LWN: Comments on "Several Russian developers lose kernel maintainership status"

Public statement from LF Legal etc.?

geert — Fri, 31 Jan 2025 13:08:11 +0000

GregKH just pointed me to a new Linux Foundation blog post:
https://www.linuxfoundation.org/blog/navigating-global-re...

TL;DR: a maintainer can accept a patch from a sanctioned entity, but not request more details, or suggest changes for a v2...

Public statement from LF Legal etc.?

geert — Tue, 17 Dec 2024 14:17:44 +0000

Apparently the rationale for this was presented at the Maintainers Summit in Vienna, three months ago[1].
Unfortunately this was an invite-only event, and AFAIK the presentations/recordings are not publicly available. Also, that part was not covered by LWN.net[2].

Today, we are still waiting for:
1. A public statement from Linux Foundation Legal,
2. A patch series for Documentation/process on the workflows mailing list, to clarify the related process and guidelines,
3. A public apology to the people who were removed from the MAINTAINERS file in error.

Thank you!

[1] "Draft Agenda for the 2024 Maintainers Summit" https://lore.kernel.org/all/20240913125310.GA1706848@mit....
[2] https://lwn.net/Articles/990740/

It was EVERYONE who have .ru in their domain to be removed

geert — Wed, 06 Nov 2024 14:12:11 +0000

Bankrupted in 2023. No idea what happened with the remnants. The website is still up.

https://www.tomshardware.com/news/russian-chipmaker-baika...

It was EVERYONE who have .ru in their domain to be removed

geert — Wed, 06 Nov 2024 14:12:09 +0000

Abylay Ospan has been reinstated in v6.12-rc6.
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/...

It was EVERYONE who have .ru in their domain to be removed

sammythesnake — Tue, 05 Nov 2024 18:08:52 +0000

Baikal Electronics (apparently Serge's employer...?) is on the list: https://sanctionssearch.ofac.treas.gov/Details.aspx?id=39178

Reverse globalization has reached the open-source domain

taladar — Tue, 29 Oct 2024 12:01:45 +0000

There certainly are types of software that "do have borders" but that is mostly the type related to country-specific legislation, geography, language or similar local concerns.

The end of Open Source?

netghost — Mon, 28 Oct 2024 14:00:10 +0000

Yes, first it only affects "maintainers and only if they work for a sanctioned company" so you feel it is OK. Does this sound familiar?

BTW, I don't even expect guys like Linus has a particular higher standards except he is an extremely capable coder, but just don't act like one.

About James' job

jzb — Sun, 27 Oct 2024 17:11:19 +0000

If you click through to the original message, you'll see that he says "we finally got clearance to publish the actual advice". The words "official statement" were not used, however.

About James' job

suzuki_jetson — Sun, 27 Oct 2024 17:06:28 +0000

I know that James Bottomley is a kernel maintainer. However, is he/she a official lawyer of LF foundation? If not, his opinion cannot be described as LF official statement.

showing proof of employment ≠ disavowing Russia

hackerb9 — Sat, 26 Oct 2024 01:32:37 +0000

MarcB, are you thinking that the sanctions are by nationality? I do not think that is the case as it looks like the US sanctions actually target 500 specific entities[1] in Russia. A maintainer doesn't need to show that they work for a foreign corporation, which I could imagine might appear to some like disavowing Russia, they can show they work for some other Russian business.

[1]: https://sanctionslist.ofac.treas.gov/Home/static/sdn.html

The end of Open Source?

hackerb9 — Sat, 26 Oct 2024 00:16:41 +0000

Um... no. Open Source and Free Software communities have always had to abide by the laws of the countries in which they reside. This is not fundamentally different.

I can see why Linus thinks there is a Russian troll factory jumping on this, but I think it is more likely that there are just a lot of people who don't know what the sanctions are or what Putin did to bring such seemingly unfair treatment upon the Russian people. On the other hand, Linus might be right about trolls fanning the flames given the amount of outrage being expressed by people who seem to be getting their "facts" from an alternate reality.

