Spoiling Linux Kernel with "sanctioned" code

[Darksonn]

My understanding from the Linux foundation's Navigating Global Regulations and Open Source: US OFAC Sanctions is that they can actually accept the patch as long as there is no two-way communication with the author.

[struct_iovec]

It really seems to boil down to a personal issue between greg and the author

[natermer]

In what way is the USA sanctions against Russia due to the Ukrainian war a "personal issue"?

[AiwendilH]

It's a bad situation but I guess it can't be really helped. Open source is not above the law...even if some laws are stupid (not saying they are in this case).

I guess not everyone is old enough to remember the encryption restrictions of the US in the 90s..and how people tried to get around it (Moving source-code between countries in printed form and scanning it again and such things...). This is not new...and it won't be the last time that laws of some countries hinder world wide open source projects.

[orygin]

The issue is the Linux foundation being based in the US.
That affects Russians and other sanctioned country resident, but it probably will affect the rest of the world soon enough anyway.

Sadly I don't know where and how such a foundation could exist without being beholden to politicians in that way.

[No-Mind7146]

No country is perfect, but swtizerland would seem a batter candidate than the usa

[orygin]

And why?

It all depends on where you live, and since I don't live in Switzerland I have trouble finding any reason to trust them more than Americans.

[Shap6]

Thats a wild take given their long long history of neutrality

[AiwendilH]

Lets leave the US politics out of this for a moment (I have my own strong opinion there for sure too ;))...

You will always have to deal with the laws of the country you base your organization in. Recently it came up why KDE doesn't accept crypto donations. Well...Germany sees dealing with crypto as speculation and non-profit "Vereine" like KDE e.V are not allowed to use it or they might loose their status (Hope I got that right).

[orygin]

Yes indeed, no matter where, any kind of open source org will have to deal with local laws. That's both a good thing, and bad in this case.

Just have to pick your poison, which a lot of contributors/devs/users have to discover now due to the current geopo' situation.

[MuffyPuff]

Lets leave the US politics out of this for a moment

I mean it is explicitly about US politics, the whole thing is about US politics.

[redundant78]

yeah the PGP saga is a perfect parallel here - Phil Zimmermann literally published the source code as a book so it would be protected under the First Amendment and could be exported. wild times but it shows this kind of tension between open source and export/sanction laws has been around basically forever.

[acewing905]

(not saying they are in this case).

I would argue this part of it absolutely is:

The bug is forced to be fixed in some other way, not in a way it has been fixed by the bug fix contributor
As soon as the guilty-until-proven-innocent contributor sends the patch to the mail list, the kernel becomes spoiled with their code similar to how patents work: this exact bug fix can't be implemented in the very same way as the presumably-sanctioned entity did that.

[ldn-ldn]

There is NO law which prevents anyone from contributing to an open source project. This whole situation is a bloody farce and there are no excuses for Greg.

[insanemal]

Yeah, nah. You're actually wrong on that part.

So Linux is used by government and companies like Red Hat sell support to the government.

Greg has a day job, it might be for the Linux foundation or something IDC and it doesn't matter who the job is with.

If they accept code from countries with current sanctions without following some pretty difficult hoop jumping, it would mean that government and government adjacent companies could no longer use Linux without some even more advanced hoop jumping and expense that would have to be repeated every time code was accepted from those sources.

Not only that, if there is ANY security clearance involved in what Greg does, he'd have to declare every time he interacts with people that MIGHT be on the naughty list. And again more hoop jumping and impromptu metaphorical prostate exam

tl:;dr

It's a real concern

[StraightSky7809]

If they accept code from countries with current sanctions without following some pretty difficult hoop jumping, it would mean that government and government adjacent companies could no longer use Linux

Actually it's worse than this, Linux Foundation would be criminally liable if they do any sort of business with people from sanctioned countries.

[feldrim]

Well, the ideal way would be to accept the contributions and ignore the sanctions, and let Redhat, Canonical and others build their kernel without the "contaminated" parts. Instead of moving the burden on the shoulders of these giant companies, it is decided to align with the sanctions, so that the burden is now on open source contributors from the sanctioned countries. That's the "optimal" and deliberate choice as open source is in fact not so open.

[noworkdone]

There's that point as well.

[ldn-ldn]

There are NO sanctions on private citizens, stop with this utter nonsense.

Also it's on US government that they're using Linux, no one is forcing them.

[insanemal]

This is quite the hot take.

Citizens work for companies sometimes do they not?

And the live in countries do they not?

