About strange email related to smalltalkhub read-only on squeak-dev
Hi all This is the week-end and we worked super well yesterday during the sprint. Lot of good enhancements - Thanks a lot to all the participants. I not really happy to be forced to do it on a sunny saturday but Iâm doing it to clarify points. Esteban sent me this text that was posted on Squeak-Dev (I personally do not read squeak related forums because I have not the time and my focus is Pharo, its consortium, my team, my research and my family). We have to react because - We do not really at ***all** understand this email - We did not kicked anybody from our mailing-list from ages - so ron is lying. In the past we even had discussion with ron - so we do not really understand. May be we got problem to log on our mailing-lists. We have no idea because we are working and not looking at such things. - When we migrated smalltalkhub to readonly we payed attention to make sure that private projects stay private. We did not migrated smalltalkhub for fun. We MUST do it or it will be done by our infrastructure! - Now the cryptography packages are MIT and they are public anyway. So again we do not understand anything. We do not get why Ron contacted us because we announced the migration publicly way in advance and we will keep the Smalltalkhub frozen repo for at least next 5 years. I feel really sorry to hear such kind of email because we do not want to fight with anybody. Our goal is to make sure that people can work with Pharo and expand their business and knowledge. We are working hard to make sure that people can invent their future with Pharo and people that know us personally know that we are not lying. S
Hi all,
I've tried to work with the Pharo group but they keep kicking me out of their mailing list. I've already mentioned this a number of times to the Pharo group but nobody seems to care.
BOLD BOLD BOLD PLEASE TAKE THIS SERIOUSLY BOLD BOLD BOLD
I am not a lawyer but we used very good lawyers to make the squeaksource repository a safe place to do cryptography work. If you are working on cryptography DO NOT POST your code anywhere except squeaksource. Especially if you are in the USA. The ONLY repository that is approved to host our cryptography code in the USA and therefore not subject to criminal violations is squeaksource. It is a CRIME in the USA to move code and make it available on the internet for everyone to download! It must be hosted on squeaksoruce.com or another location that is also properly registered.
IF YOU COPIED CRYPTOGRAPHY CODE TO ANOTHER REPOSITORY THAT IS NOT REGISTERED I would recommend you delete it immediately.
END BOLD!
Please feel free to post this to the Pharo mailing list because they apparently do not want to hear from me!
All the best,
Ron Teitelbaum
-------------------------------------------- Stéphane Ducasse http://stephane.ducasse.free.fr / http://www.pharo.org 03 59 35 87 52 Assistant: Aurore Dalle FAX 03 59 57 78 50 TEL 03 59 35 86 16 S. Ducasse - Inria 40, avenue Halley, Parc Scientifique de la Haute Borne, Bât.A, Park Plaza Villeneuve d'Ascq 59650 France
Yes, let us coordinate what to respond. To me this doesn't even sound like Ron. Usually he is a rather quite and reasonable guy. Seems to be a lot of misunderstandings here (again). As I was the one copying the Cryptography package to github it concerns me a bit. I've been remembered now about yet another strange law suit in the US and indeed we need to raise a bit of awareness for this. So let's figure out what has to be done. Norbert
Am 30.05.2020 um 14:43 schrieb Stéphane Ducasse <stephane.ducasse@inria.fr>:
Hi all
This is the week-end and we worked super well yesterday during the sprint. Lot of good enhancements - Thanks a lot to all the participants. I not really happy to be forced to do it on a sunny saturday but Iâm doing it to clarify points.
Esteban sent me this text that was posted on Squeak-Dev (I personally do not read squeak related forums because I have not the time and my focus is Pharo, its consortium, my team, my research and my family).
We have to react because - We do not really at ***all** understand this email - We did not kicked anybody from our mailing-list from ages - so ron is lying. In the past we even had discussion with ron - so we do not really understand. May be we got problem to log on our mailing-lists. We have no idea because we are working and not looking at such things. - When we migrated smalltalkhub to readonly we payed attention to make sure that private projects stay private. We did not migrated smalltalkhub for fun. We MUST do it or it will be done by our infrastructure! - Now the cryptography packages are MIT and they are public anyway. So again we do not understand anything.
We do not get why Ron contacted us because we announced the migration publicly way in advance and we will keep the Smalltalkhub frozen repo for at least next 5 years.
