Re: Distributing the JSSE

[Peter Donald]

On Sat, 3 Nov 2001 01:30, Guillaume Rousse wrote:
> Sofar no one answered this mail... Does US crytopgraphy export restrictions
> apply to both version of JSSE, or only to domestic version ? And do these
> restictions apply everywhere, or only for US-based download location ?

the restrictions apply if the distributor is US based or site is in US. In 
your case I assume sourceforge is US based so unless you have all the proper 
paperwork I doubt they will be able to distribute - even on non-US mirrors.

-- 
Cheers,

Pete

-
We should take care not to make the intellect our 
god; it has, of course, powerful muscles, but no 
personality.
-


--
To unsubscribe, e-mail:   
For additional commands, e-mail: 

Re: Distributing the JSSE

[Craig R. McClanahan]

On Fri, 2 Nov 2001, Guillaume Rousse wrote:

> Date: Fri, 2 Nov 2001 15:30:56 +0100
> From: Guillaume Rousse <[EMAIL PROTECTED]>
> Reply-To: Jakarta General List <[EMAIL PROTECTED]>
> To: [EMAIL PROTECTED]
> Cc: [EMAIL PROTECTED]
> Subject: Re: Distributing the JSSE
>
> Ainsi parlait Kasper Nielsen :
> > > > so this is an US export law issue and not a Sun License issue?
> > >
> > > I think so. It would be possible to distribute it but it would take a lot
> >
> > of
> >
> > > work to get all paper work done and I think there was other conditions
> > > (ie must be us citizen, must get the connections from embargoed countries
> >
> > blocked
> >
> > > etc)
> >
> > thats strange on http://java.sun.com/products/jsse/index-102.html they have
> > a link to
> >
> > Download JSSE 1.0.2 global software and documentation with support for
> > strong encryption.
> >
> > and a Download JSSE 1.0.2 domestic (US/Canada) software and documentation
> > with support for strong encryption
> >
> > Don't know what the difference is, but I would imagine its legal to
> > distribute something that is allready allowed to be globally distributed?
> Sofar no one answered this mail... Does US crytopgraphy export restrictions
> apply to both version of JSSE, or only to domestic version ? And do these
> restictions apply everywhere, or only for US-based download location ?
>
> Said otherwise, can jpackage project (jpackage.sourceforge.net) provide JSSE
> global version packages, as any other Sun java API packages, eventually only
> on non-US mirrors, or is it a special case ?

Crypto is different because of US export laws.  The Sun redistribution
licenses for JSSE have the same basic terms as the redistribution licenses
for the other Java APIs (see the license you had to click through to
download it for details.)

> --
> Guillaume Rousse <[EMAIL PROTECTED]>
> GPG key http://lis.snv.jussieu.fr/~rousse/gpgkey.html
>

Craig


--
To unsubscribe, e-mail:   <mailto:[EMAIL PROTECTED]>
For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>

Re: Distributing the JSSE

[Berin Loritsch]

Guillaume Rousse wrote:
> 
> Ainsi parlait Kasper Nielsen :
> > > > so this is an US export law issue and not a Sun License issue?
> > >
> > > I think so. It would be possible to distribute it but it would take a lot
> >
> > of
> >
> > > work to get all paper work done and I think there was other conditions
> > > (ie must be us citizen, must get the connections from embargoed countries
> >
> > blocked
> >
> > > etc)
> >
> > thats strange on http://java.sun.com/products/jsse/index-102.html they have
> > a link to
> >
> > Download JSSE 1.0.2 global software and documentation with support for
> > strong encryption.
> >
> > and a Download JSSE 1.0.2 domestic (US/Canada) software and documentation
> > with support for strong encryption
> >
> > Don't know what the difference is, but I would imagine its legal to
> > distribute something that is allready allowed to be globally distributed?
> Sofar no one answered this mail... Does US crytopgraphy export restrictions
> apply to both version of JSSE, or only to domestic version ? And do these
> restictions apply everywhere, or only for US-based download location ?

The latest version of JSSE complies with US restrictions for most countries.
However, US export law forbids ANY type of encryption to certain countries
(mostly known for supporting or allowing terrorist activity).

> Said otherwise, can jpackage project (jpackage.sourceforge.net) provide JSSE
> global version packages, as any other Sun java API packages, eventually only
> on non-US mirrors, or is it a special case ?

It is a special case, as certain countries are not allowed to get ANY type
of US encryption technologies.

> --
> Guillaume Rousse <[EMAIL PROTECTED]>
> GPG key http://lis.snv.jussieu.fr/~rousse/gpgkey.html
> 
> --
> To unsubscribe, e-mail:   
> For additional commands, e-mail: 


-- 

"Those who would trade liberty for
 temporary security deserve neither"
- Benjamin Franklin

--
To unsubscribe, e-mail:   
For additional commands, e-mail: 

Re: Distributing the JSSE

[Guillaume Rousse]

Ainsi parlait Kasper Nielsen :
> > > so this is an US export law issue and not a Sun License issue?
> >
> > I think so. It would be possible to distribute it but it would take a lot
>
> of
>
> > work to get all paper work done and I think there was other conditions
> > (ie must be us citizen, must get the connections from embargoed countries
>
> blocked
>
> > etc)
>
> thats strange on http://java.sun.com/products/jsse/index-102.html they have
> a link to
>
> Download JSSE 1.0.2 global software and documentation with support for
> strong encryption.
>
> and a Download JSSE 1.0.2 domestic (US/Canada) software and documentation
> with support for strong encryption
>
> Don't know what the difference is, but I would imagine its legal to
> distribute something that is allready allowed to be globally distributed?
Sofar no one answered this mail... Does US crytopgraphy export restrictions 
apply to both version of JSSE, or only to domestic version ? And do these 
restictions apply everywhere, or only for US-based download location ?

Said otherwise, can jpackage project (jpackage.sourceforge.net) provide JSSE 
global version packages, as any other Sun java API packages, eventually only 
on non-US mirrors, or is it a special case ?
-- 
Guillaume Rousse <[EMAIL PROTECTED]>
GPG key http://lis.snv.jussieu.fr/~rousse/gpgkey.html

--
To unsubscribe, e-mail:   
For additional commands, e-mail: 

RE: Distributing the JSSE

[Kief Morris]

Ylan Segal typed the following on 09:47 AM 10/26/2001 -0600
>>
>> so this is an US export law issue and not a Sun License issue?
>>
>I was under the impression that the US had lifted some of the export issues
>in regards to crypto. For example, in the past, browsers (like IE or
>Netscape) downloaded from outside the US (I live in Mexico) had only 40bit
>encryption. I could not access 128bit sites in the US with my browsers.
>About a year ago (if I am not mistaken) that changed and now I can use
>128bit sites jus fine.
>
>Just my $0.02

AFAIK (IANAL) they still require a lot of paperwork to get approval to 
export serious encryption. Netscape and Microsoft can afford to have
lawyers sort all that out for them. Also, it wouldn't be too surprising if
our fine representatives in Congress decided they could get some attention
by increasing restrictions on encryption, so that law abiding terrorists 
won't use it.

So, anybody living in a country with liberal crypto-laws want to write
a JSSE clone?

Kief


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Distributing the JSSE

[Kasper Nielsen]

- Original Message -
From: "Peter Donald" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, October 26, 2001 8:21 AM
Subject: Re: Distributing the JSSE


> >
> > so this is an US export law issue and not a Sun License issue?
>
> I think so. It would be possible to distribute it but it would take a lot
of
> work to get all paper work done and I think there was other conditions (ie
> must be us citizen, must get the connections from embargoed countries
blocked
> etc)
>
thats strange on http://java.sun.com/products/jsse/index-102.html they have
a link to

Download JSSE 1.0.2 global software and documentation with support for
strong encryption.

and a Download JSSE 1.0.2 domestic (US/Canada) software and documentation
with support for strong encryption

Don't know what the difference is, but I would imagine its legal to
distribute something that is allready allowed to be globally distributed?


- Kasper




-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Distributing the JSSE

[Craig R. McClanahan]

On Fri, 26 Oct 2001, Peter Donald wrote:

> Date: Fri, 26 Oct 2001 16:21:46 +1000
> From: Peter Donald <[EMAIL PROTECTED]>
> Reply-To: [EMAIL PROTECTED]
> To: [EMAIL PROTECTED]
> Subject: Re: Distributing the JSSE
>
> On Fri, 26 Oct 2001 02:16, Kasper Nielsen wrote:
> > > Because the amount of paperwork needed to legally distribute it is
> > > hge. The US export laws do allow non-profits and indviduals to
> > > distribute crypto things but they have to jump through a few hoops and
> >
> > make
> >
> > > sure they fill out oodles of stuff.
> > >
> > > Avalon was going to distribute it until Craig dropped a note on commons
> > > or ant list regarding this and gave a link. I followed it and it was much
> > > too much work to get it done legally so we dropped it. Craig do you still
> > > have that link ?
> >

I cannot find the original link that I forwarded, but got it off the JSSE
web site.  It had to do with the still-existing registration requirements
for people who want to export crypto software.

