Remix.run Logo
lrvick 2 days ago

No need to hack the law. Our FOSS code is constitutionally protected free speech and I would defend on those grounds.

The technical design of the project just makes it so no one can force changes on the distro unwanted by the maintainer team regardless of any courtroom outcomes.

Like, what if someone made a law that said Bitcoin nodes must KYC? They could make the law I guess, and the international network operators would just laugh at it.

kube-system 2 days ago | parent | next [-]

> Our FOSS code is constitutionally protected free speech and I would defend on those grounds.

You have precisely zero additional speech rights as a FOSS project than any other organization has. If "free speech" was a valid defense for you, then Meta would be doing the same.

> The technical design of the project just makes it so no one can force changes on the distro unwanted by the maintainer team regardless of any courtroom outcomes.

Being unable to comply is not a valid legal defense.

> Like, what if someone made a law that said Bitcoin nodes must KYC? They could make the law I guess, and the international network operators would just laugh at it.

This is the law in various places under various mechanisms. It is handled by putting people in prison or taking people's assets.

lrvick 2 days ago | parent | next [-]

Okay well if they want to jail me for being unable to comply with violating the privacy of the users of the Linux distro I work on it. Cool, I guess.

They would sure be wasting a lot of resources and public goodwill with absolutely no positive outcome for their agenda. Which is why I do not think it will actually happen.

But if it does, it does. Not going to live my life in fear, I have more security and privacy tools to ship :)

kube-system 2 days ago | parent [-]

I don’t think they’re going to spend any resources on going after you because:

* your project might not even qualify under the text of the law

* even if it did, the number of children using it to access social media is likely zero

lrvick a day ago | parent | next [-]

Oh, we will be supporting desktop/ubuntu style use cases soon. Position will remain the same though. And, agreed, they will still ignore us. But sick of seeing bigger projects cave to this nonsense.

But, none of this was about protecting kids. It never was.

voakbasda a day ago | parent [-]

They will ignore you right up until precedents are establish for a process to effectively prosecute any holdouts. Sure, first they will come for bigger fish, but then they will come for you.

lrvick 20 hours ago | parent [-]

they can try

a day ago | parent | prev [-]
[deleted]
DennisP 2 days ago | parent | prev | next [-]

Unless the PGP decision has been overturned, code as free speech is in fact a valid defense. If the government couldn't stop code they claimed were "munitions" from getting distributed, then it seems unlikely that they'll stop a Linux distro.

Corporations do whatever seems most profitable. We can't base our understanding of constitutional rights on whether Meta decides to defend them.

otterley 2 days ago | parent [-]

There was no "PGP decision." You're making that up.

DennisP 2 days ago | parent | next [-]

Maybe try google before making statements like that. The decision was Bernstein vs. US.

Prior to that, export controls prevented PGP source code from being exported from the US. Advocates printed it in books and exported those, which helped clarify the issue.

Bernstein was a math student who made his own encryption software. The government tried to make him register as an arms dealer, and he sued in 1996, with the backing of the EFF. The result was a landmark decision that established source code as free speech and basically destroyed export controls on cryptography.

In 2016, Apple cited the decision when the government tried to hack a suspect's phone, saying they couldn't be compelled to "speak" by writing code.

otterley 2 days ago | parent | next [-]

It is you who needs to do your research. That was not PGP. The Bernstein case was about Snuffle.

In that very same case, the Ninth Circuit Court of Appeals said:

"We emphasize the narrowness of our First Amendment holding. We do not hold that all software is expressive. Much of it surely is not. Nor need we resolve whether the challenged regulations constitute content-based restrictions, subject to the strictest constitutional scrutiny, or whether they are, instead, content-neutral restrictions meriting less exacting scrutiny. We hold merely that because the prepublication licensing regime challenged here applies directly to scientific expression, vests boundless discretion in government officials, and lacks adequate procedural safeguards, it constitutes an impermissible prior restraint on speech."

