Hifn Restricts Crypto Docs, OpenBSD Opens Fire

Mhrmnhrm writes "After totally closing off public access to documentation for their chips roughly five years ago, Hifn is again offering them, but with an invasive registration requirement. Needless to say, Theo de Raadt and the rest of the OpenBSD team were not amused, and following a Hifn manager's missive, the gauntlet has been thrown. Either open the docs fully, or be removed from the system. This wouldn't be the first time... the same thing happened to both Adaptec and Intel following similar spats."

Comments

Go Theo.

[AltGrendel]

They obviously don't know who they are dealing with.

This should get really interesting.

By my math...

[Enderandrew]

...I count 12 required fields where you have to enter data.

Is this worth throwing a hissy fit over? Once one person downloads the docs, they can distribute them.

Re:By my math...

[tygerstripes]

Registration at our extranet is required along with an email address that can be confirmed. We cannot support anonymous FTP or http downloads. The reason for this is that we are required by the conditions of our US export licenses to know who and where our customers are. If anyone objects to registration then we could not sell them chips anyway so it does not seem an unreasonable restriction to us.

Implication: they are collecting the data in case they're asked to provide it. To the US Govt. Yeah, that's pretty hissy-worthy when you're trying to claim that you're opening up access. I have little doubt that registration will lead to some non-disclosure agreement or other, though I'm not prepared to try it myself.

Incidentally, how does the supplying information without charging for it constitute "export"? And by comparison, if I want to download a manual for something I bought second-hand, why can't I? Just a thought.

Re:By my math...

[Deliberate_Bastard]

>I count 12 required fields where you have to enter data.

>Is this worth throwing a hissy fit over?

And I count one (1) principle at stake.

Which is *always* worth throwing a fit over.

Re:By my math...

[linvir]

Once one person downloads the docs, they can distribute them.

That would be fine if they were writing homebrew XBox games. Maintainers of major operating system distributions, on the other hand, have to be very careful about complying with licenses.

And did you even read the email? Hifn wants de Raadt to play along and pretend that their docs are open. They think that they deserve special treatment over all the other manufacturers in the industry, probably in order to collect data to sell on to marketers.

Is that worth throwing a hissy fit over? No, but then your choice of phrase is poor, and gives away how little attention you payed to the content of the email itself. It's certainly worth telling Hifn to go screw themselves over, which is what de Raadt is doing.

Re:By my math...

[bhima]

Yes.

You have to sign an NDA to get the documents. So you would be violating the NDA to redistribute them.

There isn't a business advantage to this sort of secrecy because your competitors can easily obtain this same information through a blind. So it comes down to policy motivated by irrational fear & greed. Who needs to really deal with company with these qualities?

This topic is of primary interest to me because I am shopping for a crypto accelerator card right now, for use in the fall. Given the success and ease I have had using OpenBSD, and given the great support I have from the mailing lists, this is a reasonable criterion to use when purchasing hardware. In fact at some point of the decision making process for all of my hardware I have done a search on the OpenBSD mailing lists. This sort of information makes installation and maintenance a simple thing.

So it really does boil down to unless the OpenBSD group recommends a certain piece of hardware I won't buy it...

Re:By my math...

[gowen]

And I count one (1) principle at stake.

Which is *always* worth throwing a fit over.

The ability to compromise is not a sign of weakness.

Re:By my math...

[Enderandrew]

Actually a document that is released freely in the public domain can be redistributed. The RIAA gets on people's cases about distributing something that was not released freely to begin with.

Re:By my math...

[gkhan1]

Yeah, documents released in the public domain can be distributed at will, because per definition if something is in the public domain it's not copyrighted. That is, the author has specifically given up his copyright or that the copyright has expired (what is it, 75 years after his death or something?). But this isn't the case here, the documents are released free as in beer, not free as in speech.

Take the computer software analogy: just because IE is released for free for everyone to download, it does not mean that it isn't copyrighted. Or take a book analogy: say that a writer starts handing out his books for free, that still doesn't mean that a publisher can without permission start printing copies of it. That would be copyright infringment. Or take an internet analogy: even if someone writes a stellar article on dungbeetles somewhere on the internet, available for free, it would still be illegal to put that up on Wikipedia because the original author owns the copyright on the text.

Re:By my math...

[larytet]

try to get broadcom data sheet. you can get one - encrypted PDF with personal signature. you can't run search in the doc, you can't copy name of the hardware register from PDF to the code/e-mail. you are completely screwed. every time you send a file to coworker you have to find that password and send along. and all this assuming that you ARE a customer of broadcom.

similar story with any vxWorks (commercial real-time system) docs. i suspect that WRS deliberately hunts all message boards/servers keeping any information/comments related to the OS.

another example is WinCE from MS. try to find any negative comment about the OS on the NET.

Re:By my math...

[chill]

You have to sign an NDA to get the documents. So you would be violating the NDA to redistribute them.

You are wrong. I just filled out their form and got immediate access to the spec sheets, no NDA required. The form asked if I had an existing NDA and I said "no". It didn't complain. I was automatically e-mailed a password which gave me immediate access to the 7956 Security Accelerator data sheet, no questions asked.

The data sheet itself is copyright and does say you can't redistribute without permission. It also contains a US Export notice and claims to be HiFn Confidential. I've already sent in an e-mail asking for permission, so we'll see where that goes.

The form was basically name, address, phone number and do you want to be notified when they update docs.

Get a damn P.O. Box and disposable cell phone if you are really bothered.

There ARE clauses on the document that are worrisome, so Theo HAS a valid argument but I believe a lot of this stems from boilerplate text which HiFn executives haven't read in years. Theo obviously HAS read it and is raising an appropriate fuss.

Re:By my math...

[blueskies]

A company is required by law not to export this data outside of the US. You fill out a form and say that you live in the US and you get the data you're requesting. If you're really paranoid, you do what any smart person does and use a spam-email account and a fake address.

A company lies about being required by law not to export this data outside of the US...and then lies that it is completely open...

Pray tell why Theo says he can get the same information from other us crypto chip makers without this same problem?

He called them on it and they don't want to admit that the only reason they have registrations is for marketing purposes. Everything else is a smokescreen.