> > so this is an US export law issue and not a Sun License issue?
>
> I think so. It would be possible to distribute it but it would take a lot of
> work to get all paper work done and I think there was other conditions (ie
> must be us citizen, must get the connections from embargoed countries blocked
> etc)
>

Yep.

> --
> Cheers,
>
> Pete
>

Craig


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE: Distributing the JSSE

[Ylan Segal]

>
> so this is an US export law issue and not a Sun License issue?
>
I was under the impression that the US had lifted some of the export issues
in regards to crypto. For example, in the past, browsers (like IE or
Netscape) downloaded from outside the US (I live in Mexico) had only 40bit
encryption. I could not access 128bit sites in the US with my browsers.
About a year ago (if I am not mistaken) that changed and now I can use
128bit sites jus fine.

Just my $0.02

Ylan


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Distributing the JSSE

[Pier Fumagalli]

Kasper Nielsen at [EMAIL PROTECTED] wrote:
> 
> so this is an US export law issue and not a Sun License issue?

AFAIK (in theory, but I'm not a lawyer), it is...

Pier


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Distributing the JSSE

[Peter Donald]

On Fri, 26 Oct 2001 02:16, Kasper Nielsen wrote:
> > Because the amount of paperwork needed to legally distribute it is
> > hge. The US export laws do allow non-profits and indviduals to
> > distribute crypto things but they have to jump through a few hoops and
>
> make
>
> > sure they fill out oodles of stuff.
> >
> > Avalon was going to distribute it until Craig dropped a note on commons
> > or ant list regarding this and gave a link. I followed it and it was much
> > too much work to get it done legally so we dropped it. Craig do you still
> > have that link ?
>
> so this is an US export law issue and not a Sun License issue?

I think so. It would be possible to distribute it but it would take a lot of 
work to get all paper work done and I think there was other conditions (ie 
must be us citizen, must get the connections from embargoed countries blocked 
etc)

-- 
Cheers,

Pete

---
"Therefore it can be said that victorious warriors 
win first, and then go to battle, while defeated 
warriors go to battle first, and then seek to win." 
  - Sun Tzu, the Art Of War
---


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Distributing the JSSE

[Kasper Nielsen]

- Original Message -
From: "Peter Donald" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, October 25, 2001 2:48 AM
Subject: Re: Distributing the JSSE


> On Thu, 25 Oct 2001 01:45, Jon Stevens wrote:
> > Catalina does not distribute the JSSE (from the catalina/build.xml):
> >
> >   
> > 
> >   
> >
> > I would like to know why they don't redistribute it.
>
> Because the amount of paperwork needed to legally distribute it is
> hge. The US export laws do allow non-profits and indviduals to
> distribute crypto things but they have to jump through a few hoops and
make
> sure they fill out oodles of stuff.
>
> Avalon was going to distribute it until Craig dropped a note on commons or
> ant list regarding this and gave a link. I followed it and it was much too
> much work to get it done legally so we dropped it. Craig do you still have
> that link ?

so this is an US export law issue and not a Sun License issue?

-.Kasper



-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Distributing the JSSE

[Pier Fumagalli]

Jon Stevens at [EMAIL PROTECTED] wrote:

> Catalina does not distribute the JSSE (from the catalina/build.xml):
> 
> 
>   
> 
> 
> I would like to know why they don't redistribute it.

Export regulation, I believe... When you add that to (iv), we should
definitely check the originating IP address, and make sure we're not
exporting crypto stuff in places where we shouldn't... I believe that
regarding cryptographic software there are still a lot of hurdles to clear.

(I believe we don't even redistribute OpenSSL together with Apache 2.0, even
though it's required to build the SSL module in it).

Pier


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Distributing the JSSE

[Peter Donald]

On Thu, 25 Oct 2001 01:45, Jon Stevens wrote:
> Catalina does not distribute the JSSE (from the catalina/build.xml):
>
>   
> 
>   
>
> I would like to know why they don't redistribute it.

Because the amount of paperwork needed to legally distribute it is 
hge. The US export laws do allow non-profits and indviduals to 
distribute crypto things but they have to jump through a few hoops and make 
sure they fill out oodles of stuff. 

Avalon was going to distribute it until Craig dropped a note on commons or 
ant list regarding this and gave a link. I followed it and it was much too 
much work to get it done legally so we dropped it. Craig do you still have 
that link ? 