DennisP 2 days ago | parent [-]

Yes, I mentioned that Bernstein made his own software. But that was in the context of a huge public controversy over encryption regulations, mostly focused on PGP, and after the Bernstein decision, the Clinton administration eased up on export restrictions and moved them to the Commerce department. Junger vs Daley strengthened the Bernstein decision, ruling that all source code is protected speech.

https://en.wikipedia.org/wiki/Junger_v._Daley

otterley 2 days ago | parent [-]

Yes, Junger v. Daley held that source code is speech for the purpose of First Amendment analysis in the Sixth Circuit. (The question has not yet been presented to the Supreme Court.)

But the inquiry doesn't stop there. First Amendment jurisprudence doesn't stop at asking the question "is this speech?". That's just a threshold question. If the answer is "no," then the case is analyzed one way. If the answer is "yes," then the case analyzed a different way. Think of it like a decision step in a flowchart.

Code being treated as speech doesn't automatically mean that software developers can do whatever they want, just like it doesn't mean that people who write, draw, make music, etc. can do whatever they want. It's not the magic unassailable defense you claim it to be. Courts will apply a balancing test to determine whether the Government's interest in prohibiting the speech outweighs the Constitutional interest in protecting it. The answer comes out different ways depending on the facts and the law, which is complicated.

For example, it's unlawful to make and distribute CSAM. It's unlawful to defame someone. It's unlawful to defraud someone. It's unlawful to violate others' copyrights. You have to label food and medicine a certain way. These are all forms of speech, but the courts have held that none of these restrictions (or requirements) violate the First Amendment. And I don't think we'd all be cheering someone on and claiming "code is speech" for someone who writes ransomware or software whose sole purpose is to drain your bank accounts or shut down power plants.

DennisP 2 days ago | parent [-]

I didn't claim it's a magic unassailable defense. I claimed, contrary to the previous comment, that it's a valid defense. Maybe the courts will carve out a new exception for some particular type of code, maybe they won't, but what they certainly won't do is laugh at you for defending your code on free speech grounds. Just because a legislature passes a law doesn't mean the courts will agree that the law is valid under the Constitution.

And the bar for compelling any particular speech is generally quite high. Apple could not be compelled to put a backdoor in an iPhone, even though the suspect was the San Bernardino shooter, and this did not result in Apple losing their ability to sell iPhones. The courts may well hold that you can't compel a Linux distro to implement a particular feature either.

kube-system a day ago | parent | next [-]

> And the bar for compelling any particular speech is generally quite high. Apple could not be compelled to put a backdoor in an iPhone, even though the suspect was the San Bernardino shooter, and this did not result in Apple losing their ability to sell iPhones. The courts may well hold that you can't compel a Linux distro to implement a particular feature either.

That's an entirely different situation because Apple couldn't have complied with silence. A product compliance requirment doesn't typically count as compelled speech because you can comply with silence.

For instance, COPPA is a very similar law, and it is not compelled speech, because nobody is forcing you to write software that checks if users are 13 or older. You can comply with COPPA by simply not writing software that collects data from users that are under 13. You are not being compelled because you literally have the option not to do it.

That is exactly the same in this case.

otterley 2 days ago | parent | prev [-]

This may be a matter of semantics. To me, a “valid defense” is a defense that always prevails—for example, that truth is a defense to a defamation claim in U.S. law. The rest, I call “possible defenses.”

Another possible definition, one you may have meant, is that there's a set of "invalid defenses" that could not possibly work, and the remainder are "valid" even if they might not prevail.

voakbasda a day ago | parent [-]

The courts are not deterministic. There will never be a universally valid defense, because crimes are not fungible. There can always be circumstances that change how the facts are interpreted.

busterarm 2 days ago | parent | prev [-]

That wasn't PGP, it was Snuffle.

busterarm 2 days ago | parent | prev [-]

Correct. This is so wildly misunderstood. Zimmermann was investigated for 3 years but formal charges were never filed.

greyface- 2 days ago | parent | prev | next [-]

> Being unable to comply is not a valid legal defense.

