Slashdot Mirror
Fedora To Have a "Don't Ask, Don't Tell" For Contributors
An anonymous reader writes "The Fedora Project is now going to enforce a "Don't Ask, Don't Tell" policy for contributors. What the project's engineering committee is asking their members to conceal is a contributor's nationality, country of origin, or area of residence. There's growing concern about software development contributions coming from export restricted countries by the US (Cuba, Iran, North Korea, Sudan, and Syria) with Red Hat being based out of North Carolina, but should these governmental restrictions apply to an open-source software project?"
Absolutely. Fedora is a US based company, yes? Then should they abide by US laws? Yes.
If they want to get code from countries that would otherwise be illegal in their current place of residence, they should not conceal the identies of the contributors and instead move the country they base their operations out of. Law is law.
Yes. They do. Why should US-based Open Source products get special treatment? Would that be an unfair competitive advantage if they did?
If contributing to open source projects is wrong, then I don't want anybody to be right.
If someone in Syria submits a contribution to US based software, how does that infringe an export ban?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
It's not like they're being paid money for their work.
Not sure if this is the right way to look at it but if it's a case of US banning exports to the listed countries (I can't imagine how the US would ban exports from those countries short of a bloackade) then what's the problem?
People in those countries are exporting their work on the opensource project at hand.
As for how they got their hands on that code... it's open source! they could have downloaded it from anywhere (i.e. NOT the US).
Where's the issue?
Because I do NOT trust code from Russia, China, anywhere in the Middle East, and a few other places. Just look at all the crime (Target for one) that's based in Russia alone.
There's no need to ask. We already know that everyone who codes Linux is gay.
Only the final validation contributions should be of concern in relation to contributions from export ban countries. The process that removes problems induced by errors (stupidity) ought to be good enough catch the ones induced by malice as well.
'but should these governmental restrictions apply to an open-source software project?' there would appear to be two different questions here. (1) does the current law apply and (2) should the law apply.
w.r.t. (1) Sounds like some cognizant group has determined that the law does (or at least may) apply, so the Fedora team is taking the steps they can.
As for (2), that is a matter for Congress. Lobby them if you think the law should carve out an exception for Open Source projects (all or some specific licenses).
I understand what they are trying to do. They want to protect the identity of their contributors so that their contributors are safe, and (other) locals won't condemn software that was partially written by someone in a country they don't happen to like at the time. This is a dangerous policy insofar as software provenience is concerned. When patent trolls come a-calling (and anything created that's worth more than half a penny will have more patent attornies swarming it than ambulance chasers around a kid with a kazoo). I for one would worry more about the latter than the former. Have a sealed, sign-in to confirm identities, and keep an accurate log record of who contributed what and when. Its the only way to beat off the trolls.
The ONLY opinions that matter are the customers.
I am a customer and that makes my opinion correct.
Any asshole can get a dispoable email and create an account; therefore, this prejudice against ACs is completely illogical.
I'd trust code I can see from a place I don't trust more than I'd trust code I can't see from a place I like.
I see. So you examine every line of code? No you don't. It's impossible because of the MILLIONS of lines of code.
You know, everybody takes it for granted that someone else will look at the code and make sure there isn't anything malicious. I have never - ever - seen or met anyone who looks at FOSS code. They install it and run it.
You are a fool.
If you will ban contributors because their home country intelligence agencies may be trying to plant backdoors or weaken security in a way or another, you should start with the main country by far engaged in such activities, else would be meaningless or just following an unrelated agenda. But if you trust in contributors of such country, why not of others?
There's growing concern about software development contributions coming from export restricted countries by the US (Cuba, Iran, North Korea, Sudan, and Syria) with Red Hat being based out of North Carolina, but should these governmental restrictions apply to an open-source software project?
In the name of god, why would a geek think open source development would give his US-based project Immunity from American law?
Export controls come with teeth that bite. Suggesting that your contributors conspire to evade those controls is an invitation to diasaster for everyone involved.
If anyone asks, we'll pretend we never asked you to do this.
P.S. If you are law enforcement, please ignore the subject line of this message.
(Oh, and if this makes it harder for to trace copy right should we ever decide to abuse the license to thecode you contribute, well, sucks to be you, but we're no charity.)
Those Open Source nuts should all be imprisoned! Or, at the very least, branded as the traitors they are, aiding and abetting the enemy. Perhaps they should all go to Russia with Snowden.
So you're telling me that North Korean and Iranian scientists are just as likely to contribute malicious code to libraries used by Western agencies as anyone else? I think not.
