incubator-ooo-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Rob Weir <robw...@apache.org>
Subject Re: Request dev help: Info for required crypto export declaration
Date Thu, 01 Sep 2011 18:52:46 GMT
On Thu, Sep 1, 2011 at 2:38 PM, Dennis E. Hamilton
<dennis.hamilton@acm.org> wrote:
> Please just do it this way:
>
> <http://www.apache.org/dev/crypto.html>
>

That's what I've been looking at from the start.  I don't just make
these things up in my sleep.

> ASF is very clear on what is required for *its* releases and this page appears to be
comprehensive.
>

Yes, and for the very first step, we need to classify per an ECCN
code.  To do that we need to understand the cryptographic support the
code provides.

I think we should try to understand this in detail, even if it just
boils down ultimately to a code for this regulation.  These details
are also relevant to procurement regulations for the Federal
government, and other governments as well.  So it will be good have a
comprehensive list of what algorithms we are using in general.

-Rob

> (I finally found where I saw this before.  It has also been discussed here or on the
ooo-private list before.  I remembered it as being simpler than it is.)
>
>  - Dennis
>
>
> -----Original Message-----
> From: rabastus@gmail.com [mailto:rabastus@gmail.com] On Behalf Of Rob Weir
> Sent: Thursday, September 01, 2011 09:15
> To: ooo-dev@incubator.apache.org
> Subject: Re: Request dev help: Info for required crypto export declaration
>
> On Thu, Sep 1, 2011 at 11:51 AM, Danese Cooper <danese@gmail.com> wrote:
>> On Wed, Aug 31, 2011 at 9:30 AM, Rob Weir <rob@robweir.com> wrote:
>>
>>> On Wed, Aug 31, 2011 at 12:29 PM, Dennis E. Hamilton
>>> <dennis.hamilton@acm.org> wrote:
>>>
>>
>>
>>> <snip>
>>>
>>
>>
>>> >> 1) Was something similar every done for OpenOffice.org?  Most software
>>> >> companies are aware of this US export regulation and do this
>>> >> declaration as a matter of routine.  But not all open source projects
>>> >> are as diligent as ASF is.  So it is possible that OOo never did this
>>> >> before.  But if they did, we could reuse much of their paperwork.
>>> >
>>> > AFAIR Sun did that some time ago, but I'm not 100% sure.
>>>
>>
>> Yes, Sun did this (probably for every official "release").
>>
>
> If so, this might have been kept on the corporate side, not on the
> community website.
>
> For example, searching Google for "site:openoffice.org ECCN" shows
> several requests for this information [1] [2] [3] over the years, but
> no useful responses.
>
> Looks like LO discussed it briefly [4], but dismissed it under the
> misapprehension that since they are not in the US, the regulation is
> irrelevant.   We'll obviously want to do better here.  It may not make
> a much of a difference to the individual downloaded of AOOo, but this
> paperwork is essential for anyone who might want to bundle AOOo with
> laptops, for example.  The location of the project is not the solitary
> relevant fact.  The location of the users and re-distributors is the
> key thing.
>
> [1] http://openoffice.org/projects/www/lists/users/archive/2004-12/message/24
>
> [2] http://openoffice.org/projects/marketing/lists/dev/archive/2005-11/message/204
>
> [3] http://openoffice.org/projects/www/lists/users/archive/2009-12/message/653
>
> [4] http://comments.gmane.org/gmane.comp.documentfoundation.discuss/6138
>
> I'll check what we did for IBM Lotus Symphony.
>
> -Rob
>
>
>> Danese
>>
>
>

Mime
View raw message