Sure it is. Lawyers even have a pithy Latin maxim about it: lex non cogit ad impossibilia.

kube-system 2 days ago | parent [-]

If you could stop doing that thing, it isn't an impossibility under lex non cogit ad impossibilia.

nemomarx 2 days ago | parent [-]

what could they be compelled to stop doing here? Mechanically speaking, I mean. I can imagine fines or contempt of court, etc

But how would you remove an international distro from "the marketplace" if it's free and not operating a business?

kube-system 2 days ago | parent | next [-]

It's not that complicated.

If there's a law that says "Anyone who distributes X must also Y" and you can't figure out a way to continue distributing X while also doing Y, the way you comply with the law is that you stop distributing X.

DoctorOetker 2 days ago | parent | next [-]

None of this answers the question: even if @Irvick stops distributing or participating in any way with this "stagex" distro, that "stagex" distro continues its life outside of the jurisdiction, at most you start treating it like contraband drugs within your jurisdiction.

With LLM's anyone will be able to disengage such "default wars" in popular software, so there isn't really any border control when LLM's form a large surface area of the border.

kube-system 2 days ago | parent [-]

That’s always been the case for things distributed on the internet. It’s irrelevant in terms of evaluating one’s personal compliance with the law.

DoctorOetker a day ago | parent [-]

> It’s irrelevant in terms of evaluating one’s personal compliance with the law.

That's precisely what I discussed: the case where this person fully complies and ceases distribution (but the distro doesn't cease being distributed by others).

kube-system a day ago | parent [-]

So what? That's how all laws work. What if I don't rob my local convenience store, but someone else does?

Don't make the mistake of logically getting caught up on the idea of laws "preventing crime". They never have, and they never will. The deter crime by providing for penalties when someone breaks the law.

DoctorOetker 17 hours ago | parent [-]

But they don't deter crime when people outside of the jurisdiction, or anyone inside the jurisdiction can provide for themselves with the help of LLM's.

kube-system 37 minutes ago | parent [-]

Every law only applies inside of the jurisdiction where it applies. That's the nature of how political boundaries work, it has nothing to do with LLMs.

PaulDavisThe1st 2 days ago | parent | prev [-]

"Distributing" is doing a lot of work here.

A file hosted on foreign server might functionally be a system to "distribute" that file, but it is doubtful if a US state could prevent it from existing.

They could theoretically order US ISP's to cease providing access to said file, but that's a rabbit hole I'm not sure that Illinois or any other state really wants to go down.

kube-system 2 days ago | parent [-]

Yes, most any law is primary enforced against people within the same legal jurisdiction. It matters less where the server is and more where the relevant people/organizations/assets are.

Major OS providers, including major Linux distributions, are all within reasonable reach of Illinois law.

It’s probably less relevant if you’re a hobbyist working on Hannah Montana Linux on the other side of the planet.

wtallis 2 days ago | parent | prev | next [-]

If anyone is distributing it within Illinois jurisdiction (or maybe even distributing it elsewhere while maintaining a business presence in Illinois), they could be at risk of qualifying as an operating system provider under Illinois law.

taneq 2 days ago | parent [-]

How does that work with data on a server outside of the jurisdiction, that’s freely available to download and re-upload? The ‘local legal presence’ thing might work, but then what if they only distribute it on (say) a thumb drive, sent outside the jurisdiction, which is then uploaded by a third party? This whole thing seems unenforceable (or worse, arbitrarily enforceable).

kube-system 2 days ago | parent [-]

A court will care about what you do in the jurisdictions where it has power over you. What anyone else does is their problem, not yours.