I feel really sorry to hear such kind of email because we do not want to fight with anybody. Our goal is to make sure that people can work with Pharo and expand their business and knowledge. We are working hard to make sure that people can invent their future with Pharo and people that know us personally know that we are not lying.
S
Hi all,
I've tried to work with the Pharo group but they keep kicking me out of their mailing list. I've already mentioned this a number of times to the Pharo group but nobody seems to care.
BOLD BOLD BOLD PLEASE TAKE THIS SERIOUSLY BOLD BOLD BOLD
I am not a lawyer but we used very good lawyers to make the squeaksource repository a safe place to do cryptography work. If you are working on cryptography DO NOT POST your code anywhere except squeaksource. Especially if you are in the USA. The ONLY repository that is approved to host our cryptography code in the USA and therefore not subject to criminal violations is squeaksource. It is a CRIME in the USA to move code and make it available on the internet for everyone to download! It must be hosted on squeaksoruce.com <http://squeaksoruce.com/> or another location that is also properly registered.
IF YOU COPIED CRYPTOGRAPHY CODE TO ANOTHER REPOSITORY THAT IS NOT REGISTERED I would recommend you delete it immediately.
END BOLD!
Please feel free to post this to the Pharo mailing list because they apparently do not want to hear from me!
All the best,
Ron Teitelbaum
-------------------------------------------- Stéphane Ducasse http://stephane.ducasse.free.fr <http://stephane.ducasse.free.fr/> / http://www.pharo.org <http://www.pharo.org/> 03 59 35 87 52 Assistant: Aurore Dalle FAX 03 59 57 78 50 TEL 03 59 35 86 16 S. Ducasse - Inria 40, avenue Halley, Parc Scientifique de la Haute Borne, Bât.A, Park Plaza Villeneuve d'Ascq 59650 France
Hi, So addressing only the crypto software issue and with the caveat that I am also not a lawyer but I have had to deal with certain aspects of this in the past.... Crypto software is one of those bizarre dual use items in terms of arms imports and exports. Â While we as geeks just think of this is software or mathematics and might be confused as to why governments care, governments do care deeply about this. Â And their way of expressing how much they care about this issue is by passing laws and prosecuting folks. One of the easiest ways to get in trouble is for one to make the software available to residents and/or citizens of certain countries as well as available to people on a long list kept by different governments. Â We can have a long debate about the morality of this concept but those who make the laws have decided that is the law. Â And often these laws are crafted such that the executive can change important details on short notice and that puts the risk of prosecution at the whims of different world leaders. Â The license that the software is released under is not important. Â Â What Ron is stating is that squeak source supplied some additional protections to prevent accidentally making the software available to folks who the US feels should not have access. If you have moved the software to another hosting provider without the permission or knowledge of the author, and therefore the owner of the software, you have put that person at additional risk. Â In addition you and the hosting provider are taking on additional risk. If it was moved to GitHub I strongly recommend reviewing their policies on trade controls and what risks you assume. [https://help.github.com/en/github/site-policy/github-and-trade-controls](https://help.github.com/en/github/site-policy/github-and-trade-controls) Finally I would strongly recommend talking to a competent legal advisor who is deeply familiar with the details of these laws. Â They are complex and highly variable between different parts of the world. I know this seems like a lot of trouble and wasted time but you can spend a giant amount of time and money defending oneself from arms trafficking charges. cheers bruce
Hi all
This is the week-end and we worked super well yesterday during the sprint. Lot of good enhancements - Thanks a lot to all the participants. I not really happy to be forced to do it on a sunny saturday but Iâm doing it to clarify points.
Esteban sent me this text that was posted on Squeak-Dev (I personally do not read squeak related forums because I have not the time and my focus is Pharo, its consortium, my team, my research and my family).Â
We have to react because - We do not really at ***all** understand this email - We did not kicked anybody from our mailing-list from ages - so ron is lying. In the past we even had discussion with ron - so we do not really understand. May be we got problem to log on our mailing-lists. We have no idea because we are working and not looking at such things.   - When we migrated smalltalkhub to readonly we payed attention to make sure that private projects stay private. We did not migrated smalltalkhub for fun. We MUST do it or it will be done by our infrastructure! - Now the cryptography packages are MIT and they are public anyway. So again we do not understand anything.Â
We do not get why Ron contacted us because we announced the migration publicly way in advance and we will keep the Smalltalkhub frozen repo for at least next 5 years.Â
I feel really sorry to hear such kind of email because we do not want to fight with anybody. Our goal is to make sure that people can work with Pharo and expand their business and knowledge. We are working hard to make sure that people can invent their future with Pharo and people that know us personally know that we are not lying.
