> this action prevents the Iran government from accessing the source codes and prevents the Iran government from using them for military purposes! Isn’t that ri

> this action prevents the Iran government from accessing the source codes and prevents the Iran government from using them for military purposes! Isn’t that ridiculous? No, not really. Originally the US government considered crypto-cipher implementations — including FOSS implementations thereof, if done by domestic parties — to be munitions and carefully regulated their export. That specific interpretation was struct from the books, but the spirit of it lives on. Rather than manually white-listing both FOSS projects and export partners (a lot of work for some government agency somewhere), the process is now simplified: it’s a blacklist of countries to which one is not allowed to export pretty much anything of use. It is my understanding that this wide net isn’t there because the US government really believes that random FOSS libraries are useful to the Iranian military; but rather because there’s no way to keep track of every time someone creates another FOSS implementation of a crypto-cipher, or military-precision GNSS receiving, or an atomic clock VLSI, etc. — the types of things that would actually advantage an “enemy nation”’s military to not have pre-made well-tested implementations of. The US government cannot — without work that it doesn’t have the time/money for — tell your FOSS library apart from one of military value. So it’s prohibited from ITAR-blacklisted countries by default.