Re: [PATCH] MAINTAINERS: Remove some entries due to various compliance requirements.

Re: [PATCH] MAINTAINERS: Remove some entries due to various compliance requirements.

[Geert Uytterhoeven]

 	Hi Greg,

Thanks for your patch, which is now commit 6e90b675cf942e50
("MAINTAINERS: Remove some entries due to various compliance
requirements.") in v6.12-rc4.

On Fri, 18 Oct 2024, Greg Kroah-Hartman wrote:
> Remove some entries due to various compliance requirements. They can come
> back in the future if sufficient documentation is provided.

This is very vague...
What are "various compliance requirements"?
What does "sufficient documentation" mean?

I can guess, but I think it's better to spell out the rules, as Linux
kernel development is done "in the open".  I am also afraid this is
opening the door for further (ab)use...

Gr{oetje,eeting}s,

 						Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
 							    -- Linus Torvalds

Re: [PATCH] MAINTAINERS: Remove some entries due to various compliance requirements.

[Geert Uytterhoeven]

 	Hi Greg,

Thanks for your patch, which is now commit 6e90b675cf942e50
("MAINTAINERS: Remove some entries due to various compliance
requirements.") in v6.12-rc4.

On Fri, 18 Oct 2024, Greg Kroah-Hartman wrote:
> Remove some entries due to various compliance requirements. They can come
> back in the future if sufficient documentation is provided.
>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[...]

> @@ -888,7 +882,6 @@ F:	drivers/staging/media/sunxi/cedrus/
>
> ALPHA PORT
> M:	Richard Henderson <richard.henderson@linaro.org>
> -M:	Ivan Kokshaysky <ink@jurassic.park.msu.ru>
> M:	Matt Turner <mattst88@gmail.com>
> L:	linux-alpha@vger.kernel.org
> S:	Odd Fixes
> @@ -2263,12 +2256,6 @@ L:	linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
> S:	Maintained
> F:	arch/arm/mach-ep93xx/ts72xx.c
>
> -ARM/CIRRUS LOGIC CLPS711X ARM ARCHITECTURE
> -M:	Alexander Shiyan <shc_work@mail.ru>
> -L:	linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
> -S:	Odd Fixes
> -N:	clps711x
> -

This also removes the mailing list entry, causing submitters of future
patches to forget CCing the mailing list.

Why not just drop the cancelled M:-entry instead, like you did above?

The same is true for several other sections.
I have sent a fix for the sections related to Renesas drivers[1].

> ARM/CIRRUS LOGIC EP93XX ARM ARCHITECTURE
> M:	Hartley Sweeten <hsweeten@visionengravers.com>
> M:	Alexander Sverdlin <alexander.sverdlin@gmail.com>

[1] "[PATCH/RFC] MAINTAINERS: Re-add cancelled Renesas driver sections"
     https://lore.kernel.org/all/0a189e2c4090a1b308e18005d2552e335bac354f.1729511337.git.geert+renesas@glider.be/

Gr{oetje,eeting}s,

 						Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
 							    -- Linus Torvalds

Re: [PATCH] MAINTAINERS: Remove some entries due to various compliance requirements.

[Wolfram Sang]

[-- Attachment #1: Type: text/plain, Size: 473 bytes --]


> > Remove some entries due to various compliance requirements. They can come
> > back in the future if sufficient documentation is provided.
> 
> This is very vague...
> What are "various compliance requirements"?
> What does "sufficient documentation" mean?
> 
> I can guess, but I think it's better to spell out the rules, as Linux
> kernel development is done "in the open".  I am also afraid this is
> opening the door for further (ab)use...

I agree.


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH] MAINTAINERS: Remove some entries due to various compliance requirements.

[Lukas Wunner]

On Mon, Oct 21, 2024 at 09:49:56AM +0200, Geert Uytterhoeven wrote:
> On Fri, 18 Oct 2024, Greg Kroah-Hartman wrote:
> > Remove some entries due to various compliance requirements. They can come
> > back in the future if sufficient documentation is provided.
> 
> This is very vague...
> What are "various compliance requirements"?
> What does "sufficient documentation" mean?

