Re: linux-distros membership application of openEuler

[Igor Seletskiy <i () cloudlinux com>]

Given that we are discussing early disclosure, I am unsure how open source
relates to it.
This is "pre" open-sourcing the code, so all the open source-related things
might not help at all.

I would second the call to "talk to your lawyers," especially when entities
like Huawei are involved.
I am singling out Huawei specifically because it is considered a treat to
US national security and is on the embargo list.


Regards,
Igor Seletskiy |  CEO
CloudLinux OS <https://cloudlinux.com/cloudlinuxos>   |   KernelCare
<https://kernelcare.com>   |   Imunify360 <http://imunify360.com/> |
AlmaLinux <https://almalinux.org>



On Mon, Oct 16, 2023 at 9:37 AM Aron Xu <happyaron.xu () gmail com> wrote:

> Hi,
>
> On Mon, Oct 16, 2023 at 11:34 PM Demi Marie Obenour
> <demi () invisiblethingslab com> wrote:
> > On Mon, Oct 16, 2023 at 04:52:32PM +0200, Greg KH wrote:
> > > On Mon, Oct 16, 2023 at 10:01:44AM -0400, Demi Marie Obenour wrote:
> > > > On Mon, Oct 16, 2023 at 10:23:50AM +0200, Greg KH wrote:
> > > > > On Mon, Oct 16, 2023 at 10:08:50AM +0200, Marcus Meissner wrote:
> > > > > > Hi,
> > > > > >
> > > > > > Regardless of your viability of subscription status I think we
> also
> > > > > > (sadly) have to consider current geopolitical issues here.
> > > > > >
> > > > > > As far as I understand, US companies and US citizens are not
> permitted
> > > > > > to work with Chinese organizations and/or Chinese nationals.
> > > > >
> > > > > They can when working in the open on public projects and other
> > > > > open-source-like things.  For "closed" lists and groups, please
> consult
> > > > > a lawyer as the rules there are quite varied and depends on the
> > > > > countries and companies involved.
> > > > >
> > > > > But to be sure, again, consult your corporate lawyers, they know
> the
> > > > > rules and the issues involved better than I do.
> > > > >
> > > > > good luck!
> > > > >
> > > > > greg k-h
> > > >
> > > > The question is _who_ should consult their lawyers.
> > >
> > > The people deciding if this group can be added to the closed list as
> > > they are the ones responsible for it, AND then if the group is added,
> > > the members of the list need to talk to their lawyers to see if their
> > > country laws allow them to participate in a closed group with such
> > > members.  Many countries might be fine, many might not be, it all
> > > depends on the participants and what country laws they must abide by.
> > >
> > > So in short, everyone involved in the list!  :(
> > >
> > > good luck!
> > >
> > > greg "I talk to too many lawyers" k-h
> >
> > The result of this is simply that those who do not have access to
> > lawyers on staff will not participate, which will reduce the value of
> > the list substantially.  I suspect that most people who report
> > vulnerabilities via distros@ fall into this category.  I know I do.
> >
> > Therefore, I recommend rejecting the application as too risky from a
> > legal perspective.
>
> Not matter what would be the outcome, I'd like recommend an article
> from Linux Foundation which I think is a good read:
>
> https://www.linuxfoundation.org/resources/publications/understanding-us-export-controls-with-open-source-projects
>
> I'm not a lawyer though, but here are a few cents:
>
> 1) There is no general restrictions against Chinese organizations and
> nationals;
> 2) Open source software (which is publicly available) is not subject
> to EAR (Export Administration Regulation of the US);
> 3) According to § 734.7[1] of EAR, "knowledge with the intention that
> such information will be made publicly available if accepted" is
> treated as "Published" and is considered publicly available.
>
> If I understand correctly, distros list is targeted to open source
> software issues with a policy[2] of "Please only use these lists to
> report and discuss security issues that are not yet public (but that
> are to be made public very soon)", then everyone could retain their
> peace of mind.
>
> Regards,
> Aron
>
> [1]
> https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-734/section-734.7
> [2]https://oss-security.openwall.org/wiki/mailing-lists/distros