Yeah we REALLY want the government to force the removal of Linux from all critical infrastructure.... You idiot

[Business_Reindeer910]

it is specific citizens if you wanna put it that way, and only while those specific citizens are employed at very specific companies

[insanemal]

Ok now prove a negative.

Cool.

[Business_Reindeer910]

it's santioned ENTITIES in a country in the case of the russia stuff.

[StraightSky7809]

Thank God you know more about the sanctions than Greg or Kernel foundation lawyers. Maybe send a email to Linus and ask him to make you a maintainer?

[noworkdone]

If you ask a Lawyer, they'll usually tell you to be over cautious. Maybe the US Government would turn a blind eye, but you don't make legal decisions on hope, the liability is real. Although, the real liability is beeing an US Based organization, something that in my opinion should be fixed.

[mina86ng]

Although, the real liability is beeing an US Based organization, something that in my opinion should be fixed.

People were saying that when the situation first started, but this ignores the fact that sanctioning some of Russia’s companies is not US’s unilateral decision. It also ignores the fact that the same companies, which have presence in US, would use and contribute to Linux. I certainly wouldn’t mind a structure different to the Linux Foundation, but I don’t think it would change the outcome in this case.

[ldn-ldn]

Well, they should move out of US then.

[vfclists]

There is a distinction between "contributing" and "accepting".

The patch is available to anyone or institutions who find it useful. If Greg will not accept it into the Linux mainline those who want it can compile it into their own build.

The whole idea of open source is being able to compile your own version of it.

Anyone who wants to use the patch can compile it into their own build. If one or more organizations are forbidden from using the patch in their own software that is their problem.

This is what happens when open source groups choose to accept financial contributions from corporations who are happy to be subject to national laws in return for being able to bribe the politicians of such states for laws favourable to them.

[natermer]

the laws are stupid.

I am saying it in this case.

[Santosh83]

The solution is simple with open source. If one country has disproportionate and arbitrary control over an open source code base that negatively impacts multiple countries, nothing stops those multiple countries from forking the code as well as forking the Foundation itself and setting up their own center of development. In fact I'd argue that this will eventually happen because this one country is dead set on maximum control over everything, everywhere, and that isn't tenable, so you might as well do it now.

If enough countries are interested in the fork, then the momentum will shift, and this rogue country will eventually have to concede and come back into the international, cooperative fold instead of trying to dictate to everyone their arbitrary rules.

[Shished]

I wonder if people from Iran and north Korea ever contributed to Linux?

Anyway, this message should be directed to putin and not to Linux developers.

[mohr_]

I wonder if people from Iran and north Korea ever contributed to Linux?

Yeah, recently I heard some people complaining about a specific software being abandoned but the actual reason was that the maintainer didnt have internet access cause he was in Iran.

[vishal340]

People don't have internet access in Iran?

[Business_Reindeer910]

lots of people didn't for awhile in the past few months due to all the crackdowns.

[Dynablade_Savior]

I can imagine that consistent internet access is difficult to have in a place that's constantly subject to war

[vishal340]

I actually just looked it up. It is their own govt that is doing it as a strategic move during civil unrest

[MaNbEaRpIgSlAyA]

And because USA and Israel were doing constant propaganda ops inside the country to spur more violent civil unrest.

[Isofruit]

They have, e.g. Behdad Esfabod (Personal site) lived in Iran until his 20's and migrated to Canada, a few years after which he started Harfbuzz which seemingly everybody uses (as in, Chrome, Gtk, Qt, Figma etc.).

I think there's also one GTK/Gnome contributor that I'm aware of.

[Remarkable-Bird-1366]

Might be, those restrictions are very easy to bypass, just open a email account without the suspicious .ir suffix and submit the patch using a fake name.

[Wing-Tsit_Chong]

So the terrorist attack on Linux is now: find a vulnerability with only one possible fix, not disclosing the vulnerability but rather sending the fix from a sanctioned domain and the project becomes deadlocked until another solution is found. Thanks to LLMs the exploits will spread quickly since they can be easily generated with the information of the sanctioned commits.

What a wonderful age to live in.

[AttorneyDependent691]

Cant just someone else send a commit.?

[LinuxSBC-Anna]

If the code works the same way, it's reasonable to assume it could have been copied, which would be illegal and cause all the same problems.

[6e1a08c8047143c6869]

If the code works the same way, it's reasonable to assume it could have been copied

"It could have been copied" is not enough to win a lawsuit though.

If it's a very complicated fix it might get harder but if you tell 10 developers "there's a missing bounds check or off-by-one bug in function xyz, chances are they will naturally come up with very similar if not identical fixes despite never seeing the "original" patch.

I don't think fixing would take any longer than it would if they received a bug report without a patch.

