[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: WARNING: Crypto software to be included into main Debian distribution



On Sun, Feb 24, 2002 at 12:08:13PM +0100, Florian Lohoff wrote:
> On Sat, Feb 23, 2002 at 11:32:59PM -0600, Steve Langasek wrote:
> > US export law concerns (as it should) the transport of items from within 
> > the borders of the United States to areas outside those borders.  If 
> > you're engaged in export activities from another country to the T7, on 
> > what grounds would you expect to be prosecuted in the United States?  
> > And perhaps a more important question is, why do you believe moving 
> > crypto into main /increases/ this risk, if you already operate a non-US 
> > mirror that's open to the T7?

> Because currently none of the programs in non-us have their origins in
> the US.

False.

$ apt-cache policy krb5-user
krb5-user:
  Installed: 1.2.3-2
  Candidate: 1.2.3-2
  Version Table:
     1.2.3-2 0
        500 http://non-us.debian.org testing/non-US/main Packages
        500 http://non-us.debian.org unstable/non-US/main Packages
        100 /var/lib/dpkg/status
$ head /usr/share/doc/krb5-user/copyright 
This package was debianized by Sam Hartman <hartmans@permabit.com> on
Thu, 19 Oct 2000 16:05:06 -0400.

It was downloaded from <http://web.mit.edu/kerberos

Upstream Author(s): <MIt Kerberos Team <krbdev@mit.edu>

Copyright:

Copyright (C) 1985-2000 by the Massachusetts Institute of Technology.
$

So having crypto-in-main changes the legal landscape not at all for 
those outside the US.

> So i do not export anything from the us to the T7 countries. And
> yes - My mirror is open to anyone - And i would like it to stay like
> this.

Then leave it open.  If there's a real problem, we'd be certain to find 
out soon enough -- and a decision would be made at that point in light 
of the new evidence.

> Thats new to me that there are non-us packages maintained by US
> citizens. If thats the case why is there no need to have the export
> regulation notice on the non-us mirrors today ?

Because there is no need to have the export regulation notice on mirrors 
located outside the US.  US export law doesn't place any extraordinary
requirements on people redistributing software outside of the US.

Steve Langasek
postmodern programmer

Attachment: pgpd_RAwAW8Ws.pgp
Description: PGP signature


Reply to: