Feds relax export curbs on open-source crypto
Hold the applause
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Federal restrictions will be relaxed on the export of open-source software that incorporates strong encryption, the US government announced on Friday in a lengthy disclosure.
The effect of the changes announced in the US Federal Register is that cryptography software now may be exported to Cuba, Iran, North Korea, Syria, and Sudan as long as the source code from which it was derived is already “publicly available”. To qualify for the exemption, exporters must first notify the federal government exactly where the code is located.
“It's a lot of words, but it actually has a very modest impact,” Roszel Thomsen, an attorney who represents software companies, told The Register. “That removes restrictions on exports to embargoed countries which frankly weren't big markets for US exporters anyway.”
The tweak comes as industry and public interest groups have chafed for years at a battery of rules spelled out under the EAR, or Export Administration Regulations. It requires companies and individuals in the US to follow a series of steps before making cryptographic software available abroad.
Chief among critics' complaints: The EAR applies to virtually all cryptographic software unless expressly exempted. They argue the regimen should be turned around so that the software is exempted unless specifically subject to export control.
“It's like Gulliver being tied down by a thousand strings, each one of which could be individually snapped, but collectively severely handicap the range of motion of companies and individuals in this space,” Thomsen, a partner with Thomsen and Burke, said. ®
COMMENTS
Feds cracked it then?
So basically the feds have a computer system now that can crack any encryption system (quantum computing) then. This is the only reason I can think of right now.
Cisco
Cisco are the same with their Routers and Switches - they ship without K9 images (and are therefore incapable of SSH)
The first thing we do is drop a K9 on every new router / switch we procure, then disable Telnet.
These stupid US export restrictions have probably been one of the major reasons why Telnet is still in use today, and has without a shadow of a doubt caused numerous security incidents due to lazy sys/network admins.
Maybe now manufacturers can start shipping all devices with SSH only, and resign telnet to the protocol graveyard where it should have gone over 10 years ago.
Operationally, convenient
Juniper tend to ship routers internationally *without* SSH in their installed software, which can be a bit of a pain in the arse. If you're in a *bare* DC/office and your corporate laptop has a restrictive personal firewall that prevents FTP, using SCP is much preferable to upgrade software.....a minor point, but I've run into it before :-)
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
