Slashdot Mirror
SourceForge Removes Blanket Blocking
Recently there was much gnashing of teeth as SourceForge (which shares a corporate overlord with Slashdot) started programmatically blocking users in certain countries to comply with US export restrictions. Thankfully they didn't let it end there and have found a way to put the power back in the hands of the users. "Beginning now, every project admin can click on Develop -> Project Admin -> Project Settings to find a new section called Export Control. By default, we've ticked the more restrictive setting. If you conclude that your project is *not* subject to export regulations, or any other related prohibitions, you may now tick the other check mark and click Update. After that, all users will be able to download your project files as they did before last month's change."
So they are letting people "opt in" to remove export controls. Who is liable if the code is subject to export restrictions, SF or the developer?
This is dumb. The terrorists will just get their mates in another country to get whatever it is they want.
Only the kind of stupid Americans that though that restricting the export of encryption technology would actually work would think of this. What happened there? They all got it anyway.
What exactly do they hope to achieve with this stupidity?
Why not simply host the servers in a country that doesn't have brain-dead restrictions on the "export" of ones and zeros? One that doesn't classify encryption/decryption code as a "munition"?
I've abandoned my search for truth; now I'm just looking for some useful delusions.
As a Canadian locked out of Hulu and Comedy Central's web clips, I wish geolocation based on IP would burn in hell already.
That being said:
There was a Syrian developer commenting on the story about the original announcement, he was justifiably pissed off that Sourceforge had decided to deny him access to his own work. Does this change allow him to work on his project in peace?
Has Slashdot decided to stop mentioning that Sourceforge is owned by the same parent company? They're sure trying to do some damage control by going straight to Slashdot's front page with their weird opt-in workaround..
I can code. I am not american. I am not a lawyer. People are downloading from local mirrors, not from USA. How can i say if the project should be restricted or not?
Why does the USA government not build a firewall to prevent exporting any American byte to the restricted list?
Yeah. These restrictions make so much sense. Because we all know that North Korea has no way to get access to any servers outside North Korea. And no one can use a proxy server at all. And they really are going to be absolutely helpless without the tiny open-source projects. This is as ridiculous as the old restrictions on exporting encryption (at least those got removed a few years ago).
Great news, and this is a brave thing to do :)
Blindly blocking all SF projects to some people was wrong. I said this before, US export laws should only apply to US products. OpenSource/Free software projects should stay "open" and "free/libre" to everybody. Those who worked hard on these projects, including developers from the banned countries, should have the right to decide whether their projects should be blocked or not.
Some said the law applies to SF just because they host the projects. If the law was strict to this level then the whole internet should be banned to these countries.
At least consider it.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Why the hell does anyone even use SourceForge anymore? Their tools suck, the site is beyond slow and plastered with ads, and you have to play download roulette with their crappy 90s-era mirroring system. Plus you get crazy decrees like this from whatever's going on at the top. It's not like there aren't alternatives these days. Google Code is awesome by comparison.
...that projects such as TOR and Freenet exist.
"If a nation expects to be ignorant and free in a state of civilization, it expects what never was and never will be."
The problem is the cost of the special made-in-USA-color-electron-microscope, they have to check each byte to see if it contains red, white and blue electrons.
to encrypt EVERYTHING !!!
Google wants to "do no evil" for the N.S.A.
Yours In Astrakhan,
Kilgore Trout
The USA has compiled a list of the countries it considers most repressive, and attempted to forbid the citizens of those countries from using encrypted communications... I don't think the governments on that list mind.
# cat
Damn, my RAM is full of llamas.
...necessary. Why has Source Forge suddenly decided that it is?
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
It requires mates to operate the proxy server.
Which developed country is willing to take thousands of refugees from the U.S. copyright regime, software patent regime, mobile phone regulatory regime, and other results of bought senators?
A couple of weeks ago, to ensure compliance with US law as we roll out improvements to SourceForge.net, we began programmatically blocking access to the site for users in certain countries against which the US government imposes sanctions.
`Sanctions` are acts of WAR
So private corporations assist in illegal types of warfare by the US goverment which is legally owned by the deepest pockets.
How can SourceForge allow project admins to circumvent this law that provides for teh safety of all scared american peeple?
I mean, first it is law and now the project admin, who can be non-american -terrorist?- , can decide?