S
Hi all,
I've tried to work with the Pharo group but they keep kicking me out of their mailing list. Â I've already mentioned this a number of times to the Pharo group but nobody seems to care. Â
BOLD BOLD BOLD PLEASE TAKE THIS SERIOUSLY Â BOLD BOLD BOLD
I am not a lawyer but we used very good lawyers to make the squeaksource repository a safe place to do cryptography work. Â If you are working on cryptography DO NOT POST your code anywhere except squeaksource. Â Especially if you are in the USA. Â The ONLY repository that is approved to host our cryptography code in the USA and therefore not subject to criminal violations is squeaksource. Â It is a CRIME in the USA to move code and make it available on the internet for everyone to download! Â It must be hosted on [squeaksoruce.com](http://squeaksoruce.com) or another location that is also properly registered.Â
IF YOU COPIED CRYPTOGRAPHY CODE TO ANOTHER REPOSITORY THAT IS NOT REGISTERED I would recommend you delete it immediately.
END BOLD! Â
Please feel free to post this to the Pharo mailing list because they apparently do not want to hear from me!
All the best,
Ron Teitelbaum
-------------------------------------------- Stéphane Ducasse [http://stephane.ducasse.free.fr](http://stephane.ducasse.free.fr) / [http://www.pharo.org](http://www.pharo.org) 03 59 35 87 52 Assistant: Aurore Dalle FAX 03 59 57 78 50 TEL 03 59 35 86 16 S. Ducasse - Inria 40, avenue Halley, Parc Scientifique de la Haute Borne, Bât.A, Park Plaza Villeneuve d'Ascq 59650 France
Thanks, Bruce. The part about (the possibility that) squeak source is configured to restrict distribution was the missing piece for me. I had previously assumed (hah!) that it would be available to anyone anywhere. On Sun, May 31, 2020, 10:39 Bruce O'Neel <bruce.oneel@pckswarms.ch> wrote:
Hi,
So addressing only the crypto software issue and with the caveat that I am also not a lawyer but I have had to deal with certain aspects of this in the past....
Crypto software is one of those bizarre dual use items in terms of arms imports and exports. While we as geeks just think of this is software or mathematics and might be confused as to why governments care, governments do care deeply about this. And their way of expressing how much they care about this issue is by passing laws and prosecuting folks.
One of the easiest ways to get in trouble is for one to make the software available to residents and/or citizens of certain countries as well as available to people on a long list kept by different governments. We can have a long debate about the morality of this concept but those who make the laws have decided that is the law. And often these laws are crafted such that the executive can change important details on short notice and that puts the risk of prosecution at the whims of different world leaders.
The license that the software is released under is not important.
What Ron is stating is that squeak source supplied some additional protections to prevent accidentally making the software available to folks who the US feels should not have access.
If you have moved the software to another hosting provider without the permission or knowledge of the author, and therefore the owner of the software, you have put that person at additional risk. In addition you and the hosting provider are taking on additional risk.
If it was moved to GitHub I strongly recommend reviewing their policies on trade controls and what risks you assume.
https://help.github.com/en/github/site-policy/github-and-trade-controls
Finally I would strongly recommend talking to a competent legal advisor who is deeply familiar with the details of these laws. They are complex and highly variable between different parts of the world.
I know this seems like a lot of trouble and wasted time but you can spend a giant amount of time and money defending oneself from arms trafficking charges.
cheers
bruce
*30 May 2020 14:43 Stéphane Ducasse <stephane.ducasse@inria.fr <stephane.ducasse@inria.fr>> wrote:*
Hi all
This is the week-end and we worked super well yesterday during the sprint. Lot of good enhancements - Thanks a lot to all the participants. I not really happy to be forced to do it on a sunny saturday but Iâm doing it to clarify points.
Esteban sent me this text that was posted on Squeak-Dev (I personally do not read squeak related forums because I have not the time and my focus is Pharo, its consortium, my team, my research and my family).