Theo

[dirtyhippie]

Oi, Theo! I agree with you 100%, but please, tone down the virtiol just a smidge! From TFA:

Jason and I spent a lot of time writing that code in the past, but because your policies are privacy invasive towards us, and thus completely thankless for the sales that we have given you in the past -- we will not spend any more time on your crummy products.

And if you continue baiting me, I will delete the driver from our source tree.

Calling their products "crummy" and threatening them with driver deletion if they don't stop "baiting" you is not a way to get what you want. Now it means some egomaniacal manager has to eat crow for the driver to go public. I was in 100% agreement with your post until I got to this point.

Sometimes, I wish someone would just slip some sort of tranquilizer in the water supply near Alberta...

Re:Theo

[flumps]

In fairness you do not know what has gone before. Theo mentions "personal emails" and "previous discussions".

Some people just do not listen unless you threaten them like this. It must've been the last straw..

Re:Theo

[Bin_jammin]

Theo must be the only person you have to deal with ever. Seems most everyone I meet these days is like that.

Re:Theo

[Anonymous Coward]

I have to disagree there. The chap may look like a fool to certain people,
but he is only further alienating people who are outside the project already.
There needs to be more of this kind of plain talk. I have great respect for
these types of character who speak straight and openly mock officious business
and legal nonsense. I have the greatest respect for the PirateBay practice
of posting the laughable legal notices they receive along with scathing
responses. We need more of this open hostility to bullshit.

You say that Hifn made no insult, but that is for Theo to infer not for you
to deduce. Perhaps he takes an authoratarian expectation to comply with arbitary
hoop jumping as an insult, I can see that too.

Your definition of professionalism is quite personal. For example, someone who
bases their choice of software on the personality of the coders rather than
the quality of the product could be taken as churlish and unprofessional too.

Re:Theo

[ScouseMouse]

The fact that he *does* stick to his principles despite people telling him just how out dated and un-capitalist he is, is the reason i *do* use open source.

The problem is that Manufacturers seem to have the idea that they can dictate terms to the people who produce software to run on their hardware. Unfortunately, In the majority of cases, that appears to actually be the case.

The insulting thing in the original email was that he should be expected to comprimise his principles to support other people's profit, and as he is *not* being paid by Hifn, I personally see that it is well within his rights to not support the hardware in question.

Perhaps if you went up to some Civil rights protestor in the 1960's and said that this entire equality thing was a bit silly, and they should just accept these limitations, because its convenient for the asker, you may get a similar response.

Yes, i know this is a bit contrived, however, its worth noting that there are people who consider this sort of thing a matter of Civil rights. The right to be able to do whatever you want with the electronics in your computer, as opposed to what someone you have never met tells you.

Some people do consider this sort of thing a huge insult, and if putting it in plain language offends you enough that you dont use open source software, then i feel sorry for you. Your missing out on a lot of great software written by people who love what they do, however thats your choice.

Re:Theo

[Anonymous Coward]

You clearly have no idea what goes on before Theo brings something public.

Repeated contacts are attempted, and vendors ignore them.
More contacts are attempted, and maybe a low-level person says, "I'll check into it"...and then vanishes.

This goes on for some time before things are brought public.

Publicly pointing out the idiocy of a corporate policy is an absolute last step. The potential for dammage is recognized, but by that point, it really doesn't matter. The "nice and quiet" approach has been tried, failed, and produced NOTHING. What's the worst that can happen by bringing things public and nasty? Nothing! What's the best that can happen? Something better than nothing. This is only done after there is NOTHING LEFT TO LOSE!

Vendors like it when you are nice and ask quietly. They can easily ignore you, pretend you don't exist and conduct business as usual.

Meanwhile, the rest of the open source software world sits back, calls Theo a jerk, and benefits from the work he does, and says, "look how nice we are". Lazy bums.

Re:Theo

[Casualposter]

And Microsoft's Ballmer throws chairs, so do you not use Microsoft products because a chief executive acts like a five year old throwing a temper tantrum because something didn't go his/her way?

Adults are children with breeding rights.

Re:Theo

[freshman_a]

You complained about Theo's name calling by calling him names. That's called being a hypocrite. If you need to used some twisted logic about it being ok for you and not for Theo, then you do that and make yourself feel better.

That's far more acceptable than being rude to someone who was being extremely patient.

Please. You have no idea what was said in private emails and such. If you read the mailing list post, you'd see the message posted by the Hifn employee talks about keeping the source code proprietary. That has nothing to do with the issue at hand. Theo doesn't want code, he wants specs. The whole message completely dodges the issues Theo is having. I'd be pretty frustrated too, if I were him.

We all get it. It's pretty obvious from your other 5 posts on this article that you don't like Theo. Good for you. However, some people do admire him and the work that he's done.

Re:Theo

[BVis]

Next thing will probably be MS opening the source for Vista and seven angels with trumpets...

More like "those other three horsemen should be along any time now.."

Re:Theo

[the_B0fh]

Has any one who badmouths Theo actually tried to talk to him? I've communicated with him without any issues. Just because a person has principles, and stands up for those principles, loudly, doesn't mean he is an asshole.

Looking at the NetBSD issue, Theo was bitching about developers who kept introducing security holes - I dunno about you, but I'd bitch slap people who keep introducing security holes too, else you end up with something like Windows.

Re:Theo

[vertinox]

One can stick to one's principles without being a whiny little shit about it.

"If you don't ask, you don't get." -Mahatma Gandhi

Re:Theo

[number11]

8 or 10 years ago we didn't have the wars of today, road side bombs, remote detonation with cell phones, and all other types of devices.

Yeah, "we" had a lot of that stuff (the Mossad was the world expert on killing people via cell phone), it's just that at that time the US hadn't attacked and occupied Iraq, so those things mostly weren't happening to Americans.

Consider it a neccesary evil of sorts. Not our fault, just a result of terror.

You're right that it's an evil, but it's not necessary. You don't think "bad people" can get copies of the data sheets? That's stupid. I can think of half a dozen ways to get the info, and you probably can too. Besides, you can't build a bomb from a chip data sheet. And on the other side of the coin, there is absolutely no reason to believe that the information will be used only for export control. Or, as far as that goes, even for legal purposes, since Bush has made it clear that he views himself and his security forces as above the law.

People who put their life on the line (IEDs) while you confortably sit back and code.

I feel terrible about that. But the thing is, they're not doing it for me (whatever they may think), because Iraq never was a threat to me. Bush & Cheney didn't invade Iraq because of terrorism, they did it for political reasons. And they didn't do it to "free the Iraqis", because there are any number of other countries whose governments are even more oppressive, but remain unattacked.

Before the attack, Iraqis lived under a thuggish dictator who killed thousands. They also had electricity, women could work outside the home, and they could drive their cars without fear of being stopped and killed at some random checkpoint or machine-gunned by panicky American troops. Today, the thousands are instead killed by US troops, Interior Ministry death squads, religious militias, Al Quaida, and random car bombs. And there's not much electricity.

I don't know what the answers are, but I'm positive that collecting identifying info on people who want to look at chip data sheets is not one of them.

Re:Theo

[the_B0fh]

I've been on misc@ for about 8 years now. From what I've seen, Theo is only short with people who want to make him do things _their_ way, rather than work with him to get things done his way.

For example, every now and then, someone who bitch about the price of CDs, and how it would be more beneficial to sell OpenBSD CDs with only x86, as that's what most users have. You know, sell it for $29.95 or something, and supposedly, OpenBSD will sell more of it.

Most of the times, these people are only interested in doing things for THEMSELVES. People buy OpenBSD CDs to support the project - else, they'd just download it. Additionally, it takes time, money and effort to carry TWO different products, and all these is being done by volunteers. Not to mention inadvertantly shipping the wrong product, etc.

But for some damned reason, these people keep coming back to insist that THEIR way is better, and OpenBSD MUST OFFER A SINGLE X86 CD VERSION OF OPENBSD, OR OPENBSD WILL DIE OFF.

bloody irritating fsckers, lemme tell you.

Well, theres a surprise.

[gowen]

That's a typical OpenBSD discussion, in which Theo DeRaadt
i) is basically right
ii) still manages to sound like spoiled whiny tosser in the process.

Re:Well, theres a surprise.

[flumps]

... but most of slashdot is like that isn't it? You should be used to it by now :)

Personal Info == Legal Tender

[TripMaster Monkey]

From Theo's response:

"50 personal questions" is not open access. Please don't lie about it.

Theo is essentially taking the position that personal information is tantamount to currency, and therefore, requesting personal info is tantamount to charging...hence, HIFN can no longer be considered Open Source. This position may currently be confined to OSS in general and the HIFN question in particular, but it's not difficult to imagine this argument generalized to apply to any situation in which an entity requests personal information. Personal info needs to be treated as the valuable commodity that it is...kudos to Theo for taking a stand on this issue.

Theo also addreses something many of us here are worried about:

>Registration at our extranet is required along with an email address
>that can be confirmed. We cannot support anonymous FTP or http
>downloads. The reason for this is that we are required by the
>conditions of our US export licenses to know who and where our customers
>are. If anyone objects to registration then we could not sell them
>chips anyway so it does not seem an unreasonable restriction to us.

So the personal information you ask for in the registration process
will be given to the US government if they ask? Without court
documents demanding the information?

Even disregarding the 'personal info == currency' argument outlined above, this objection stands on its own. HIFN is basically stating that yes, the info gathered will be handed over to the U.S. government on request, to satisfy their licensing requirements. This alone is a deal-breaker.

Theo sums his entire argument up beautifully here:

We are not your customers. YOU ARE OUR CUSTOMER. Our driver sells
your chips.

I know that our hifn driver has some problems. But because I cannot
get data sheets without giving you private information, I will not
spend even one moment more of my time to improve support for your
products. Jason and I spent a lot of time writing that code in the
past, but because your policies are privacy invasive towards us, and
thus completely thankless for the sales that we have given you in the
past -- we will not spend any more time on your crummy products.

Well said, Theo. I for one don't care to support a company who engages in such practices, and I would rather see no support for a product than half-assed support, because the driver writers were not allowed full, unfettered access to the data sheets.

And finally from Theo's response:

And if you continue baiting me, I will delete the driver from our
source tree.

I stand by my statement that HIFN is not open.

Don't just say it, Theo, do it. If you stand by your statement, then HIFN has no place in the source tree, and should be deleted immediately.

Re:Personal Info == Legal Tender

[TripMaster Monkey]

Well, it would appear that a condition of obtaining an export licence for their products is that they be able to identify their customers.

This is entirely beside the point. The driver writers are not customers.

Documentation of a product is not restricted by export licenses pertaining to that product...only the product itself is restricted.

Re:Personal Info == Legal Tender

[mytec]

Theo isn't asking for a product. He is asking for documentation (data sheets). Further, as the email points out, he isn't looking for documentation regarding unreleased products, etc. but for documentation that was *freely* available eight years ago. Additionally he points out that other *crypto* companies provide information that is more available. What is unclear to me though is whether or not those companies he vaguely mentions are US companies.

Export regulations?

[nonmaskable]

I didn't see any useful discussion of the key point in Cohen's email:

Registration at our extranet is required along with an email address
that can be confirmed. We cannot support anonymous FTP or http
downloads. The reason for this is that we are required by the
conditions of our US export licenses to know who and where our customers
are. If anyone objects to registration then we could not sell them
chips anyway so it does not seem an unreasonable restriction to us.

With a choice between "make Theo happy" and "violate export regulations" it doesn't seem like Hifn is exactly trying to "bait" Theo or OpenBSD.

Re:Export regulations?

[tygerstripes]

Please see previous post - I really don't see how this is supposed to be a violation of export licences! Export is sale overseas (please don't attack, pedants; I'm generalising). This is information which, according to HIFN, is "open" ie freely obtainable. We're not talking about the chips here, are we? Just the information about them.

I'll be the first to admit I may be missing something obvious, but would genuinely appreciate being told what it is. In affable tones, if it's not too much to ask.

Re:Export regulations?

[Adam Hazzlebank]

With a choice between "make Theo happy" and "violate export regulations" it doesn't seem like Hifn is exactly trying to "bait" Theo or OpenBSD.

It does raise an interesting point, should you effectively boycott a company because of the restrictions the government puts on it?

Re:Export regulations?

[giorgiofr]

OF COURSE we should. That's the best way to show the gov't we don't like market regulation in any shape or form. When the big industries take their ball, go play somewhere else with sensible laws and the economy suffers utter and complete collapse, maybe they'll get the message.

Re:Export regulations?

