Remove sanctioned provider "beget"

[XakepSDK]

Welcome

• Yes, I'm using a binary release or the library within the two latest releases.
• Yes, I've searched for similar issues on GitHub and didn't find any.

Detailed Description

The hosting provider and a registrar "Beget" was sanctioned in the new 21st EU sanctions package.
https://www.opensanctions.org/entities/NK-e5CvLLxUoDtLNKg4kgWdWF/

Please, remove the support for the sanctioned entity.
Support for such entity violates GitHub ToS, mainly:

1. Section B Paragraph 3

You may not use GitHub in violation of export control or sanctions laws of the United States or any other applicable jurisdiction. You may not use GitHub if you are or are working on behalf of a Specially Designated National (SDN) or a person subject to similar blocking or denied party prohibitions administered by a U.S. government agency. GitHub may allow persons in certain sanctioned countries or territories to access certain GitHub services pursuant to U.S. government authorizations. For more information, please see our Export Controls policy.

2. Section C

Your use of the Website and Service must not violate any applicable laws, including copyright or trademark laws, export control or sanctions laws, or other laws in your jurisdiction. You are responsible for making sure that your use of the Service is in compliance with laws and any applicable regulations.

It's very likely that sharing this code through various channels violates ToS of those channels & laws of hosting countries.

Effective version of lego

v5.3.1

How do you use lego?

Docker image

In which context are you using lego?

Personal use

🌱 Supporting the Maintainers

• Yes, I find this project useful, and I appreciate the work done by the maintainers.
• Yes, I have starred this repository to help others find it.
• Yes, I have sponsored this project to keep the project stable and maintained.

Confirmation

• Yes, I've included all the information above (version, usage, etc.).

[ldez]

Having an implementation for this provider doesn't violate any ToS.

We are not providing any services, we don't use this service, this is only code, and this code can be share freely.

[XakepSDK]

That's a violation of European laws.

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02014R0833-20260717

Article 2

1. It shall be prohibited to sell, supply, transfer or export, directly or indirectly, dual-use > goods and technology, whether or not originating in the Union, to any natural or legal person, entity or body in Russia or for use in Russia.

▼M24
1a. The transit via the territory of Russia of the dual-use goods and technology, as referred to in paragraph 1, exported from the Union shall be prohibited.

▼M7
2.

It shall be prohibited to:
(a)
provide technical assistance, brokering services or other services related to the goods and technology referred to in paragraph 1 and to the provision, manufacture, maintenance and use of those goods and technology, directly or indirectly to any natural or legal person, entity or body in Russia or for use in Russia;
(b)
provide financing or financial assistance related to the goods and technology referred to in paragraph 1 for any sale, supply, transfer or export of those goods and technology, or for the provision of related technical assistance, brokering services or other services, directly or indirectly to any natural or legal person, entity or body in Russia, or for use in Russia;

A person cannot use beget services outside of russia. To pay for their services, you need to have a russian bank account.

[ldez]

Sorry but no: we don't sell, supply, transfer or export, directly or indirectly, dual-use goods and technology.

And:

• M24 doesn't apply in our case.
• M7 doesn't apply too.

You are misinterpreting the regulation, the article 1 is clear about the scope:

c) “technical assistance” means any technical support related to repairs, development, manufacture, assembly, testing, maintenance, or any other technical service, and may take forms such as instruction, advice, training, transmission of working knowledge or skills or consulting services, including verbal forms of assistance;

We are not interacting with Beget or any Russian companies, institutions, etc. to help them, we are not doing any development, testing, or maintenance for them.

[XakepSDK]

Supporting them in this repo means their sanctioned service will enjoy free protocol upgrades and bug fixes. If the project will introduce breaking changes that will require updates in the provider-supporting code - that's also maintenance. If it's not supported in this repo, this means they will do all of this themselves. I believe this falls under the technical assistance part.
They are free to fork this repository and/or carry their own patches in their repos hosted on russian infrastructure.

[ldez]

Sorry, but you are misinterpreting the regulation.

I don't maintains Beget services, I maintain lego.

I fix lego bugs, not Beget service bugs.

I'm pretty sure that Beget doesn't even use lego or know that lego exist.

To be clear, I don't support in any way the Russian institutions, government, and companies.

If you want to start a crusade, there are a lot of projects related to Beget on GitHub: https://github.com/search?q=Beget&type=code

However, unless you are a legal professional, I recommend refraining from interpreting the regulations.

[XakepSDK]

I don't maintains Beget services, I maintain lego.

And Lego has direct support for their platform

To be clear, I don't support in any way the Russian institutions, government, and companies.

You do support Beget integration with lego.

However, unless you are a legal professional, I recommend refraining from interpreting the regulations.

Are you one? Aren't you interpreting it too?

I'm leaving this discussion.

[ldez]

@XakepSDK I'm interested to understand what was your goal?

Are you trying to help us to follow regulation?
If yes, you should be a lawyer because we cannot do things based on random interpretation of the regulations and ToS.

Are you trying to fight against the war?
I'm against wars and I am a pacifist. lego is not a place to propagate war fight.

I'm only an OSS maintainer, who lives under the poverty threshold, I don't have the money to pay for a lawyer to check if your interpretation is right or not, so I use my own interpretation of the regulations and ToS.
I am doing my best with the resources and knowledge I have.

[XakepSDK]

I'm not a lawyer. I want to follow the regulation.

It's safer to just remove them, isn't it? We aren't lawyers but I strongly believe it's illegal to support this code.
Large projects that have more money and lawyers removed support for sanctioned hardware. For example Linux removed support for Baikal and Elbrus CPUs. Let's Encrypt and other large companies very recently stopped issuing any certificates to the sanctioned entities.
Also Russia is building it's own certificate authority based on the ACME protocol. They will force all citizens and companies to install their own root certificates to support their own infrastructure. Their domestic web browsers already carry those root certs.

That's the most peaceful way to fight a war - to increase cost of war. If they are building their own infrastructure, they should invest their own time and money in every bit of it. Every penny counts.
I agree that it's just the code, I believe that the code should be shared freely, but that's the world I live in. It's in your right to do what you think is the best.

I use this library with a docker for some of my personal projects. I also wanted to contribute and followed steps in the CONTRIBUTING.md file.

[ldez]

It's safer to just remove them, isn't it? We aren't lawyers but I strongly believe it's illegal to support this code.

I don't share your opinion, so I will not remove any providers.
You are focused on Beget, but if you look closely you will see several sanctioned providers by the EU or the US, inside lego, and maybe there are providers sanctioned in other regions of the world.

Note, that other ACME clients are also supporting the same sanctioned providers.

Large projects that have more money and lawyers removed support for sanctioned hardware.

This is a different story, I will not enter in the hardware topic.

Let's Encrypt and other large companies very recently stopped issuing any certificates to the sanctioned entities.

Let's Encrypt is providing a service, lego is not doing that.

That's the most peaceful way to fight a war - to increase cost of war.

This is not fighting against war but participate in a war.
I don't want to participate in a war through my OSS projects because I don't want to become a target.

I'm sure you are acting with good intentions, but I will not follow you on the topic.
But be assured that if I am subject to any proven legal obligation related to sanctioned providers, I will comply with it without the slightest hesitation.

I use this library with a docker for some of my personal projects.

I'm happy if my work is useful to you.