Looking at what other organizations have done provides some clues.
E.g. the RIPE NCC initially took the stance:

   "The RIPE NCC provides critical services to its membership spread across
    a diverse geographical and political region.
    The Executive Board of the RIPE NCC believes that the means to communicate
    should not be affected by domestic political disputes, international
    conflicts or war. This includes the provision of correctly registered
    Internet numbering resources."
    https://www.ripe.net/about-us/news/ripe-ncc-executive-board-resolution-on-provision-of-critical-services/

However due to being governed by Dutch law, that policy had to be amended:

   "The Dutch Ministry of Foreign Affairs confirmed to us that IP resources
    are considered economic resources, as defined in the EU sanctions
    regulation, and must be frozen for sanctioned entities.
    The RIPE NCC complies with this restriction by freezing the registration
    (not the use) of the Internet number resources in the RIPE Database.
    This means that sanctioned entities cannot acquire further resources or
    transfer resources. However, we do not deregister their resources or
    terminate their Standard Service Agreement (SSA) if they are RIPE NCC
    members."
    https://www.ripe.net/membership/member-support/the-ripe-ncc-and-ukraine-russia/

At least the RIPE NCC was transparent in the process and seemingly did only
the absolute minimum to comply (freeze, but not deregister IP address blocks).
An approach that might be befitting for the kernel community / LF as well.

Thanks,

Lukas

Re: [PATCH] MAINTAINERS: Remove some entries due to various compliance requirements.

[James Bottomley]

> On Fri, 18 Oct 2024, Greg Kroah-Hartman wrote:
> > Remove some entries due to various compliance requirements. They
> > can come back in the future if sufficient documentation is
> > provided.
> 
> This is very vague...

We finally got clearance to publish the actual advice:

   If your company is on the U.S. OFAC SDN lists, subject to an OFAC
   sanctions program, or owned/controlled by a company on the list, our
   ability to collaborate with you will be subject to restrictions, and
   you cannot be in the MAINTAINERS file.

> What are "various compliance requirements"?
> What does "sufficient documentation" mean?

The documentation Greg is looking for (which a group of Lawyers at the
LF will verify) is that someone in the removed list doesn't actually
work for an OFAC SDN sanctioned entity.

> I can guess, but I think it's better to spell out the rules, as Linux
> kernel development is done "in the open". I am also afraid this is
> opening the door for further (ab)use...

I agree we should have been more transparent about this but I think it
would be hard for someone other than Greg to get a Maintainer removed
on the "compliance issue" grounds so it's probably not that open to
abuse.

Regards,

James

Re: [PATCH] MAINTAINERS: Remove some entries due to various compliance requirements.

[NotYourFox]

Thanks for clarification.
It could be a "good enough" explanation to settle things down. If not 
for Linus' reply.

One message made him lose most of the respect he earned in Russia for 
good things. More importantly, our trust in Linux and FOSS in general.
Very, very disappointing, even more to me as I don't see any better 
alternatives.

Linus is a developer, a hacker, and one of the names everyone thinks 
about when it comes to FOSS. Not one of those arrogant politicians. He 
should have never changed.

Signed,
forever a Linux user.

Re: [PATCH] MAINTAINERS: Remove some entries due to various compliance requirements

[Joe Putin]

This is certainly a positive development, since for the first time, we 
realize that the code we write could be used in missiles/weapons that
bomb people like you and me. Our families, and our children.

But it's important to discern "the people" and "the army". Since, people
all around the world are just like you and me who are trying to survive
this world.

The best way out here is that we ask these rouge militaries to publicly
release the code they use to massacre civilians. So, we can put them to
shame for the algorithms they use to decide who gets to live and who
not.

Linux is GPL license which requires derived works to be publicly
released. Hence, not complying would put them in a morally and legally
wrong position.

For the militaries that are conducting brutal Genocides, bombing
hospitals, schools, refugee camps, homes. We must speak for the
innocent civilians.

But we should not side with those, whose objective is ambitious pursuit of
wealth and power, At cost of the commons.

Linux kernel is the epitome of what collective human effort can achieve.
The internet has enabled us to communicate, otherwise we would all be
brainwashed by our respective government's propaganda. Let's make use of 
this for good.

This world is already a terrible place, let's not make it worse.  We
"the people" stand together.

Re: [PATCH] MAINTAINERS: Remove some entries due to various compliance requirements.

[Vladimir Smirnov]

A short disclaimer: opinions expressed are solely my own and not those
of my employer (hence I'm writing that from my personal email)

Misha, I know that after our last interaction you probably won't reply,
but I think it is useful for others to do a small fact-checking of your
reply here.

> There's another one: some lame duck's Executive Order 14071.

When you reference some EO - please quote it and give a link.

As if you go and read the document, you'll see that the invesments are
prohibited (and Maintainership is not an investment), approvals of
transactions (and again, not applicable) and that Secretary of the Treasure
have right to ban certain actions, like sales or reexportation. Again -
nothing directly applicable here.

> http://youtu.be/L5Ec5jrpLVk

I guess, that is the source of the "EO 14071" you've referenced, right?