[Toy G]

Documentation on how to interface with the hardware chip is NOT covered by export regulations. Only the actual chip, and its design specifications in regard to implemented algorithms, are covered.
Hence, the docs that OpenBSD folks need (and had access to, until a few years ago) are NOT covered.

The choice is between "giving back access to documentation to allow developers to work with your hardware" or "keep track of developers for marketing purposes".
Export regulations enter the picture only if you don't know them.

Re:Export regulations?

[nonmaskable]

I really don't see how this is supposed to be a violation of export licences

AFAIK (and IANAL), detailed hardware documentation is considered the same as the product under the export license laws. Cryptographic technology actually falls under an even more restrictive license class - munitions.

http://en.wikipedia.org/wiki/Export_of_cryptograph y

Read the "Current Status" section. My point is that Hifn isn't "baiting" anyone. You might disagree with their lawyer or think it's your right to demand that Hifn fight "the man", but that's another issue.

Re:Export regulations?

[TripMaster Monkey]

AFAIK (and IANAL), detailed hardware documentation is considered the same as the product under the export license laws.

Please post links supporting this contention, or withdraw it.

Cryptographic technology actually falls under an even more restrictive license class - munitions.

Whle this is true, the source code can still be legally exported in written format, since it falls under Free Speech.

From this article:

And interestingly, you can't ban the export of a book, because a book is a form of free speech, and free speech is protected by the first amendment to the United States Constitution. So when a new version of PGP becomes available in the United States, it's source code is simply published in book form and mailed overseas, where the source can be retrieved by scanning it and using inexpensive optical character recognition software to convert the printed pages back to machine-readable program text files.

Given that, as you stated, crypto falls under the even more restrictive license class of 'munitions', if you can export PGP source code without violating U.S. export restrictions, I'm betting you can export data sheets too.

My point is that the HIFN's explanation of their requirement for personal info to satisfy their U.S. export license is pure codswallop, your nonsensical comments about HIFN 'fighting the man' notwithstanding.

Re:Export regulations?

[nonmaskable]

Please post links supporting this contention, or withdraw it.

http://www.access.gpo.gov/bis/ear/ear_data.html

You can skip many of the "Part XXX"s. The applicable categories are obvious. Don't forget to read interpretations and supplement 2.

I'm not going to respond to the rest of your rant, other than to suggest you get legal advice somewhere other than mailing lists and agitprop web sites.

Re:Export regulations?

[TripMaster Monkey]

The applicable categories are obvious.

If they're so obvious, why didn't you post links to those categories, or better yet, applicable excerpts?

Don't forget to read interpretations

Fair enough...I read through Part 770 - Interpretations, but strangely enough, the word 'documentation' is only used once in the entire document. I've posted the relevant passage for clarity:

(2) Export documentation requirement.

          (i) When preparing a license application for a
numerical control system, the machine tool and
the control unit are classified separately. If either
the machine tool or the control unit requires a
license, then the entire unit requires a license. If
either a machine tool or a control unit is exported
separately from the system, the exported
component is classified on the license application
without regard to the other parts of a possible
system.

                  (ii) When preparing the Shipper's Export
Declaration (SED) or Automated Export System
(AES) record, a system being shipped complete
(i.e., machine and control unit), should be
reported under the Schedule B number for each
machine. When either a control unit or a machine
is shipped separately, it should be reported under
the Schedule B number appropriate for the
individual item being exported.

Please explain how the above supports your contention that 'detailed hardware documentation is considered the same as the product under the export license laws'.

and supplement 2.

Which supplement 2? The Supplement No. 2 to Part 764 - Denied Persons List, or the Supplement No. 2 to Part 774 - General Technology and Software Notes? (HINT: Neither supplement contains anything to support your contention that 'detailed hardware documentation is considered the same as the product under the export license laws'.)

In short, it looks like you thought you could try to justify your argument by pointing me to a ridiculously large government document, and then hoping I wouldn't bother to actually read it. You thought wrong.

I'm not going to respond to the rest of your rant,

Translation: I can't refute it, so I'll shut my eyes and pretend it's not there.

other than to suggest you get legal advice somewhere other than mailing lists and agitprop web sites.

And this from the person who qualified their original contention with 'AFAIK' and "IANAL'. Pot, meet kettle.

Re:Export regulations?

[nytes]

Any technical data can be covered by export regulations. Under ITAR it can be (and currently is) considered a service.

My company builds satellite tracking systems. You can control it from a serial terminal using a simple command set (an "interface") but we are not allowed to give our international customers that command set without State Dept. clearance, which can take six months to get.

Furthermore, we need to know who our customers intend to allow to see that information (like subcontractors).

ITAR compliance is a bitch. It's deliberately vague so they can apply it flexibly.

Re:Export regulations?

[nonmaskable]

The applicable categories are obvious.
If they're so obvious, why didn't you post links to those categories, or better yet, applicable excerpts?

Laziness. Category 5pt2, and 4 & 5pt1 also. Look how broad ITAR 120.10 is (and according to another poster in the thread they can also classify info as a "service" and use those sections).

In short, it looks like you thought you could try to justify your argument by pointing me to a ridiculously large government document, and then hoping I wouldn't bother to actually read it. You thought wrong.

I thought right. It looks like you searched a couple of sections for the word "documentation" without even trying to follow it. Understanding "ridiculously large" and complex laws that put people in jail is hard, that's why lawyers get paid big.

other than to suggest you get legal advice somewhere other than mailing lists and agitprop web sites.
And this from the person who qualified their original contention with 'AFAIK' and "IANAL'. Pot, meet kettle.

Or with more thought and less attitude you might infer that I take my own advice.

I'm not going to respond to the rest of your rant,
Translation: I can't refute it, so I'll shut my eyes and pretend it's not there.

Better translation: Oops, I'm wrestling a pig in mud.

How does this sort of exaggerated response help?

[rsidd]

Theo repeatedly claims that the site wants "approximately 50 personal questions". I looked, and there are only 11 questions with required answers, of which I can only construe two (office phone number, and office address) as invasive of Theo's privacy. (I assume everyone knows Theo's name and email address, from the mailing lists.)

If he objects to providing that information, he can say so, but this sort of easily-refuted hyperbole doesn't help.

Oh for pity's sake...

[tygerstripes]

Due to lazy moderation and posting, there now appears to be no point in posting anything as a reply, so I'll ask again what I think is a pertinent question as a main post:

How would this violate US Export Licences???

