Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.debian.user > #211756 > unrolled thread

A followup on github discussion

Started byReco <recoverym4n@enotuniq.net>
First post2019-07-26 15:00 +0200
Last post2019-07-28 12:10 +0200
Articles 20 on this page of 32 — 18 participants

Back to article view | Back to linux.debian.user


Contents

  A followup on github discussion Reco <recoverym4n@enotuniq.net> - 2019-07-26 15:00 +0200
    Re: A followup on github discussion Roberto C. Sánchez <roberto@debian.org> - 2019-07-26 15:20 +0200
      Re: A followup on github discussion Reco <recoverym4n@enotuniq.net> - 2019-07-26 17:50 +0200
        Re: A followup on github discussion Roberto C. Sánchez <roberto@debian.org> - 2019-07-26 18:00 +0200
          Re: A followup on github discussion Reco <recoverym4n@enotuniq.net> - 2019-07-26 18:10 +0200
            Re: A followup on github discussion Nate Bargmann <n0nb@n0nb.us> - 2019-07-26 19:40 +0200
            Re: A followup on github discussion John Hasler <jhasler@newsguy.com> - 2019-07-27 05:30 +0200
              Re: A followup on github discussion Dominik George <natureshadow@debian.org> - 2019-07-27 08:40 +0200
                Re: A followup on github discussion John Hasler <jhasler@newsguy.com> - 2019-07-27 16:10 +0200
                  Re: A followup on github discussion Stefan Monnier <monnier@iro.umontreal.ca> - 2019-07-27 18:30 +0200
                    Re: A followup on github discussion John Hasler <jhasler@newsguy.com> - 2019-07-27 19:30 +0200
                      Re: A followup on github discussion Joe <joe@jretrading.com> - 2019-07-27 20:00 +0200
                        Re: A followup on github discussion John Hasler <jhasler@newsguy.com> - 2019-07-27 20:20 +0200
                      Re: A followup on github discussion Gene Heskett <gheskett@shentel.net> - 2019-07-28 02:00 +0200
                Re: A followup on github discussion David Wright <deblis@lionunicorn.co.uk> - 2019-07-27 17:00 +0200
          Re: A followup on github discussion Anders Andersson <pipatron@gmail.com> - 2019-07-26 18:10 +0200
            Re: A followup on github discussion Roberto C. Sánchez <roberto@debian.org> - 2019-07-26 18:30 +0200
              Re: A followup on github discussion Reco <recoverym4n@enotuniq.net> - 2019-07-26 19:10 +0200
              Re: A followup on github discussion Richard Owlett <rowlett@cloud85.net> - 2019-07-26 19:20 +0200
                Re: A followup on github discussion Roberto C. Sánchez <roberto@debian.org> - 2019-07-26 21:20 +0200
        Re: A followup on github discussion Gene Heskett <gheskett@shentel.net> - 2019-07-26 18:40 +0200
    Re: A followup on github discussion Steve Kemp <steve@steve.org.uk> - 2019-07-26 15:20 +0200
    Re: A followup on github discussion Nicolas George <george@nsup.org> - 2019-07-26 15:20 +0200
      Re: A followup on github discussion <tomas@tuxteam.de> - 2019-07-26 15:30 +0200
      Re: A followup on github discussion "Stephen P. Molnar" <s.molnar@sbcglobal.net> - 2019-07-26 15:40 +0200
        Re: A followup on github discussion Reco <recoverym4n@enotuniq.net> - 2019-07-26 17:50 +0200
      Re: A followup on github discussion Reco <recoverym4n@enotuniq.net> - 2019-07-26 17:50 +0200
        Re: A followup on github discussion Richard Owlett <rowlett@cloud85.net> - 2019-07-26 19:00 +0200
    Re: A followup on github discussion Peter Ehlert <peter@sdi-baja.com> - 2019-07-26 16:30 +0200
      Re: A followup on github discussion <tomas@tuxteam.de> - 2019-07-26 16:50 +0200
    Re: A followup on github discussion Shahryar Afifi <shahryarafifi@yahoo.com> - 2019-07-28 00:20 +0200
      Re: A followup on github discussion deloptes <deloptes@gmail.com> - 2019-07-28 12:10 +0200

