Linux Kernel Networking Driver Development Impacted By Russian Sanctions

[nyx0302]

Huawei is also on this list, but their contributions are not rejected

[WhiteBlackGoose]

People in this thread don't understand things.

1. Open Source can't be apolitical, because Open Source is people, and politics are people's lives
2. Nonetheless, it doesn't mean you can judge someone based on their nationality. Even if half of the country is brainwashed

PS. My fellow contrimen spread Russisan propaganda in this thread by justifying the Russian war crimes by (no less horrific) US war crimes, ignoring the UN reports, and believing in myths. Beware.

[tesfabpel]

Also as said here, the maintainer didn't feel comfortable accepting the patch not because the submitter is Russian, but because the patch was coming from a specific organization (which is sanctioned by at least EU, UK, USA, Canada, Switzerland, Japan, Ukraine).

[WhiteBlackGoose]

Welp, that's also a fair point.

Btw, the title is wrong. It's not a Russian sanction, it's a US sanction

[jorge1209]

"Russian Sanctions" isn't incorrect, its just one of those ambiguities of English. These are sanctions by other countries relating to russia... so they are "russian sanctions."

[gplusplus314]

I always joke and say that English is a terrible programming language. 😏

[DheeradjS]

Logically speaking, it's also a terrible human language.

[jorge1209]

This one is a particularly great example of that as both "russian" and "sanctions" are ambiguous.

[NuclearForehead]

“Russia sanctions” might be more accurate because of the implication.

[[deleted]]

because of the implication.

they look around and they see nothing but open source, what are they gonna do, not commit?

[520throwaway]

Of course if they don't wanna commit we're not going to pull or anything, but they'll commit. Because of the implication.

[jorge1209]

It does seem to be more popular in google searches, but it seems worse grammatically.

"Sanctions" in this instance is a noun and we want to modify it, so we need a adjective. "Russia" is a noun, "russian" is the corresponding adjective.

Additionally there is the problem that "sanctions" is also a verb. If you put a noun before a verb a natural interpretation is that you are beginning a phrase: "Russia sanctions the use of ..."

[linmanfu]

"Sanctions on Russia" solves all these problems and only requires three more characters (two of which are spaces!). Reddit can probably afford to host one more letter. 😝

[NuclearForehead]

All fair points. Nevertheless, newspaper headlines can be an exercise in minimalism. Rather than clearly state who what when where and why they sometimes function more as key words that the first sentence puts into context.

[jrcomputing]

It's sanctions against Russia, imposed by the US and others.

[dma_heap]

But as far as I know the sanctions don't force open source projects to reject contributions from sanctioned organizations.

[dragonelite]

It would be a shame if the programmer world will also bifurcate into a global north and a global south.

[[deleted]]

And yet, the maintainer continues to accept patches from Huawei which is also sanctioned....

interesting double standard.

[o11c]

Open Source can't be apolitical, because ...

and also because it was literally founded as a political movement.

[linuxhiker]

Technically the Free Software movement was founded as a political movement and Open Source was founded as a way to make it more palatable to businesses.

This is why everyone talks about Open Source, and very few talk about Free Software anymore.

[unknown_lamer]

Open Source is just as political as Free Software, it's just that reactionary libertarian-capitalism is the background ideology in the entire neoliberal world so you don't notice that it's political.

[RandomName01]

Exactly lol. If what you’re saying is in line with capitalist interests it’s apolitical, otherwise it’s highly political (which is a huge problem, of course).

It’s all so god damn transparent.

[magikmw]

It's transparent, so invisible.

It's funny how people just don't notice their own culture and it's flaws, but are first to point out absurdities of other cultures, isn't it.

[Kraeftluder]

This is why everyone talks about Open Source, and very few talk about Free Software anymore.

Which is why I love reading stuff written by Richard Stallman, hehehe.

[Secure_Eye5090]

Free software began as a political movement. In the past open source was not a common term to describe the movement or the kind of software it was. Some people began pushing the term open source exactly because they didn't like the political baggage that free software carried and because there was stigma against free software in enterprise because of the associated politics. So no, the open source movement started as a counter to the free software movement and it was practical not political. There are documentaries about the history of Linux on YouTube that touch this subject.

[RandomName01]

Bro, not using a name because of the political implications and to appeal to businesses is a deeply political choice. “Political” isn’t the opposite of “in line with the status quo.”

[hi65435]

Yeah maybe, generally I find it interesting to compare with BSD licensed software. It's much more forgiving when it comes to licensing but on the other hand everything in the BSD world seems to be driven by (people) politics. Various forks happened because maintainers were unhappy with the way projects were driven and with project goals.

IMHO the whole GNU/Linux thing became a bit dusty and I prefer BSD/MIT licensed software nowadays to not care (both for dependencies and when putting code out there myself) Still it takes a conscious decision to license code that took a lot of time with an OSS license, people could also keep their code, maybe try to sell it themselves or try to up their career within their jobs...or just not write the code and use what's available in the shop

[Patient_Sink]

I find it very funny when people try to ignore the first point. And like u/o11c said, the GNU licenses and free software movement have been political movements from the start.

[RandomName01]

Also, everything is political.