Fine, don't export chips overseas without knowing who you're selling to, but documentation? For driver developers no less?? When Hifn themselves are trying to say that this information is open and free???

This is the key point of Theo's argument, surely: that Hifn are not at all obliged to demand this information, and therefore are going against the principles of open access/source by demanding it. Can someone please explain what I'm missing here.

Re:Oh for pity's sake...

[TripMaster Monkey]

How would this violate U.S. Export Licenses

It wouldn't. Exporting documentation...even source code...is protected as Free Speech, provided the export is in book format.

From this article:

And interestingly, you can't ban the export of a book, because a book is a form of free speech, and free speech is protected by the first amendment to the United States Constitution. So when a new version of PGP becomes available in the United States, it's source code is simply published in book form and mailed overseas, where the source can be retrieved by scanning it and using inexpensive optical character recognition software to convert the printed pages back to machine-readable program text files.

If you can export PGP source code without violating U.S. export restrictions, I'm betting you can export data sheets too. Therefore, HIFN's argument is invalid.

Would that not be...

[Phil John]

Would that not be on documentation that explained exactly how the chip worked and not just how to send and receive bits from it?

If this is the case with HIFN, why do some other hardare companies in the same field not have the same restrictions?

There was a good comment made later in the thread:

Perhaps you can talk to your legal counsel and actually break out the documentation needed for these open source drivers into a separate and truly open to the "general public" anonymous download site. I doubt that the documentation that is being requested by developers is putting you in violation of US Export Regulations
....snip....
I understand it's very easy these days for attorneys to just say put everything behind your registration only access extranet to be safe. This is not acceptable and, in my opinion, is not open to the general public like you stated.

That sums up my thoughts much more succinctly.

Abusive much?

[thePowerOfGrayskull]

While I whole-heartedly agree with the point Theo was making in his article, I can't help but think that engaging in hyperbole (50 questions? ~25 is accurate) and verbally abusing and threatening the vendor is going to help in any way.

Re:Abusive much?

[Just Some Guy]

I can't help but think that engaging in hyperbole (50 questions? ~25 is accurate) and verbally abusing and threatening the vendor is going to help in any way.

True, but on the other hand, Theo really does have the upper hand on this one. If I can't use those cards under OpenBSD, I won't buy them. If I can, I probably will (because I could actually use some of that functionality in my VPN servers). Since I suspect a large part of their potential client base is in the same situation, it'd be in their best financial interests to go meet Theo's (reasonable) requests and stay stop arguing the point.

Re:Abusive much?

[chazwurth]

Do you have much experience working with vendors?

I don't mean this as a joke. Often the *only* way to get vendors to do what you want is -- minimally -- to verbally abuse them, and often to threaten them. And if they're real wankers, to threaten them with bad publicity. And if they're super-wankers (which so many of them are), to actually start talking about them publically.

Sure, doing it this way is a gamble -- he may piss them off so much that they stop communicating. Some vendors (the rational ones) deal better with public humiliation than others. But it seems from his message that he'd been in communication with them for some time. This was probably a last resort. I say more power to him.

Give it a rest, Theo.

[Ritchie70]

OK, great. This info was freely available on their web site 8 years ago. So?

You know what, if you'd wanted this 15 years ago, you would have phoned them up, given them the EXACT SAME INFO THEY'RE ASKING FOR on their web site, and they would have mailed it to you.

And a sales-person might have called to see if you wanted to buy some chips.

Theo's "50 questions" is email, name, company name, title, address, phone number, and "what is your project? What is your role? When do you want to buy some chips?" How about a little reality here. Theo does some great stuff, but that doesn't mean he gets to bend how the world works to his will.

Just like the "I don't get any donations" rant from him a bit ago, he just doesn't seem to be well grounded in business realities. If you want donations, you need a tax-exempt foundation, not "make checks out to Theo." If you want data sheets, you might have to tell the company who you are and why you want them.

Re:Give it a rest, Theo.

[quarkscat]

The parent poster is a troll, and his argument is patently absurd.

HIFN might make their documentation available to the (USA) public,
but if it is released under restrictive NDA language, it is hardly "OSS-
friendly". Is OpenBSD supposed to bundle binary-only drivers, with
the MS-inspired adage "Trust us, we know what's best for you?"
I think not!

Imagine your level of trust in OpenBSD drivers that you cannot even
see the source code to, let alone be forced to go back to the OEM for
man / info pages. HIFN has far exceeded any legal requirement that
USA Export Control regulations impose, and Theo has rightfully called
them out for their current nonsensical position. This is not about HIFN
furnishing proprietary SystemC or ERDA(?) data that would reveal the
construction of the chipset or the crypto algorythms involved -- this
is about data on how to fully interface to the chipset's I/O. There is
no valid reason for OpenBSD (or any other open source OS) to continue
to support HIFN. In fact, I woudn't mind seeing kernel code included that
would fail to build with HIFN support, sort of like has been discussed on /.
regarding locking out the SCO OS.

Re:Give it a rest, Theo.

[dstone]

How about a little reality here. Theo does some great stuff, but that doesn't mean he gets to bend how the world works to his will.

"The reasonable man adapts himself to the world; the unreasonable one persists in trying to adapt the world to himself. Therefore all progress depends on the unreasonable man." -George Bernard Shaw.

Whinge whinge whinge..

[mcbridematt]

"Jason and I spent a lot of time writing that code in the
past, but because your policies are privacy invasive towards us, and
thus completely thankless for the sales that we have given you in the
past -- we will not spend any more time on your crummy products."

Sales?

Unless Theo can give a decent estimate of how much 'sales' OpenBSD has 'given' them, I doubt the upper brass at Hifn cares about Theo's whinging.

If you want drivers for "less mainstream OS'es", please attach your request to a large multi-mega-million part order from <insert vendor here>. If you don't believe me, we'll, the only reason NVIDIA's Linux support is miles ahead of ATI is due to the demand from Hollywood setups to use high-end-5000%-margin professional cards on Linux, not geeks on Slashdot playing Tuxracer.

Re:Whinge whinge whinge..

[91degrees]

Unless Theo can give a decent estimate of how much 'sales' OpenBSD has 'given' them, I doubt the upper brass at Hifn cares about Theo's whinging.

