Subject: Re:[Mark Eichin <[email-masked]>] Re: xntp: Is it an `export' version?

From: Michael Shields <[email-masked]>
Date: Mon, 1 Jul 1996 19:39:40 +0000

At 1996-06-27 21:18 +0000, Mark Eichin wrote:
>A similar issue is with the Kerberos package -- I've got one (in fact
>if you are in the US you can get the free sources from Cygnus which
>include debian.rules and build it yourself.)

I'm guessing this is the V4 Kerberos?  I have a package of 5beta6 which is
not uploaded anywhere for legal reasons.  I also have a few other packages,
like the Amanda backup system, which have Kerberos support and are thus
restricted.  It would be nice to make these available.

>Is anyone interested in providing "US-ONLY" debian space?

I can provide the resources, but there are a lot of details to be sorted out.

--
Shields, CrossLink.

---

From: Mark Eichin <[email-masked]>
Date: 01 Jul 1996 16:21:11 -0400

> I'm guessing this is the V4 Kerberos?

Yes, I meant V4. 

>  I have a package of 5beta6 which is

Cool. (we should talk, offline, on how you did the 5beta6 packaging,
and possibly get it into the MIT release for real...)

> I can provide the resources, but there are a lot of details to be sorted out.

Yep. Where do you want to start?

---

From: Marek Michalkiewicz <[email-masked]>
Date: Tue, 2 Jul 1996 19:21:10 +0200 (MET DST)

Mark Eichin:
> Is anyone interested in providing "US-ONLY" debian space? I've got a
> few packages that could go there, if the site were responsible:
> 	cns4 (Cygnus Kerberos v4)
> 	cvs (with kerberos support for the remote code)
> 	cns5 (Kerberos V5)

Unfortunately I can't provide any "US-ONLY" space - instead,
here is a suggestion...

Let's make the Debian diffs for these packages available for
everyone - they don't contain any encryption code, so they
should be exportable.  This way it is possible for someone
outside the US to download the source from some non-US site
(I think I have seen the Kerberos v5 source distribution
available from idea.sec.dsi.unimi.it), package it for Debian
and make it available from a non-US site.  No one is exporting
the code from the US, and everyone should be happy...

On the other hand, we are already "international arms dealers"
anyway - PGP is available from any Debian mirror site, and DES
encryption code is in every copy of the standard Linux libc...

So, let's either distribute the munitions (kerberos, libc, pgp,
ssh, xntp) from a non-US site, or totally ignore the silly US
export restrictions.  Having a US-only export controlled site
is the worst possible solution IMHO (but then I am not in the
US, so I may be biased :-).  (Unless there is also a non-US
site, but then the US site is not really needed - links from
the US to, say, Finland are fast enough.)

Marek

---

From: Mark Eichin <[email-masked]>
Date: 02 Jul 1996 15:49:06 -0400

well, I can't afford the jail time nor can I risk the company I work
for by "just ignoring" the issue. As for just patches -- well, patches
to V5 might be reasonable -- but as for v4, the debian packaging is
already in the "upstream" release. :-)

As for cvs -- the kerberos calls are already in cvs as published; go
ahead and build your own version, that's easy - I'm talking about a
binary package (which, without shared libs for v4, of necessity
includes crypto code.)

As for getting the MIT V5 release - since it was done at MIT, having
it show up outside the US means *someone* exported it, though it may
simply have been someone outside the reach of US law. They don't
appear to be able to blame the site maintainers on that one though,
but then again, MIT has more lawyers than we have engineers...

> ssh, xntp) from a non-US site, or totally ignore the silly US

Feel free to set one up -- however, it won't help me distribute the
crypto-enhanced packages that *I* work on... and I'd like to be able
to make them widely available in the US.

Perhaps we should just get space on ftp.csua.berkeley.edu or maybe
ftp.csn.net (from a random sampling of the cypherpunks list) or maybe
I can cnovince Ted to set up a section on tsx-11 that's tagged the way
the section on athena-dist is...

---

From: Ian Jackson <[email-masked]>
Date: Mon, 8 Jul 96 02:00 BST

Mark Eichin writes ("[Mark Eichin <[email-masked]>] Re: xntp: Is it an `export' version?"):
> After I sent it, it occurred to me that debian-devel is a better place
> to ask this...					_Mark_
> 
...
> 	cvs (with kerberos support for the remote code)

I'm strongly opposed to these packages being made available `US-only'.

Instead some European developer should pick them up.  These things
(the upstream sources) are not hard to get from non-US FTP sites -
this may mean that they were illegally exported at some point in the
past, but there's no crime of `handling illegally exported goods' (as
there is for stolen goods).

We need an FTP site in Europe willing to be the master for our
security-related stuff, so that the primary FTP site is avoiding
distributing them to non-US sites.

What I propose is that we arrange that one of the European mirrors -
preferably a fast mirror willing to server other mirror sites - have a
`security' directory which isn't mirrored from master.  Instead,
people upload their security-related stuff there and master mirrors it
`in reverse'.  The Packages files will be slightly out of date in
these directories, we'll have to make do with that.

Even better would be for our master site to be out of the US.

Ian.

---

From: Mark Eichin <[email-masked]>
Date: 10 Jul 1996 14:22:53 -0400

> I'm strongly opposed to these packages being made available `US-only'.

Well, by all means get someone outside the US to do the work.

However, since that *hasn't happenned* I'm just looking for a way to
share the results of myself and others in the US *having done the work
already*.

> past, but there's no crime of `handling illegally exported goods' (as

I'm pretty sure that it is, in fact, illegal under US law to "import
something which has been *illegally exported*." I don't see it in the
itar text, but I've been informed of it in the past, so I'll try to
find a reference.

---

From: Michael Shields <[email-masked]>
Date: Fri, 12 Jul 1996 19:23:18 +0000

>there is for stolen goods).

There are two problems with this:

(a) Although there sometimes are European (or other non-US) developers,
they may not always be.  If there is no US-only site, then the software
might just not be made available.  This is the case now for Kerberos, and
for Kerberized apps.

(b) Although the software is often smuggled out of the US, it may not
always be available elsewhere on a timely basis.

Having a US-only site and American developers is suboptimal, I agree, but
it is useful.  I'm offering the archive site and some packages, and Mark
has some packages to put up as well.  I'm not saying that it would in the
abstract further development of crypto software -- I'm saying that the work
is done and it would be nice if other people could share and enjoy packages
which already exist.

--
Shields, CrossLink.

---

From: Chris Fearnley <[email-masked]>
Date: Tue, 16 Jul 1996 16:13:55 -0400 (EDT)

'Michael Shields wrote:'
>is done and it would be nice if other people could share and enjoy packages

The Debian diff file could be exported.  So a transition once a
team of developers in the free-world were found, would be easy.

-- 
Christopher J. Fearnley            |    Linux/Internet Consulting
[email-masked], [email-masked]       |    UNIX SIG Leader at PACS
http://www.netaxs.com/~cjf         |    (Philadelphia Area Computer Society)
ftp://ftp.netaxs.com/people/cjf    |    Design Science Revolutionary
"Dare to be Naive" -- Bucky Fuller |    Explorer in Universe