We have to react because - We do not really at ***all** understand this email - We did not kicked anybody from our mailing-list from ages - so ron is lying. In the past we even had discussion with ron - so we do not really understand. May be we got problem to log on our mailing-lists. We have no idea because we are working and not looking at such things. - When we migrated smalltalkhub to readonly we payed attention to make sure that private projects stay private. We did not migrated smalltalkhub for fun. We MUST do it or it will be done by our infrastructure! - Now the cryptography packages are MIT and they are public anyway. So again we do not understand anything.
We do not get why Ron contacted us because we announced the migration publicly way in advance and we will keep the Smalltalkhub frozen repo for at least next 5 years.
I feel really sorry to hear such kind of email because we do not want to fight with anybody. Our goal is to make sure that people can work with Pharo and expand their business and knowledge. We are working hard to make sure that people can invent their future with Pharo and people that know us personally know that we are not lying.
S
Hi all,
I've tried to work with the Pharo group but they keep kicking me out of their mailing list. I've already mentioned this a number of times to the Pharo group but nobody seems to care.
BOLD BOLD BOLD PLEASE TAKE THIS SERIOUSLY BOLD BOLD BOLD
I am not a lawyer but we used very good lawyers to make the squeaksource repository a safe place to do cryptography work. If you are working on cryptography DO NOT POST your code anywhere except squeaksource. Especially if you are in the USA. The ONLY repository that is approved to host our cryptography code in the USA and therefore not subject to criminal violations is squeaksource. It is a CRIME in the USA to move code and make it available on the internet for everyone to download! It must be hosted on squeaksoruce.com or another location that is also properly registered.
IF YOU COPIED CRYPTOGRAPHY CODE TO ANOTHER REPOSITORY THAT IS NOT REGISTERED I would recommend you delete it immediately.
END BOLD!
Please feel free to post this to the Pharo mailing list because they apparently do not want to hear from me!
All the best,
Ron Teitelbaum
-------------------------------------------- Stéphane Ducasse http://stephane.ducasse.free.fr / http://www.pharo.org 03 59 35 87 52 Assistant: Aurore Dalle FAX 03 59 57 78 50 TEL 03 59 35 86 16 S. Ducasse - Inria 40, avenue Halley, Parc Scientifique de la Haute Borne, Bât.A, Park Plaza Villeneuve d'Ascq 59650 France
Hi all, as Bruce said, regulations around cryptography exports from the US are complex, and controversial. I am afraid that this thread has the potential to confuse the Smalltalk community, and it raises more questions than gives answers (which is fine but where do we go from here?) I am also not a lawyer, also have dealt with this issue before (on several occasions), and every single time the conversation turns into personal opinions and (almost always) corporate lawyering that will follow a CYA route without properly researching the facts. I hope to provide some information that might clarify this a bit to the best of my understanding. Cryptography Exports from the US is best described here: https://bis.doc.gov/index.php/encryption-and-export-administration-regulatio... <https://bis.doc.gov/index.php/encryption-and-export-administration-regulatio...> This link will be most relevant to open source software: https://bis.doc.gov/index.php/policy-guidance/encryption/1-encryption-items-... <https://bis.doc.gov/index.php/policy-guidance/encryption/1-encryption-items-...> The previously cited link at Github (https://help.github.com/en/github/site-policy/github-and-trade-controls <https://help.github.com/en/github/site-policy/github-and-trade-controls>) is only partially relevant here, and itâs really important if you want to use the Github Enterprise Server to host your repositories. The http://www.squeaksource.com/Cryptography/ <http://www.squeaksource.com/Cryptography/> resource is not blocked for access from export-controlled countries (easily verifiable by using a combination of VPN, Tor and proxychains). The Squeaksource repository acknowledges on the home page the hosting support provided by the Software Composition Group and University of Bern, based in Switzerland. While the IP of the service itself appears to be in the US state of Texas, WHOIS on the domain reveals that the registrar is http://www.hetzner.com/ <http://www.hetzner.com/> which appears to be hosted in Bavaria, Germany. This means that if tomorrow the owner of the domain decides to change the DNS records and host it in another jurisdiction instead, there is no one who can stop them. The rest is my personal opinion: If you read the text of the EAR and take into account all other facts, I think that the notion that anyone should get into trouble by copying open source Smalltalk crypto libraries to other repositories is just a pure FUD. This software is open source, it is publicly available including the source code, it is hosted on a domain that is controlled by a non-US entity, and itâs easily accessible in its current form from countries that are currently on the US âvorbotenâ list. That said, I wonât discourage anyone from seeking a legal advice but if you do, make sure these points are addressed. Jerry Kott, OSCP Principal, Imageware Corporation <https://image-ware.com/> Security with Integrity. By Choice. By Design. This message has been digitally signed. PGP Fingerprint: A9181736DD2F1B6CC7CF9E51AC8514F48C0979A5
On 31-05-2020, at 3:17 PM, Richard Sargent <richard.sargent@gemtalksystems.com> wrote:
Thanks, Bruce. The part about (the possibility that) squeak source is configured to restrict distribution was the missing piece for me. I had previously assumed (hah!) that it would be available to anyone anywhere.