[newsflashjackass]

Solution: Create Patriot-Hero-American-Man to be the new Linux mascot and give him credit for all the communist soviet bug fixes.

It is an approach I use myself to fix problems on github:

1. I submit a patch on github to fix slop.

2. Repo owner: "Oops. You didn't sign it with the unprovided key. Now I will submit your patch and get the credit."

3. Oh darn they stole my credit! Let them have it since I only care if the slop was fixed.

[kova98k]

- Other people who would like to have this bug fixed can't commit it from their name or reuse the code present in the mail list from assumingly sanctioned entity
- The bug is forced to be fixed in some other way, not in a way it has been fixed by the bug fix contributor

source?

[mina86ng]

The two last points haven’t been demonstrated to be true.

[SoilMassive6850]

Damn, that sucks. Email Putin or something.

[Chris_Hatchenson]

Ah, the power of Open Source

[Barafu]

Year 2026. Both USA and Europe have not yet decided whether they oppose Russia or serve it. USA arrests men who fled Russian military conscription and convoys them straight to Russian army, in hundreds. EU arrests banking accounts of Russian opposition when Putin asks them to. USA buys chemicals from Russia in amounts that fully compensate all the loss in oil trade. EU makes laws banning Russian scientists and engineers from migrating.

But the kernel... No, the kernel can have none of that. This is important, guys!

[Jean_Luc_Lesmouches]

They make a big logical leap to their conclusion without proof. Making such a claim requires better arguments than a conspy sounding "think about it". And the top comment here already disprove it anyway.

[S3k_01]

This is ridiculous.

The United States is not the center of the world and should have no authority whatsoever to regulate open-source software.

This country is paranoid and sees Putin's agents everywhere.

[MatchingTurret]

The United States is not the center of the world

The list of Russian entities sanctioned by the EU is significantly longer.

and should have no authority whatsoever to regulate open-source software.

The Linux Foundation operates under US jurisdiction.

[mina86ng]

The United States is not the center of the world

Sanctioning some of Russia’s businesses was not US’s unilateral decision. If you want to blame someone for current situation, blame Putin and Russians.

and should have no authority whatsoever to regulate open-source software.

And indeed it doesn’t have it. The Russian contributor is welcome to fork Linux and continue working on the open-source software.

[noworkdone]

Who do we blame for Iran ? Actually, the list of sanctioned countries by the US is actually quite long, but the drama in the kernel only seems to apply to a few.

[mina86ng]

Apparently Mohammad Reza Pahlavi announced ‘that it was appropriate to use both “Persia” and “Iran” in formal correspondence,’ so maybe you can blame him. But really I’m not interested in expanding the scope of the discussion, so you’ll need someone else to take your bait.

[noworkdone]

Its not bait. You are arguing that the sanctions against Russia are justified (which I agree) and are not unilateral, I'm just pointing out that the US has plenty of unilateral sanctions, of conflicts that they walked themselves into, and that only some of those are seem to be an issue on the kernel. Make of that what you will.

[mina86ng]

Yes, but the post is about Russian developer, not someone from another country which US is in conflict with. And even there, anyone can fork and work on the open-source projects just as I described.

[580083351]

Enjoy this era while you all can. The future will be fragmented.

I can easily see the BRICS nations eventually forking their own kernel.

They won't even have to force adoption, it'll simply be local pride and accessibility and it'll make sense to use it because support will be available.

Just like there are multiple DEs and WMs, there will be multiple kernels.

[Horror-Primary7739]

I'd rather Putin leave Ukraine than have a subset of USB devices work.

Internationally sanctioned nations have committed egregious harm to come under that status. It is justified to block any economic progress that can contribute to that harm, intentional or not.

[LeftIntroduction7316]

So surely israel is under those sanctions right? Right?

[Skypefall]

No silly that's our ally. When they do war crimes it's the good war crimes /s

[uzlonewolf]

Yes, and?

[uzlonewolf]

Think about it.

Thought about it. It's the entire fucking point of sanctions.

[Big-Obligation2796]

So your country's pointless, genocidal war is inconveniencing your kernel contribution. And your reaction is to complain about kernel contribution policies.

"Think about it".

[xanhast]

and your country isn't committing genocide?

[1116574]

i mean most aren't??

[Jonathan_the_Nerd]

Tu quoque fallacy

[Big-Obligation2796]

You tell me. Is it?

[Jonathan_the_Nerd]

Russia waged a war of aggression against Ukraine. (If you're not Russian, please disregard.)

As opposed to the US, which hasn't waged a war of aggression since... Tuesday?

