Slashdot Mirror
Cryptographic Software in Debian's Main Archive
Cine writes: "James Troup and Sam Hartman recently sent a note to all debian mirror maintainers, to inform them about the current situation and future plans. Sometime after March 8th, crypto software like OpenSSH, SSL support, and many other enhancements will be integrated into the debian main archive. This is in accordance to legal advice the Debian project received."
After all this time, they still don't have OpenSSH in the main sections? I knew they were behind the times with kernel, glibc, and X, but goddamn!
Crypto helps aid in privacy, and privacy should be available to everyone no matter who they are or where they live.
It's as though they just walked up and handed security to those who don't know how to use it. I haven't used debian, but I understand you can install it if you need it, and you need it if you install it. They just made it a lot tougher to maintain mirrors in some respects, and at the same time made it an easier sell.
The Debian team has been working on this for a long time. Hopefully it will make installations and upgrades quicker as the servers can now be on the same continent :-).
One thing that was interesting is that under section 740.13(e) of the US EAR, the software can be exported as long as the people that are exporting it file for export notification. Apparently one thing that they were worried about was whether or not the individual mirrors had to each file or if Debian could just file for the main archives and all the mirrors. According to their legal advice that should be okay. Let's just hope that they don't have any legal problems with it in the future.
for compatible crypto packages!
Thanks, Debian!
The crypto situation was so screwed up before only terrorists could understand it.
I'm really glad to see this finally being included into the main archive. I'm also glad to see that they consulted legal sources before charging into any of this. Hopefully they will keep integrating cryptography into the distro more as time goes on. Keep up the good work guys.
ahh, the egg in the basket..
According to the link, as soon as you sell the software you have to file various things.
This restricts people from selling debian.
Which makes life hard for CD distributors, and is in contradiction with the GPL.
Note: I do not sell debian( or any software ).
...most projects are un-aware of the fact that open source is exempt. I suppose projects such as openbsd, based in other countries, still have the advantage though - defining when software is sold for a fee is difficult. is a fee only for media, or for a compilation, etc, still under this open source clause?
Unless I am missing something, this won't have any real effect on end users. When I request a package to install it, I request it by name and have no idea what subdirectory it is kept in, apt keeps track of this information for me.
Perhaps this is a bit offtopic, but Debconf 2002 was also announced today. Will holding it in Canada make a difference crypto-wise? Probably not, but it should be a rockin' good time for participants anyway.
It's also been conveniently scheduled to coincide nicely with the Ottawa Linux Symposium. Other than that, more info will be forthcoming within the next couple of weeks.
This is the second time I've seen this "recomendation" come out of a legal organization, in almost exactly the same wording no less. I've got to believe therefore that they are pulling it from some other source, such as an official regulation or other document.
Does anyone have such a list though? Can anyone provide a copy of it? Is it even technically possible to generate? In real time, or even close? I mean sure, it's technically trivial to implement this blocking, just a few iptables/ipchains commands, or some entries in the firewall's firmware... but I think getting that list to begin with is nearly impossible. How do you know where the other end of the phone line that is dialed into some modem bank on the other side of the net is?
In the last instance that I saw this (an external server at work) corporate legal was threatening to pull the plug if the admins didn't provide proof they were doing this. After much head scratching and searching the net my sugested response was that they would be happy to implement this just as soon as the legal department provided them with such a list.
I'm told they never heard back from legal on that topic.
So CmdrTaco = God?
Don't make me laugh.
Glückwünsche, haben Sie Slashdot ermordet, indem Sie zum korporativen Druck beugten und Subskriptionen einlei
Bush admits Shadow U.S. government in place
It amazes me that the U.S. government has done as much as it can to try to outlaw privacy. To me, it seems that things are out of control in some parts of the U.S. government. The U.S. spends more on surveillance of everyone everywhere than any country ever has in the history of the world. Money is spent on being sneaky, rather than on making good relationships.
It is futile to try to avoid the export of software, particularly when having it is legal in other countries. Yet taxpayer money is spent on this. The U.S. government, in my opinion, should not try to control the entire world.
More on the extremes of U.S. government policy: What should be the Response to Violence?
Bush's education improvements were
after reading the legalese, the only thing i'm curious about is why there are different standards for crypto that has examinable source and crypto that is only available in executable form. isn't it already known that pgp, rsa, , etc are strong whether or not the source and algorithms are published?
Oh yeah... It seems that the Debian Project is one step closer to supplanting OpenBSD.
