Slashdot Mirror
Fedora To Have a "Don't Ask, Don't Tell" For Contributors
An anonymous reader writes "The Fedora Project is now going to enforce a "Don't Ask, Don't Tell" policy for contributors. What the project's engineering committee is asking their members to conceal is a contributor's nationality, country of origin, or area of residence. There's growing concern about software development contributions coming from export restricted countries by the US (Cuba, Iran, North Korea, Sudan, and Syria) with Red Hat being based out of North Carolina, but should these governmental restrictions apply to an open-source software project?"
Absolutely. Fedora is a US based company, yes? Then should they abide by US laws? Yes.
If they want to get code from countries that would otherwise be illegal in their current place of residence, they should not conceal the identies of the contributors and instead move the country they base their operations out of. Law is law.
Yes. They do. Why should US-based Open Source products get special treatment? Would that be an unfair competitive advantage if they did?
If contributing to open source projects is wrong, then I don't want anybody to be right.
If someone in Syria submits a contribution to US based software, how does that infringe an export ban?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
It's not like they're being paid money for their work.
Because I do NOT trust code from Russia, China, anywhere in the Middle East, and a few other places. Just look at all the crime (Target for one) that's based in Russia alone.
There's no need to ask. We already know that everyone who codes Linux is gay.
Only the final validation contributions should be of concern in relation to contributions from export ban countries. The process that removes problems induced by errors (stupidity) ought to be good enough catch the ones induced by malice as well.
'but should these governmental restrictions apply to an open-source software project?' there would appear to be two different questions here. (1) does the current law apply and (2) should the law apply.
w.r.t. (1) Sounds like some cognizant group has determined that the law does (or at least may) apply, so the Fedora team is taking the steps they can.
As for (2), that is a matter for Congress. Lobby them if you think the law should carve out an exception for Open Source projects (all or some specific licenses).
I understand what they are trying to do. They want to protect the identity of their contributors so that their contributors are safe, and (other) locals won't condemn software that was partially written by someone in a country they don't happen to like at the time. This is a dangerous policy insofar as software provenience is concerned. When patent trolls come a-calling (and anything created that's worth more than half a penny will have more patent attornies swarming it than ambulance chasers around a kid with a kazoo). I for one would worry more about the latter than the former. Have a sealed, sign-in to confirm identities, and keep an accurate log record of who contributed what and when. Its the only way to beat off the trolls.
If you will ban contributors because their home country intelligence agencies may be trying to plant backdoors or weaken security in a way or another, you should start with the main country by far engaged in such activities, else would be meaningless or just following an unrelated agenda. But if you trust in contributors of such country, why not of others?
There's growing concern about software development contributions coming from export restricted countries by the US (Cuba, Iran, North Korea, Sudan, and Syria) with Red Hat being based out of North Carolina, but should these governmental restrictions apply to an open-source software project?
In the name of god, why would a geek think open source development would give his US-based project Immunity from American law?
Export controls come with teeth that bite. Suggesting that your contributors conspire to evade those controls is an invitation to diasaster for everyone involved.
Those Open Source nuts should all be imprisoned! Or, at the very least, branded as the traitors they are, aiding and abetting the enemy. Perhaps they should all go to Russia with Snowden.
So you're telling me that North Korean and Iranian scientists are just as likely to contribute malicious code to libraries used by Western agencies as anyone else? I think not.
Open-source is supposed to be about maximum transparency, not about hiding information that might actually be relevant. Imagine having to apply security at airports if you had no idea whether the person you are about to scan is a 90 year old grandmother or an 18-25 male from the Middle East. Statistics and common sense tells you that one is a lot more likely to be malicious than the other, so why throw common sense out the window?
Meet me. I have on occasion not only read FLOSS code, but also contributed.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Maybe the US should stop making enemies.
To say it's 'export controlled' is an oversimplification of the restrictions around working with those nations.
But in simple terms, this is about *contributors*, not downloading. And if it weren't an issue, then Fedora people wouldn't be trying to game it for plausible deniability (which of course doesn't work when you say "Hey everyone, I want to be able to claim plausible deniability so could you just omit some information so I can do that?"
XML is like violence. If it doesn't solve the problem, use more.
Don't ask don't tell.
"If any question why we died, Tell them because our fathers lied."