Page 1 of 2  [1] 2  Next page →


#211756 — A followup on github discussion

FromReco <recoverym4n@enotuniq.net>
Date2019-07-26 15:00 +0200
SubjectA followup on github discussion
Message-ID<yo7Zg-4X9-3@gated-at.bofh.it>
	So, dear list,

this is just a quick followup on discrimination practices employed by
GitHub.
Today it was brought to my attention that GitHub has restricted access
to users who live in countries that have US sanctions applied - [1].

Therefore, if somebody is still had any doubts that GitHub does not
respect software freedoms - leave any hope. GitHub is unsuitable for
hosting free software.

Reco

[1] https://help.github.com/en/articles/github-and-trade-controls

[toc] | [next] | [standalone]


#211757

FromRoberto C. Sánchez <roberto@debian.org>
Date2019-07-26 15:20 +0200
Message-ID<yo8iB-5jN-3@gated-at.bofh.it>
In reply to#211756
On Fri, Jul 26, 2019 at 03:53:50PM +0300, Reco wrote:
> 	So, dear list,
> 
> this is just a quick followup on discrimination practices employed by
> GitHub.
> Today it was brought to my attention that GitHub has restricted access
> to users who live in countries that have US sanctions applied - [1].
> 
> Therefore, if somebody is still had any doubts that GitHub does not
> respect software freedoms - leave any hope. GitHub is unsuitable for
> hosting free software.
> 
Well, that's a very nice slant you put on the issue.  As a public
company in the US, GitHub is expected to respect US law.  Certainly
there are instances where civil disobedience is called for, but
violating export regulations is perhaps not the best choice.  Also, the
article which you linked explicitly states that they are working with
regulators to help them understand that GitHub providing services in
sanctioned markets actually *supports* the US government's foreign
policy objectives of free flow of information and free speech.

It seems like that course of action is much more likely to yield
positive results and changes than GitHub deliberately disregarding US
law in this case.  Choosing to ignore the law would likely result in
GitHub being shut down and/or executives being prosecuted.  I suspect
that such a loss would actually result in far less support and advocacy
for software freedom than we currently enjoy.

Well, it seems like I've fed the troll enough, so I'll stop now.

Regards,

-Roberto

-- 
Roberto C. Sánchez

[toc] | [prev] | [next] | [standalone]


#211767

FromReco <recoverym4n@enotuniq.net>
Date2019-07-26 17:50 +0200
Message-ID<yoaDL-6Gg-11@gated-at.bofh.it>
In reply to#211757
On Fri, Jul 26, 2019 at 09:12:48AM -0400, Roberto C. Sánchez wrote:
> On Fri, Jul 26, 2019 at 03:53:50PM +0300, Reco wrote:
> > 	So, dear list,
> > 
> > this is just a quick followup on discrimination practices employed by
> > GitHub.
> > Today it was brought to my attention that GitHub has restricted access
> > to users who live in countries that have US sanctions applied - [1].
> > 
> > Therefore, if somebody is still had any doubts that GitHub does not
> > respect software freedoms - leave any hope. GitHub is unsuitable for
> > hosting free software.
> > 
> Well, that's a very nice slant you put on the issue.  As a public
> company in the US, GitHub is expected to respect US law.

And last time I've checked, so is Software In Public Interest.


> Certainly there are instances where civil disobedience is called for,
> but violating export regulations is perhaps not the best choice.

And the same logic can be applied to SPI and therefore Debian Project.
Or, maybe not?


> Also, the article which you linked explicitly states that they are
> working with regulators to help them understand that GitHub providing
> services in sanctioned markets actually *supports* the US government's
> foreign policy objectives of free flow of information and free speech.

