7 ms·

HashiCorp forbids its software being used in China

117 points by xzyaoi 6y ago

jdxcode 6y ago
I wonder if this includes Hong Kong
- kyuudou 6y ago
  Or Taiwan!
  - thefounder 6y ago
    Why would it include Taiwan? They are separate countries not separate "systems"
    - dwheeler 6y ago
      It says it only applies to the People's Republic of China, and in the notes above it's only because of the laws of the People's Republic of China. In all practical senses Taiwan is a separate country, but there are reasons not to admit it: http://www.youtube.com/watch?v=4AivEQmfPpk&t=2m55s http://www.youtube.com/watch?v=4AivEQmfPpk&t=2m55s
Bellamy 6y ago
Why exactly they do that?
- bE9a3S5So8igd3 6y ago
  Good question. It's not like IP protection is practical in China--this software WILL be used in China against license. It's also basically impossible to hold Chinese companies (often entangled with the communist government of China) accountable for things like fraud or IP theft. Maybe it's just a political statement.
  - bdcravens 6y ago
    None of this is true. It's not political, it's not about IP, it's about Chinese law, and it doesn't apply to OSS. https://news.ycombinator.com/item?id=23351181 https://news.ycombinator.com/item?id=23351181
    - thejynxed 6y ago
      What they are saying is that even in regards to OSS it wouldn't matter because China has such a disregard for non-Chinese law (and the citizens have blatant disregard for even some Chinese law) and property that they will just outright steal it or otherwise break any law that inconveniences them to just use the software anyway.
mesozoic 6y ago
Nice
stunt 6y ago
Weird that there is no official announcement from HashiCorp to explain this decision.
- xzyaoi 6y ago
  It would be great if they could explain this decision in more detail, but I guess they are still working on to explain this better and clearer.
- bdcravens 6y ago
  https://news.ycombinator.com/item?id=23351181 https://news.ycombinator.com/item?id=23351181
mitchellh 6y ago
Hello, I'm a founder of HashiCorp and I'd like to explain this. First, this document only applies to enterprise evaluation software. This doesn't apply to our OSS software and this shouldn't be linked anywhere near our OSS except in the context of signing up for an enterprise eval. Most importantly: why is this here? This is NOT a political statement. This is a legal requirement. The encryption we use in Vault is subject to Chinese export control laws and it is illegal for us (by Chinese law) to sell in China. To be able to sell Vault within China we'd have to restrict the encryption that could be used within Vault to government-acceptable versions. We don't do this, therefore it is illegal for us to sell in China. We have to include this line in our enterprise terms. EDIT: Our legal team has updated the copy in our terms to be more explicit. You can read the updated copy in the second paragraph here: https://www.hashicorp.com/terms-of-evaluation https://www.hashicorp.com/terms-of-evaluation
- TechBro8615 6y ago
  It's interesting to me that it's Chinese export control laws that affect you. Normally when you hear about this kind of thing, it's the US export restrictions causing the issue. Does that not apply in this case? And wouldn't you be importing into China? (IANAL, genuinely asking)
  - OzzyB 6y ago
    Exactly, which is why OP's clarification is welcomed. I too made the same assumption as you did, or rather thought it was some political statement based on our current geopolitical climate. But no, it's the Chinese looking to force a US company to use their pre-approved encryption for reasons that should be obvious. Bravo.
  - jhanschoo 6y ago
    Perhaps they're referring to the Encryption Law https://www.cov.com/-/media/files/corporate/publications/2019/10/china_enacts_encryption_law.pdf https://www.cov.com/-/media/files/corporate/publications/201... in effect this year that discusses both the import and export of encryption.
  - 6y ago
clippit 6y ago
From Mitchell Hashimoto, the founder of HashiCorp: https://twitter.com/mitchellh/status/1266390186054651905 https://twitter.com/mitchellh/status/1266390186054651905
- meritt 6y ago
  Whoa, wait, the founder's last name is Hashimoto? That's awesome. I always just assumed it was a portmanteau related to hash functions.
  - wenc 6y ago
    Ah that's interesting -- I've never associated it with hash functions though I can see how one might be led to. Hashi to my ears sounds distinctively Japanese (I understand it either means "bridge" or "chopsticks").
deleted 6y ago
[deleted]
rolls-reus 6y ago
https://twitter.com/mitchellh/status/1266396356572139526 https://twitter.com/mitchellh/status/1266396356572139526 According to the founder they use a Chinese approved encryption scheme for enterprise versions in China. I wonder what encryption that is.