Open-source is supposed to be about maximum transparency, not about hiding information that might actually be relevant. Imagine having to apply security at airports if you had no idea whether the person you are about to scan is a 90 year old grandmother or an 18-25 male from the Middle East. Statistics and common sense tells you that one is a lot more likely to be malicious than the other, so why throw common sense out the window?
Please tell me how do you restrict any possible way to export something that is free, publicly accessible, that is available over a public distributed network?
With closed source software you can restrict who and when access the code, but for Open Source software there is no practical way of doing so.
How do you enforce the export control?... Blocking whole blocks of IP address from export controller countries? Using smart-filters to prevent the source code going out? Are you going to require to every open source software project to register to keep track of them and add them to a "forbidden to see outside de US" list?
Tell me how in earth do you think that control export of public and available knowledge is enforceable in a practical and/or economical way?
The problem at the end of the day is that the people in export-controller countries are going to have access to Open Source software in a way or another, and they might have valuable contributions but don't accepting those contributions could mean that US is going to be isolated on their development and their political "enemies" are going to have better software, just because a export control law that doesn't really reflects the way that the modern world works.
In my experience, trying to be willfully ignorant of stuff like this is not going to work as a defense. Here, they are explicitly explaining 'we don't want to know so that we can deal with sanctioned nations and truthfully claim we don't know it's happening. There's a clear intent expressed that, if sanctions are relevant, they are trying to explicitly violate the sanctions.
It'd be one thing for contributors to naturally realize they should lie, or else if they *lazily* didn't bother to check/collect that information. But they are essentially instructing people on a specific course of action specifically to not get hit by sanction concerns.
This slashdot beta is ugly as hell.
Maybe the US should stop making enemies.
To say it's 'export controlled' is an oversimplification of the restrictions around working with those nations.
But in simple terms, this is about *contributors*, not downloading. And if it weren't an issue, then Fedora people wouldn't be trying to game it for plausible deniability (which of course doesn't work when you say "Hey everyone, I want to be able to claim plausible deniability so could you just omit some information so I can do that?"
XML is like violence. If it doesn't solve the problem, use more.
Export restrictions of non-classified information that's already "out there" are asinine. The very nature of software is such that you can clone infinite copies. If Iran wants something, it's trivial for them to plant just one guy in-country, have him download it at a coffee-shop and e-mail it out or whatever.
We went through this in the 90s. Remember the little form you had to fill out for strong encryption? I used to fill in my name as "Hafez the Enforcer". Nothing ever happened because not only is it impossible to stop the flow of information, even if I really were a terrorist and FUCKING TOLD THEM, they did nothing to stop it with a STUPID FUCKING FORM!!!
Meanwhile, any company that wants to follow the law has to burn that many more billable hours to make sure they're in compliance.
The security interests of the United States would be equally well served by requiring the Pledge of Allegience to appear on all electronic shopping carts. Maybe I shouldn't give them any ideas...
Don't ask don't tell.
"If any question why we died, Tell them because our fathers lied."
Fine, accept code from foreigners, but be well aware that this will make is certain that it will not be used in many corporate sites. One of the items I have to certify when using open-source in a corporate environment is that there is no foreign content. Otherwise it cannot be used. No one is going to go through the source code from something like OpenOffice and look for malicious code, and show that it does not exist, if it has off-shore content, it will not be used, period.
Ideally, no; practically, yes. Some players, such as DPRK, have a long and celebrated history of trying to ruin everyone's fun just because they can. Demonstrable trolls should be faced with ever-increasing scrutiny where the legitimacy of the project is at stake, even if those trolls are nation-states.
You can easily assign a dollar amount in benefit from the development or distribution to a foreign company so yes, they definitely should remain banned. As for workers working on the project, that doesn't make a lot of sense until you consider that you're giving them a compilable version of the code to work on and thus a product that can be assigned value.
maybe hostile nations should stop trying to pwn open source projects with back door code. you tell me that all code is inspected, I say bs. instead of "don't ask don't tell" we need rigorous account checking. Who is the person submitting the code? what is his background? what other code has he submitted?
Well, I noticed you decided they are male before even running the hypothetical background check...
Doesn't an export restriction mean you can't send goods to a restricted country? If somebody in Cuba sends code to Redhat, in the US, that would seem to be an import. There is an easy solution, even if it does apply. Said developer just needs to upload it to a server in a friendly country without the restriction and Redhat get it from there. In such cases, usually France is the go between.
This isn't really a policy.