And it also mentions, quoting:

Users are responsible for ensuring that the content they develop and
share on GitHub.com complies with the U.S. export control laws,
including the EAR and the U.S. International Traffic in Arms Regulations
(ITAR).




Reco

[toc] | [prev] | [next] | [standalone]


#211768

FromRoberto C. Sánchez <roberto@debian.org>
Date2019-07-26 18:00 +0200
Message-ID<yoaNr-6JQ-1@gated-at.bofh.it>
In reply to#211767
On Fri, Jul 26, 2019 at 06:39:51PM +0300, Reco wrote:
> On Fri, Jul 26, 2019 at 09:12:48AM -0400, Roberto C. Sánchez wrote:
> > On Fri, Jul 26, 2019 at 03:53:50PM +0300, Reco wrote:
> > > 	So, dear list,
> > > 
> > > this is just a quick followup on discrimination practices employed by
> > > GitHub.
> > > Today it was brought to my attention that GitHub has restricted access
> > > to users who live in countries that have US sanctions applied - [1].
> > > 
> > > Therefore, if somebody is still had any doubts that GitHub does not
> > > respect software freedoms - leave any hope. GitHub is unsuitable for
> > > hosting free software.
> > > 
> > Well, that's a very nice slant you put on the issue.  As a public
> > company in the US, GitHub is expected to respect US law.
> 
> And last time I've checked, so is Software In Public Interest.
> 
> 
> > Certainly there are instances where civil disobedience is called for,
> > but violating export regulations is perhaps not the best choice.
> 
> And the same logic can be applied to SPI and therefore Debian Project.
> Or, maybe not?
> 
Perhaps you are not familiar with Debian project history.  There was a
time when cryptographic software in Debian was hosted outside the US (in
the "non-US" repository) so that Debian users outside the US could have
access to strong crypto-enabled packages (e.g., Mozilla with more than
40-bit encryption).

Does Debian's respect for US law in that case somehow manifest itself as
black mark against the project?  Should Debian as a project have just
said, "forget it, we'll host the strong crypto here in the US for
everybody in the world, even though it is against the law, whatever the
consequences?"

The laws/regulations around that "strong crypto is a munition" have
mostly been resolved, thanks in part to the advocacy of people in
projects, like Debian.

Had the project deliberately broken the law, I suspect we would not have
the vibrant project that we have today.

> 
> > Also, the article which you linked explicitly states that they are
> > working with regulators to help them understand that GitHub providing
> > services in sanctioned markets actually *supports* the US government's
> > foreign policy objectives of free flow of information and free speech.
> 
> And it also mentions, quoting:
> 
> Users are responsible for ensuring that the content they develop and
> share on GitHub.com complies with the U.S. export control laws,
> including the EAR and the U.S. International Traffic in Arms Regulations
> (ITAR).
> 
What's your point?  Similar dervices with data centers and hosting in
Europe have similar disclaimers stating that users are responsible for
GDPR compliance.  In fact, disclaimers of the like are rather common.
For example, like this one from the MOTD on one of my Debian servers:

"Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law."

That could easily be rewritten as:

"Users are reponsible for anything they do with this collection of
software packages and for making sure that its use complies with
applicable laws in the applicable jurisdiction(s)."

Regards,

-Roberto

-- 
Roberto C. Sánchez

[toc] | [prev] | [next] | [standalone]


#211769

FromReco <recoverym4n@enotuniq.net>
Date2019-07-26 18:10 +0200
Message-ID<yoaX8-72W-1@gated-at.bofh.it>
In reply to#211768
On Fri, Jul 26, 2019 at 11:56:07AM -0400, Roberto C. Sánchez wrote:
> > > Certainly there are instances where civil disobedience is called for,
> > > but violating export regulations is perhaps not the best choice.
> > 
> > And the same logic can be applied to SPI and therefore Debian Project.
> > Or, maybe not?
>
> Had the project deliberately broken the law, I suspect we would not have
> the vibrant project that we have today.