117 points by xzyaoi 6y ago

jdxcode 6y ago

I wonder if this includes Hong Kong

kyuudou 6y ago
Or Taiwan!
- thefounder 6y ago
  Why would it include Taiwan? They are separate countries not separate "systems"
  - dwheeler 6y ago
    It says it only applies to the People's Republic of China, and in the notes above it's only because of the laws of the People's Republic of China. In all practical senses Taiwan is a separate country, but there are reasons not to admit it: http://www.youtube.com/watch?v=4AivEQmfPpk&t=2m55s http://www.youtube.com/watch?v=4AivEQmfPpk&t=2m55s

Bellamy 6y ago

Why exactly they do that?

bE9a3S5So8igd3 6y ago
Good question. It's not like IP protection is practical in China--this software WILL be used in China against license. It's also basically impossible to hold Chinese companies (often entangled with the communist government of China) accountable for things like fraud or IP theft. Maybe it's just a political statement.
- bdcravens 6y ago
  None of this is true. It's not political, it's not about IP, it's about Chinese law, and it doesn't apply to OSS. https://news.ycombinator.com/item?id=23351181 https://news.ycombinator.com/item?id=23351181
  - thejynxed 6y ago
    What they are saying is that even in regards to OSS it wouldn't matter because China has such a disregard for non-Chinese law (and the citizens have blatant disregard for even some Chinese law) and property that they will just outright steal it or otherwise break any law that inconveniences them to just use the software anyway.

mesozoic 6y ago

Nice

stunt 6y ago

Weird that there is no official announcement from HashiCorp to explain this decision.

xzyaoi 6y ago
It would be great if they could explain this decision in more detail, but I guess they are still working on to explain this better and clearer.
bdcravens 6y ago
https://news.ycombinator.com/item?id=23351181 https://news.ycombinator.com/item?id=23351181

mitchellh 6y ago

Hello, I'm a founder of HashiCorp and I'd like to explain this. First, this document only applies to enterprise evaluation software. This doesn't apply to our OSS software and this shouldn't be linked anywhere near our OSS except in the context of signing up for an enterprise eval. Most importantly: why is this here? This is NOT a political statement. This is a legal requirement. The encryption we use in Vault is subject to Chinese export control laws and it is illegal for us (by Chinese law) to sell in China. To be able to sell Vault within China we'd have to restrict the encryption that could be used within Vault to government-acceptable versions. We don't do this, therefore it is illegal for us to sell in China. We have to include this line in our enterprise terms. EDIT: Our legal team has updated the copy in our terms to be more explicit. You can read the updated copy in the second paragraph here: https://www.hashicorp.com/terms-of-evaluation https://www.hashicorp.com/terms-of-evaluation

TechBro8615 6y ago
It's interesting to me that it's Chinese export control laws that affect you. Normally when you hear about this kind of thing, it's the US export restrictions causing the issue. Does that not apply in this case? And wouldn't you be importing into China? (IANAL, genuinely asking)
- OzzyB 6y ago
  Exactly, which is why OP's clarification is welcomed. I too made the same assumption as you did, or rather thought it was some political statement based on our current geopolitical climate. But no, it's the Chinese looking to force a US company to use their pre-approved encryption for reasons that should be obvious. Bravo.
- jhanschoo 6y ago
  Perhaps they're referring to the Encryption Law https://www.cov.com/-/media/files/corporate/publications/2019/10/china_enacts_encryption_law.pdf https://www.cov.com/-/media/files/corporate/publications/201... in effect this year that discusses both the import and export of encryption.
- 6y ago

clippit 6y ago

From Mitchell Hashimoto, the founder of HashiCorp: https://twitter.com/mitchellh/status/1266390186054651905 https://twitter.com/mitchellh/status/1266390186054651905

meritt 6y ago
Whoa, wait, the founder's last name is Hashimoto? That's awesome. I always just assumed it was a portmanteau related to hash functions.
- wenc 6y ago
  Ah that's interesting -- I've never associated it with hash functions though I can see how one might be led to. Hashi to my ears sounds distinctively Japanese (I understand it either means "bridge" or "chopsticks").

deleted 6y ago

[deleted]

rolls-reus 6y ago

https://twitter.com/mitchellh/status/1266396356572139526 https://twitter.com/mitchellh/status/1266396356572139526 According to the founder they use a Chinese approved encryption scheme for enterprise versions in China. I wonder what encryption that is.