Official statement regarding recent Greg’ commit 6e90b675cf942e from Serge Semin
Hello Linux-kernel community,
I am sure you have already heard the news caused by the recent Greg’ commit 6e90b675cf942e (“MAINTAINERS: Remove some entries due to various compliance requirements.”). As you may have noticed the change concerned some of the Ru-related developers removal from the list of the official kernel maintainers, including me.
The community members rightly noted that the quite short commit log contained very vague terms with no explicit change justification. No matter how hard I tried to get more details about the reason, alas the senior maintainer I was discussing the matter with haven’t given an explanation to what compliance requirements that was. I won’t cite the exact emails text since it was a private messaging, but the key words are “sanctions”, “sorry”, “nothing I can do”, “talk to your (company) lawyer”… I can’t say for all the guys affected by the change, but my work for the community has been purely volunteer for more than a year now (and less than half of it had been payable before that). For that reason I have no any (company) lawyer to talk to, and honestly after the way the patch has been merged in I don’t really want to now. Silently, behind everyone’s back, bypassing the standard patch-review process, with no affected developers/subsystem notified - it’s indeed the worse way to do what has been done. No gratitude, no credits to the developers for all these years of the devoted work for the community. No matter the reason of the situation but haven’t we deserved more than that? Adding to the GREDITS file at least, no?..
I can’t believe the kernel senior maintainers didn’t consider that the patch wouldn’t go unnoticed, and the situation might get out of control with unpredictable results for the community, if not straight away then in the middle or long term perspective. I am sure there have been plenty ways to solve the problem less harmfully, but they decided to take the easiest path. Alas what’s done is done. A bifurcation point slightly initiated a year ago has just been fully implemented. The reason of the situation is obviously in the political ground which in this case surely shatters a basement the community has been built on in the first place. If so then God knows what might be next (who else might be sanctioned…), but the implemented move clearly sends a bad signal to the Linux community new comers, to the already working volunteers and hobbyists like me.
Thus even if it was still possible for me to send patches or perform some reviews, after what has been done my motivation to do that as a volunteer has simply vanished. (I might be doing a commercial upstreaming in future though). But before saying goodbye I’d like to express my gratitude to all the community members I have been lucky to work with during all these years.
My main concern with this happening is how much secret control the US government has over top Linux maintainers. Many commenters say that Linus couldn’t refuse the request from the government because he lives in the US and Linux Foundation is in the US. So what other requests from the government known to put backdoors into software they couldn’t refuse in the past or won’t be able to refuse in the future?
I, too, do not want to be deleted out of existence by the US government/military and so i, too, comply with sanctions.
We have reason to believe Linus and the kernel team are not filling the kernel with government back doors (for the thing, there’s a high chance someone notices and makes it public that such code was put into the kernel by one of them). Linus has talked about refusing to do this in the past. However, it’s no surprise they’re not willing to risk the whole project for a handful of people working for Russian weapons manufacturers.
Yes, this is exactly my same thoughts.
This is terrifying.
I don’t like what the Russian government is doing and Putin is cruel and evil, albeit intelligent (which makes him even more terrible).
That being said, in the US, government agencies can order a company to do certain things, put in certain code, or whatever and then issue a gag order as part of that preventing disclosure. And although there’s a limit to how much that can screw over open-source software users, we do not know what exploits nation-states have, we don’t know what backdoors are in different chipsets or closed-source firmware.
If a developer writing open source code can be blacklisted so easily without transparency into the process, it suggests the company is being ordered to do certain things and not disclose them by the US government, which is a government that still engages in torture.
Notice how they are not coming out and saying “We were not ordered to do this by any government agency.”
Could the foundation be forced to elevate a developer with government ties who then is able to “accidentally” put in an extremely hard to detect exploit into linux that won’t be detected at first and only patched later?
I really wish companies associated with linux were not in a country that lacked transparency with government regulations and in which gag orders were not possible.