It seems that OpenSSH is still being integrated into the main archive of Debian, Woody (aka 3.0) is still awaiting release, and there is no specific holistic proactive security project. Nevertheless, portability, correctness et al. are definitely emphasized. Now the binary emulation may seem a dubious feature in many cases, especially with Linux occasionally recieving more support than many commercial Unices, though there are some efforts at binary emulation on Suns.
Okay, I'll admit - this was a troll. OpenBSD is still very valuable and viable, and still the best choice for security minded situations. But as yet another bulwark of OpenBSD is breached by Debian, this topic will again merit reevaluation. I still feel that the distant future will find OpenBSD being outpaced by whatever system the Debian Project presents, be it still based on Linux, a more direct BSD derivative, or a more direct embodiment of the GNU System.
-castlan
> Glückwünsche, haben Sie Slashdot ermordet, > indem Sie zum korporativen Druck beugten und > Subskriptionen einleiteten. fish translation?
For the Debian end user, getting stuff like OpenSSH has been very easy, contrary to what some posters have said. There is little or no benefit for most end users in this change; and a huge increase in trouble and inconvenience for some end users, who happen to be citizens or residents of a country like Cuba that the Bush regime doesn't currently like.
US crypto regulations are not only a nuisance, they're also volatile. "Things are getting better", we hear. Bullshit. Things are changing unpredictably. Few people (and certainly no software developers) have any idea what US policy will be next year.
The only sensible policy is to keep the crypto archive in a country that has never had export regulations for crypto software (there are many).
Glückwünsche, haben Sie Slashdot ermordet, indem Sie zum korporativen Druck beugten und subskriptionen einleiteten.
...
translation:
Congratulations, you killed slashdot because you couldn't resist the coroporate pressure and because you introduced subscriptions.
The translation may not be 100% accurate, but it's about the new subscription system introduced yesterday
Life sucks.
Hey! Yes I'm talking to you, there in the states...
Why are you still there instead of migrating in
a really democratic country, where citizens are
free too write/use/export/pubish/reverse-engineer
any kind of software they like?
As US residents who did not know how to program crypto know, crypto is available in outher countries. A few years ago, the easiest way to get secure shell was to get OpenBSD from Canada, or buy something expensive. Programers with access to crypto knowledge could make what they wanted.
One of the main goals of public key encryption thechnology was to aid people in countries likely to be on US blacklists. Giving those people the ability to communicate privatly is much worse for oppressive governments than any improvement in that government's software library. Governments can usually afford programers and have what they want where they want it.
Most countries have proved that crypto is a doubtful tool of subversion. Oppresive countries have made cryptography illegal (yes, I'm refering to past US laws and current UK laws). Those that use it only set themselves up for investigation. Indeed, we can be sure that owning a computer at all in some places will earn you a beating.
I'm happy to see the US going in the right direction for a change. I have and love Debian. One of the best things about it is secure shell. It's great to be able to use and administer my home machines from work or anywhere else in the world without worrying about someone breaking in. "ssh user@mahine -X" run on my lan makes all of my machies transparently usable at once through a single monitor and keyboard. Having this wonderful tool even easier to get is a great step forward. Hopefully the US will consider this one of the weapons to freely distribute from the "Arsenal of Democracy". Go get it!
Friends don't help friends install M$ junk.
It doesn't work in Mozilla, either. Come on, Klerck, get with it.
Yay! Now I should be able to get this stuff from the nearby and really fast mirror on campus. Ahh..
Now, I just wonder if the FreeS/WAN folks will ever get their code integrated with the standard Linux kernel..
...before September 11 last year. It makes me wonder about its validity when commenting on Government policy.
This will have a huge effect in the long run, since crypto isn't just used for encryption. It's also used for authentication, and is critical in token-based authentication (e.g., smartcards). With tokens, you have strong authentication ("something you have" (token) and "something you know" (passphrase), lacking only "something you are" (e.g., fingerprint)).
This allows you to do some really nice things. You want temporary root access? Sure - put your card in the reader and type in your passphrase. Once you remove the card, root access goes away.
Or you need access to a database containing confidential information? Put in the your card and you gain access to database... but it will be dropped when you remove your card.
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
Flamebait perhaps, but not Off Topic. Integrated crypto is a significant feature of OpenBSD. Now Debian has the capability to integrate their crypto. This will propel Debian forward significantly into areas where OpenBSD was once undisputedly the better choice. Perhaps instead of ignorantly moderating, you could have actually posted a response. Of course, that assumes that you are capable of intelligent communication. My bad.