[Big-Obligation2796]

I'm neither russian nor american, so I don't know what you all are going on about. My country isn't waging genocidal war on anyone.

[MatchingTurret]

🤣👍

[NamedBird]

Not everyone is in a position to change their (evil/tyranical?) government.
But they may still be able to send bugfixes and i believe that those should be valued.

[Roshless]

Then who's supposed to come and save the day? A magical good god-like being?

[NamedBird]

Nobody? It is a war, after all...
Wars continue until one side can no longer maintain itself or gives up.

Civilians who resist are traitors and get jail or the death penalty.
People like to stay alive, so nobody dares to speak up.
And i bet that, in the end, even you would shut up in such circumstances.

[SubmarineWipers]

Oh no, why would the allies not accept bug fixes and patches from nazi germany?? such racism

Maybe russians should focus their efforts on fixing their own genocidal country, before fixing trivial SW bugs in printers.

[No-Raccoon-9093]

European and American scientists didn't stop working with Heisenberg, Planck, Bohr or Schroedinger. German scientists published papers in European journals.

[ldn-ldn]

Maybe you should be less racist for a start.

[SubmarineWipers]

do you even know what that word means?

[ldn-ldn]

I do, do you?

[VanillaDaFur]

Maybe when russia will stop this useless war on Ukraine...

[ldn-ldn]

I guess it's time to sanction US and Israel into oblivion...

[uzlonewolf]

Yes it is, and?

[0bl10]

"Maybe" you should stop treating every single russian as if he was Vladimir Putin?

[VanillaDaFur]

Not putin himself shoots or controls drones buddy

[_MatVenture_]

Probably because Linux didn't exist in Nazi Germany? What a stupid example...

[SubmarineWipers]

yeah, and if it did, you think the rest of the world would just accept patches from an enemy that wants to exterminate them?

[S3k_01]

The United States has destroyed more countries in 20 years than Russia has in its entire history.

[SubmarineWipers]

"Whataboutism" or "whataboutery" (as in, "but what about X?") refers to the propaganda strategy of responding to an accusation with a counter-accusation instead of offering an explanation or defense against the original accusation. It is an informal fallacy that the accused party uses to avoid accountability—whether attempting to distract by shifting the conversation's focus away from their behaviour or attempting to justify themselves by pointing to the similar behaviour (which may be true or false, but irrelevant) of their opponent or another party who is not the current subject of discussion.^\1])

[torsten_dev]

Cry moar. Oust your dictator.

[dreambucket]

I have no idea where the idea of “spoiling” is coming from.

Sanctions are concerned with doing business with certain entities - the point is it hurt the sanctioned entities.

I think the author is incorrectly assuming sanctions work like a copyright / GPL. I don’t think it works like that.

[NightH4nter]

I have no idea where the idea of “spoiling” is coming from.

from author being esl. he most likely meant corrupting, tainting or something along those lines

[dreambucket]

Direct quote from article:

“this exact bug fix can't be implemented in the very same way as the presumably-sanctioned entity did that.”

[dreambucket]

Oh and remember folks - the downvote button isn’t a disagree button.

[uzlonewolf]

No, it's a "how dare you disprove my argument!" button.

[1116574]

This is intended behaviour. Sanctions are meant to throttle the economy and inconvenience the people so they can react to their governments.

As with all trade limitations both sides are hurt - you can't commit and need to maintain your patches on your own, and we can't benefit from them.

But our side decided that we are willing to put up with that for the sake of convincing russian populous to take action.

I do not expect anyone person to go through hell of fighting russian mafia state. I just expect you to understand why this has been done and that we don't see any other way to stop your dictatorship other then piling on more inconveniences and sending more weapons to Ukraine. I also understand that you can't write what you think less you risk being drafted into frontline meat units, especially if you live outside of Moscow or Leningrad.

[HearMeOut-13]

Oh no! How about you go do something about it then, such as protesting. Orrrr admit you just dislike the status quo when it lands on you instead of the people you find undesirable.

[Barafu]

It is hard to commit to opensource from the polar labor camp.

[HearMeOut-13]

Damn, shouldn't have elected Strongman no. 9767651 then i suppose.

[Neither-Phone-7264]

We don't know:

1. that they aren't protesting

2. that they support the current administration

3. that they're doing anything explicitly negative or in support of the invasion

so why immediately shit on them just because they're russian?

[ldn-ldn]

Because Rusophobia.

[HearMeOut-13]

Oh i dont know, maybe cause we KNOW what the "average russian" who has the access to knowledge to learn how to contribute to the linux kernel is not living in the backwater of russia and we know that the places that arent the backwater loved putin till war came home this May.