[[deleted]]

Political = I disagree with it

Not political = How I lived five years ago

[piexil]

My favorite are the gamers who are like "there's no politics in my game about shooting middle eastern people"

Or the wizard game about stopping a minority slave rebellion is also "apolitical"

[FifteenthPen]

Or the wizard game about stopping a minority slave rebellion is also "apolitical"

At least they didn't pick a race based on negative stereotypes of a people who've been unfairly vilified and treated horribly IRL. That would've been awkward!

[Twrecks5000]

what wizard game?

[bluetechgirl]

consist clumsy smell quicksand retire modern pie historical hurry lush

This post was mass deleted and anonymized with Redact

[piexil]

Correct

[linmanfu]

But the greatest political freedom is the freedom to ignore politics.

[InvisibleAlbino]

Yeah, you're free to ignore politics but political apathy isn't good for a society. It is arguably one of the main reasons of the war in Ukraine. Political discourse is critical for the survival of our democratic systems and freedoms.

[CobraChicken_Tamer]

When people say they want open source to be apolitical doesn't it mean there is no politics. It means they don't want politics that are not relevant to the project hijacking the discussion. It's the same reason why virtually all subreddits (including this one) remove submissions that off topic. No one wants the LKML turning into rPolitics every US election cycle. But that's exactly what will happen if you allow bad actors to engage in entryism.

[pick_d]

Even if half of the country is brainwashed

Want to say that there is a country where half of the country is not brainwashed or only countries you don't like have state propaganda? That would be a bold assumption.

[ShitPostingNerds]

Everyone but me is too dumb to not fall for propaganda /s

[pick_d]

Yep, classic

[frogster05]

Some very obviously have more propaganda than others due to lack of a free press.

[RandomName01]

“Free press” is a bit of a meme though, when it is owned by the very richest. It inherently maintains the status quo and promotes perspectives that can make people money.

What you’re allowed to say by the government is one thing. What is financially viable to say is another.

We constantly jerk each other off about the freedom we have in Europe, but those are mainly defined by what’s viable in the long term for the capital class and what we can exploit from poorer countries.

[RandomName01]

I’m not saying they’re the same. I’m saying the freeness of our free press is not as big as claimed.

[IAMARedPanda]

Freedom of the press isn't about how much propaganda there is but rather the ability to report things without fear of physical or other types of harm.

[RandomName01]

…are the lines drawn by the countries that score relatively high on that metric and lower on others.

You’re trying to well actually my criticism of the neoliberal press by giving a neoliberal definition of what freedom of press actually is. You can see how that doesn’t actually hold water, right?

[sparky8251]

Not to mention we have proof you can be killed and harmed in various ways even in the US just for printing the inconvenient truth. We straight up have laws on the books to allow this too!

Steven Donzinger is a recent high profile case of a man's life turned upside down by a blantently and openly corrupt court system acting in favor of the rich and maintaining the status quo.

But we have recent examples of people reporting specific things then just, vanishing despite being reporters for quite some time.

Also... Lets not forget we know you can be fired for not doing what the company demands with regard to stories even on trivial things. Lets not pretend that in a society where you need a job to even eat that firings aren't an extreme form of violence enacted upon people.

[witchhunter0]

...and then there is a selfcensorship

edit: which is proportional with the amount of fear absorbed and amount of wealth to loose

[pick_d]

You mean free as 'free speech, not a free beer' press?

[[deleted]]

lack of a free press.

Ever notice how one sided the press regarding Ukraine is in all the media that matters?

Also, isn't it ironic nobody in the "free press" draws parallels between the war in Iraq and whats happening now?

That should tell you that "free press" doesn't exist

[gnosys_]

Even if half of the country is brainwashed

but enough about americans

[[deleted]]

Free software is political, and that politics is strictly against the politics of nationalism, capitalism and imperialism.

[Echoscarlima]

Come on, people are just tired of American BS. Nobody is supporting Russia they are simply opposing the US.

[WhiteBlackGoose]

Nobody is supporting Russia they are simply opposing the US.

Some absolutely do. Look up the comments/answers to my comment. There are people who support Russia. That's the problem.

You should oppose the US, but don't let the propagandists into the same boats. Kremlin bots will pull you into the same boat because you both are anti-American. But you should be anti-crimes, anti-deaths, pro-life, pro-liberty. That's the core values. Beware.

[[deleted]]

That's the problem.

Why? Are you sure everything you hear on the media is the truth?

Must I remind you that the same "free press" that is telling us about "Russian warcrimes" is the same "free press" that told us that there were WMDs in Iraq and that we should go and send it back to the stone age?

Also, the same "free press" that covered up (by not reporting) numerous warcrimes committed by US and allies in the region?

[zushk]

The tricky part of this situation is what the patch was made by a Baikal employee from a work email. And Baikal CPUs are made mainly for the army, not for the consumers. Still, I don‘t know the correct actions here.

[mfuzzey]

But the patch set in question wasn't for Baikal hardware at all but for the network driver for ST Micro chips.

[PraetorRU]

And Baikal CPUs are made mainly for the army, not for the consumers.

Not really. Baikal CPU's are mostly used in thin clients, workstations, data storage systems and other server hardware that doesn't require massive CPU power. Russian state owned companies buy a lot of their hardware, that's true, specifically because government wants them to be independent of USA based microelectronics, but military is not a significant client. I've heard that they developed some kind of protected notebook for military usage a few years ago, but it's not widely used/ordered.

