THIS ISSUE: FOSS collaboration hit by embargo AI power use rockets KDE 6 arrives on desktops Linux boosts Cyberpunk 2077

Despite OpenEuler’s bar from the linux-distros mailing list, its site is going strong and the project is still hosted on GitHub.

CREDIT: www.openeuler.org/en/

OPEN SOURCE

US/Chinese tech embargo hits FOSS collaboration

Chinese-developed distro OpenEuler is denied entry to oss-security’s linux-distros mailing list. Is this the end of open source collaboration?

In mid-October 2023, a contributor to the Linux distro OpenEuler created a thread on OpenWall to request the OS’s inclusion on the linux-distros mailing list. He pointed out that OpenEuler ostensibly meets all membership requirements, including the fact it uses all or mostly open source components, isn’t just a repackaging of another Linux OS and the community participates in security updates.

While acknowledging the project’s eligibility according to the listed criteria, the request was denied by mailing list member and SUSE developer Marcus Meissner, who stated:

“As far as I understand, US companies and US citizens are not permitted to work with Chinese organisations and/or Chinese nationals.”

Not all thread contributors were in agreement, as it undermines the very nature of open source collaboration. Most agreed that it was unrealistic to expect volunteer coders to pay for a US corporate lawyer to look into this.

The US government clearly considers open source fair game when it comes to embargoes. In August 2022, the US Treasury’s Office of Foreign Assets Control (OFAC) added a tool called Tornado Cash to its Specially Designated Nationals and Blocked Persons List (SDN list). When reporting on this for The Register, journalist Simon Sharwood tried to contact the Linux Foundation and the Apache Foundation for comment but both failed to reply, suggesting even they are uncertain on this point of law.

The broader question is how effective an embargo on open source can be. In the case of Tornado Cash, GitHub implemented the US Treasury’s sanctions by removing its repository, before restoring it in read-only mode.

Still, despite OpenEuler not receiving a seat at the linux-distros table, the project website is still going strong and its source code is freely available for individual coders who wish to work on it, though those based in the US may need to take legal advice first.