I wouldn't be surprised if a lot of their customers were BSD users. It's quite a common OS in the sort of application this chip is designed for.

If you don't believe me, we'll, the only reason NVIDIA's Linux support is miles ahead of ATI is due to the demand from Hollywood setups to use high-end-5000%-margin professional cards on Linux, not geeks on Slashdot playing Tuxracer.

PowerVR released a linux driver for the Kyro 2. The only people who would have had any interest in that were the geeks playing TuxRacer.

What makes you think the Linux geek market is so small? A lot of Linux nerds are early adopters, and are quite likely to choose one high end graphics card over another simply because it will run on their Linux partition. Half a million slashdot readers may not be the bulk of their market, but it's probably worth something.

Re:Whinge whinge whinge..

[bodgit]

I wouldn't be surprised if a lot of their customers were BSD users. It's quite a common OS in the sort of application this chip is designed for.

HiFn chips are used in the crypto accelerators made by Soekris Engineering. OpenBSD running on one of their embedded PC boards along with one of their crypto accelerator cards is quite a popular combination.

registration is better than no registration

[m874t232]

When companies impose weird intellectual property restrictions on their data sheets, then I'm all for making the process of getting the data sheets as cumbersome as possible--that way, FOSS developers will at least become aware that there is something funny going on.

Some other vendors hide a restrictive license ("if you look at this, we own stuff you do with it") somewhere in the documentation or behind a "Read This License" link, but people who look at the documentation never notice.

Theo is the man

[brennz]

I like Theo. The more of his statements I read, the more I appreciate his no compromise, take no prisoners approach.

50 personal questions sounds way beyond overkill. I've downloaded plenty of export controlled software, with merely a few questions.

My guess is, Hifn like many other companies, gives everything to their sales folks, or worse, resells it. Can you blame Theo for taking offense, when they want 50 personal questions answered?

BTW, is this the signup? http://extranet.hifn.com/home/anonymous/?workflow= signupapp or just part of it? That part about the NDA bothers me.....

"50 personal questions"?

[hotspotbloc]

Does anyone know what they were besides what's on the first sign up page?

Someone has to take a stand...

[Jerom]

... and lately the only OS focussing on fais seems to be openBSD. Thanks for fighting for OUR long term freedom again Theo.(Also a thank you to RMS). The one PC I have left at home runs OpenBSD and i BUY every new release.

Kudos to Theo and the openBSD team

J.

Sign up

[webmistressrachel]

It seems from the general tone of comments that nobody has actually signed and looked at this site. First, an earlier poster was correct in saying that there are much fewer questions than 50; and your email is verified (no different from many other companies and sites).

I have signed up, the confirmation arrived within seconds and on the welcome is a message it may take several hours for a sysadmin to allow access - but no, I'm downloading PDF's straight away so it must be automated.

It's just marketing; but Theo is right about that not being completely free, as in free speech.

The article mentions "liberalisation", it seems that they're leaning to the left, but they're not actually left in their ideas and business model. Dump the driver.

Can hifn comply with OpenBSD's demands?

[mwvdlee]

Everybody seems to be sidestepping the main issue.

The real question that should be answered is whether hifn are indeed required by law to ask personal information of the people downloading documentation, as hifn claims they are.

If they are, than hifn simply cannot comply with OpenBSD's demands without breaking U.S. law.

Re:Can hifn comply with OpenBSD's demands?

[abertoll]

There most certainly are laws that restrict documentation to be exported to other countries: particularly if the technology was partially or wholly paid for by the US government. (Though I don't know this to be the case for this situation.)

Re:Can hifn comply with OpenBSD's demands?

[LandruBek]

We aren't talking about exporting the technology, we are talking about exporting documents that talk about the technology. And if that is illegal, perhaps this thread is too, because it is talking about documents that talk about crypto technology. Turtles all the way down.

I know there are export controls on the chips, but I don't believe it would be illegal to give away the datasheets, for the reasons that I wrote about to a couple other guys. In short, they are only the freaking datasheets, not the crypto-goodies themselves. By the way, the last thing NSA would fuss about would be if the datasheets helped you hack the technology -- they worry about too-strong encryption, not too-weak encryption (with the exception of that time they silently fixed the differential cryptanalysis vulnerability in DES, before the world at large knew what differential cryptanalysis was). (By the way, hi to you guys in Fort Meade, if you're reading this.)

Bad vendor policy = bad devices drivers

[herodiade42]

Such kernels developers feedback are very precious and insightful for us, customers. It's not only a matter of freedom an principles, it's about quality.

Be sure that - whatever the OS you use, being Linux, OpenBSD or FreeBSD -, when a vendor behaves that bad and is so reluctant in providing open access to documentation, you won't have a good driver nor a good support.

Those vendors behaviours are usually symptoms of a "closed" attitude, secrecy centerd, so even when we accept NDA, we can't expect them to disclose the whole needed informations (like, say, all firmwares versions bugs that needs a workaround in drivers level, know bad behaviour of their chipsets etc). This attitude will also discourage some knowledgeable developers to help to improve the driver, to fix bugs etc. Requiring NDA will prevent OSS kernel developers to share sensitive informations regarding their experience with the device (between OS, and even sometime inside the same kernel dev team).

So for now, if you need a stable encryption accelerator device, consider choosing an other vendor. Look out for Via C3, or SafeNet (and even some Broadcom) chipsets: those vendors plays the game well, don't seat on their customers (we) and the developers needs. They don't even hide behind a "U.S. export laws restrictions" argument, and didn't faced trials, proving the hypocrisy of HiFn assertions.

Gotta be some restrictions even on book format

[caveat]

I'm willing to bet that there's a limit to what you can export, even in book form. Going to extremes, if I tried to export plans for the W80 nuclear warhead in book form (or print it on a T-shirt), I'd guess not only would export of that book be banned, but I'd be taking a nice long vacation at Club Fed..

Re:Gotta be some restrictions even on book format

[Bryan_Casto]

Here's the crucial difference. The plans for the W80 nuclear warhead are classified information. The source code for PGP is not. Now, it may be encumbered by things such as copyright or intellectual property rights, but that doesn't stop the rights holder from using those rights. Likewise, the crypto boards themselves may be considered munitions, but the documentation describing the capabilities and interfaces are intellectual property covered by copyright at best.

Re:Go Theo-Batter up.