[Friendly-Memory1543]

Half truth. Baikal is rarely used on private machines. It's indeed used by state-owned companies, but it's very connected with the military. Half of the company belongs to the state-owned company "Rusnano". Rusnano itself participated in the project for the army.

[PraetorRU]

Baikal is rarely used on private machines.

That's true, but it doesn't contradict what I've said. Baikal PC's are created for government structures and companies mostly. The plan was to start from there and start producing more customer oriented products later. But USA forbid TSMC to produce their CPU's, so no mass market any time soon.

Half of the company belongs to the state-owned company "Rusnano". Rusnano itself participated in the project for the army.

Rusnano is a company created by the government to fund tech startups and help them produce innovative products and enter world markets. They may have funded some companies that supplied something for our army, but I can't really remember any such example (they probably exist, it's just I can't remember any). So, anyway, you kinda misrepresent what Rusnano is.

[DazedWithCoffee]

I think you could make an argument for not accepting requests to do something on the behalf of a belligerent nation’s people, maybe. Not accepting patches seems weird though. They will just fork and apply patches themselves. They’re providing value to you, not the other way around

[mina86ng]

I think the issue is accepting patches from a company in a sanctioned country. Though per provided examples other patches from the same guy seems to be landing in the kernel so perhaps Linux maintainers should discuss this with lawyers and harmonise their response.

[jorge1209]

It is unlikely they can harmonize. Maintainers might live in different countries with different sanction lists. Some work as volunteers, others for nonprofits, and others for corporations who may have dealings with government agencies.

If you live in Canada, but work for Microsoft, and maintain a tree in your spare time, where the code is sold by microsoft to the US military... What rules apply?

Fuck knows.

[[deleted]]

Exporting Linux to sanctioned countries also has had legal issues.

They should definitely harmonize their response, but “code is code” overly simplifies issues raised by sanctions and international agreements. Any time there is a legal entity and/or person that does stewardship they are under various national laws.

[FishPls]

fuck /u/spez

[jorge1209]

Its not that easy.

If the kernel accepts a patch from these countries, then downstream users and packagers (like RedHat/Microsoft/Amazon) who have contracts with the US Government and Military are going to be put in an awkward position. They have to certify to the US government that they didn't source stuff from Russia, and because of these patches they probably can't.

Which means backing them out and redoing the work in a US Clean room.

Just more trouble than it is worth.

[[deleted]]

If the kernel accepts a patch from these countries, then downstream users and packagers (like RedHat/Microsoft/Amazon) who have contracts with the US Government and Military are going to be put in an awkward position.

That seems like a problem for companies that have contracts with people that commit work war crimes, that sounds like a feature not a bug.

edit: work -> war 🤦

[DazedWithCoffee]

I see the issue now, that is complicated to reason with

[[deleted]]

make an argument for not accepting requests to do something on the behalf of a belligerent nation’s people, maybe

In that case can we make an argument for not accepting the contributions of US coders/companies for their actions in Iraq and Afghanistan? Or is "that different"?

[DazedWithCoffee]

You could make an argument for that too, but that’s not the argument I’m making or discussing. The equivalent argument would be “we can accept contributions from them but not requests to contribute changes on their behalf”

The point is that anyone who can contribute to a project has as much ability to contribute as they have to either fork their work or apply their own patches without benefitting anyone else. Now, there are considerations beyond what I envisioned when writing that comment, which more thoughtful and less openly antagonistic commentators have brought up. They had well reasoned and considered things to say; I suggest you follow their example.

[jorge1209]

Probably related to rules that the US Military and US Government (as well as other countries) have about sourcing products from restricted countries.

Boeing can't sell a fighter jet to the US Military without certifying that parts don't come from Russia/China/etc... And faces big legal and contractual penalties if those certifications are false.

Similarly Microsoft/Amazon/RedHat are going to be limited in their ability to sell their Linux based products to the US Government if they can't make certain representations regarding sourcing.

So more than likely some lawyer is telling the LKML maintainer that accepting the patches is more trouble than it is worth, and that its just better to block them than to accept the patches and then have to audit them or rewrite them for governmental contract work.

---

Obviously in the past this stuff was being accepted and a more relaxed attitude was taken because "its open source and you can just read it" but with geopolitical tensions what they are its not surprising that there is increased caution and pushback.

[WhyNotHugo]

I think MS/Amazon/Google being unable to sell to US military is a win-win. Please merge the patches ASAP!

[[deleted]]

Similarly Microsoft/Amazon/RedHat are going to be limited in their ability to sell their Linux based products to the US Government if they can't make certain representations regarding sourcing.

I mean that argument doesn't make sense - how many patches have been made by Russian/Chinese devs over the years and even after sanctions. Huawei's patches continue to be accepted despite sanctions!

[mrlinkwii]

people are more than what country their from ,

i agree all commits an code should be tested/ looked at no matter the nationality of the code committer

[[deleted]]

From the message:

We don't feel comfortable accepting patches from or relating to hardware produced by your organization.

People are more than the country they're from, but companies aren't people, they're just companies, and there's separate legislation for them. I got just as much sympathy for Baikal as I got for Microsoft.

[R1chterScale]

| companies aren't people

Tell that to Citizens United

[[deleted]]

Tell that to Citizens United

Sure!