You misunderstood me.
By providing a set of free software which by definition can be used for
any purpose (including, but not limited to creation of, say, firearms
and "controlled substances") to any part of the world (including the
countries embargoed by US) Debian Project (and SPI as a rightholder)
currently violates US export control laws.

Or not?


> > > Also, the article which you linked explicitly states that they are
> > > working with regulators to help them understand that GitHub providing
> > > services in sanctioned markets actually *supports* the US government's
> > > foreign policy objectives of free flow of information and free speech.
> > 
> > And it also mentions, quoting:
> > 
> > Users are responsible for ensuring that the content they develop and
> > share on GitHub.com complies with the U.S. export control laws,
> > including the EAR and the U.S. International Traffic in Arms Regulations
> > (ITAR).
>
> What's your point?

GitHub TOS directly contradict the very definition of free software.
No more, no less.


> Similar dervices with data centers and hosting in
> Europe have similar disclaimers stating that users are responsible for
> GDPR compliance.  In fact, disclaimers of the like are rather common.
> For example, like this one from the MOTD on one of my Debian servers:
> 
> "Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
> permitted by applicable law."
> 
> That could easily be rewritten as:
> 
> "Users are reponsible for anything they do with this collection of
> software packages and for making sure that its use complies with
> applicable laws in the applicable jurisdiction(s)."

I'm not a layer (and probably neither are you), yet I see a loophole
here already. The "applicable jurisdiction(s)" term.
Is it local jurisdiction? Is it jurisdiction of the country the user is
citizen of?

Reco

[toc] | [prev] | [next] | [standalone]


#211778

FromNate Bargmann <n0nb@n0nb.us>
Date2019-07-26 19:40 +0200
Message-ID<yocmd-88W-9@gated-at.bofh.it>
In reply to#211769

[Multipart message — attachments visible in raw view] — view raw

* On 2019 26 Jul 11:09 -0500, Reco wrote:
> I'm not a layer (and probably neither are you), yet I see a loophole
> here already. The "applicable jurisdiction(s)" term.
> Is it local jurisdiction? Is it jurisdiction of the country the user is
> citizen of?

I'm not any sort of legal authority either, but my sense is that the
laws of a local jurisdiction the user happens to be in apply regardless
of citizenship status.  I have heard, again no legal authority, that
persons traveling outside their country may face prosecution for acts
that are legal in the destination but not at home.

Point being that people need to be cognizant of the laws that apply.

- Nate

-- 

"The optimist proclaims that we live in the best of all
possible worlds.  The pessimist fears this is true."

Web: https://www.n0nb.us
Projects: https://github.com/N0NB
GPG fingerprint: 82D6 4F6B 0E67 CD41 F689 BBA6 FB2C 5130 D55A 8819

[toc] | [prev] | [next] | [standalone]


#211787

FromJohn Hasler <jhasler@newsguy.com>
Date2019-07-27 05:30 +0200
Message-ID<yolzd-6gm-51@gated-at.bofh.it>
In reply to#211769
Reco writes:
> ...violating export regulations is perhaps not the best choice.

Export regulations do not apply to Open Source software (Debian is an
example).  They do apply to Microsoft's software, though, and Microsoft
may just be applying company policy.  They have to be careful because
they could lose their export licenses for doing things that would not be
illegal if they didn't have any.
-- 
John Hasler 
jhasler@newsguy.com
Elmwood, WI USA

[toc] | [prev] | [next] | [standalone]


#211788

FromDominik George <natureshadow@debian.org>
Date2019-07-27 08:40 +0200
Message-ID<yoox4-8aD-5@gated-at.bofh.it>
In reply to#211787
>Export regulations do not apply to Open Source software (Debian is an
>example).

Source?

-nik

[toc] | [prev] | [next] | [standalone]


#211794

FromJohn Hasler <jhasler@newsguy.com>
Date2019-07-27 16:10 +0200
Message-ID<yovyy-4gz-5@gated-at.bofh.it>
In reply to#211788
I wrote:
> Export regulations do not apply to Open Source software (Debian is an
> example).

nik writes:
> Source?

