4 ms·

I wonder how a company that uses 100% open source software would comply with an order like this. def decrypt_email?(email) do email in surveilance_or

I wonder how a company that uses 100% open source software would comply with an order like this. def decrypt_email?(email) do email in surveilance_order_emails() end

arthurcolle 6y ago
Not a lawyer and I am just speculating but in the US I believe it would likely result in the court compelling the maintainer of the libraries in question to comply with the original order, or issue new orders to compel the parties in question given the new information.
- leipert 6y ago
  With most licenses couldn’t you use a fork?
  - therealEleix 6y ago
    Forks are generally required to maintain the original licensing of the originating source. That would be like taking part of the Windows source code and "forking" it with the only change being the licensing. Just because you forked it and changed the license doesn't make it true.
    - arthurcolle 6y ago
      ^ this Also: what would forking have to do with anything? If youre compelled to put a backdoor in code to be able to intercept messages from a particular person, a better argument would be to just say "lol idk how 2 do codez" as opposed to "lol im gonna fork, fuck off"
leipert 6y ago
You mean so that they do not leak the affected email address?
- PopeDotNinja 6y ago
  I mean if your code is open source, and you get an order to insert a backdoor of some kind, how can you put the backdoor in the open source code without violating a nondisclosure clause in the government’s order?
  - colejohnson66 6y ago
    Unless you can prove your running copy is the same as the provided code (which is pretty hard for server software), you can always keep a private forked copy with the backdoor and run that
  - PeterisP 6y ago
    Law overrides contract, so if distributing those changes is prohibited, then not distributing those changes to code is not a violation of the open source licence, the relevant clauses of the licence contract can not be legally binding. So you'd just [be required to] keep a non-open fork of that code even if the license (e.g. AGPL) would prohibit that.
    - detaro 6y ago
      I don't think a law requiring you to not distribute the changes overrides the license clauses terminating your license for not distributing them? It's not the license givers problem that you can't comply with the license, don't use it then?
      - PeterisP 6y ago
        Of course, not using that license and stopping the use of that code is also a completely valid (though costly) option. If the licence giver believes that you're violating the contract, they are free to try and enforce that contact in court. A German court would almost certainly rule that the clause is unenforceable at least as it applies to that particular order-related modification (the licence requirements would still be valid for unrelated modifications). There is a nontrivial legal question whether that would imply that the requirement voids the licence as a whole or just the specific clause. Specific terms (e.g. AGPL clause 12) may suggest that it would void the whole licence, but I wouldn't be certain on how German courts would consider it given these specific circumstances; a German lawyer might have a good idea but I do not. But in any case, contractual obligations are not an excuse for noncompliance with other legal requirements. If it does turn out that executing the order is incompatible with a particular license, then you must execute the order anyway and decide what's the best way to handle the consequences. Breaching a contract is a legally valid option as well, and in some cases that may even be the best option, if the expected liabilities/damages are less than the consequences of complying with it.
BlackLotus89 6y ago
It's not decrypting mails. Right now it looks like every incoming mail is encrypted with the public key of the recipient. What they need to do is more in the line of def encrypt_mail(email): if email.user=="badperson": store(email) else: store(encrypt(email)) Rather stupid to be honest since it's not obvious how new mails could help the car salesman (don't know what zulieferer should be in english... supplier?) in any way shape or form. Or do they want to know if the blackmailer sends more blackmails? Don't know, don't care. I'm just always shocked how such verdicts come to be. PS Don't know how to properly format text here
isv 6y ago
They will do what reddit did, keep "sensitive" additions to your system closed, and if you are not distributing it, you are not required to publish it. Just watch out for AGPL.
- im3w1l 6y ago
  Just read the list of bad people from a config file?

I wonder how a company that uses 100% open source software would comply with an order like this. def decrypt_email?(email) do email in surveilance_order_emails() end

arthurcolle 6y ago

Not a lawyer and I am just speculating but in the US I believe it would likely result in the court compelling the maintainer of the libraries in question to comply with the original order, or issue new orders to compel the parties in question given the new information.

leipert 6y ago
With most licenses couldn’t you use a fork?
- therealEleix 6y ago
  Forks are generally required to maintain the original licensing of the originating source. That would be like taking part of the Windows source code and "forking" it with the only change being the licensing. Just because you forked it and changed the license doesn't make it true.
  - arthurcolle 6y ago
    ^ this Also: what would forking have to do with anything? If youre compelled to put a backdoor in code to be able to intercept messages from a particular person, a better argument would be to just say "lol idk how 2 do codez" as opposed to "lol im gonna fork, fuck off"

leipert 6y ago

You mean so that they do not leak the affected email address?

PopeDotNinja 6y ago
I mean if your code is open source, and you get an order to insert a backdoor of some kind, how can you put the backdoor in the open source code without violating a nondisclosure clause in the government’s order?
- colejohnson66 6y ago
  Unless you can prove your running copy is the same as the provided code (which is pretty hard for server software), you can always keep a private forked copy with the backdoor and run that
- PeterisP 6y ago
  Law overrides contract, so if distributing those changes is prohibited, then not distributing those changes to code is not a violation of the open source licence, the relevant clauses of the licence contract can not be legally binding. So you'd just [be required to] keep a non-open fork of that code even if the license (e.g. AGPL) would prohibit that.
  - detaro 6y ago
    I don't think a law requiring you to not distribute the changes overrides the license clauses terminating your license for not distributing them? It's not the license givers problem that you can't comply with the license, don't use it then?
    - PeterisP 6y ago
      Of course, not using that license and stopping the use of that code is also a completely valid (though costly) option. If the licence giver believes that you're violating the contract, they are free to try and enforce that contact in court. A German court would almost certainly rule that the clause is unenforceable at least as it applies to that particular order-related modification (the licence requirements would still be valid for unrelated modifications). There is a nontrivial legal question whether that would imply that the requirement voids the licence as a whole or just the specific clause. Specific terms (e.g. AGPL clause 12) may suggest that it would void the whole licence, but I wouldn't be certain on how German courts would consider it given these specific circumstances; a German lawyer might have a good idea but I do not. But in any case, contractual obligations are not an excuse for noncompliance with other legal requirements. If it does turn out that executing the order is incompatible with a particular license, then you must execute the order anyway and decide what's the best way to handle the consequences. Breaching a contract is a legally valid option as well, and in some cases that may even be the best option, if the expected liabilities/damages are less than the consequences of complying with it.

BlackLotus89 6y ago

It's not decrypting mails. Right now it looks like every incoming mail is encrypted with the public key of the recipient. What they need to do is more in the line of def encrypt_mail(email): if email.user=="badperson": store(email) else: store(encrypt(email)) Rather stupid to be honest since it's not obvious how new mails could help the car salesman (don't know what zulieferer should be in english... supplier?) in any way shape or form. Or do they want to know if the blackmailer sends more blackmails? Don't know, don't care. I'm just always shocked how such verdicts come to be. PS Don't know how to properly format text here

isv 6y ago

They will do what reddit did, keep "sensitive" additions to your system closed, and if you are not distributing it, you are not required to publish it. Just watch out for AGPL.

im3w1l 6y ago
Just read the list of bad people from a config file?