up
              16
              arrow-down
              9
              ·
              edit-2
              1 day ago

              “Write a stern letter to a foreign government” and “Vote against ‘very probable 101% genocide’ and for ‘proven 100% genocide’” are some weak tea, and beside the point being made.

              • prole@lemmy.blahaj.zone
                link
                fedilink
                arrow-up
                4
                arrow-down
                4
                ·
                edit-2
                15 hours ago

                Oh look, a bad faith argument about the upcoming election from someone who I’ve tagged for making bad faith arguments about the upcoming election. Fun.

              • kbal@fedia.io
                link
                fedilink
                arrow-up
                12
                arrow-down
                7
                ·
                1 day ago

                Your particular complaints are better addressed to almighty God I suppose. So long as you don’t blame linux kernel devs for them it’s all the same to me.