The choices are
1) This project does NOT incorporate, access, call upon, or otherwise use encryption of any kind, including, but not limited to, open source algorithms and/or calls to encryption in the operating system or underlying platform.
and
2) This project DOES incorporate, access, call upon or otherwise use encryption. Posting of open source encryption is controlled under U.S. Export Control Classification Number "ECCN" 5D002 and must be simultaneously reported by email to the U.S. government. You are responsible for submitting this email report to the U.S. government in accordance with procedures described in: http://www.bis.doc.gov/encryption/PubAvailEncSourceCodeNotify.html and Section 740.13(e) of the Export Administration Regulations ("EAR") 15 C.F.R. Parts 730-772.
My project FileUniq is plain python, and executes a call to "md5" in order to get a hash. Obtaining a python library that provides the md5 function is not even described in the documentation, but I definitely do make a call to encryption in the underlying platform. However, I firmly believe that the U.S. Bureau of Industry and Security will not appreciate my TSU notification.
Maybe Sourceforge actually wants to overwhelm the BIS with useless submissions?
I am fairly certain that Germany is already a member of the same treaties. The German developer would just be charged instead. Some information, like some physical devices, only has use for killing. Is there some qualitative difference that makes it wrong to regulate such information, but ok to regulate the devices?
refactor the law, its bloated, confusing and unmaintainable.
I guess SourceForge has vetted this process with its attorneys, but I must be missing something. If a project admin opens up his project's block, he's personally criminally liable should some citizen of a country on the wrong list see a controlled technology from one of SourceForge's servers. That's scary enough for US citizens residing in the US. However, SourceForge doesn't provide the admins (AFAIK) with any export control training, or even vet their citizenship; an admin in Syria, with Syrian citizenship, who did this would seem to be out of reach of the US, which would then fall back to SourceForge, since it did not control access to the technology on its servers. Unless SourceForge has now asked to see citizenship papers of each of its project admins ... ?
This problem covers all sorts of technology far beyond encryption but, just to continue the encryption example, there is a little note on p. 7 of Category 5 (Part 2: Information Security) of the Commerce Control List:
...will stop those terrorists from getting their hands on PGP...
they would stop exporting all this crap television.
The number one reason why this is *very* much ado about nothing is that the projects the U.S. Government would have any interest in AT ALL are novel and strong encryption schemes. To satisfy both novel and strong conditions puts one into a *very* small and elite group.
Sure, there are many projects that implement standard/weak/known encryption. That's completely different than a project that implements legitimately novel AND strong to the point of piquing the interest of the BIS/spooks. I don't know for sure, but zrtp might be an example.
An American company can export SSL/TLS/PKI and similar, crypto products without ever drawing the interest of the BIS. I guess at some point in distant history, this was not the case. As someone that actually worked with the BIS on getting encryption export compliance it has been easy for a long time.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
The USA is squandering some of its technological lead and economic opportunities with dumb-ass laws.
I've already had to stop hosting several online businesses in the US due to the patriot act and international customers' unwillingness to have there data stored in the US.
Stem cell research was set back a decade by Christian fundamentalist opposition making its way into
federal law.
Laws restricting export of US software just result in software being innovated faster elsewhere.
As Freeman Dyson once said: The best way to defeat soviet communism would be to ship Apple computers to their population en masse. He was basically right, though who knew it would be cloned PCs that would do the trick.
Where are we going and why are we in a handbasket?
I congratulate SourceForge on empowering their users to choose for themselves, but I'm still moving my stuff elsewhere. Not just because of the country restrictions, but also because I don't like the new (slow, heavy, buggy) interface, and because I've been getting dropped connections from them.
The question is: what is the best place to move to?
Please correct me if I got my facts wrong.
OpenSSL and PKI-integrated projects all use standard crypto libraries that are based on standard crypto technology.
The BIS's interest lies in novel and strong encryption schemes. The difficulty of which is hard to describe.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
My project FileUniq is plain python, and executes a call to "md5" in order to get a hash.
MD5 is non-special (and deprecated anyway) no one at the BIS would give you a moment's difficulty. Worst case scenario, notify the BIS and they send you an official reply. I know this because I've worked with the BIS to export encryption technology. They were very easy to work with and tolerated my inexperience. Call them and explain your situation.
Sourceforge's language is a little daunting. A (new?) lawyer (justifying his job?) at sourceforge MegaCorp probably has quite a bit to do with the entire fiasco.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
That's why they are doing it this way. If they had it by default off someone might argue, perhaps successfully, that it was Sourceforge's fault since they didn't stop it from happening. However here they are blocking it by default and the screen probably has something along the lines of "You certify this is ok for export by removing this." Thus if it comes up, it is on the user. They made the change, they should have reasonably been aware of what it was for and made sure their software was ok.