I keep seeing people talk about this as an across the board "ban of Russian developers" from Linux when actually it only affects maintainers and only if they work for a sanctioned company. Hopefully, that will get sorted when the compliance paperwork goes through and some of the maintainers are reinstated.

Why hide it?

dberlin — Fri, 25 Oct 2024 20:39:55 +0000

Sure, but you (and everyone else) don't know what orders they had, and what they were or were not permitted to say, not just by lawyers, but by anyone else.
It depends a ton on the situation (IE gag orders are common, etc)

Why hide it?

pizza — Fri, 25 Oct 2024 20:14:25 +0000

> First, I think people don't quite understand the entities on the other side of this (IE OFAC, Department of Treasury, etc). People are used to seeing copyright issues get resolved, but truthfully, this is nothing like that. This is actually serious. OFAC violations are strict liability (IE it doesn't matter if you knew), and carry very serious criminal and civil penalties. Personal criminal liability, in fact. If they come to you with an issue telling them something like "hey can you wait a few weeks so we can work out something we can say to our community" is not really going to work. They not only don't care, but it's also a good way to end up in jail.

At $dayjob-3, we had a lot of headaches due to dual-use technologies colliding with OFAC and ITAR. If anything, you're understating the seriousness of the situation.

(With a lot of of additional personal "fun" due to my place of birth being on the naughty lists for nearly my entire life. Suffice it to say there's a decent-sized file on me at $TLA)

Why hide it?

shironeko — Fri, 25 Oct 2024 19:48:03 +0000

What trips me up is the commit and the following comments doesn't say nothing, they said a lot of things that just messes with people.

I would think the community would be a lot less upset and a lot less confused if the message is simply "we can't comment on this because lawyers"

Typical US hypocrisy and hypocrisy by Linus

daroc — Fri, 25 Oct 2024 14:55:48 +0000

I think that continuing to discuss this is going to end up with an endless spiral of increasingly negative comments. I have set the comments on this article to 'moderated', and will be applying a high bar to what gets let through.

Typical US hypocrisy and hypocrisy by Linus

marcinjend — Fri, 25 Oct 2024 14:34:15 +0000

Offensive content removed. — Editors

Let's stop this here

jake — Fri, 25 Oct 2024 13:39:51 +0000

This whole sub-thread (not just the comment I am replying to here) has drifted far from the topic at hand. Please stop it here.

thanks,

jake

It was EVERYONE who have .ru in their domain to be removed

aposimz — Fri, 25 Oct 2024 12:47:48 +0000

MailRu Group is in SDN list, however nearly everyone in Russia has @mail.ru address. That's like having @gmx.net mailbox for a German, it doesn't show any affiliation of those individuals with MailRu Group.

Besides, trvn.ru domain is a personal domain with just "Hello!" on the main page, I don't think it is in SDN list. How does this work then?

I think they just decided to carpet-bomb the whole thing, just so there are no concerns in the future. There's no legal entity to protect Russians, and their own government is not interested in that, so that's quite safe thing to do from a legal standpoint.

Documenting that you don't work for a sanctioned entity

farnz — Fri, 25 Oct 2024 12:17:15 +0000

The usually accepted route is to get your tax documents from your government, along with either proof of employment elsewhere or a statement from your old employer that they no longer employ you.

The tax documents show that you're not being taxed on income from your old employer; the proof of employment elsewhere, or confirmation that your old employer no longer employs you, shows that you're not being paid "under the table" by your old employer, either. And if your new employer is cover for your old employer, you can expect them to be covered by sanctions fairly shortly thereafter, in a game of whack-a-mole.

Ultimately, this comes down to the point of sanctions; they're meant to be the last step before an out-and-out trade blockade, where targeted industries in a country you wish to make suffer lose their ability to trade with you, but other industries don't. That way, you can still get the benefits of (e.g.) buying raw materials like oil or metal ores from the country you're trying to make suffer, but they can't sell refined metals or consumer products on the global market.