Look in the Debian archive.  Strong encryption, on servers in the USA
(some operated by institutions such as MIT), no licenses, nobody in
jail.

I was a Debian developer back when the US government asserted that their
export regulations applied to Free Software: We kept strong encryption
in an archive that was stored only on servers outside the USA.  It
eventually became clear to the regulators that if they persisted they
were going to lose a court case on First Amendment grounds.  They
changed their rules to avoid having a precedent set which might have
undermined their whole program.

For a while they had a bizarre requirement that a copy of the source of
anything containing strong encryption be emailed to them when it went
into the archive (but not in advance: there was no waiting period).
This required the archive maintainers to review each new package for
possible encryption, but that wasn't too hard and they tended to err on
the side of caution.  Eventually they were asked to stop sending the
stuff.

The reasoning (if you can call it that) is that they cannot restrict
publication but they contended that source code was not speech.  It
became obvious that someone was going to eventually make them take it to
court, where they would lose.

It now seems to be established that putting Open Source software up on
a public server is protected speech.  Exporting copies of closed source
proprietary software, however, is not.  This means that Microsoft has to
avoid knowingly exporting restricted material to certain countries.


-- 
John Hasler 
jhasler@newsguy.com
Elmwood, WI USA

[toc] | [prev] | [next] | [standalone]


#211797

FromStefan Monnier <monnier@iro.umontreal.ca>
Date2019-07-27 18:30 +0200
Message-ID<yoxK2-5xR-11@gated-at.bofh.it>
In reply to#211794
> It now seems to be established that putting Open Source software up on
> a public server is protected speech.  Exporting copies of closed source
> proprietary software, however, is not.  This means that Microsoft has to
> avoid knowingly exporting restricted material to certain countries.

My understanding is that export of *source code* is allowed, whereas
export of *executable code* is at risk.  And Free Software squeezes
in-between because someone was sane enough to realize that whether
`make` is run before exporting or after exporting doesn't make any
difference to the end result.


        Stefan

[toc] | [prev] | [next] | [standalone]


#211804

FromJohn Hasler <jhasler@newsguy.com>
Date2019-07-27 19:30 +0200
Message-ID<yoyG5-68l-9@gated-at.bofh.it>
In reply to#211797
Stefan writes:
> My understanding is that export of *source code* is allowed...

Only *published* source code.

> And Free Software squeezes in-between because someone was sane enough
> to realize that whether `make` is run before exporting or after
> exporting doesn't make any difference to the end result.

If that level of sanity existed in the export control bureaucracy most
of their rules would not exist.
-- 
John Hasler 
jhasler@newsguy.com
Elmwood, WI USA

[toc] | [prev] | [next] | [standalone]


#211806

FromJoe <joe@jretrading.com>
Date2019-07-27 20:00 +0200
Message-ID<yoz98-6ik-31@gated-at.bofh.it>
In reply to#211804
On Sat, 27 Jul 2019 12:28:32 -0500
John Hasler <jhasler@newsguy.com> wrote:

> Stefan writes:
> > My understanding is that export of *source code* is allowed...  
> 
> Only *published* source code.
> 
> > And Free Software squeezes in-between because someone was sane
> > enough to realize that whether `make` is run before exporting or
> > after exporting doesn't make any difference to the end result.  
> 
> If that level of sanity existed in the export control bureaucracy most
> of their rules would not exist.

It's based on the concept that only Americans can write software: it's
not a problem for the rest of the world to know how strong encryption
works, because only Americans are able to write software to do it, and
they're not allowed to export it. 

Just as well, really, because only American encryption software writers
can be leaned on by the US government...

I do recall a time when even source code could only be exported in
physically printed form, not in electronic form, and PGP was
distributed abroad as a book.