> I think (ii) is funny because from what I'm hearing is that Jboss has
> modified it and is distributing it because there is a serious classloader
> problem in it.

And we all know how JBoss only does things that are legal  right ?

-- 
Cheers,

Pete

--
 The fact that nobody understands you doesn't 
 mean you're an artist.
--

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Distributing the JSSE

[Jon Stevens]

on 10/23/01 7:38 PM, "Geir Magnusson Jr." <[EMAIL PROTECTED]> wrote:

> On 10/23/01 5:55 PM, "Jason van Zyl" <[EMAIL PROTECTED]> wrote:
> 
>> On 10/23/01 2:38 PM, "Jon Stevens" <[EMAIL PROTECTED]> wrote:
>> 
>>> on 10/23/01 10:40 AM, "Jason van Zyl" <[EMAIL PROTECTED]> wrote:
>>> 
 I want to distribute the JSSE jars with the Turbine Development Kit but I'm
 not entirely sure if it's legal. On the JSSE website it says that "the
 binary implementation may be used royalty-free as part of commercial
 applications", but in the license it says for internal use only?
>>> 
>>> It is not legal.
>> 
>> If that is indeed the case does anyone know of any JSSE implementations that
>> can be distributed?
>> 
> 
> 
> Why is it not legal?  According to the license posted by jason, there is a
> supplemental section that reads :
> 
> SUPPLEMENTAL LICENSE TERMS
> 
> These supplemental license terms ("Supplement") add to or
> modify the terms of the Binary Code License Agreement
> (collectively, the "Agreement"). Capitalized terms not
> defined in this Supplement shall have the same meanings
> ascribed to them in the Agreement. These Supplement terms
> shall supersede any inconsistent or conflicting terms in
> the Agreement, or in any license contained within the
> Software.
> 
> 1. License to Distribute. Sun grants you a non-exclusive,
> non-transferable, royalty-free, limited license to (a) use
> the binary form of the Software for the sole purpose of
> designing, developing and testing your JavaTM applets and
> applications intended to run on a compatible Java
> environment (the "Programs"), provided that the Programs
> add significant and primary functionality to the Software,
> and (b) reproduce and distribute the binary form of the
> Software through multiple tiers of distribution provided
> that you: (i) distribute the Software complete and
> unmodified; (ii) do not distribute additional software
> intended to supersede any component(s) of the Software;
> (iii) do not remove or alter any proprietary
> legends or notices contained in or on the Software; and
> (iv) only distribute the Software pursuant to a license
> agreement that protects Sun's interests consistent with the
> terms contained in this Agreement, and provides that Sun is
> a third party beneficiary to such license agreement. If you
> distribute the Software pursuant to this paragraph, you
> must include the following statement as part of product
> documentation (whether hard copy or electronic), as a
> part of a copyright page or proprietary rights notice
> page, in an "About" box or in any other form reasonably
> designed to make the statement visible to users of the
> Software:  "This product includes code licensed from
> RSA Data Security".
> 
> The only problem that I see is (iv).  Is that it?
> 

Catalina does not distribute the JSSE (from the catalina/build.xml):

  

  

I would like to know why they don't redistribute it.

I think (ii) is funny because from what I'm hearing is that Jboss has
modified it and is distributing it because there is a serious classloader
problem in it.

(iv) definitely doesn't make me feel real comfortable.

-jon


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Distributing the JSSE

[Kasper Nielsen]

- Original Message -
From: "Jason van Zyl" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, October 23, 2001 11:55 PM
Subject: Re: Distributing the JSSE


> On 10/23/01 2:38 PM, "Jon Stevens" <[EMAIL PROTECTED]> wrote:
>
> > on 10/23/01 10:40 AM, "Jason van Zyl" <[EMAIL PROTECTED]> wrote:
> >
> >> I want to distribute the JSSE jars with the Turbine Development Kit but
I'm
> >> not entirely sure if it's legal. On the JSSE website it says that "the
> >> binary implementation may be used royalty-free as part of commercial
> >> applications", but in the license it says for internal use only?
> >
> > It is not legal.
>
> If that is indeed the case does anyone know of any JSSE implementations
that
> can be distributed?
>

I seriously doubt anybody would waste time on creating another
implementation of JSSE, when the reference implementation is freely
available (with source code) and is included in future versions of java.

- Kasper
- Kasper




-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Distributing the JSSE

[Geir Magnusson Jr.]