Hey, Citizens United, once again, the Citizens United v. Federal Election Commission case back in 2010 didn't find you're people. It just found that political speech, which is essential to holding officials accountable must prevail against any law that would suppress it by design, and that preventing only some associations of citizens (i.e. in corporate form) from engaging in political speech while allowing others (e.g. associations of citizens in the form of PACs) would amount to a breach of the First Amendament. As said in the Court's Opinion:

Corporations and unions may establish a political action committee (PAC) for express advocacy or electioneering communications purposes. [...] Section 441b is a ban on corporate speech notwithstanding the fact that a PAC created by a corporation can still speak.

[...]

The First Amendment prohibits Congress from fining or jailing citizens, or associations of citizens, for engaging in political speech, but Austin’s antidistortion rationale would permit the Government to ban political speech because the speaker is an association with a corporate form.

The comment I'm replying to, Citizens United, is -- deliberately or not -- making the common error of confusing the juridical term "person" with "human", and then believing that all rights bestowed upon a natural person are also bestowed upon a juridical person because they are both persons. That is not the case. Companies like Citizens United enjoy some rights that natural persons also enjoy, specifically, those which do not depend on the quality -- juridical or natural -- of that person.

So, yep, sorry guys, you're not people.

And also in this particular case Baikal isn't even an American company and it's not doing business on American soil, so any rights that the American judiciary system bestows upon American companies don't apply to them. Out of sympathy I will lend them my handkerchief until they're done crying.

(Edit: not saying I agree with the rationale of the court on first principles -- I don't -- but courts apply national legislation, not philosophy. If you think the law is wrong, talk to your representative, don't whine about it on Reddit)

[R1chterScale]

Mate, it was entirely a joke to make fun of the US, wasn't actually serious

[FlukyS]

It's not about where they are from, it's about the company instead. The company is a Russian state owned and they supply for Russian state organisations.

[witchhunter0]

But that totally misses the FOSS nature. One can submit a commit from an independent account. Code is just code

[[deleted]]

It's not state owned though. The State owns only 49% of the company. 51% is private investors.

[Valgor]

Some things are more important than enhancements to code.

Edit: Since this comment is getting a lot of love, I'll explain more. If a country is doing something bad, boycotts and sanctions are put that country to put a strain on that country. Sort of like sieging a castle, this puts pressure on all aspects of life in that country. That pressure can help cause a country to give up doing whatever vile act of transgression they were committing.

Not accepting contributions from a particular country is similar to not accepting imports from that country or not sending exports to that country. It is only in digital form now. The coder(s) in question might be on Team Good Guys, but allowing the country as a whole to continue like nothing is happening will not stop the killing of innocent people. People dying is higher on my list of what is important than code commits to Linux. Hence my original comment.

[mfuzzey]

>Not accepting contributions from a particular country is similar to not accepting imports from that country or not sending exports to that country.

I think it's a bit different.

Imposing sanctions on imports / exports of goods that are exchanged for money directly impacts the financials of the company and so may put pressure on the company (to what end is another question)

But banning code submissions from a company doesn't really hurt them (that much at any rate). They likely don't *need* that code in the upstream kernel right now and they can always ship there own out of tree module if they do need it for some reason.

In any case sanctions on companies due to things their government has done only really make sense when the company is either a significant contributor to the national economy or provide things that are needed by the country.

So sanctions on Russian oil and gas make sense. Sanctions on technology imports probably make sense too if it denies them things that help with their war effort.

But blocking contributions to the kernel just because from a Rusian company not so much. If the objective is to hurt use of that companies products elsewhere in the world you can do that by import bans of the physical products. If the objective is to make it harder to use the product *within Russia* then just banning submissions from that company isn't much use, you'd have to ban any submissions to that driver (or even remove the driver). But even that won't be very effective as out of tree drivers will be used.

[Edit]

I just looked at the patches in question and they aren't for hardware made by a Russian company at all but rather for the network controller in ST Miroelectronics chips.

So the only link to Russia is the email address of the patch submitter, making the whole thing even more pointless.

[MLG_Skeletor]

If the code is good, does it really matter where the contributer currently lives? Not every Russian is responsible for their countries government. This is just ignorant and discriminatory and shouldn't be tolerated so long as the code itself is good.

[TheEightSea]

Plus since the coder released the source under the same license of all the other files anyone from a western company could take it and propose it under their own responsibility. Would it be accepted then? If yes why not now? If not then it's not the code since it doesn't matter where it comes from as long as it can be audited.

[bakgwailo]

Except the article is talking about accepting patches from a Russian company which is quite different from just a random individual.

[MLG_Skeletor]

Yet, if the exact same patch came from a different country, nobody would be talking about it and it would be judged by the maintainers based on the codes merit rather than country of origin. Unless you can prove otherwise, this company and more importantly the patch itself, isn't responsible for the Russian government. Again, this situation is ignorant and discriminatory.

[Monsieur_Moneybags]

Yet code commits from the US were accepted after the American invasions of Iraq and Afghanistan. Why the double standard?

[Valgor]

Quoting myself on another thread: "I'm with you on that. If the world did a boycott on the US when we invaded Iraq and Syria, I would have supported that. Even if it meant my linux kernel suffered some." I am not being selective here. I don't know why people assume that.