Anyway, I actually would rephrase what I wrote in a different place exactly in
reply to someone bringing that video today:

There are several problems with that video:
1) Misleading title - you can clearly see that not all russian programmers were
banned by briefly checking MAINTAINERS file in its current state.
2) Maybe I don't know something, but Greg and Linus or CoC or Maintainers
handbook never mentions that removing from maintainers = ban. So that was
a mistake in the video.
3) About EO 14071 - I've quickly hinted to you that it is not what the video
says. To prove the point author then picks up an FAQ from OFAC about expanding
sanctions, which is completely different document and then underquote what it
says... If you scroll just a tiny bit further, you would see that FAQ
explicitly exclude opensource. If you don't belive me check for yourself:
https://ofac.treasury.gov/faqs/1185
Or if you don't trust FAQ, look at the original text: 31 CFR Part 587
And no, those are not sanctions that was known and just delayed until 2024,
but that is a minor problem in the video.
4) Video overall over exaggerate what happend. E.x. "Maintainer of CPU
Architecture" - you can easly get few messages back in the thread and
fact-check who was that and confirm that author is not entierly correct.
5) Even by the time video was published, it was easy to verify that the
whole thing related to OFAC SDN lists - it was a public knowledge that
affected people worked for companies on that list and even the wording itself
gives away what exactly that is (Greg's mention of documentation actually
only can mean it is related to relatively easily fixable problem) and later
Linus made it even clearer by saying something in line with "talk to your
company's lawayer" - which also confirms that.


So I would strongly suggest you to actually do a fact-checking of information
you consume and then spread, because if your opinion is based on false
statements, you probably will have disorted perspective on the matter.

> instead of diggin' their own grave as ordered
> by the most real nazis on this planet.

And that is a good example of what I've meant above. You should fact-check
before you call someone a nazi or even hint that, especially if in other cases
you've quoted low quality information (like the video above).

As there is almost 100% chance that if you'd did that - you won't be saying
what you were saying here or on the other thread within this discussion.

Re: [PATCH] MAINTAINERS: Remove some entries due to various compliance requirements.

[Angry Dev]

>> On Fri, 18 Oct 2024, Greg Kroah-Hartman wrote:
>>> Remove some entries due to various compliance requirements. They
>>> can come back in the future if sufficient documentation is
>>> provided.
>> This is very vague...
> We finally got clearance to publish the actual advice:
>
>     If your company is on the U.S. OFAC SDN lists, subject to an OFAC
>     sanctions program, or owned/controlled by a company on the list, our
>     ability to collaborate with you will be subject to restrictions, and
>     you cannot be in the MAINTAINERS file.
>
>> What are "various compliance requirements"?
>> What does "sufficient documentation" mean?
> The documentation Greg is looking for (which a group of Lawyers at the
> LF will verify) is that someone in the removed list doesn't actually
> work for an OFAC SDN sanctioned entity.
I'm pretty sure those sanction lists existed before LF did this move and
they never played a role up until now. It's necessary, I guess, to remember
that those lists are made by political entities for political reasons. If
it would be all so very clear, I really wonder why it is still possible to
work together for Russians and people/companies from the US on the ISS. I
don't really know, but I strongly guess there are companies invoked which
also work for the military on both sides. As most of you know there are
general elections in the US in a couple of days and it's not completely
unlikely that a very erratic and fickle person will be the next president.
It's also not very unlikely in that case, that those sanction lists get
extended because of "I don't like them: Put Em on the list.". So you are
giving a part of your power to US politicians, something nobody who
submitted code to the linux kernel ever agreed to. You are changing the
rules as you go. It's also important to remember that the linux kernel is
not a (commercial) product of the linux foundation or owned by them. It is
(currently) maintained by people who work for the (US based) linux
foundation and it is actually a problem for/of them and it looks a lot like
they (ab)used their technical power to get rid of it. (which can be seen on
the way it was done - which disrespects all rules of submitting a patch).
And as the cherry on top, everybody who disagrees is called a "Russian
Troll" by the project leader. I'm not - believe it or not: idgas. You
really should check your tone, especially if you run out of arguments. Or
is it you just hiding behind lawyers and want to emphasize your political
stand? I would agree in this particular case but neither your nor my
political stand can speak for a global project like linux. In any case: I'm
done with this project and hope somebody in free country will fork.

>> I can guess, but I think it's better to spell out the rules, as Linux
>> kernel development is done "in the open". I am also afraid this is
>> opening the door for further (ab)use...
> I agree we should have been more transparent about this but I think it
> would be hard for someone other than Greg to get a Maintainer removed
> on the "compliance issue" grounds so it's probably not that open to
> abuse.
>
> Regards,
>
> James
>
>
>

Re: [PATCH] MAINTAINERS: Remove some entries due to various compliance requirements.

[John Mcenroy]

Hello Linux Community


Alfred Tennyson
Freedom

Of old sat Freedom on the heights,
    The thunders breaking at her feet;
Above her shook the starry lights;
    She heard the torrent meet.