-- 
Joe

[toc] | [prev] | [next] | [standalone]


#211807

FromJohn Hasler <jhasler@newsguy.com>
Date2019-07-27 20:20 +0200
Message-ID<yozst-6Ez-5@gated-at.bofh.it>
In reply to#211806
Joe writes:
> It's based on the concept that only Americans can write software: it's
> not a problem for the rest of the world to know how strong encryption
> works, because only Americans are able to write software to do it, and
> they're not allowed to export it.

It's based on the concept that encryption is militarily useful and
therefor is a munition under the definition of munition in the export
control law and therefor should not be exported without a license (which
is not the same as "they're not allowed to export it").  Exporting
firearms also requires a license.  That does not mean that they think
that no one else can make guns nor does it mean that export of firearms
is never allowed.

The laws were written to control (not forbid) the export of actual
weapons and then stretched to cover "dual use technology" and
information as to how to make things as well as the things themselves.
It works as poorly in the latter case as you would expect, of course.

> ...American encryption software writers can be leaned on by the US
> government...

No they can't.

> I do recall a time when even [encryption] source code could only be
> exported in physically printed form, not in electronic form, and PGP
> was distributed abroad as a book.

It was also printed on T-shirts which people wore while leaving the
country.  The government knew very well that the Federal courts would
not allow them to seize books and printed material.  It soon became
clear to them that the courts would agree that the same material in
digital form would get the same protection.

The export control laws are not an Official Secrets Act, though the
export control bureaucracy would have you believe it is.

-- 
John Hasler 
jhasler@newsguy.com
Elmwood, WI USA

[toc] | [prev] | [next] | [standalone]


#211810

FromGene Heskett <gheskett@shentel.net>
Date2019-07-28 02:00 +0200
Message-ID<yoELw-1jZ-9@gated-at.bofh.it>
In reply to#211804
On Saturday 27 July 2019 13:28:32 John Hasler wrote:

> Stefan writes:
> > My understanding is that export of *source code* is allowed...
>
> Only *published* source code.
>
> > And Free Software squeezes in-between because someone was sane
> > enough to realize that whether `make` is run before exporting or
> > after exporting doesn't make any difference to the end result.
>
> If that level of sanity existed in the export control bureaucracy most
> of their rules would not exist.

John, you have to know better than to expect complete sanity from the 
bureaucracy. TPTB won't allow it.

Cheers, Gene Heskett
-- 
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
If we desire respect for the law, we must first make the law respectable.
 - Louis D. Brandeis
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]


#211795

FromDavid Wright <deblis@lionunicorn.co.uk>
Date2019-07-27 17:00 +0200
Message-ID<yowkV-4xX-1@gated-at.bofh.it>
In reply to#211788
On Sat 27 Jul 2019 at 08:37:35 (+0200), Dominik George wrote:
> >Export regulations do not apply to Open Source software (Debian is an
> >example).
> 
> Source?

Pick your format:

http://www.epic.org/crypto/export_controls/finalregs.pdf
https://epic.org/crypto/export_controls/regs_1_00.html

  “3. Also in §740.13, to, in part, take into account the "open
   source" approach to software development, unrestricted encryption
   source code not subject to an express agreement for the payment of
   a licensing fee or royalty for commercial production or sale of any
   product developed using the source code can, without review, be
   released from "EI" controls and exported and reexported under
   License Exception TSU. Intellectual property protection (e.g.,
   copyright, patent, or trademark) would not, by itself, be construed
   as an express agreement for the payment of a licensing fee or
   royalty for commercial production or sale of any product developed
   using the source code. To qualify, exporters must notify BXA of the
   Internet location (e.g., URL or Internet address) or provide a copy
   of the source code by the time of export. These notifications are
   only required for the initial export; there are no notification
   requirements for end-users subsequently using the source
   code. Notification can be made by e-mail to crypt@bxa.doc.gov.

