This Is Pretty Alarmist [LWN.net]

This Is Pretty Alarmist

Posted Feb 2, 2025 2:41 UTC (Sun) by linuxrocks123 (subscriber, #34648)
Parent article: The Linux Foundation on global regulations and sanctions

This is just typical corporate legal department "we do not want to cross the line and also don't want to come within 10,000 feet of the line" alarmism. Speaking with an SDN over the Internet, including in a programming language, with no money changing hands, is almost certainly not going to be considered "providing a service" to them, and, if it is, courts would almost certainly rule that's a violation of the First Amendment.

Now, maybe, if you're talking with a designated foreign terrorist organization, AND you know that you're talking to a terrorist (no strict liability bullshit), AND the Supreme Court decides to go further down the Holder v. Humanitarian Law Project road once your case gets to them, THEN you could actually get in trouble for doing software development on the Internet. But that's a totally different situation than anything described in this tripe from the Linux Foundation.

to post comments

This Is Pretty Alarmist

Posted Feb 2, 2025 8:32 UTC (Sun) by lunaryorn (guest, #111088) [Link] (1 responses)

The Linux Foundation presumably had qualified legal advice, which not only considered the Foundation itself but also the situation of individual contributors to the kernel, and which incidentally aligns with other legal counsel concerning sanction laws.

If this is "typical corporate legal department alarmism" then what's your comment? Typical Internet armchair layering? What would be your qualification to talk about applicability of US sanction laws?

This Is Pretty Alarmist

Posted Feb 2, 2025 10:34 UTC (Sun) by linuxrocks123 (subscriber, #34648) [Link]

Here's a good starting point for you if you'd like to research this topic: https://crsreports.congress.gov/product/pdf/r/r45618

This Is Pretty Alarmist

Posted Feb 3, 2025 11:19 UTC (Mon) by neggles (subscriber, #153254) [Link] (1 responses)

This is not true, it was mentioned on LKML that these actions were the result of the LF receiving a "friendly reminder" from a US government agency; they did not really have a choice.

This Is Pretty Alarmist

Posted Feb 4, 2025 1:05 UTC (Tue) by linuxrocks123 (subscriber, #34648) [Link]

I'm not talking about the Linux Foundation's article, not the removal of the maintainers. It makes sense for the Linux Foundation to comply with that request/demand even if it was an overreach, because the Linux Foundation has corporate sensibilities.

And Linus Torvalds, of course, is not going to push back because he is a patriotic Finn.

This Is Pretty Alarmist

Posted Feb 5, 2025 16:19 UTC (Wed) by david.a.wheeler (subscriber, #72896) [Link] (2 responses)

> This is just typical corporate legal department "we do not want to cross the line and also don't want to come within 10,000 feet of the line" alarmism.

First, a caveat: I work full-time for the Linux Foundation. I'm speaking for myself here, though.

The cited article *did* lay out a case where they don't think there's a problem: "a one-way receipt of source code via an SDN therefore should be exempt from OFAC sanctions." In many cases that's all that's happening anyway.

Please note that the LF has lawyers who are quite smart & have a lot of understanding on these issues (it's literally their job). If they say "two-way communication discussing the patch..." is riskier, I would take that warning seriously. These aren't people who play being a lawyer on Reddit; they *are* lawyers, posting general advice after looking deeply at the issue.

You may think it alarmist, and it's your right to think that. It's *definitely* your right to examine these laws, and if you think they're bad, argue for changing them. But these are laws with teeth, and to my non-lawyerly eyes this seems like reasonable advice on how to comply with the current laws as they exist today.

This Is Pretty Alarmist

Posted Feb 5, 2025 17:01 UTC (Wed) by Wol (subscriber, #4433) [Link]

> You may think it alarmist, and it's your right to think that. It's *definitely* your right to examine these laws, and if you think they're bad, argue for changing them. But these are laws with teeth, and to my non-lawyerly eyes this seems like reasonable advice on how to comply with the current laws as they exist today.

ESPECIALLY if, as appears to be the case, these lawyers have had a visit from "men with guns", saying "nice foundation you have here, be a shame if something happened to it ...". It's all very well being full of bravado, but if you *have* had the "midnight visit", you're going to be a damn sight more cautious going forward ...

Cheers,
Wol

This Is Pretty Alarmist

Posted Feb 6, 2025 10:32 UTC (Thu) by geert (subscriber, #98403) [Link]

> "a one-way receipt of source code via an SDN therefore should be exempt from OFAC sanctions."

The document does mention an exception to that:

"For example, if a developer from AcmeSDN (and AcmeSDN is an SDN subject to OFAC sanctions) contributes a driver that enables the AcmeSDN processor to work in your software, that contribution would likely be an issue."

> In many cases that's all that's happening anyway.

Anyone with statistics about how many (or: how few) patches and patch series have their v1 applied?