On Sun, May 31, 2020, 10:39 Bruce O'Neel <bruce.oneel@pckswarms.ch <mailto:bruce.oneel@pckswarms.ch>> wrote:
Hi,
So addressing only the crypto software issue and with the caveat that I am also not a lawyer but I have had to deal with certain aspects of this in the past....
Crypto software is one of those bizarre dual use items in terms of arms imports and exports. While we as geeks just think of this is software or mathematics and might be confused as to why governments care, governments do care deeply about this. And their way of expressing how much they care about this issue is by passing laws and prosecuting folks.
One of the easiest ways to get in trouble is for one to make the software available to residents and/or citizens of certain countries as well as available to people on a long list kept by different governments. We can have a long debate about the morality of this concept but those who make the laws have decided that is the law. And often these laws are crafted such that the executive can change important details on short notice and that puts the risk of prosecution at the whims of different world leaders.
The license that the software is released under is not important.
What Ron is stating is that squeak source supplied some additional protections to prevent accidentally making the software available to folks who the US feels should not have access.
If you have moved the software to another hosting provider without the permission or knowledge of the author, and therefore the owner of the software, you have put that person at additional risk. In addition you and the hosting provider are taking on additional risk.
If it was moved to GitHub I strongly recommend reviewing their policies on trade controls and what risks you assume.
https://help.github.com/en/github/site-policy/github-and-trade-controls <https://help.github.com/en/github/site-policy/github-and-trade-controls>
Finally I would strongly recommend talking to a competent legal advisor who is deeply familiar with the details of these laws. They are complex and highly variable between different parts of the world.
I know this seems like a lot of trouble and wasted time but you can spend a giant amount of time and money defending oneself from arms trafficking charges.
cheers
bruce
30 May 2020 14:43 Stéphane Ducasse <stephane.ducasse@inria.fr <mailto:stephane.ducasse@inria.fr>> wrote: Hi all
This is the week-end and we worked super well yesterday during the sprint. Lot of good enhancements - Thanks a lot to all the participants. I not really happy to be forced to do it on a sunny saturday but Iâm doing it to clarify points.
Esteban sent me this text that was posted on Squeak-Dev (I personally do not read squeak related forums because I have not the time and my focus is Pharo, its consortium, my team, my research and my family).
We have to react because - We do not really at ***all** understand this email - We did not kicked anybody from our mailing-list from ages - so ron is lying. In the past we even had discussion with ron - so we do not really understand. May be we got problem to log on our mailing-lists. We have no idea because we are working and not looking at such things. - When we migrated smalltalkhub to readonly we payed attention to make sure that private projects stay private. We did not migrated smalltalkhub for fun. We MUST do it or it will be done by our infrastructure! - Now the cryptography packages are MIT and they are public anyway. So again we do not understand anything.
We do not get why Ron contacted us because we announced the migration publicly way in advance and we will keep the Smalltalkhub frozen repo for at least next 5 years.
I feel really sorry to hear such kind of email because we do not want to fight with anybody. Our goal is to make sure that people can work with Pharo and expand their business and knowledge. We are working hard to make sure that people can invent their future with Pharo and people that know us personally know that we are not lying.
S
Hi all,
I've tried to work with the Pharo group but they keep kicking me out of their mailing list. I've already mentioned this a number of times to the Pharo group but nobody seems to care.