Source forge was blocking downloads by Blanket Jackson??? I didn't even know he was an open source hacker! He doesn't really look old enough...
I've abandoned my search for truth; now I'm just looking for some useful delusions.
The two options given in the SourceForge.net project settings are:
1. This project does NOT incorporate, access, call upon, or otherwise use encryption of any kind, including, but not limited to, open source algorithms and/or calls to encryption in the operating system or underlying platform.
2. This project DOES incorporate, access, call upon or otherwise use encryption. Posting of open source encryption is controlled under U.S. Export Control Classification Number "ECCN" 5D002 and must be simultaneously reported by email to the U.S. government. You are responsible for submitting this email report to the U.S. government in accordance with procedures described in: http://www.bis.doc.gov/encryption/PubAvailEncSourceCodeNotify.html and Section 740.13(e) of the Export Administration Regulations ("EAR") 15 C.F.R. Parts 730-772.
The 2nd option is the default and what all projects are currently set to.
In order to select the first, you can't be using any kind of encryption at all. Our project, PortableApps.com, isn't really about encryption, it's about taking your favorite software with you on a flash drive wherever you go. But we do bundle a number of open source apps that use encryption including Firefox, Thunderbird, Sunbird, Songbird, FileZilla, KeePass, Toucan, KompoZer, 7-Zip, Miranda IM, Pidgin, PuTTY, SeaMonkey, WinSCP, WinWGet, OpenOffice.org, PDFTK Builder, PNotes and PeaZip. That means we need to keep the 2nd option selected and those countries remain blocked.
In reality that means pretty much every project on source forge that is or includes a web browser, ftp client, email client, scp client, im client, archive tool, etc will have to keep the 2nd option selected and remain blocked as well.
Portable versions of Firefox, GIMP, LibreOffice, etc
Lie lie lie
Lye lie lye
Li li Lie li li lie lye lye la la Lie
(variations in spelling to defeat postercomment compression filter.)
Where are we going and why are we in a handbasket?
What's the point of export restrictions on software? Does the government really think that if some enemy country wanted a piece of software available in the US that they couldn't send someone over here and then send it home?
Last I looked the GPL doesn't allow the distributor (sourceforge in this case) to discriminate against "persons or groups". Thus saying sourceforge legally cannot distribute GPL code if they promote a discriminatory system (and they are) even if you can duck shove the responsibility to the author (nor can the author use the GPL under these circumstances).
Well, I'm not a programmer, but I hate Google Code. I hate their design. I mean, really hate. It reminds me of Gnome and its HIG philosophy (which is "users are retards"). Those curved edges and the two-color palette... ewww.
Also, sourceforge offers web hosting, so free projects can keep their sites (which could have a better design) at no cost. I don't know if Google Code does this, never saw it.
The SF interface started sucking after recent "update". It was really awful, 404 and 501 errors all the time. Now it is more reliable, but still awfully slow and unintuitive. A very bad "update" that was. Can I have the old design, please?
> Well, when you need to choose between a stupid candidate and an abominable one, sometimes stupid is the better choice.
Sometimes, the hard one is knowing which is which... Especially when a candidate can be both.
Damnit, I need my blanket to keep warm!
Bow-ties are cool.
Just to give you an idea of how bad the situation is, here's a sample of domains that I *have* to access through TOR or proxies. I'm in Syria, and this is really just a sample .. ... etc are blocked by the Syrian authorities. ... and now sourceforge are allowed by the authorities here but the sites block all Syrian IPs.
Note that:
amazon, facebook, youtube, skype, blogspot
wikipedia.org is directly accessible but wikimedia.org is blocked!!!
sun downloads, googlecode
amazon.com ...
anon.inf.tu-dresden.de
blogspot.com
code.google.com
dl.google.com
dlc-cdn.sun.com
dlc.sun.com
truveo.com
video.aol.com
facebook.com
googlecode.com
skype.com
tagged.com
wikimedia.com
youtube.com
all4syria.org
download.virtualbox.org
Isn't obscurity exactly what you want until you figure out a counter? If I figured out how to turn a bunch of smoke detectors and cleaning chemicals into a thermo-nuke that fits in a shoe heel, I don't think I'd make the plans public right away. Yes the public as a whole knowing how it worked would speed up the effort to build a detector, but not as much as it would speed up some teenager with a bad week making something nasty in chem lab. Don't they withhold details on a linux kernel bug until they get it fixed now?
refactor the law, its bloated, confusing and unmaintainable.