The specific case arose, FESCo asked Fedora Legal for it, Fedora Legal asked for expert opinion from Red Hat's lawyers, and the guidance that came back was posted to the FESCo ticket and meeting log. That's it. It's a case where a general project committee asked for expert legal guidance.
You can read basically the entire thing happening at https://fedorahosted.org/fesco... .
That's what we were told, when the left and libertarians wanted it eliminated re gays. Everybody should be "free" and "out" etc. Information "wants to be free". Hooray for "openness"....
Hang-on... idiots who only read first sentences will thinkk this is an anti-gay troll-fest... but it's not... it's about consistency and basic philosophy about disclosure.
Now we are told hiding information is good. How is this good? If truly being "free" and "open" is the ideal in modern society, then surely a CORE part of that openness and freedom is that the contributors to open-source code are "out" (not "outed" by others, but by their own hands). Are we to say that "free" software is better because we can all know all about it (and can examine the source code) but that it does not matter WHO contributed various code? Really? So if the NSA is contributing the bits of code that handle security or encryption that's NOT important for the community to know? Really? Well if it is important to know if the NSA is contributing code, then is it important to know if some hackers working for Putin and tied to Russian identity theft activity is involved? Well, if you don't trust the NSA or you don't trust Putin what makes you think it's good to have code submitted by somebody working for the North Korean thugocracy or the Iranian Revolutionary Guard?
It may well be currently fashionable to hate America (Thanks a lot, Bush and Obama...) but that CERTAINLY should not drive any rational person to be willing to entust vital things to anonymous sources in worse places. Many of which are home to some of the most tawdry and malicious coders. Surely the maximum freedom for users of open-source code includes complete openness on WHERE the code comes from (and thus allows each individual to decide for him/herself how much scrutiny is required on any particular bit). Whenever somebody seeks to hide something, there is a reason. What's being hidden? Why is it being hidden? When the NSA is caught hiding things from the citizens we get suspicious... Why should we be any less suspicious when somebody tells us they are going to hide information about contributors from some of the worst and most-evil places on Earth? To loop-back to my opening sentence: With DODT (the OP, not me, chose that particular metaphor) in the military we were told that hiding people's ID was bad in many ways; that it encouraged bad attitudes and bad behaviors, it led to less securtiy, was oppressive, etc. (dig-up any 1990's political argument you like) but suddenly this is good? Again, why?
Philosophical inconsistencies bother me. There are usually un-said (i.e. hidden and intentionally-obscured) reasons when a person or organization acts in a philosophically-inconsistent manner
No, but it can be good enough for a jury to find them non-guilty despite the facts - a tradition that extends throughout US history and long before.
God help the geek who thinks that "jury nullification" will work for him.
Historically, it spares the home-town boy. The high school jock whose drunken spree ended with two kids dead in a hit and run. It's the outsider who risks getting nailed to the wall whether the evidence supports it or not.
The geek never quite comes to grips with the fact that he is the alien, the stranger, in the courtroom. The ne'er---do---well, the defendant who was born on the wrong side of the tracks.
The American juror is middle aged, middle class, small-C conservative.
He never responds well to the geek's cleverness or his arrogance --- and will not cut him any slack.
Damn straight! We should all just run Microsoft software, and accept the fact that the NSA has exploits that can't be verified! Open source is total crap anyway, and only those with secrets to hide should run it, right? FOOL! Why dont you crawl back into the pit from which you came!
So the NSA is working for a hostile nation? got it. No American citizen can be trusted to contribute code. its as simple as that. you talk about "hostile nations" when the largest warmonger on this planet is yourself? the ignorance must be strong in you.
How are any of those question relevant?
Is the code up to par? Done deal.
It is not like these OSS projects allow anyone to commit to the main dev tree(s).
Cuba, Iran, North Korea, Sudan, and Syria?
Check out openbsd policy on us citizen code contributions to the kernel or advice on where it might be safe to download code from. Years ago I thought this was just Theo being Theo. Send money.
Maybe the US should stop making enemies.
If we stop making enemies, pretty soon we stop waging wars.
If we stop waging war, the military-industrial complex that Eisenhower talked about goes belly up.
If the military-industrial complex that Eisenhower talked about goes belly up, say goodbye to the American economy, and soon thereafter, the world economy.
If we say goodbye to the economy, all infrastructure will implode, including the publishers of /.
If /. goes the way of the dodo bird, all the nerds and nerd wanna-be's that troll and otherwise vent their bile here get all backed up and start expressing themselves in other, darker and more brick-and-mortar-y ways.
So, bob's your uncle, and the world ends badly.
Nobody wants that.
--- Say something clever. Pretend it was me. Thanks.