  “Review and classification are not required for foreign made
   products using this source code. Moreover, under §744.9, exporters
   of unrestricted encryption source code are not restrained from
   providing technical assistance to foreign persons working with such
   source code. In addition, exporters of source code are not subject
   to Internet download screening requirements under
   §734.2(b)(9)(iii). Posting of the source code on the Internet
   (e.g., FTP or World Wide Web site), where it may be downloaded by
   anyone, would not establish "knowledge" (as that term is defined in
   the EAR) of a prohibited export or reexport. Such posting would not
   trigger "red flags" necessitating the affirmative duty to inquire
   under the "Know Your Customer" guidance provided in Supplement
   No. 3 to Part 732. Otherwise, compliance with EAR requirements as
   to prohibited exports and reexports still apply.”

Cheers,
David.

[toc] | [prev] | [next] | [standalone]


#211770

FromAnders Andersson <pipatron@gmail.com>
Date2019-07-26 18:10 +0200
Message-ID<yoaX8-72W-11@gated-at.bofh.it>
In reply to#211768
On Fri, Jul 26, 2019 at 5:56 PM Roberto C. Sánchez <roberto@debian.org> wrote:
>
> On Fri, Jul 26, 2019 at 06:39:51PM +0300, Reco wrote:
> > On Fri, Jul 26, 2019 at 09:12:48AM -0400, Roberto C. Sánchez wrote:
> > > On Fri, Jul 26, 2019 at 03:53:50PM +0300, Reco wrote:
> > > >   So, dear list,
> > > >
> > > > this is just a quick followup on discrimination practices employed by
> > > > GitHub.
> > > > Today it was brought to my attention that GitHub has restricted access
> > > > to users who live in countries that have US sanctions applied - [1].
> > > >
> > > > Therefore, if somebody is still had any doubts that GitHub does not
> > > > respect software freedoms - leave any hope. GitHub is unsuitable for
> > > > hosting free software.
> > > >
> > > Well, that's a very nice slant you put on the issue.  As a public
> > > company in the US, GitHub is expected to respect US law.
> >
> > And last time I've checked, so is Software In Public Interest.
> >
> >
> > > Certainly there are instances where civil disobedience is called for,
> > > but violating export regulations is perhaps not the best choice.
> >
> > And the same logic can be applied to SPI and therefore Debian Project.
> > Or, maybe not?
> >
> Perhaps you are not familiar with Debian project history.  There was a
> time when cryptographic software in Debian was hosted outside the US (in
> the "non-US" repository) so that Debian users outside the US could have
> access to strong crypto-enabled packages (e.g., Mozilla with more than
> 40-bit encryption).
>
> Does Debian's respect for US law in that case somehow manifest itself as
> black mark against the project?  Should Debian as a project have just
> said, "forget it, we'll host the strong crypto here in the US for
> everybody in the world, even though it is against the law, whatever the
> consequences?"
>
> The laws/regulations around that "strong crypto is a munition" have
> mostly been resolved, thanks in part to the advocacy of people in
> projects, like Debian.

You seem to contradict yourself a bit here - at least if you argue for
GitHub's stance. As you yourself point out, Debian went around the
law. Because of that, no user was affected even while the law was
still relevant. GitHub does not offer a workaround (yet). If they
lobby for that - great. In the meantime, their choice of location seem
to limit their ability to offer the same freedom to everyone.

[toc] | [prev] | [next] | [standalone]


#211771

FromRoberto C. Sánchez <roberto@debian.org>
Date2019-07-26 18:30 +0200
Message-ID<yobgt-79V-3@gated-at.bofh.it>
In reply to#211770
On Fri, Jul 26, 2019 at 06:08:40PM +0200, Anders Andersson wrote:
> 
> You seem to contradict yourself a bit here - at least if you argue for
> GitHub's stance. As you yourself point out, Debian went around the
> law. Because of that, no user was affected even while the law was
> still relevant. GitHub does not offer a workaround (yet). If they
> lobby for that - great. In the meantime, their choice of location seem
> to limit their ability to offer the same freedom to everyone.
> 
I'm not arguing for or against GitHub's stance, nor is there a
contradiction.

