News

From the other phoronix article:

UPDATE: When asked whether Linus Torvalds was under any sort of NDA around this, he responded:

"No, but I'm not a lawyer, so I'm not going to go into the details that I - and other maintainers - were told by lawyers.

I'm also not going to start discussing legal issues with random internet people who I seriously suspect are paid actors and/or have been riled up by them."

I don't love this decision, but I think if you're willing to read between the lines here, it sounds like maybe he didn't have much of a choice. Then again, Torvalds also seems pretty happy to comply.

In other areas, sanctions don't always mean a complete ban. For example, Ian Nepomniachtchi is still allowed to play chess internationally, just not under the Russian flag. This seems needlessly putative unless there are legitimate security concerns.

Linus either makes me think he's a dick, or he makes me laugh. Sometimes both. I liked his response:

Greg Kroah-Hartman who authored the patch dropping the various maintainers has yet to comment on the mailing list thread, but a few minutes ago Linus Torvalds chimed in with his opinion. Linux creator Linus Torvalds wrote:

"Ok, lots of Russian trolls out and about.

It's entirely clear why the change was done, it's not getting reverted, and using multiple random anonymous accounts to try to "grass root" it by Russian troll factories isn't going to change anything.

And FYI for the actual innocent bystanders who aren't troll farm accounts - the "various compliance requirements" are not just a US thing.

If you haven't heard of Russian sanctions yet, you should try to read the news some day. And by "news", I don't mean Russian state-sponsored spam.

As to sending me a revert patch - please use whatever mush you call brains. I'm Finnish. Did you think I'd be supporting Russian aggression? Apparently it's not just lack of real news, it's lack of history knowledge too."

I mean, it's on Phoronix to take this kinda out of context, but on Linus how he phrases things. You would think after years at the forefront of one of the most important FOSS projects, he'd know better.

So to add some missing context: We are talking 11 maintainers, it's not like hundreds have been removed. Im addition, it seems like most of them are employed by russian companies, not private individuals. Their code on the other hand has not been removed.

What bothers me is that it's unclear whether future pull-requests would be rejected as well, or whether this is a matter of association.

IMO it would have been nice if Linus focused on some details regarding this action in his response, or alternatively not responding at all. Even if all he can say is that currently he can't comment on it, it's definitely better than borderline xenophobic rambling and getting mad at supposed trolls, feeding trolls if anything.

I haven't gone through all their work, but some of the delisted maintainers were working on driver support for Baikal, a Russia based electronics company. Their work includes semiconductors, ARM processors. Given the sanctions against Russia, especially for dual use stuff like domestic semiconductors, I would expect that Linus and other maintainers were told or concluded that by signing off and merging their code they'd be personally violating sanctions.

Linus says your reasoning is inaccurate.

Looks like a dumb and ineffective move in general. No public answers as to what the supposed compliance requirements are with the patch. And, removing credit or banning individuals based on nationality seems like really poor precedent.

~~I disagree that this has anything to do with any Biden executive order. In fact, the patch doesn’t say anything about what those requirements are or what prompts the change. I don’t see why FOSS in general even necessarily needs to comply with US regulations. I think we should refrain from this kind of speculation.~~

EDIT: Linus later confirmed the sanctions were the cause of this action on the mailing list.

The social engineering on open source maintainers that create lesser understood security implications are basically toast.

:(

I really don't know what the answer is other than HEY EVERYONE PLEASE HELP but like, glhf.

Sux.

Fucking based.

I wonder if there is any merit to this or if the government actually suspects or believes there is a large risk giving certain maintainers access.

I could actually see NSA protecting Linux with reasonable intentions, but I could also just see the whitehouse making dumbass moves because some shmuck wants credit for "securing" something.

Either way, I don't think it's large enough that it's much of an issue.