What is the purpose?

james — Fri, 25 Oct 2024 12:09:09 +0000

"Proof" and "evidence" are two separate concepts. In particular, remember that for lawyers, "evidence" is often given in court or as part of a deposition: "nah, mate, I was never near the place 'e was killed".

Much of the business of a court is deciding which evidence to accept.

Somebody submitting something like a sworn statement or affidavit stating that they are not employed by a particular company would be considered evidence that they are not employed by that company. Further evidence of their financial affairs (for example, who does employ them) would make that evidence stronger.

Here's the official statement via James Bottomley

nix — Fri, 25 Oct 2024 11:33:42 +0000

We still don't know who the someone else was, either. Lawyers really are such cowards. (I say this as someone related to multiple lawyers, who have in the past complained to me about how much their place of work *requires* them to appear to be cowardly slimeballs for the sake of limiting legal liability. This is no doubt the same sort of thing.)

projects are left without maintainers

nix — Fri, 25 Oct 2024 11:08:55 +0000

How do you document that you're *not* employed by someone? You can provide a contract of employment for someone else, but that proves nothing (you could have left). You'd almost have to ask your employers' lawyers to talk to the LF's lawyers. What you can do if you're currently unemployed (as is likely if, say, you *left* your ex-employer's employ because you disagreed with their helping the war, but didn't go public with that disagreement because you don't much like the idea of a very long prison term) I'm not sure.

Why hide it?

nix — Fri, 25 Oct 2024 11:03:45 +0000

That's been confirmed: lawyers. Giving no information gives the impression that this is totally underhand, even though it isn't -- but this is apparently less important to such lawyers than covering their legal arses and making absolutely sure that nothing *they* say ever gets public where people might sue them for it, even when they're ordering other people to say things in public that harm their reputations. Lovely people :(

What is the purpose?

bluca — Fri, 25 Oct 2024 11:00:47 +0000

You can very easily prove that you work for _somebody else_ that is not on the sanctions list. Also I have no idea how it works in Russia, but in the UK I can prove via my tax documents, provided by the government, that shows who I work for.

Here's the official statement via James Bottomley

bluca — Fri, 25 Oct 2024 10:50:55 +0000

No, because Huawei is not subject to the same sanctions as Russian government/companies/entities are

What is the purpose?

jorgegv — Fri, 25 Oct 2024 08:18:59 +0000

"The relevant documentation would be, as others have said, evidence that the relevant people are not employed by a listed entity."

...which of course cannot be be provided. You cannot prove that something physical does _not_ exist. Only that something exists. The Russell tea pot tale comes into mind...

Sanctions?

geert — Fri, 25 Oct 2024 07:13:37 +0000

https://elixir.bootlin.com/linux/v6.11.5/source/LICENSES/...

The US brings us down

NYKevin — Fri, 25 Oct 2024 07:00:30 +0000

The US government has been playing this game for longer than most of us have been alive. Finding loopholes is a fool's errand. If you do find a loophole, they close it, put everyone involved on one or more lists, and arrest any participants who happen to be on US soil.*

In this particular case, the purported loophole is to use an intermediary in Switzerland. This is not a novel strategy, and the US hit upon the idea of "sanctions are transitive, so now your Swiss intermediary is sanctioned too" a long time ago.

* "But I had a valid loophole!" you protest. That's not going to cut it. When you piss off the feds, they are not just looking at one specific action to see if it was a crime. They are looking at your entire pattern of behavior leading up to that point, and comparing every little thing you did against every little law and regulation that might possibly fit. Given the sheer complexity and oppressive thoroughness of OFAC regulations alone, it is highly unlikely that your loophole really does comprehensively cover all of your activity leading up to the point at which the feds decide that you are a criminal. Plus they can also charge you with things like wire fraud, money laundering, and structuring, so you have to worry about all of those laws as well. Do you think a bank is going to help you evade sanctions, if you tell them that that is what you are trying to do? No, you're going to lie to them, which by itself already opens the door to a panoply of secondary crimes.

Sanctions?

khagaroth — Fri, 25 Oct 2024 06:22:50 +0000

With this broad of a wording, isn't GPL software itself in violation as it doesn't have any mechanism to prohibit profit targeted usage by sanctioned entities?

