3 ms·

I believe the real issue here is that Fedora serves as an upstream test bed for Red Hat Enterprise. Since the code changes made in Fedora trickle through to Red

I believe the real issue here is that Fedora serves as an upstream test bed for Red Hat Enterprise. Since the code changes made in Fedora trickle through to Red Hat, and Red Hat is widely used as the distro of choice in military private clouds, and the UBI distro from Red Hat is the container image base of choice for the DoD assured containers repository, they're trying to keep contributors from countries hostile to the US military out of the supply chain. It's not that they're trying to punish the guy for being from Iran. They're trying to keep Iranian contributors out of the code base because they fear the Iranian government can lean on him to plant malicious code. I can rightfully see this leading to questions about how "free" Red Hat really is when it needs to bow to military interests like this for commercial reasons (they want to keep those enterprise support contracts with the DoD). Software freedom was always meant to refer to freedom for users, though, not freedom for developers.

the_af 5y ago
> I can rightfully see this leading to questions about how "free" Red Hat really is I think it's a very apt question. Free Software isn't free if you can only use it as long as the US doesn't deem your country as hostile. (Note: your country, not even you as a specific individual. It's that crazy). Free Software isn't Free-as-in-friendly-to-the-US, or at least it shouldn't be.
- seba_dos1 5y ago
  You can use all these software even in Iran though. You just have to get it from somewhere else. I can write a FLOSS app and decide to distribute it only to people whose name is Amy, and it will remain 100% FLOSS as long as these Amys have all their freedoms guaranteed (including the freedom to redistribute that software to anyone else). The only thing that seems at odds with software freedom (at least as understood by FSF and OSI) shown in this article is Fedora's "By clicking on and downloading..." screen. IANAL, but "you can't redistribute this to XYZ" sounds like "this software is non-free" to me. This is actually an interesting problem. If I make a FLOSS app, but my government decides against my will that neither I nor anyone I shared it with can share it any further, is it FLOSS anymore? I guess no, but what if I break the law and share it anyway?
  - the_af 5y ago
    I think the main argument is indeed spelled out in your last paragraph. Can it be Free Software if access to it is legally restricted based on nationality? I'm going to guess that it can't be, at least not according to FSF's definition of Free as in "libre". If it turns out it's just US-centric-free, that's a disappointing narrowing down of the concept. > You can use all these software even in Iran though. You just have to get it from somewhere else. I think using the distro or even getting access to the source code is not the issue. This dev likely already has a local copy. But how is he going to legally get newer copies of the source code or meaningfully collaborate with other contributors? Let's say he says "screw this" and manages to somehow host a fork in an Iranian server. How are other contributors based in the US going to share their contributions without legal risks?
    - seba_dos1 5y ago
      Collaboration is orthogonal to the software being free though. You're free to make a fork and accept (or not) any contributions you want to - not just based on your country laws, but also even just on your whim. If the laws prohibit you from collaborating with someone, it's you who's not free, not the software you make. Also, being able to get newer copies is not an issue from the Free Software definition point of view. All it cares about is whether you're free to do things with a copy you already got. Don't get me wrong, taking away the ability to collaborate and having to jump through hoops to be able to participate in modern world are real and severe problems - it just has nothing to do with software freedom per se (at least unless you're prevented from sharing the obtained software with someone else).
csydas 5y ago
> Software freedom was always meant to refer to freedom for users, though, not freedom for developers. Honest question, what is your source for this? Is it opinion or is it part of some declaration from some group? What happens when a developer is also a user? As I get it, for this particular developer, the end effect is the same. For me, a developer and a user are one in the same here, just different parts on a spectrum with many shades. I am extremely sympathetic to the author of the article because I really don't agree with the position alleged here: >They're trying to keep Iranian contributors out of the code base because they fear the Iranian government can lean on him to plant malicious code. This is not a threat vector, not really. Crytpo has made it that any developer with the skill and will can become the vector for such an attack. We can see this in ransomware readily, with almost weekly articles on how relatively unsuspecting developers are bought up and used to develop/spread ransomware, and I see absolutely no reason why a truly interested government couldn't do the exact same. If it's good enough for the billions of dollars the crypto-gangs are running, I'm sure a government could make it work all the same... I'm not sure I can see sanctions like this as anything but political posturing, and I question the efficacy of it when in practice, the result is stuff like this that just denies simple freedoms that the US has no right denying to anyone. Edit: Just to clarify, I am not proposing you are personally responsible for the above claims or expecting you to defend them, my question(s) are in earnest and combined with some personal opinions of course. So if some of the statements seem challenging towards you, it is not intentional, just a late friday post for me.
- lliamander 5y ago
  > Honest question, what is your source for this? Is it opinion or is it part of some declaration from some group? > What happens when a developer is also a user? As I get it, for this particular developer, the end effect is the same. I think the parent comment's point was that open source doesn't mean everyone is entitled to contribute back to the main project. As a user you may be a developer by trade, and you are certainly free to modify and share the source code, but the project maintainers are free to not include your changes back into their repository. A prime example of this is SQLite, which is open source despite the fact that they don't accept code submissions outside of the core team. >> They're trying to keep Iranian contributors out of the code base because they fear the Iranian government can lean on him to plant malicious code. > This is not a threat vector, not really. It really is. The Linux kernel has itself thwarted what appeared to be an attempt by U.S. intelligence services to inject vulnerabilities into the kernel source code. Now the fact that the U.S. government was itself the threat may make worries about Iran doing the same seem rather silly, but in this case I think the fact that Fedora source code is used by the DoD makes sense. All this to say, I'm certainly not happy about this situation. A big part of the spirit of open source is to overcome our differences in an attempt to solve shared problems. That's why the OSI definition of open source requires that open source licenses not discriminate against persons, groups, or fields of endeavor. That being said, however much open source may not want to be interested in politics, it is certainly true that politics is interested in open source.
hjek 5y ago
> They're trying to keep Iranian contributors out of the code base because they fear the Iranian government can lean on him to plant malicious code. That doesn't quite explain why you don't even have read access in Iran though: > Through Iran’s IP range, you cannot even clone a simple project from GitLab or pull the Nginx image from Docker Hub or Google Container Registry!