There in her place she did rejoice,
    Self-gather’d in her prophet-mind,
But fragments of her mighty voice
    Came rolling on the wind.

Then stepped she down thro’ town and field
    To mingle with the human race,
And part by part to men reveal’d
    The fullness of her face –

Grave mother of majestic works,
    From her isle-altar gazing down,
Who, Godlike, grasps the triple forks,
    And, king-like, wears the crown,

Her open eyes desire the truth.
    The wisdom of a thousand years
Is in them. May perpetual youth
    Keep dry their light from tears;

That her fair form may stand and shine,
    Make bright our days and light our dreams,
Turning to scorn with lips divine
    To falsehood of extremes.


Альфред Теннисон
Свобода

Свобода древле обитала
На высях гор; в сияньи звезд
Над нею небо трепетало,
Под ней дробился гром окрест.

Огнем пророческого духа
Там дивный лик её блистал;
Но мощный глас её до слуха
Порою к людям долетал.

Затем низшед к полям и градам,
Смешалась с смертною толпой
И понемногу нашим взглядам
Разоблачила образ свой.

Так, в мир явившись миролюбцем,
Меж нас воздвигла свой алтарь,
Вооружась, как бог трезубцем,
Блестя короною, как царь.

Её отверзтый взор стремится
Лишь к правде, к мудрости отцов.
О, пусть же вечно он не тмится
Слезой над тупостью слепцов!

О, пусть, воссев на трон не зыбкий,
Нам светит правдой сквозь туман
И уст божественной улыбкой
Рассеет крайностей обман!


Linux user
John Mcenroy
---
johnmcenroystudios@gmail.com

Re: [PATCH] MAINTAINERS: Remove some entries due to various compliance requirements.

[Alexander Pevzner]

Hi everybody,

My name is Alexander Pevzner, and I live in Russia, Moscow.

I'm probably one of these "Russian trolls", mentioned by Linus in his 
message a couple of days ago.

Regardless of that, I use Linux as my primary OS since 1.2.13 kernel (so 
about 30 years for now) and I've contributed few lines of code (or, most 
likely, few thousand of lines of code) to make driverless printing and 
scanning work on Linux, so if you use one of those modern multifuction 
printers, this is very likely that among other stuff you use one of 
couple of my projects already on our personal computer.

As for me, the free software movement is the important thing. Really 
important. It makes people to cooperate. Not only individuals, but 
people from competing corporations. The free software movement sometimes 
"glues" people stronger, that money interest, which often works to 
separate people.

The whole history of the humanity can be seen as a history of ugly wars 
(the war is always ugly regardless of its reasons, because it always 
kills the human in a person).

 From another side, the whole history of the humanity can be seem as a 
history of cooperation. It was cooperation that allowed us to get out of 
the caves into outer space, to create computers and to write operating 
systems and other software for them.

Any war will some day end and any government will some day become part 
of the history, but the story of human cooperation has a chance to 
outlive the history.

In that sense, free software works in direction just opposite to the 
war. It lets people to cooperate, to see humans in another person's eyes 
(and code). Even when we are separated by the war.

And it puts a lot of responsibility to the free software leaders, 
because they not only manage lines of code, but somehow define edges of 
the future of the entire humanity. At least, in some aspects.

As a professional, I'm trying to cleanly separate software development 
from any kind of politics (probably, the same we all expect from the 
medical doctors). When I receive PR for review or a bug report, I look 
only to proposed code changes or bug description, regardless on who send 
me it.

The Linux Foundation is the community of software professionals. I 
understand that this is US organization and it is sometimes obliged by 
the US laws and regulation.

What would I expect from the professional organization in a case like 
this. The following:
1. The clear public note, that according to some US regulation the 
people from the sanctioned organizations cannot longer act as kernel 
maintainers
2. The personal communication with each of them, with explanation what 
is going on and verification that these persons are under sanctions
3. The clear public note, now with the list of affected persons, 
explaining that they will be removed from the maintainers list and with 
the great thanks for the work that they have done before.
4. Inclusion of these peoples into the kernel's hall of fame (the 
CREDITS list)

Nothing of this has be done, unfortunately. This is very, very pity :(

--
With the best regards, Alexander Pevzner (pzz@apevzner.com)

Re: [PATCH] MAINTAINERS: Remove some entries due to various compliance requirements.

[metux]

On 24.10.24 17:39, James Bottomley wrote:

> The documentation Greg is looking for (which a group of Lawyers at the
> LF will verify) is that someone in the removed list doesn't actually
> work for an OFAC SDN sanctioned entity.

Aha, guilty until proven otherwise ?

Is that how things are handled in the "land of the free" ?


--mtx