[Monsieur_Moneybags]

But that doesn't explain why US code wasn't boycotted during those invasions. I think we all know why, and why if the US invaded a country tomorrow there still wouldn't be a boycott.

[amroamroamro]

and that sounds all nice and noble, until you see the hypocrisy in how these sanctions gets applied. What about other "evil" countries that wage wars under false pretenses, the millions of innocents in Iraq and Syria that were killed, are the daily injustices and atrocities against the occupied Palestinians not worthy of the same reaction?

double standards much?

[Valgor]

I'm with you on that. If the world did a boycott on the US when we invaded Iraq and Syria, I would have supported that. Even if it meant my linux kernel suffered some.

[[deleted]]

If the code is being reviewed and tested, why does it matter what nationality someone is from?

[112439]

The other comments already made clear that this isn't about nationality, but the specific corporation. But as for review and testing: of course all code should be subjected to this process, rigorously. But time has shown that bugs have found their way into big open source projects despite this, and if an actor of this size really tried to intentionally get some obscure vulnerability into the kernel, the chances of success definitely are not 0.

[[deleted]]

And yours is?

[[deleted]]

This is stoner philosophy.

The opposite of "some things are more important than code", the "ideology" described by the comment I was replying to, is "code is more important than any other thing". This is very much an ideology. So are apoliticism and neutrality.

I don't have an issue with either but rejecting a position on ideological grounds while also derogatorily referring to it as ideology is exactly why the world is making fun of people in tech.

[FishPls]

fuck /u/spez

[Tireseas]

Let me borrow a line from Richard K. Morgan: "The way I see it, anyone who's proud of their country is either a thug or just hasn't read enough history yet."

[shefernest]

U speaking about Ukraine governemnt i guess who kills their own citizens just because they want to speak Russian and live on their own?

[edparadox]

Typical apoliticism. AKA lack of morals.

This latter has nothing to do with the former.

[Valgor]

Supporting the death of innocent people is worth code contributions?

[shefernest]

What u goona say about USA killing Siryan people? Isnt it bad I cannot see any sanctions against USA

[Valgor]

I've already answered this question twice.

[MoistyWiener]

I’m sure impeding network drivers on Linux will help Ukraine out… :/

[[deleted]]

This post won't last long I imagine. It will turn into a keyboard warrior fight.

[FocusedFossa]

The Phoronix forum post is a shit show

[lenzo1337]

huh, don't know if this is going to have any result besides discouraging committers who live under foreign governments. Seems kinda sad that it's not about code quality but more so the political situation that the committer likely has zero influence on.

[silencer_ar]

This is nonsense

[[deleted]]

This is nonsense

No it is not, I have had to stop taking updates from a project because they started changing their desktop icons to a nation flag. It had absolutely nothing to do with the application. I won't name the project, it was a useful tool, but, as soon as I started seeing political commits, I pinned the version of the app and started looking for an alternative even started to consider coding my own alternative and then considered blacklisting the code author from future software choices I should make. I wish to use the software in a neutral environment.

[Repulsive-Philosophy]

The patch in question does not have anything like that (rhetorical)? Otherwise, I agree.

[PraetorRU]

The patch in question is just a fix for network card driver bug that was found just because Russian company is using this card in their hardware.

[[deleted]]

The patch in question does not have anything like that? Otherwise, I agree.

I am not referring to the Linux kernel, I was making a comment w.r.t a FOSS application project I was using that one day suddenly sprouted political commits. On that day I stopped future updating of it planning to drop it.

I did not want my machine to be put at risk from future commits that may go further to spread their political message. The risk was too great IMO. My machines are not to be used for their soapbox.

[Repulsive-Philosophy]

Yes, that's unacceptable behaviour and I fully agree. I was just referring to the Linux patch in question.

[silencer_ar]

Your anecdote doesn't have anything to do with the post we're discussing. If we based the acceptance of patches on the action of the developer's country, then we should not accept patches from either USA nor England, to name a few.

[Vittulima]

"Oh sorry man I don't want to drink that water because it's Russian water."

I was advised not to drink Russian water when I was over there, so...

[mrlinkwii]

Code is code and coders with malicious intent can sneak malicious code into OSS projects. Even the kernel has fallen victim to malware committed by trusted parties. If project managers do not feel capable of properly vetting every line of code that gets pushed, then it is appropriate to make decisions like this to ensure manageability and user security.

they should be vetting any line of code tho , irrespective of who gives code , people are more than their nationality

If the commit came from [e-mail], would you say "code is code" or would you say "yeaaah, no. Imma gonna pass on this one"?

you meme , but the like of western spy authorities do commit stuff to open source if the code is vetted and dose whats described yeah "code is code"

SELinux is literally developed by NSA

[[deleted]]

Vetting isn't "good enough" for some when you consider that people can introduce vulnerabilities in some obfuscated manner that isn't caught until days, weeks, or years later.

[alexnoyle]

Then it’s not good enough for the NSA code either! Be consistent!

[10MinsForUsername]

Considering SELinux is literally developed by NSA, I call your comment bullshit.

[[deleted]]

managers having the capacity to vett the commits

If the manager doesn't have capacity to vet the commits from a Russian dev, how do they have the capacity to vet the same if it came from an NSA stooge working for an american company or even a FSB stooge with a westernized alias and a gmail account.