the_af 5y ago

> I can rightfully see this leading to questions about how "free" Red Hat really is I think it's a very apt question. Free Software isn't free if you can only use it as long as the US doesn't deem your country as hostile. (Note: your country, not even you as a specific individual. It's that crazy). Free Software isn't Free-as-in-friendly-to-the-US, or at least it shouldn't be.

seba_dos1 5y ago
You can use all these software even in Iran though. You just have to get it from somewhere else. I can write a FLOSS app and decide to distribute it only to people whose name is Amy, and it will remain 100% FLOSS as long as these Amys have all their freedoms guaranteed (including the freedom to redistribute that software to anyone else). The only thing that seems at odds with software freedom (at least as understood by FSF and OSI) shown in this article is Fedora's "By clicking on and downloading..." screen. IANAL, but "you can't redistribute this to XYZ" sounds like "this software is non-free" to me. This is actually an interesting problem. If I make a FLOSS app, but my government decides against my will that neither I nor anyone I shared it with can share it any further, is it FLOSS anymore? I guess no, but what if I break the law and share it anyway?
- the_af 5y ago
  I think the main argument is indeed spelled out in your last paragraph. Can it be Free Software if access to it is legally restricted based on nationality? I'm going to guess that it can't be, at least not according to FSF's definition of Free as in "libre". If it turns out it's just US-centric-free, that's a disappointing narrowing down of the concept. > You can use all these software even in Iran though. You just have to get it from somewhere else. I think using the distro or even getting access to the source code is not the issue. This dev likely already has a local copy. But how is he going to legally get newer copies of the source code or meaningfully collaborate with other contributors? Let's say he says "screw this" and manages to somehow host a fork in an Iranian server. How are other contributors based in the US going to share their contributions without legal risks?
  - seba_dos1 5y ago
    Collaboration is orthogonal to the software being free though. You're free to make a fork and accept (or not) any contributions you want to - not just based on your country laws, but also even just on your whim. If the laws prohibit you from collaborating with someone, it's you who's not free, not the software you make. Also, being able to get newer copies is not an issue from the Free Software definition point of view. All it cares about is whether you're free to do things with a copy you already got. Don't get me wrong, taking away the ability to collaborate and having to jump through hoops to be able to participate in modern world are real and severe problems - it just has nothing to do with software freedom per se (at least unless you're prevented from sharing the obtained software with someone else).

csydas 5y ago

> Software freedom was always meant to refer to freedom for users, though, not freedom for developers. Honest question, what is your source for this? Is it opinion or is it part of some declaration from some group? What happens when a developer is also a user? As I get it, for this particular developer, the end effect is the same. For me, a developer and a user are one in the same here, just different parts on a spectrum with many shades. I am extremely sympathetic to the author of the article because I really don't agree with the position alleged here: >They're trying to keep Iranian contributors out of the code base because they fear the Iranian government can lean on him to plant malicious code. This is not a threat vector, not really. Crytpo has made it that any developer with the skill and will can become the vector for such an attack. We can see this in ransomware readily, with almost weekly articles on how relatively unsuspecting developers are bought up and used to develop/spread ransomware, and I see absolutely no reason why a truly interested government couldn't do the exact same. If it's good enough for the billions of dollars the crypto-gangs are running, I'm sure a government could make it work all the same... I'm not sure I can see sanctions like this as anything but political posturing, and I question the efficacy of it when in practice, the result is stuff like this that just denies simple freedoms that the US has no right denying to anyone. Edit: Just to clarify, I am not proposing you are personally responsible for the above claims or expecting you to defend them, my question(s) are in earnest and combined with some personal opinions of course. So if some of the statements seem challenging towards you, it is not intentional, just a late friday post for me.

lliamander 5y ago
> Honest question, what is your source for this? Is it opinion or is it part of some declaration from some group? > What happens when a developer is also a user? As I get it, for this particular developer, the end effect is the same. I think the parent comment's point was that open source doesn't mean everyone is entitled to contribute back to the main project. As a user you may be a developer by trade, and you are certainly free to modify and share the source code, but the project maintainers are free to not include your changes back into their repository. A prime example of this is SQLite, which is open source despite the fact that they don't accept code submissions outside of the core team. >> They're trying to keep Iranian contributors out of the code base because they fear the Iranian government can lean on him to plant malicious code. > This is not a threat vector, not really. It really is. The Linux kernel has itself thwarted what appeared to be an attempt by U.S. intelligence services to inject vulnerabilities into the kernel source code. Now the fact that the U.S. government was itself the threat may make worries about Iran doing the same seem rather silly, but in this case I think the fact that Fedora source code is used by the DoD makes sense. All this to say, I'm certainly not happy about this situation. A big part of the spirit of open source is to overcome our differences in an attempt to solve shared problems. That's why the OSI definition of open source requires that open source licenses not discriminate against persons, groups, or fields of endeavor. That being said, however much open source may not want to be interested in politics, it is certainly true that politics is interested in open source.

hjek 5y ago

> They're trying to keep Iranian contributors out of the code base because they fear the Iranian government can lean on him to plant malicious code. That doesn't quite explain why you don't even have read access in Iran though: > Through Iran’s IP range, you cannot even clone a simple project from GitLab or pull the Nginx image from Docker Hub or Google Container Registry!