On 10/23/01 5:55 PM, "Jason van Zyl" <[EMAIL PROTECTED]> wrote:

> On 10/23/01 2:38 PM, "Jon Stevens" <[EMAIL PROTECTED]> wrote:
> 
>> on 10/23/01 10:40 AM, "Jason van Zyl" <[EMAIL PROTECTED]> wrote:
>> 
>>> I want to distribute the JSSE jars with the Turbine Development Kit but I'm
>>> not entirely sure if it's legal. On the JSSE website it says that "the
>>> binary implementation may be used royalty-free as part of commercial
>>> applications", but in the license it says for internal use only?
>> 
>> It is not legal.
> 
> If that is indeed the case does anyone know of any JSSE implementations that
> can be distributed?
> 


Why is it not legal?  According to the license posted by jason, there is a
supplemental section that reads :

SUPPLEMENTAL LICENSE TERMS

These supplemental license terms ("Supplement") add to or
modify the terms of the Binary Code License Agreement
(collectively, the "Agreement"). Capitalized terms not
defined in this Supplement shall have the same meanings
ascribed to them in the Agreement. These Supplement terms
shall supersede any inconsistent or conflicting terms in
the Agreement, or in any license contained within the
Software.

1. License to Distribute. Sun grants you a non-exclusive,
non-transferable, royalty-free, limited license to (a) use
the binary form of the Software for the sole purpose of
designing, developing and testing your JavaTM applets and
applications intended to run on a compatible Java
environment (the "Programs"), provided that the Programs
add significant and primary functionality to the Software,
and (b) reproduce and distribute the binary form of the
Software through multiple tiers of distribution provided
that you: (i) distribute the Software complete and
unmodified; (ii) do not distribute additional software
intended to supersede any component(s) of the Software;
(iii) do not remove or alter any proprietary
legends or notices contained in or on the Software; and
(iv) only distribute the Software pursuant to a license
agreement that protects Sun's interests consistent with the
terms contained in this Agreement, and provides that Sun is
a third party beneficiary to such license agreement. If you
distribute the Software pursuant to this paragraph, you
must include the following statement as part of product
documentation (whether hard copy or electronic), as a
part of a copyright page or proprietary rights notice
page, in an "About" box or in any other form reasonably
designed to make the statement visible to users of the
Software:  "This product includes code licensed from
RSA Data Security".

The only problem that I see is (iv).  Is that it?


-- 
Geir Magnusson Jr. [EMAIL PROTECTED]
System and Software Consulting
"Whoever would overthrow the liberty of a nation must begin by subduing the
freeness of speech." - Benjamin Franklin



-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Distributing the JSSE

[Jason van Zyl]

On 10/23/01 2:38 PM, "Jon Stevens" <[EMAIL PROTECTED]> wrote:

> on 10/23/01 10:40 AM, "Jason van Zyl" <[EMAIL PROTECTED]> wrote:
> 
>> I want to distribute the JSSE jars with the Turbine Development Kit but I'm
>> not entirely sure if it's legal. On the JSSE website it says that "the
>> binary implementation may be used royalty-free as part of commercial
>> applications", but in the license it says for internal use only?
> 
> It is not legal.

If that is indeed the case does anyone know of any JSSE implementations that
can be distributed?
 
> -jon
> 
> 
> -
> To unsubscribe, e-mail: [EMAIL PROTECTED]
> For additional commands, e-mail: [EMAIL PROTECTED]

-- 

jvz.

Jason van Zyl

http://tambora.zenplex.org
http://jakarta.apache.org/turbine
http://jakarta.apache.org/velocity
http://jakarta.apache.org/alexandria
http://jakarta.apache.org/commons



-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Distributing the JSSE

[Jon Stevens]

on 10/23/01 10:40 AM, "Jason van Zyl" <[EMAIL PROTECTED]> wrote:

> I want to distribute the JSSE jars with the Turbine Development Kit but I'm
> not entirely sure if it's legal. On the JSSE website it says that "the
> binary implementation may be used royalty-free as part of commercial
> applications", but in the license it says for internal use only?

It is not legal.

-jon


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Distributing the JSSE

[Jason van Zyl]

Hi,

I want to distribute the JSSE jars with the Turbine Development Kit but I'm
not entirely sure if it's legal. On the JSSE website it says that "the
binary implementation may be used royalty-free as part of commercial
applications", but in the license it says for internal use only?

Here's the lic:

http://java.sun.com/products/jsse/LICENSE.txt

-- 

jvz.

Jason van Zyl

http://tambora.zenplex.org
http://jakarta.apache.org/turbine
http://jakarta.apache.org/velocity
http://jakarta.apache.org/alexandria
http://jakarta.apache.org/commons



-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]