BOLD BOLD BOLD PLEASE TAKE THIS SERIOUSLY BOLD BOLD BOLD
I am not a lawyer but we used very good lawyers to make the squeaksource repository a safe place to do cryptography work. If you are working on cryptography DO NOT POST your code anywhere except squeaksource. Especially if you are in the USA. The ONLY repository that is approved to host our cryptography code in the USA and therefore not subject to criminal violations is squeaksource. It is a CRIME in the USA to move code and make it available on the internet for everyone to download! It must be hosted on squeaksoruce.com <http://squeaksoruce.com/> or another location that is also properly registered.
IF YOU COPIED CRYPTOGRAPHY CODE TO ANOTHER REPOSITORY THAT IS NOT REGISTERED I would recommend you delete it immediately.
END BOLD!
Please feel free to post this to the Pharo mailing list because they apparently do not want to hear from me!
All the best,
Ron Teitelbaum
-------------------------------------------- Stéphane Ducasse http://stephane.ducasse.free.fr <http://stephane.ducasse.free.fr/> / http://www.pharo.org <http://www.pharo.org/> 03 59 35 87 52 Assistant: Aurore Dalle FAX 03 59 57 78 50 TEL 03 59 35 86 16 S. Ducasse - Inria 40, avenue Halley, Parc Scientifique de la Haute Borne, Bât.A, Park Plaza Villeneuve d'Ascq 59650 France
On 1 Jun 2020, at 06:39, Jerry Kott <jkott@image-ware.com> wrote:
If you read the text of the EAR and take into account all other facts, I think that the notion that anyone should get into trouble by copying open source Smalltalk crypto libraries to other repositories is just a pure FUD. This software is open source, it is publicly available including the source code, it is hosted on a domain that is controlled by a non-US entity, and itâs easily accessible in its current form from countries that are currently on the US âvorbotenâ list.
Indeed.
What I do not like is that people say " group but they keep kicking me out of their mailing list â when this is absolutely not true! We can discuss and can argue even violently but we do not lie. S.
On 31 May 2020, at 19:38, Bruce O'Neel <bruce.oneel@pckswarms.ch> wrote:
Hi,
So addressing only the crypto software issue and with the caveat that I am also not a lawyer but I have had to deal with certain aspects of this in the past....
Crypto software is one of those bizarre dual use items in terms of arms imports and exports. While we as geeks just think of this is software or mathematics and might be confused as to why governments care, governments do care deeply about this. And their way of expressing how much they care about this issue is by passing laws and prosecuting folks.
One of the easiest ways to get in trouble is for one to make the software available to residents and/or citizens of certain countries as well as available to people on a long list kept by different governments. We can have a long debate about the morality of this concept but those who make the laws have decided that is the law. And often these laws are crafted such that the executive can change important details on short notice and that puts the risk of prosecution at the whims of different world leaders.
The license that the software is released under is not important.
What Ron is stating is that squeak source supplied some additional protections to prevent accidentally making the software available to folks who the US feels should not have access.
If you have moved the software to another hosting provider without the permission or knowledge of the author, and therefore the owner of the software, you have put that person at additional risk. In addition you and the hosting provider are taking on additional risk.
If it was moved to GitHub I strongly recommend reviewing their policies on trade controls and what risks you assume.
https://help.github.com/en/github/site-policy/github-and-trade-controls <https://help.github.com/en/github/site-policy/github-and-trade-controls>
Finally I would strongly recommend talking to a competent legal advisor who is deeply familiar with the details of these laws. They are complex and highly variable between different parts of the world.
I know this seems like a lot of trouble and wasted time but you can spend a giant amount of time and money defending oneself from arms trafficking charges.
cheers
bruce
30 May 2020 14:43 Stéphane Ducasse <stephane.ducasse@inria.fr> wrote: Hi all
This is the week-end and we worked super well yesterday during the sprint. Lot of good enhancements - Thanks a lot to all the participants. I not really happy to be forced to do it on a sunny saturday but Iâm doing it to clarify points.
Esteban sent me this text that was posted on Squeak-Dev (I personally do not read squeak related forums because I have not the time and my focus is Pharo, its consortium, my team, my research and my family).