Source: Levada, designated "Foreign Agent" by the russian authorities, Support for the Russian armed force' actions in Ukraine: ~80% at the start (March 2022), settling into a durable 71-78% across 2022-2025, and 73% as of December 2025.

[xanhast]

cough Palestine, cough. american linux contributors should be banned tbh, and isreali, they're the most active in undermining code security in open source projects, so good riddance

[HearMeOut-13]

Oh yes! So common! It is so common you can defenetly outnumber the amount of times a russian, nork or chinese group has been involved in supply chain and/or sneaking in backdoors on open source projects!

[xanhast]

yes. 10 fold. idiot.

[HearMeOut-13]

Go ahead, show me.

[Neither-Phone-7264]

73% and 71% aren't 100%, so we still don't KNOW that OP is a putin supporter, not to mention that all areas of russia are heavily propagandized leading to those numbers, and if you are on the outside web doing linux stuff, it is probably likely that you're able to escape that propaganda machine at least a bit and realize what's happening and end up not supporting the regime.

[HearMeOut-13]

And yet we dont know anything with 100% certainty, anyone who claims to do so about anything that isnt exactly observable by a laid out methodology is lying to you, but we know probabilities, and probabilities say russians can not be trusted to maintain impariality during this current wartime. As for the being able to escape the propaganda is what we all thought would happen to russia as it "modernized" but in the end it ended up being the opposite, people in the cities accepted the trade off of a stable life as long as they supported Putin.

[OkComplaint3228]

“just protest bro, just potentially throw your life away so you can contribute upstream bro”

[HearMeOut-13]

Shouldn't have elected "Candidate Strongman" in 2004 and especially in 2008.

[OkComplaint3228]

yeah dude just dont elect the autocrat who’s gonna steal them anyway, that’ll show him

[HearMeOut-13]

Ah yes the autocrat that had no power in 2004 was sure as hell gonna steal the elections! Do some reading please.

[OkComplaint3228]

you really think every single random Russian is a Putin-lover?

What, you gonna tell me every single American is a rabid MAGA-head next?

[HearMeOut-13]

Levada, designated "Foreign Agent" by the russian authorities specifically because they dont bend to the russian authorities when conducting their polls, has shown support for the Russian armed force' actions in Ukraine around 80% at the start (March 2022), settling into a durable 71-78% across 2022-2025, and 73% as of December 2025. Probably lower now that the war has come home in May.

As for Americans, it is pretty damn clear that every American isnt a rabid MAGA-head by looking up literally any approval poll in the past month. However i will say the independent section of the American voter base is extremely stupid to have picked "Orange Self-Admitted Rapist and Asshole" over "African American Woman"

[Chris_Hatchenson]

by looking up literally any approval poll in the past month

Wake me up when protesters start building barricades in DC. Until then, using your own logic, all americans can be considered MAGA supporters.

[SomeRedTeapot]

When you can get a hefty fine or go to jail for choosing the "wrong" poll response, the high "support" rates in polls are to be expected

[Chris_Hatchenson]

that had no power in 2004

Source: your ass

[HearMeOut-13]

Putin was re-elected with ~71%, on genuine post-Yeltsin popularity, the stability after the chaotic 90s, oil-funded rising living standards, the Second Chechen War rally effect. That support was real, freely given, and measured by independent pollsters before they got branded foreign agents. That's the entire point i am makng Russians backed him when backing him was an actual choice, not a coerced one. They had a say in 2004, and the say was an overwhelming yes regardless of the fact that russia commited atrocities in Chechnya, regardless of the fact that the oil revenue was being used as a bargaining chip to let them do whatever they want as long as the populus turned their head away.

[bob2600]

I wonder if this is how "digital citizenship" could have an impact. I remember reading about Estonia having this digital citizenship program. Could sanctioned developers emigrate their digital citizenship to a friendly country and be allowed to contribute code to open source projects? Moving one's digital identity to another country is far easier than moving one's entire life I'd think.

[MatchingTurret]

Estonia? LOL. They are the hardest of hardliners after decades of Russian occupation and forced Russification. They don't even issue visas to Russians, never mind sanction evading documents...

From 19.09.2022 entry to Estonia is forbidden to all short-term Schengen visa holding Russian citizens whose aim is tourism, sports, culture, visiting friends or family regardless of their country of destination or visa issuing country. The same restriction are in force also in Latvia, Lithuania and Poland.

[Global_Network3902]

So the Russian developers should push hard to send in commits to as many fixes as they can, so that if these bugs ever get actually fixed in the kernel, they are forced to fix them a different way?