On Thu, Sep 1, 2011 at 2:38 PM, Dennis E. Hamilton <[email protected]> wrote: > Please just do it this way: > > <http://www.apache.org/dev/crypto.html> >
That's what I've been looking at from the start. I don't just make these things up in my sleep. > ASF is very clear on what is required for *its* releases and this page > appears to be comprehensive. > Yes, and for the very first step, we need to classify per an ECCN code. To do that we need to understand the cryptographic support the code provides. I think we should try to understand this in detail, even if it just boils down ultimately to a code for this regulation. These details are also relevant to procurement regulations for the Federal government, and other governments as well. So it will be good have a comprehensive list of what algorithms we are using in general. -Rob > (I finally found where I saw this before. It has also been discussed here or > on the ooo-private list before. I remembered it as being simpler than it is.) > > - Dennis > > > -----Original Message----- > From: [email protected] [mailto:[email protected]] On Behalf Of Rob Weir > Sent: Thursday, September 01, 2011 09:15 > To: [email protected] > Subject: Re: Request dev help: Info for required crypto export declaration > > On Thu, Sep 1, 2011 at 11:51 AM, Danese Cooper <[email protected]> wrote: >> On Wed, Aug 31, 2011 at 9:30 AM, Rob Weir <[email protected]> wrote: >> >>> On Wed, Aug 31, 2011 at 12:29 PM, Dennis E. Hamilton >>> <[email protected]> wrote: >>> >> >> >>> <snip> >>> >> >> >>> >> 1) Was something similar every done for OpenOffice.org? Most software >>> >> companies are aware of this US export regulation and do this >>> >> declaration as a matter of routine. But not all open source projects >>> >> are as diligent as ASF is. So it is possible that OOo never did this >>> >> before. But if they did, we could reuse much of their paperwork. >>> > >>> > AFAIR Sun did that some time ago, but I'm not 100% sure. >>> >> >> Yes, Sun did this (probably for every official "release"). >> > > If so, this might have been kept on the corporate side, not on the > community website. > > For example, searching Google for "site:openoffice.org ECCN" shows > several requests for this information [1] [2] [3] over the years, but > no useful responses. > > Looks like LO discussed it briefly [4], but dismissed it under the > misapprehension that since they are not in the US, the regulation is > irrelevant. We'll obviously want to do better here. It may not make > a much of a difference to the individual downloaded of AOOo, but this > paperwork is essential for anyone who might want to bundle AOOo with > laptops, for example. The location of the project is not the solitary > relevant fact. The location of the users and re-distributors is the > key thing. > > [1] http://openoffice.org/projects/www/lists/users/archive/2004-12/message/24 > > [2] > http://openoffice.org/projects/marketing/lists/dev/archive/2005-11/message/204 > > [3] http://openoffice.org/projects/www/lists/users/archive/2009-12/message/653 > > [4] http://comments.gmane.org/gmane.comp.documentfoundation.discuss/6138 > > I'll check what we did for IBM Lotus Symphony. > > -Rob > > >> Danese >> > >