Some oddball Linux distro really has no relevance to the larger picture that lawmakers are trying to accomplish though. The vast majority of kids are using iphone/android/mac/chromebook/windows. Basically zero are using esoteric container images to access TikTok.

hellojesus a day ago | parent [-]

But wouldn't this type of law drive youth to using more exotic distributions to get around the issue? It's not far fetched to think that kids will just live boot from tails or another distro to visit socials and circumvent this rule. Plus with unlocked pixel bootloaders it would be trivial for them to petition their parents for a pixel, hard reset it, unlock the bootloader, install grapheneos via the web installer, and then be on their way. If parents don't know how to monitor their kids I doubt they'll notice grapheneos not being base android.

kube-system a day ago | parent [-]

What is this bill blocking that kids want so bad that they'd go through the trouble to do that... and lose blue bubbles with their friends?

The ability to receive specifically unsolicited DMs from adult strangers?

Opting in to behavioral tracking?

This bill doesn't block social media for kids... I expect their response to be simply that they keep using social media on their phone the way they already do.

hellojesus 17 hours ago | parent [-]

Perhaps I'm just too old and don't use mainstream socials outside of HN, but when I was growing up the very act of knowing I was on a "child" account was reason to break out of it alone. I broke a lot of operating systems that way but also got good at repairing them. Jailbreaking was normal. War driving was normal. Breaking WEP just because you could was normal. Later, watching your neighbors go crazy over the fence as you deauthed their devices from their network was normal. It was just part of being a kid and having fun learning about the world.

kube-system 35 minutes ago | parent [-]

By far the vast majority of children did not have that experience in the past, nor do they today.

otterley 2 days ago | parent | prev [-]

Same way anything else gets pulled from distribution. You shut down the servers, destroy keys, remove files, etc. Sure, the files may remain in circulation from unofficial sources, but that's not your problem, as long as you're no longer facilitating it.

lrvick 19 hours ago | parent [-]

We are fairly unique for a Linux OS in that we have no central servers, and there are no central keys, and no central entity to even send a C&D to. Everything is a quorum of privately owned hardware, so truly I do not know what mechanism they could even try.

tessierashpool 2 days ago | parent | prev | next [-]

> If "free speech" was a valid defense for you, then Meta would be doing the same.

Meta lobbied heavily for this. The fact that they have not decided to use free speech to fight the move that they are lobbying for is not an argument that free speech is irrelevant here.

This is not legal advice but a personal request: please do not get your legal advice from Hacker News. Get it from a lawyer.

lrvick 2 days ago | parent | next [-]

Meta is a company. I am an individual.

kube-system 2 days ago | parent | prev [-]

Alright, then let me rephrase:

> If "free speech" was a valid defense to any legal compliance laws that affect software, then any software company would raise this defense this rather than comply.

DennisP 2 days ago | parent [-]

And in fact, Apple in 2016 went to court rather than comply with the government's order to put a backdoor in the iPhone, and they argued their case in part on free speech grounds.

Whether other companies do the same depends on what they consider the most profitable path, including legal fees and risk.

otterley a day ago | parent [-]

Don’t read too much into the Apple case. There was no precedent set by that. The FBI withdrew their demands after they found a different mechanism to obtain what they needed.

DennisP a day ago | parent [-]

Of course there was no precedent set. They were using a precedent that had already been set. We'll never know how it would have turned out, but the previous comment implied that corporations always comply rather than going to court on the grounds that code is speech, so I posted a well-known counterexample.

nobody9999 2 days ago | parent | prev | next [-]

>If "free speech" was a valid defense for you, then Meta would be doing the same.

Is that some sort of in joke? Meta loves more surveillance, more data and more info about their vassals^W users.

I'm sure their lobbyists were pushing hard to get this law passed.

s3p 2 days ago | parent | prev [-]

[dead]

otterley 2 days ago | parent | prev | next [-]

The concern here is probably with the shipping of the product (i.e. the binary artifacts), not the code itself. I can imagine a situation in which you could continue to make the code available, but could not produce a shippable artifact from it that Illinoians could access.

lrvick 2 days ago | parent [-]

If they are successful at doing so, then those distribution methods were too brittle.