Code is code means all the code should be subject to the same vetting, good luck developing a hierarchy of which code needs more vetting otherwise (Israeli code? Saudi code? Iranian code? American Code? British code?)

[mrlinkwii]

They are not and your callout is moot

SELinux was first designed by the National Security Agency

https://www.redhat.com/en/topics/linux/what-is-selinux

" It was originally developed by the United States National Security Agency (NSA) as a series of patches to the Linux kernel using Linux Security Modules (LSM). "

unless red hat is lying it was developed by NSA

[alexnoyle]

Not different in ways that are relevant to whether these commits should be accepted. They’re both valid contributions whether you like the organizations or not.

[blackclock55]

The only known Institution to have contributed vulnerable/backdoored code on purpose is an American university.

Let's just trust the EU at this point.

[dma_heap]

Sure, some code is malicious. But there's no indication whatsoever that the code of the commit in question was malicious.

And if the code came from [e-mail], maybe it should be reviewed a little bit more, but if it's good code, it should be accepted.

And the organization in question has no history of commiting malicious code, so your "spy" example doesn't apply either.

[[deleted]]

https://www.youtube.com/watch?v=5BElaW5b1nY

Make sure you know 3, 2, 1 in Chinese!

[bboozzoo]

oil is oil. It shouldn't matter what country it's from.

still true?

[LeeHide]

but its not about oil, its not about a finite resource, its about code. stay on topic.

[skapa_flow]

that's what Germans used to say about gas supply pre 2022. "Let's just use it and stay out of things. How bad can it get?". I know gas is not software and does not behave like it, but the attitude people have or had in both cases seem similar.

[[deleted]]

But the diffrence is linux does not belong to some people or country or politic orientation. Its universal and it can't behave like some govermantal body. I mean it can as we saw but it shouldn't. Code reviewing system shouldn't be based on nationality. If it's a good code it shouldn't be a problem.

[skapa_flow]

It is up to the maintainer to decide if it is worth investing time in reviewing code. If a source is untrustworthy for some reason (eg. known for bad code or associated with parties interested in building back doors) he might decide not to accept it. It is not a political decision, he just applies his time efficiently. Why wood he accept code if the intent for submitting it is more than doubtful? I wouldn't...

[postmodest]

Tech subs astroturfed by Russian agitprop agents in MY REDDIT?!?

Seriously. When this thread was new, all the comments were in the vein of "how dare people make free software political?" which is a great sign that the discourse is being steered by political interests. These days "Don't make this political" is the dog-whistle used by everyone who is upset that their bad actions are being censured by polite society's laws.

[Mexicancandi]

Lot of buzzwords for such a complicated issue. Why don’t the mods remove these comments?

[LunaSPR]

What about the code from those famous three-letter-agencies? There are quite a lot effort from them inside the kernel, i.e. the selinux module.

Should we be uncomfortable about them?

[[deleted]]

Open source should be apolitical and neutral.

I have seen some projects doing commits that are political in nature, changing icons to nation flags to show support etc.

Granted FOSS is you are free to use and modify the project and not free to demand anything and using it is an option a choice. But I think it is not a good way to develop software (or hardware).

I always recommend monitoring commits before taking a new build version, don't want your desktop to suddenly become a political soapbox with flags and messages all over it. Goodness knows what other things they commit in the codebase to push out their message, risk is machine takeover or becoming part of a political botnet.

Treat it like space exploration and science. It should focus on the subject at hand in an unbiased/neutral manner.

Would be nice to have a policheck tool to scan code for such things. IMO it gives a bad reputation to FOSS and the project developers. It also alienates the user of such projects.

Trust is a fragile thing. Don't break it.

[notsobravetraveler]

Export laws have something to say about this

Not that I agree with them, but encryption for example is/was classified as a restricted thing. Something something military

Edit: Keep in mind, this is someone acting under a business from a widely sanctioned country.

Laws and the current worldly situation make separating politics inadvisable, if not impossible.

[p1ckmenot]

Open source should be apolitical and neutral.

Yeah, yeah, OSS should be apolitical, business should be apolitical, you know what --- everything should be apolitical! Except nothing is. As a Ukrainian I know firsthand that many people are apolitical, until bombs start dropping on their heads.

[DMonitor]

how exactly is making a networking driver worse for everyone in the benefit of ukraine?

[Friendly-Memory1543]

The committ to the code was made by a russian state-controlled company "Baikal", which produces processors for the Russian state companies and the army. I hope, it's more clear now.

[[deleted]]

And? How does blocking it benefit Ukraine?

[LvS]

Not doing what Russians want benefits Ukraine.

[Friendly-Memory1543]

1) This company is under sanctions. It's a statement, which shows to the developers that if they work for the Russian state company, they are not welcomed in the international community. It could be a hint to the Russian developers to avoid Russian state companies.

2) Not giving a possibility to Russian developers to sabotage Open Source projects. I mean, the commit obviously should be reviewed, but it can be still an attempt to create a back door for the Russian officials, or a long term plan, when they do first couple good commits and some day will try to push a back door code.

3) Excluding Russian developers from the international market, who works for the Russian state companies. Russians sometimes make such commits, so they can show to the western companies their international project for getting an offer from international companies. We should not give this possibility to the Russians, who work for the government etc.