Fine, accept code from foreigners, but be well aware that this will make is certain that it will not be used in many corporate sites. One of the items I have to certify when using open-source in a corporate environment is that there is no foreign content. Otherwise it cannot be used. No one is going to go through the source code from something like OpenOffice and look for malicious code, and show that it does not exist, if it has off-shore content, it will not be used, period.
You can easily assign a dollar amount in benefit from the development or distribution to a foreign company so yes, they definitely should remain banned. As for workers working on the project, that doesn't make a lot of sense until you consider that you're giving them a compilable version of the code to work on and thus a product that can be assigned value.
Export restrictions
Except that this is an issue of imports, not exports.
Work is allegedly being done in some foreign country and then brought in as a component of a (supposedly) US product. Yes, the subsequent export of that product might raise some issues. But not logically over the foreign-built bits.
Have gnu, will travel.
maybe hostile nations should stop trying to pwn open source projects with back door code. you tell me that all code is inspected, I say bs. instead of "don't ask don't tell" we need rigorous account checking. Who is the person submitting the code? what is his background? what other code has he submitted?
Doesn't an export restriction mean you can't send goods to a restricted country? If somebody in Cuba sends code to Redhat, in the US, that would seem to be an import. There is an easy solution, even if it does apply. Said developer just needs to upload it to a server in a friendly country without the restriction and Redhat get it from there. In such cases, usually France is the go between.
The point isn't that your (or I) read all the code, but that the author can't control who will look at it, and lots of people are likely to, particularly if they notice anything suspicious about how it acts.
As for you being a customer of Fedora...how much did you pay them? I could see you claiming to be a customer of Red Hat, but of Fedora? (OTOH, it's true this code is likely to eventually make its way into Red Hat's commercial offerings...so if you are a customer of Red Hat, i.e. purchase one of their commercial packages with support contract), you do have reasonable grounds to claim to be a customer. But I rather doubt that you are.
P.S.: I rarely look at the code, but I do occasionally look at some piece if I want to figure out how they are doing some particular thing. And I suspect that the number of people who occasionally look at a piece of the code here and there is much higher than you expect, even though very few do it full time, or even very much of the time.
I think we've pushed this "anyone can grow up to be president" thing too far.
This isn't really a policy.
The specific case arose, FESCo asked Fedora Legal for it, Fedora Legal asked for expert opinion from Red Hat's lawyers, and the guidance that came back was posted to the FESCo ticket and meeting log. That's it. It's a case where a general project committee asked for expert legal guidance.
You can read basically the entire thing happening at https://fedorahosted.org/fesco... .
No, but it can be good enough for a jury to find them non-guilty despite the facts - a tradition that extends throughout US history and long before.
God help the geek who thinks that "jury nullification" will work for him.
Historically, it spares the home-town boy. The high school jock whose drunken spree ended with two kids dead in a hit and run. It's the outsider who risks getting nailed to the wall whether the evidence supports it or not.
The geek never quite comes to grips with the fact that he is the alien, the stranger, in the courtroom. The ne'er---do---well, the defendant who was born on the wrong side of the tracks.
The American juror is middle aged, middle class, small-C conservative.
He never responds well to the geek's cleverness or his arrogance --- and will not cut him any slack.
How could someone work on the code without it first being exported to them?
By working on a copy that originated and has been maintained outside the jurisdiction of the USA.
Have gnu, will travel.
Cuba, Iran, North Korea, Sudan, and Syria?
Check out openbsd policy on us citizen code contributions to the kernel or advice on where it might be safe to download code from. Years ago I thought this was just Theo being Theo. Send money.
Maybe the US should stop making enemies.
If we stop making enemies, pretty soon we stop waging wars.
If we stop waging war, the military-industrial complex that Eisenhower talked about goes belly up.
If the military-industrial complex that Eisenhower talked about goes belly up, say goodbye to the American economy, and soon thereafter, the world economy.
If we say goodbye to the economy, all infrastructure will implode, including the publishers of /.
If /. goes the way of the dodo bird, all the nerds and nerd wanna-be's that troll and otherwise vent their bile here get all backed up and start expressing themselves in other, darker and more brick-and-mortar-y ways.
So, bob's your uncle, and the world ends badly.
Nobody wants that.
--- Say something clever. Pretend it was me. Thanks.