In both cases, the organizations in question respected the law and
sought to effect change in the interest of promoting freedom.

Your statement that "no user was affected" is not accurate.  Every user
was affected, both within and without the US, as a result of the added
complexity of an additional package source.  That also incurred an
additional maintenance burden on the project.

Perhaps there is more that GitHub could do, like locating hosting
facilities in other parts of the world and then offering services to the
sanctioned markets via a mechanism that would not violate US law.  I
would encourage anyone who feels strongly about it to either go to work
for GitHub and effect such a change, or to create a technically
equivalent or superior competitor that is not subject to the same legal
jurisdiction.

However, as I write the above, it dawns on me that Reco's initial post
did not offer any alternative service providers or suggestions for
improving the situation and so the objective might just be to complain
or to incite some form of argument.

Regards,

-Roberto

-- 
Roberto C. Sánchez

[toc] | [prev] | [next] | [standalone]


#211776

FromReco <recoverym4n@enotuniq.net>
Date2019-07-26 19:10 +0200
Message-ID<yobTb-7DQ-1@gated-at.bofh.it>
In reply to#211771
On Fri, Jul 26, 2019 at 12:24:27PM -0400, Roberto C. Sánchez wrote:
> However, as I write the above, it dawns on me that Reco's initial post
> did not offer any alternative service providers or suggestions for
> improving the situation and so the objective might just be to complain
> or to incite some form of argument.

I felt that there was no need to. Quoting fellow poster:

The solution should be easy as cake, host our own git server ;)

Reco

[toc] | [prev] | [next] | [standalone]


#211777

FromRichard Owlett <rowlett@cloud85.net>
Date2019-07-26 19:20 +0200
Message-ID<yoc2R-7Hz-3@gated-at.bofh.it>
In reply to#211771
On 07/26/2019 11:24 AM, Roberto C. Sánchez wrote:
> [SNIP]
> 
> Perhaps there is more that GitHub could do, like locating hosting
> facilities in other parts of the world and then offering services to the
> sanctioned markets via a mechanism that would not violate US law.  I
> would encourage anyone who feels strongly about it to either go to work
> for GitHub and effect such a change, or to create a technically
> equivalent or superior competitor that is not subject to the same legal
> jurisdiction.
> 

As this discussion *appears* to revolve around US law ...

If you are an annoyed/offended U.S. citizen
"Have you contacted your Senator/Representative?"

If not a "U.S. citizen", "I do *NOT* know" :<

YMMV

[toc] | [prev] | [next] | [standalone]


#211784

FromRoberto C. Sánchez <roberto@debian.org>
Date2019-07-26 21:20 +0200
Message-ID<yodV0-1jC-5@gated-at.bofh.it>
In reply to#211777
On Fri, Jul 26, 2019 at 12:10:46PM -0500, Richard Owlett wrote:
> On 07/26/2019 11:24 AM, Roberto C. Sánchez wrote:
> > [SNIP]
> > 
> > Perhaps there is more that GitHub could do, like locating hosting
> > facilities in other parts of the world and then offering services to the
> > sanctioned markets via a mechanism that would not violate US law.  I
> > would encourage anyone who feels strongly about it to either go to work
> > for GitHub and effect such a change, or to create a technically
> > equivalent or superior competitor that is not subject to the same legal
> > jurisdiction.
> > 
> 
> As this discussion *appears* to revolve around US law ...
> 
> If you are an annoyed/offended U.S. citizen
> "Have you contacted your Senator/Representative?"
> 
> If not a "U.S. citizen", "I do *NOT* know" :<
> 
I make somewhat regular use of the ability to contact my legislators at
various levels.

The issue here is that I find complaints of the nature of that which
spawned this thread to be somewhat bothersome.

Regards,

-Roberto

-- 
Roberto C. Sánchez

[toc] | [prev] | [next] | [standalone]


Page 1 of 2  [1] 2  Next page →

Back to top | Article view | linux.debian.user


csiph-web