Here's the official statement via James Bottomley

makendo — Fri, 25 Oct 2024 05:02:54 +0000

If it is the Huawei guys being removed, the backlash would be stronger even with angry mobs and alleged trolls excluded. There are more Chinese participating in kernel dev than Russians.

A followup message seems to imply that they are unlikely to be removed unless the lawyers explicitly and clearly told them to. For now we can only pray that a removal of Chinese maintainers, which would _almost definitely_ result in a fork of the Linux codebase, won't happen.

Why hide it?

dberlin — Fri, 25 Oct 2024 04:00:59 +0000

Open source lawyer here (but not involved in this).
Let me try to give you a bunch of practicalities here. I don't honestly have an opinion, but i think there's a bunch of info that is uncommonly known that might help.

First, I think people don't quite understand the entities on the other side of this (IE OFAC, Department of Treasury, etc). People are used to seeing copyright issues get resolved, but truthfully, this is nothing like that. This is actually serious. OFAC violations are strict liability (IE it doesn't matter if you knew), and carry very serious criminal and civil penalties. Personal criminal liability, in fact. If they come to you with an issue telling them something like "hey can you wait a few weeks so we can work out something we can say to our community" is not really going to work. They not only don't care, but it's also a good way to end up in jail.

Again, i have no opinion and I have no idea if that happened here. I have seen it happen before for sure.

Second, as a general rule, releasing legal advice destroys privilege of various sorts. Does it really matter in this case? Certainly not for the advice itself, where it would obviously no longer be privileged. The more concerning issue is probably whether they accidentally destroy privilege for any discussions around it, or any work products, or ...

Hypothetical:
Imagine DoT had come to the linux foundation (or whoever) with an issue. They go to discuss it with their attorneys. That discussion would probably be something like "oh fuck what do we do" and probably involved discussions or issues that, if they were non-privileged, could be dangerous (admission of things that turn out to be crimes, because basically everything related to this kind of compliance is a crime, etc). This sounds weird but it's totally common - the whole goal of privilege is to enable people to discuss things with their attorney without worrying about whether it will get used against them, so they can get the best legal advice possible.
Now you accidentally destroy privilege in this discussion by releasing the resulting advice (or whatever) - congrats, lots of people are screwed.

Privilege issues are not simple to deal with, either, as they vary state to state and country to country.
Especially when you are talking about serious issues like OFAC/etc compliance, I would generally be very careful about privilege.

These are just some of the practicalities, I can think of more, but these are IMHO, the biggest ones.

Note that this is not a US specific thing, either. Everyone has their version of OFAC/et al, with very serious penalties and ...
The only difference is who is on their lists.

Here's the official statement via James Bottomley

0x51 — Fri, 25 Oct 2024 03:42:29 +0000

According to the statement, all the Huawei guys should be removed from the MAINTAINERS list?

LWN: Comments on "Several Russian developers lose kernel maintainership status"

Public statement from LF Legal etc.?

Public statement from LF Legal etc.?

It was EVERYONE who have .ru in their domain to be removed

It was EVERYONE who have .ru in their domain to be removed

It was EVERYONE who have .ru in their domain to be removed

Reverse globalization has reached the open-source domain

The end of Open Source?

About James' job

About James' job

showing proof of employment ≠ disavowing Russia

The end of Open Source?

Why hide it?

Why hide it?

Why hide it?

Related links

Related links

Typical US hypocrisy and hypocrisy by Linus

Typical US hypocrisy and hypocrisy by Linus

Let's stop this here

Related links

It was EVERYONE who have .ru in their domain to be removed

Related links

Documenting that you don't work for a sanctioned entity

What is the purpose?

Related links

Here's the official statement via James Bottomley

projects are left without maintainers

Related links

Why hide it?

What is the purpose?

Here's the official statement via James Bottomley

Related links

What is the purpose?

Related links

Sanctions?

The US brings us down

Sanctions?

Here's the official statement via James Bottomley

Why hide it?

Here's the official statement via James Bottomley