I expect in response one of the maintainers outside US jurisdiction of their own volition publishes via bittorrent, tor hidden services, and embedding blobs in public blockchains with no help from me.

Then the problem the legislators sought to solve just got a lot worse, while calling a lot of attention to how little power they actually have to control decentralized FOSS software projects.

Of course another point of the project is building the entire thing from source code with deterministic results only takes a few hours. For many, this would be faster than downloading artifacts.

It is not needed for maintainers to publish binaries at all. Publishing signatures on the expected hashes would suffice at worst.

kube-system 2 days ago | parent [-]

The person you replied to is using "could"/"could not" to mean "would comply with the law"/"would not comply with the law"

Nobody here is saying that anyone is going to swoop in and physically prevent this software from being distributed on the internet.

> Then the problem the legislators sought to solve just got a lot worse, while calling a lot of attention to how little power they actually have to control decentralized FOSS software projects.

The legislators who passed this don't give a shit about that. Their intended target of this legislation is mainstream devices and mainstream users.

lrvick 2 days ago | parent [-]

Agreed. They are never going to actually come for niche Linux distros. All the more reason I am pushing back on all the fear.

The correct response from the Linux community is to say "fuck off", and get back to making their distros more secure, more private, and easier to use.

kube-system 2 days ago | parent | next [-]

Major distros will comply because they want to sell their services in Illinois.

I don’t think noncompliance of a container image is much of a “fuck you” since I don’t think lawmakers have ever heard of you nor would they really care about your compliance anyway.

This bill is primarily about kids using smartphones.

lrvick a day ago | parent [-]

Containers, desktop, server. We do all of it.

Anyway. Kids are an excuse to get it passed. It is about testing the waters of how much control can be exerted by government on end user devices, and we need all maintainers to hold the line.

otterley 2 days ago | parent | prev [-]

[flagged]

iamnothere 2 days ago | parent [-]

I see you’ve moved on to personal attacks, failing the “friendly advice” angle.

otterley a day ago | parent [-]

"Don't be an Internet Tough Guy" is among my friendly advice. People can see right through it, and it often works against you.

singleshot_ 14 hours ago | parent | prev | next [-]

No, not all code is constitutionally protected free speech. Generally speaking, code can be considered speech, but it can also be considered defamation, a munition that could not be exported, a dangerous device that a convicted person could not possess, or a number of other Very Bad Things that could get a fella in a jam.

Look to Universal Studios v. Corley for an example of code (speech) that is nonetheless not free, because the government has an interest and can regulate subject to intermediate scrutiny.

> Truly I dare someone to try to take me to court over this. Would be great publicity for our coercion resistant approach.

IANYL but that’s commendable. Ain’t a lot of people got a code to live by anymore. But it’s double the reason you should touch base with an attorney. Remember this: test cases have to know what they’re testing. If you want to move the law forward you have to break it correctly.

pornel 2 days ago | parent | prev | next [-]

Technical solutions may be seen as kindly as handcuffing yourself to something when told to leave. "I can't, I've made it impossible for myself to obey the law".

They might not be able to break your private keys, but they can fine you or jail you for not complying.

lrvick 2 days ago | parent [-]

I could, at worst, resign from the project. International maintainers would carry on the work, but I will never be compelled to write code I do not wish to write.

aleph_minus_one 2 days ago | parent | prev | next [-]

> No need to hack the law. Our FOSS code is constitutionally protected free speech and I would defend on those grounds.

"Der Proceß" [The Trial] by Franz Kafka is just a realistic description of the court system (Franz Kafka studied law).

wkrsz 2 days ago | parent | prev [-]

What if you "complied" and released your personal version/fork with age verification that no one would use?

lrvick 2 days ago | parent [-]

I could probably play games like this, but I outright do not believe this law is constitutionally valid, and believe it must be challenged by anyone they try to wield it against.

I would refuse to even give the appearance of compliance in hope to motivate others to do the same.