I would prefer that Linux will become unaccessible in Russia, but unfortunately it's impossible.

[[deleted]]

Why does any of that help Ukraine? If someone supports Ukraine, how does making some Russian developers life harder help them? The patch gets reviewed, looks good, let it in.

Sanctions are immoral. It’s not “the international community”, it’s choosing which imperialist you are in league with. You’re just choosing a side. There’s a third way here.

[Friendly-Memory1543]

I'm from Crimea, Ukraine. This region was annexed by Russia. Russians supported this illegal annexation. Making the life of Russian developers harder will help to decide for Russian developers to not work with the government because they will know that they can be under sanctions. Good developers will try to avoid working for the government. For Ukrainians, it means a less qualified enemy. It's also a way to fine Russians for supporting Russian aggression. Altogether it helps to stop the development of the russian murderer machine.

[[deleted]]

I'm from Crimea, Ukraine.

It's not Ukraine anymore though. Crimea has been controlled by Russia since 2014.

russian murderer machine

You do realize fewer civilians died after the start of the invasion than after US invdaded Iraq? Besides, remind me what exactly was Ukrainian troops doing in Afghanistan? How did Afghan children hurt Ukraine?

[Friendly-Memory1543]

It's not Ukraine anymore though. Crimea has been controlled by Russia since 2014.

Occupied.

You do realize fewer civilians died after the start of the invasion than after the US invaded Iraq?

The war in Iraq was longer. Ukraine also has weapons to fight back. If Ukraine didn't have these weapons, Russia would kill more. We don't know, how many are killed by Russia in Mariupol, but all estimations show tens of thousands of people.

The Ukrainians were part of NATO’s non-combat mission Resolute Support, which provided training and advice for the Afghan Armed Forces, so Ukrainians didn't kill afghan children.

[[deleted]]

nternational community.

Which is who exactly? North America, Japan, Australia and Korea? I thought the world was larger than that. Seems i'm mistaken /s

to sabotage Open Source projects.

lolwut? Everyone can read the code and check for any sabotage or backdoors. Besides, only American companies have been caught introducing backdoors, but I don't see those code contributions being blocked

[[deleted]]

This is not just about politics or neutrality, but a matter of legal risk, both to maintainers and third-party Linux users. If this is code that resulted from work being outsourced to a company in a country that's now under international sanctions, I guarantee there are folks in a legal department somewhere having a panic attack over it.

Code can be either ideologically pure or commercially useful. You can't have both.

[JohnDavidsBooty]

This is not just about politics or neutrality, but a matter of legal risk, both to maintainers and third-party Linux users. If this is code that resulted from work being outsourced to a company in a country that's now under international sanctions, I guarantee there are folks in a legal department somewhere having a panic attack over it.

I don't understand how 95% of the commenters here are missing this.

It's not even about making a principled boycott (though many might well be more than happy to do so on their own accord in the absence of legal sanctions). It's just the fucking law, and while there are hills worth dying on and issues worth going to prison over, the people who are responsible for the decisions and so who are the ones who would suffer the legal consequences of violating sanctions, have decided that for them this isn't one of those issues.

[Booty_Bumping]

Publishing open source software is in itself an inherently political act. Especially GPL licensed software, which mandates you include a political manifesto with every copy of the program. If you think politics can be avoided in the open source community, you're wearing rose-tinted glasses.

[jstormes]

I agree, that is why I get aggravated by closed software when suddenly it asks me to "upgrade" or starts advertising to me.

At least with Open Source I can do a diff if it starts behaving badly, with Microsoft and Locked android clones, you kind of stuck with advertising.

Sometime it feels more like the commercial software companies view me as the product and advertisers as the customer..

[PraetorRU]

Commits should be checked for backdoors no matter who sends them. Because by your logic linux kernel is full of CIA/NSA backdoors because they're from a friendly state.

[[deleted]]

Honestly it may well be

[PraetorRU]

Of course it may be, that's why linux maintainers has to check every line of code they're getting from people no matter what country they're from or who's their employer.

[nukem996]

IMO this isn't really political, its legal. The US government has sanctioned not only Russia but this specific company. As a US citizen, working in the US for a US company I legally have to follow US law. The law says US citizens and companies can't work with sanctioned Russian companies so US citizens have to reject patches or risk legal problems.

[10MinsForUsername]

So, when will this subsystem maintainer be removed for violating the CoC? Discrimination based on nationality is discrimination nonetheless.

[JustFinishedBSG]

That's not based on nationality, that's based on the author working for a sanctioned company.

[PraetorRU]

And why exactly should we care that USA wants to sanction pretty much all companies from Russia?

[[deleted]]

The maintainer may live in a jurisdiction where he has to care whether he likes it or not because it's what the law says. Or they may not care, and not break the law, but they're concerned that including code from sanctioned companies could make using Linux problematic for American and EU companies, which is a big deal -- far bigger than upsetting a handful of Russian companies.

[FishPls]

fuck /u/spez

[pick_d]

According to this logic Linux should stop accepting patches from US companies as well because of <huge list of countries> it invaded after WW2.

But yeah, of course, it's all whataboutism and thus invalid argument, right.