[Svartalf]

It's the most security oriented. Funny...a crypto chip vendor spurning the most security oriented
OS developers' desires for unfettered acces, etc. No personal info should need to be given to a
vendor unless he's entering into a sales relationship with them. Honestly- too much risk of Identity
Theft through this sort of thing.

Seriously, I'd have to agree with him on this one- and I'm from the Linux camp and would be driving
sales into that segment very shortly. I'd be making a big stink about it too. And what's sad about
all these vendors is that they're doing nothing but pissing off the people that'd be helping them
sell chips.

In reality, the vendors are doing this because idiot IP lawyers tell them to do so. There should
be no IP revealed in the systems interfaces to a device. It should be the silicon equivalent to
an API. If there is IP honestly revealed, then you've got something new, and the patent itself
should be sufficient to protect it. If you're trying to hide a design flaw by not revealing info-
don't. You should design devices with interfaces that make sense and are system safe or can be made
so with the right device driver code.

Keeping it secretive helps nobody in reality. For example, ATI's drivers work adequately on the
desktop space but are less performant on at least part of the laptop line under Linux- because of
a design/coding flaw in the closed source drivers. I can't reccomend anyone get a laptop with an
ATI based display because they just don't seem to work as well. If someone had source code and
technical data access they could most likely fix the problems in question- unless the chip had a
design hickey. Even then, unless it's something that would compromise security, it should be
able to be coded around- Windows drivers can do Sideport memory correctly, why can't the Linux
support do the same thing?

At any rate, I believe I've drifted from the conversation... Yes Theo's got a niche play- but
in the segment that Hifn's in, it's an important one all the same.

Simple solution to a stupid problem.

[Pig Hogger]

Bah!

Just give bogus information.

Everybody does!

Theo should never talk

[Tweekster]

in a form that will be made public. They need a PR person.

He is right in principal in many cases, however he has absolutely no talent when it comes to voicing that principal. OpenBSD seriously need a PR person that knows how to deal with actual people, you know with a hint of tact, cause he doesnt have any whatsoever.

Thanks, but no.

[Just Some Guy]

From the email:

Hifn reserves the right to keep our source code proprietary.

Fair enough, Hank. But I reserve the right to not use proprietary crypto code in sensitive applications - which are the only ones that I'd actually buy hardware acceleration for in the first place.

Let's get this straight: there's a world of difference between closed video card drivers and closed crypto drivers. Many of us are squeamish about about the former, so why would you think we'd cheerfully accept the latter? A closed source video driver could potentially crash my non-networked game machine. A closed source encryption accelerator cold potentially open my VPN server to the whole world.

I hope you can appreciate the community's position here, but whether you agree with it or not is immaterial. Should you change your opinion to better mesh with that of your would-be customers, please let us know. Many of us would like to buy your products if they become usable for our applications.

Re:Theo's behavior doesn't help the cause...

[shis-ka-bob]

Each time I install OpenBSD, it just works. They support a wide range of hardware, but they insist on coding it correctly. You cannot be sure that you are coding 'by the spec' if you have to reverse engineer. You might be pretty sure you have it right, but you can't be certain. The OpenBSD team is limited in size and they don't have the resources to fool around with hardware becuase some prick in management doesn't see that giving the data freely to the OpenBSD team will only lead to better support for their hardware. The 'worst case' for the manager would be if the OpenBSD folks find that the hardware doesn't meet its own specifications. In the long run, finding this is a good thing - nobody stopped buying Intel becuase of the Pentium division error. Finding and fixing it improves the hardware but it is costly in the short run, so it will harm the manager's bonus this quarter. Theo seems to be taking the long view and sticking to principle, not convenience.

If I have the choice, I run OpenBSD on servers because when it fits, it fits like a glove. If Theo acts like everyone else and just rolls over when a suit tells him no, OpenBSD would be just like every other Linux/BSD distro. This sort of attention to details (in both software and licenses) makes OpenBSD distictive. In marketing-speak, this is called 'developing a niche'. Within its niche, OpenBSD has no equal. If it looses its niche, then it will loose its market share. So I think the best thing Theo can do is to be Theo.

Kudos to theo

[wardk]

While I agree his language may not make friends, it's his system, his drivers, his sweat., if he wants to call a bunch of weasels with crap products weasels with crap products, who are we to judge?

I say to Theo: "kick **more** ass"

and to hell with detractors, most of whom surely have never installed OpenBSD, let alone taken the extra step to purchase it.

You read it wrong...

[Svartalf]

Context is everything in this sort of thing.

You missed one IMPORTANT detail in this- the documentation to drive the chip is NOT covered under Export Regulations.
Only the drivers their OEMS bundle WITH the cards, any technical documentation talking to algos, AND the chip itself
are covered by Export Regulations. They don't have a need to restrict the SDK info for that reason.

Once you understand that, this becomes more of a businessman trying to "protect" purported IP type thing.

stat-of-the-art registration form? NOT!

[Savage650]

A few messages down in the thread, we find this gem: http://marc.theaimsgroup.com/?l=openbsd-misc&m=115 021494129899&w=2

As soon as one submits one's private information to Hifn, the submitted data indeed no longer could be considered private. Look at Hifn's HTML on the registration page:

<form action="http://extranet.hifn.com/home/anonymous/De fault.asp" method="post" name="userEdit" onSubmit="return validate(this);">

Is Hifn running low on supplies of cryptography hardware accelerators? Or do these accelerators no longer work in recent operating systems due to the lack of documentation?

Oh the Irony ;-)

Go Firefox extension Bug_me_not

[Happler]

I was curious and found that the Firefox extension for http://www.bugmenot.com/ has logins for the site so that you can view the info. You know, I hate forced, "free" logins.

You're right—not much surprise on /.

[jbn-o]

[...] in which Theo DeRaadt [...] still manages to sound like spoiled whiny tosser in the process.

No, he doesn't. /. readers probably have so little practice speaking truth to power that they don't recognize what it looks like when it's laid out before them. The only non-surprise here is that another /. poster is finding a way to criticize those who defend our freedom to share and modify by speaking up and acting out. It's much like the overrated comments on the recent RMS in France thread where RMS was denied an audience with Prime Minister Dominique de Villepin; some posters in that thread chose to focus on RMS' dress, even implicltly supporting RMS' lack of a suit as a valid reason for dismissal rather than point out far more salient (possibly financial) relationships between de Villepin and Bill Gates (or other heads of state who do business with Microsoft and Bill Gates). de Raadt's strident message in this OpenBSD thread is on-topic, on-target, clearly written, precise, and perfectly appropriate. We need more such language in the pursuit of software freedom. I would have hoped that /. readers, being overwhelmingly computer users who probably receive very little respect in their own work regardless of how they dress, would be more inclined to weigh someone's message, not their appearance.