We have to react because - We do not really at ***all** understand this email - We did not kicked anybody from our mailing-list from ages - so ron is lying. In the past we even had discussion with ron - so we do not really understand. May be we got problem to log on our mailing-lists. We have no idea because we are working and not looking at such things. - When we migrated smalltalkhub to readonly we payed attention to make sure that private projects stay private. We did not migrated smalltalkhub for fun. We MUST do it or it will be done by our infrastructure! - Now the cryptography packages are MIT and they are public anyway. So again we do not understand anything.
We do not get why Ron contacted us because we announced the migration publicly way in advance and we will keep the Smalltalkhub frozen repo for at least next 5 years.
I feel really sorry to hear such kind of email because we do not want to fight with anybody. Our goal is to make sure that people can work with Pharo and expand their business and knowledge. We are working hard to make sure that people can invent their future with Pharo and people that know us personally know that we are not lying.
S
Hi all,
I've tried to work with the Pharo group but they keep kicking me out of their mailing list. I've already mentioned this a number of times to the Pharo group but nobody seems to care.
BOLD BOLD BOLD PLEASE TAKE THIS SERIOUSLY BOLD BOLD BOLD
I am not a lawyer but we used very good lawyers to make the squeaksource repository a safe place to do cryptography work. If you are working on cryptography DO NOT POST your code anywhere except squeaksource. Especially if you are in the USA. The ONLY repository that is approved to host our cryptography code in the USA and therefore not subject to criminal violations is squeaksource. It is a CRIME in the USA to move code and make it available on the internet for everyone to download! It must be hosted on squeaksoruce.com <http://squeaksoruce.com/> or another location that is also properly registered.
IF YOU COPIED CRYPTOGRAPHY CODE TO ANOTHER REPOSITORY THAT IS NOT REGISTERED I would recommend you delete it immediately.
END BOLD!
Please feel free to post this to the Pharo mailing list because they apparently do not want to hear from me!
All the best,
Ron Teitelbaum
-------------------------------------------- Stéphane Ducasse http://stephane.ducasse.free.fr <http://stephane.ducasse.free.fr/> / http://www.pharo.org <http://www.pharo.org/> 03 59 35 87 52 Assistant: Aurore Dalle FAX 03 59 57 78 50 TEL 03 59 35 86 16 S. Ducasse - Inria 40, avenue Halley, Parc Scientifique de la Haute Borne, Bât.A, Park Plaza Villeneuve d'Ascq 59650 France
-------------------------------------------- Stéphane Ducasse http://stephane.ducasse.free.fr / http://www.pharo.org 03 59 35 87 52 Assistant: Aurore Dalle FAX 03 59 57 78 50 TEL 03 59 35 86 16 S. Ducasse - Inria 40, avenue Halley, Parc Scientifique de la Haute Borne, Bât.A, Park Plaza Villeneuve d'Ascq 59650 France
Stef, that is a second problem. The main problem to me is solving the crypto stuff once and for all. And then I would like to know why people like Ron say things like this. But yes, shouldn't go without explanation/reaction! Norbert
Am 03.06.2020 um 00:13 schrieb Stéphane Ducasse <stephane.ducasse@inria.fr>:
What I do not like is that people say " group but they keep kicking me out of their mailing list â when this is absolutely not true!
We can discuss and can argue even violently but we do not lie.
S.
On 31 May 2020, at 19:38, Bruce O'Neel <bruce.oneel@pckswarms.ch <mailto:bruce.oneel@pckswarms.ch>> wrote:
Hi,
So addressing only the crypto software issue and with the caveat that I am also not a lawyer but I have had to deal with certain aspects of this in the past....
Crypto software is one of those bizarre dual use items in terms of arms imports and exports. While we as geeks just think of this is software or mathematics and might be confused as to why governments care, governments do care deeply about this. And their way of expressing how much they care about this issue is by passing laws and prosecuting folks.
One of the easiest ways to get in trouble is for one to make the software available to residents and/or citizens of certain countries as well as available to people on a long list kept by different governments. We can have a long debate about the morality of this concept but those who make the laws have decided that is the law. And often these laws are crafted such that the executive can change important details on short notice and that puts the risk of prosecution at the whims of different world leaders.
The license that the software is released under is not important.
What Ron is stating is that squeak source supplied some additional protections to prevent accidentally making the software available to folks who the US feels should not have access.