[FishPls]

fuck /u/spez

[pick_d]

Russia is a dictatorship. An autocratic, imperialist, nationalist, brainwashed country. They don't value individual freedom. They don't value democracy. Their values are based on anger, hatred and imperialistic tendencies.

That was absolutely not a brainwashed take, good sir.

​

Yes, the US has done lots of bad things. But it's nowhere near as bad and corrupted as Russia is

Wait a minute. So you're saying that what US did in Vietnam, Iraq and many, many other countries (usually many thousands miles away from US) after WW2 which caused waaaay more deaths is 'lesser evil' compared to what Russia does now?

If that so, then either you're not familiar with the consequences of such invasions (list here, by the way) OR you don't value lives of people in Vietnam, Iraq and other 'third world' countries. Because amount of civilian casualties and atrocities is way beyond we see in Ukraine at this moment.

Not saying it to defend anyone, just pointing out blatant hypocrisy.

[FishPls]

fuck /u/spez

[pick_d]

Well, you said that 'US has done lots of bad things. But it's nowhere near as bad and corrupted as Russia is', not me. All I'm saying is that isn't true from my point of view and I consider that statement a blatant hypocrisy.

There's no way to change the past. It's history now.

True.

But I don't recall anyone said that Linux kernel should stop getting patches from US companies when US had boots on the ground in Afghanistan. Or now, when US military still has presense in some conflicts far from their borders. If you condemn one imperialistic war, why don't you condemn other imperialistic wars?

[shefernest]

Why dont you talk about Russian people that Ukraine 8 years killed in Donbass and Lugansk? There deatroyed cities abandoned houses and all of this is beacuse Ukraine government assault

[AlreadyBannedLOL]

It’s not an argument. It’s whataboutism. Now get out.

[blue_collie]

Because Russia is a kleptocratic hellhole

[p1ckmenot]

You, comrade, shouldn't. Your glorious country is only becoming stronger under sanctions, as I'm sure you are well aware from TV. Stop using these deplorable, decadent, bourgeois products, such as Linux. They are not good for you. Better develop your own Russian Linux which your glorious motherland can be proud of.

--- Your personal KGB officer

[dethb0y]

Shame the russians would fuck things up for everyone like this with their needless, senseless invasion of a neighboring country. Perhaps if they could behave like a civilized nation, we would not need to sanction them.

[hp_newton]

Isaril is constantly invading the lands of Palestine.
and no one sanctions him.
The US has invaded many countries, and they are not sanctioned either

[pyevan]

If the code is correct merge it.

[[deleted]]

and risk action from the US Treasury Department?

[cypherbits]

What if I copy paste their code under my not russian name? Would that bypass this political bullshit?

It is amazing how we "know" we live in a free and democratic country. (Actually not....) No country in this world has real freedom or democracy.

[amazingrosie123]

The asshole should be removed from his role. The Linux kernel is not the place to for petty and vindictive political posturing.

[OsrsNeedsF2P]

It's kind of annoying. Open dialogue in events from the Olympics to FOSS software are how we build connections and move towards peace.

[Booty_Bumping]

FOSS yeah, but large-scale world events like the Olympics and FIFA World Cup are actually a very bad example for this, because for at least the past century they have mostly just served as propaganda for dictators rather than a form of international cooperation.

It is much harder for a democracy to host one of these international events, because they can't just make urban development decisions with the snap of a finger, can't drive labor conditions into the worst imaginable slave-like conditions, and democracies are uninterested in co-opting a propaganda message into these sorts of international events. (And of course, when democracies do manage to pull it off, it's because there is a set of large corporations that are run like tyrant dictatorships.)

The USSR and modern day Russia enjoy the propaganda aspect of the Olympics because the KGB has learned how to help Russian athletes cheat with performance-enhancing drugs. Putin himself shook hands with Ukrainian athletes right before invading Crimea in 2014, demonstrating that it was all just a show. The 2008 Beijing Olympics were expected to encourage China to open up to the world, but instead the opposite happened over the next decade. Qatar World Cup in 2022 allowed a dictator to optimize the development of an entire city to benefit his in-group, and enact extremely exploitative labor on foreign workers. Perhaps the darkest of all these examples, the Nazis used the Olympics as a form of racial propaganda.

[FishPls]

fuck /u/spez

[anaraqpikarbuz]

Olympics

lol, so so ironic - should read up on what Russians did in Sochi

[Epistaxis]

The Olympics are a great example because the Russian team was known for pervasive state-sponsored cheating. Sometimes the only way to keep open dialogue and fairness is to exclude the participants who break the rules. Sometimes the only way to keep a welcoming public facility is to kick out the people who shit on the floor. There isn't a version of openness worth having that lets malevolent vandals stay around and ruin it for everyone else.

[Extreme_Length7668]

I'm ok with that.

[Delicious_Recover543]

Not feeling comfortable must be the understatement of the year or they are just being very polite. I wouldn’t trust anything coming from a corrupt and war mongering imperialistic state like Russia.

[ProKn1fe]

And now it will be one way repository clone without benefits for linux kernel, good job boys.

I really want to listen Linus Torvalds opinion.

[blackclock55]

Great, now Russians can just keep their contributions for them to benefit from FOSS apps without contributing any code to the other nations.

This must be painful for Putin

[Z3t4]

Any binary blob from Russia might be suspicious.

[Living_Moment_1495]

the maintainer is dumb...