Slashdot Mirror
Mozilla Firefox Not In Violation of US Export Rules
darthcamaro writes "While the internet may know no borders, the US government does. There are a number of rules that affect software vendors, including encryption export regulations from the US Department of Commerce and export sanctions by the Department of Treasury. But what do you do when your application is open source and freely available to anyone in the world? Do the same the rules apply? It's a question that Mozilla asked the US government about. The answer they received could have profound implications not just for Firefox but for all open source software vendors. 'We really couldn't accept the notion that these government rules could jeopardize the participatory nature of an open source project, so we sought to challenge it,' Harvey Anderson, VP and General Counsel of Mozilla, told InternetNews.com. 'We argued that First Amendment free speech rights would prevail in this scenario. The government took our filing and then we got back a no-violation letter, which is fantastic.'"
http://xkcd.com/504/
Oh, and FireFirst? :)
Or some way to break the encryption, eg. they've got the boss of Verisign in their back pocket.
No sig today...
However, that exemption is nullified if the source code is distributed to any of the countries on the U.S embargo list, such as Cuba, Iran or North Korea.
Huh. I didn't realize that Cuba, Iran, and North Korea didn't have any mathematicians or anyone else that is capable of developing their own cryptography. Or that other countries that do not have a problem with those particular countries do not have that expertise either. I guess the US has a monopoly on that talent. It's a good thing that the US Government is embargoing crypto. It worked great for nuclear bomb technology after all!
It's NOT me! It's the meds! I'm on 1000mg of Fukitol.
Why else would OpenBSD be distributed from Canada? And contributions of crypto code from the USA are very carefully checked IIRC.
http://michaelsmith.id.au
... that an innovative business like Mozilla needs to live in fear of the government and nervously await its blessing.
Moot. M-O-O-T.
n. Of no practical importance; irrelevant.
Mute is what people wish you'd be. Moot is what you are.
</nerdrage>
https://www.eff.org/https-everywhere
A virtual country to own virtual propery, including software as this. A country which by definition has no rules of any kind, and is outside of every jurisdiction, because you can't sue or attack anyone from it. It would work like an encrypted multi-mirrored darknet. Every real server participating, would store a set of "random noise" data blocks on his systems. Nobody could decrypt it, including that server. Only people inside the darknet with access to their private block could. Nobody could delete it, because there would always be at least 3 copies, floating in the darknet, encrypted differently, so that you would not be able to know that they contain the same data.
As an easter egg it would contain a honeypot, which would contain only one short sentence: "NOW WHAT, BITCHES?" ;)
Any sufficiently advanced intelligence is indistinguishable from stupidity.
but that thought, or words on a page, are very simply not munitions, disingenuous government definitions be damned.
"National Security is the chief cause of national insecurity." - Celine's First Law
Debian 3.1 corresponds to 2005. I'm amazed that Mozilla was unaware of this and needed to ask someone.
if firefox is shielded from these export restrictions because of first amendment protection wouldn't any open source implementation of strong encryption also be protected? wouldn't this make those export restrictions very nearly mute?
Don't people remember what happened with Phil Zimmerman over PGP?
The munitions classification on encryption software was used against him for posting the PGP source code on Usenet. They really, really wanted to nail him to the wall over that one.
There was a certain irony in the restrictions on exporting crypto software deemed 'munitions'. You could take the source, publish it as a book in an OCR font (with the page numbers between comment delimiters), and export it anywhere in the world.
Where's the Kaboom?
There's supposed to be an Earth-shattering Kaboom.
Yes, it contributed correctness to the world - always a good thing.
Seriously, it also (if the original poster is able to take criticism) helped them avoid this mistake in the future, potentially in front of a prospective client/etc.
There's a big difference between a typo or otherwise one-off failure and mistaking one word for another. It's nitpicking over typos because it's unlikely someone thinks 'teh' is correct, but when they use a word like mute in place of moot - not easily mistyped but easily mistaken - it's usually an indicator that they don't know better.
2. Moot
n. The founder of 4chan.org
Synonym: mootle.
signature is pants
Ho-hum. Unrestricted export of open-source products incorporating encryption from the US has been legal for quite a while. All you have to do is file an application with the Feds under the Export Regs Section 740.13 "TECHNOLOGY AND SOFTWARE -- UNRESTRICTED (TSU)" before you make the source and binaries available, and you don't have to screen downloads or worry if the Officially Designated Bad Guys download your code: your ass is covered.
This war was won a loooong time ago by Philip Zimmermann when the Feds wanted to crush him for releasing PGP. All props go to Phil!
Section 740.13 (e) "(6) "Knowledge" of a prohibited export or reexport. Posting of source code or corresponding object code on the Internet (e.g., FTP or World Wide Web site) where it may be downloaded by anyone would not establish "knowledge" of a prohibited export or reexport. See Section 740.13(e)(4) of the EAR for prohibited knowing exports to Cuba, Iran, Iraq, Libya, North Korea, Sudan and Syria. In addition, such posting would not trigger "red flags" necessitating the affirmative duty to inquire under the "Know Your Customer" guidance provided in Supplement No. 3 to part 732 of the EAR."
Just to establish that this is really... not news. Just PR, move along folks, nothing to see here.
"The government took our filing and then we got back a no-violation letter, which is fantastic.'"
Mozilla basically asked if it would be okay if Mozilla (not you, not me, not everybody else) could put strong encryption in their software. They didn't get a court ruling--they got permission. And there's nothing wrong with that, but it doesn't mean they are some champions of free speech rights. No, it means that they have successfully looked after their own interests. And other, particularly smaller, open source developers shouldn't expect to have the same good fortune in getting permission.
Not to be too grumpy. It is good news that somebody was exempted from a stupid regulation.
Did someone not tell me? Is it Government Does The Right Thing Day today???
So far we have, in succession, on Slashdot:
Not bad for one day. The cynic in me assumes all this is going to be reversed tomorrow... :-p
My bicyles
In fact Phil did just that to bring the code to Canada.
Inventions have long since reached their limit, and I see no hope for further development.-- Frontinus, 1st cent. AD