If you have moved the software to another hosting provider without the permission or knowledge of the author, and therefore the owner of the software, you have put that person at additional risk. In addition you and the hosting provider are taking on additional risk.
If it was moved to GitHub I strongly recommend reviewing their policies on trade controls and what risks you assume.
https://help.github.com/en/github/site-policy/github-and-trade-controls <https://help.github.com/en/github/site-policy/github-and-trade-controls>
Finally I would strongly recommend talking to a competent legal advisor who is deeply familiar with the details of these laws. They are complex and highly variable between different parts of the world.
I know this seems like a lot of trouble and wasted time but you can spend a giant amount of time and money defending oneself from arms trafficking charges.
cheers
bruce
30 May 2020 14:43 Stéphane Ducasse <stephane.ducasse@inria.fr <mailto:stephane.ducasse@inria.fr>> wrote: Hi all
This is the week-end and we worked super well yesterday during the sprint. Lot of good enhancements - Thanks a lot to all the participants. I not really happy to be forced to do it on a sunny saturday but Iâm doing it to clarify points.
Esteban sent me this text that was posted on Squeak-Dev (I personally do not read squeak related forums because I have not the time and my focus is Pharo, its consortium, my team, my research and my family).
We have to react because - We do not really at ***all** understand this email - We did not kicked anybody from our mailing-list from ages - so ron is lying. In the past we even had discussion with ron - so we do not really understand. May be we got problem to log on our mailing-lists. We have no idea because we are working and not looking at such things. - When we migrated smalltalkhub to readonly we payed attention to make sure that private projects stay private. We did not migrated smalltalkhub for fun. We MUST do it or it will be done by our infrastructure! - Now the cryptography packages are MIT and they are public anyway. So again we do not understand anything.
We do not get why Ron contacted us because we announced the migration publicly way in advance and we will keep the Smalltalkhub frozen repo for at least next 5 years.
I feel really sorry to hear such kind of email because we do not want to fight with anybody. Our goal is to make sure that people can work with Pharo and expand their business and knowledge. We are working hard to make sure that people can invent their future with Pharo and people that know us personally know that we are not lying.
S
Hi all,
I've tried to work with the Pharo group but they keep kicking me out of their mailing list. I've already mentioned this a number of times to the Pharo group but nobody seems to care.
BOLD BOLD BOLD PLEASE TAKE THIS SERIOUSLY BOLD BOLD BOLD
I am not a lawyer but we used very good lawyers to make the squeaksource repository a safe place to do cryptography work. If you are working on cryptography DO NOT POST your code anywhere except squeaksource. Especially if you are in the USA. The ONLY repository that is approved to host our cryptography code in the USA and therefore not subject to criminal violations is squeaksource. It is a CRIME in the USA to move code and make it available on the internet for everyone to download! It must be hosted on squeaksoruce.com <http://squeaksoruce.com/> or another location that is also properly registered.
IF YOU COPIED CRYPTOGRAPHY CODE TO ANOTHER REPOSITORY THAT IS NOT REGISTERED I would recommend you delete it immediately.
END BOLD!
Please feel free to post this to the Pharo mailing list because they apparently do not want to hear from me!
All the best,
Ron Teitelbaum
-------------------------------------------- Stéphane Ducasse http://stephane.ducasse.free.fr <http://stephane.ducasse.free.fr/> / http://www.pharo.org <http://www.pharo.org/> 03 59 35 87 52 Assistant: Aurore Dalle FAX 03 59 57 78 50 TEL 03 59 35 86 16 S. Ducasse - Inria 40, avenue Halley, Parc Scientifique de la Haute Borne, Bât.A, Park Plaza Villeneuve d'Ascq 59650 France
-------------------------------------------- Stéphane Ducasse http://stephane.ducasse.free.fr <http://stephane.ducasse.free.fr/> / http://www.pharo.org <http://www.pharo.org/> 03 59 35 87 52 Assistant: Aurore Dalle FAX 03 59 57 78 50 TEL 03 59 35 86 16 S. Ducasse - Inria 40, avenue Halley, Parc Scientifique de la Haute Borne, Bât.A, Park Plaza Villeneuve d'Ascq 59650 France
participants (6)
-
Bruce O'Neel -
Jerry Kott -
Norbert Hartl -
Richard Sargent -
Stéphane Ducasse -
Sven Van Caekenberghe