Re: Crypto is a Red Herring

[mpapet]

*IF* the company's corporation is U.S. based, then nearly all crypto is easily exported these days. Even RSA.

If you make a new cryptographic method in the US, (not PKI/RSA/etc, not AES/DES, not known hashing) then your system will probably require review before export approval. This is not most crypto though.

No, you can't send it to Cuba or other countries declared bad for whatever reason, but you can export crypto from the U.S. to most places in the world easily.

The vendor's spooky "if" scenarios are a pathetic attempt to justify collecting personal information.

Re:Is it just me...

[vertinox]

Do you honestly believe personal achievement gives a person license to be petty and immature, or are you just baiting me?

I'm not baiting you. I'm just stating that if someone does more than the average person is willing or able to do he can go crow about it a bit.

As in... If a scientist cured AIDs or cancer tomorrow, he can kick a puppy or two and we should be able to look past that.

This is of course relative to your position on absolute and relative morality, but if someone does something for me out of his own free will and effor (and it benefits me greatly), he can be as a big of an immature ass as he wants and I'll gladly ignore it and enjoy his product.

However, if you haven't done anything to improve our well being and just complain about others being improper and immature brats... I'm sort of hard pressed to agree with you if that immature brat has done work that has helped many of us as a whole.

Personally, I would like mature, polite, and altruistic people making software for me (and does it out of the kindness of their heart and not a bullshit sales talk to take my money) over an immature one, but sometimes we have to deal with the fact those people don't exist as often as we would like...

I'd like to be proven wrong because that would we live in a better world than I think we do.

Re:Rogue video drivers on non-networked machines

[Just Some Guy]

What's actually funny, is how many people in security sensitive environments rely on those closed-source video drivers.

Well, we all have our limits. Some people worry, and justifiably so, that their BIOS isn't open. I'm somewhere in the middle in that I use the proprietary NVidia drivers, even though I don't like it. I'd think that everyone, though, would agree that the crypto engine is the absolute last thing you want to cede control of.

I don't know if Theo reads Slashdot...

[jd]

The vendor is clearly in the wrong. The EU, for example, has made it clear that interfaces are not copyrightable and that reverse-engineering interfaces is legit. Furthermore, interfaces are generally NOT protected by NDAs, no matter what Hifn claims. I was able to download data sheets, APIs and bleep knows what else from Motorola's old chip unit (I think it's now called Freescale) without signing anything, without answering any questions and without agreeing to a damn thing. If NDAs were normal, you'd think a company like Motorola would have heard about it by now.

I do agree with Theo that if the information is not free, then vendors should not expect OS writers to bend their principles to include it. On the flip-side, I don't want OpenBSD (or any other free OS) to be impacted by stupidity on the part of vendors if there's anything I can do to help.

My only question of Theo and the OpenBSD folks is: Is there anything that those of us who reject Hifn's arguments as absurd and contrary to accepted practices can do to help? (Well, besides not supporting Hifn in any way.)

This is clearly a case where differences in any other opinion should be irrelevent. Theo deserves support on this. Open Source in general deserves support on this.

Re:This doesn't hurt Hifn much at all

[Nimrangul]

And if you had read the threads here you'd notice a lot of people care if OpenBSD supports something, people who don't even use OpenBSD check to see if it supports a particular device prior to purchase, since OpenBSD has a very strong stance on free and open , one significantly stronger than the likes of your average Linux project and decidedly stronger than the other BSDs.

You may also have noticed how many people point out that when you are dealing with cryptography or security, you deal with OpenBSD. Hifn's cards are used in several places, but notably in the security field, where OpenBSD lives. OpenBSD users are the target demographic for crypto acceleration cards.

Theo isn't the idiot here, as Hifn obviously cares, they cared enough to talk to the misc@ mailing list and try to get people on their side.

I admit I would rather someone of Theo's importance use a little more diplomatic speach, but I don't bother myself, so why should I hold him to a higher standard than I hold myself?

Time...

[Svartalf]

One resource that ATI doesn't have enough of is time. They don't have a lot of manpower dedicated to the Linux drivers so there's less effort put into fixing things like this- they're worrying more about piling new exposed features (which is also desired as well...). If there were open source drivers, there'd be a good chance someone like myself would fix the problem in question (I can do this sort of thing, I used to work on the FIRST set of open source Accelerated Drivers (Utah-GLX), which is why I've got a G3 Mac given me by John Carmack (Still in my possession), I've loads of acquaintances from out of Loki Games, and I'm doing work for Linux Game Publishing.)- because I've the skills and I have the time and desire to see it fixed- and the only reason why I've time is that it's a blocker for me to use this laptop I'm posting with as a development machine.

Re:HUGE problem with Open Source projects

[Ash-Fox]

> But guys like Theo are our public face. What's wrong with that picture?

Nothing.

Re:Is it just me...

[faedle]

Is Hifn's hardware supported in Linux?

Not in the kernel tree, but there is a third-party driver available. My understanding from associates who work with the Linux version is it isn't as feature-rich as the OpenBSD driver, and those who develop on it are also frustrated by Hifn's new policies.

What percentage of their customers rely on OpenBSD support? Who are they more loyal to, Hifn for the hardware or OpenBSD for the OS?

As someone who works for a place that uses crypto cards, I can tell you: we are more bound to the OS than the crypto hardware. There's a lot of different crypto hardware on the market, but if you want to do any kind of hardcore embedded systems development using a POSIX API, there aren't a lot of choices out there.

You know...

[Azuma Hazuki]

For all that people accuse Theo de Raadt of being abrasive, singleminded, and ideological, we NEED people like him. It's the de Raadts and the Stallmans, the ones who refuse to back down in the face of corporate and (soon) government pressure, who make the open source movement possible. I think this very same bloody-minded stubbornness is one of the most important things he brings to the table. I admire his convictions and worry about his blood pressure. Theo, if you're reading this: don't give up!