Archive for September, 2006

In-kernel ALSA support in Gentoo

Saturday, September 16th, 2006

I think some people might have misunderstood Diego’s post about ALSA support in Gentoo.

To clarify, we (as in Gentoo kernel maintainers) do support in-kernel ALSA drivers, but Diego (who maintains the out-of-kernel alsa-driver package) does not. I recommend using the in-kernel drivers, Diego recommends using the out-of-kernel drivers.

If you do have problems with the in-kernel version, please do file bugs, but make sure they get assigned to rather than Diego.

Settling in, started work

Saturday, September 9th, 2006

The US move has worked out rather well. I’m set up with a bank account, cell phone, basic room furnishings, etc. The various Americanisms I complained about last time are slowly becoming easier to accept.

I’ve managed to keep myself mostly occupied. After helping Seemant move house, I met up with Steve B at the end of last week. Steve is a friend from university and was visiting Boston after working all summer in New York. Then at the weekend, Dave took me down to Connecticut for a barbeque with some of his friends and family, which was fun.

I started work on Tuesday. It’s an exciting atmosphere to work in, as the product release isn’t too far off. The technology is even more amazing than I remember it, and everyone has been very welcoming. The office is calm, open, and spacious. It’s going to a busy year, taking over many of Seemant’s roles as well as with plenty of other interesting problems to solve.

NFIS2 and U.S. export control laws

Saturday, September 2nd, 2006

On the journey to find some working fingerprint matching code for use in dpfp and future projects, several people have pointed me towards NFIS2.

NFIS2 is a set of utilities for fingerprint analysis and matching. It has been developed by NIST for DHS and the FBI, so presumably it is of a decent quality. Additionally, Andrei Tchijov tells me that it does work.

This sounds great, and to get a copy all you have to do is ask for them to send you a CDROM. The CD includes source code and documentation. The code is mostly public domain, some with BSD-style “preserve this copyright notice” licensing terms.

There is only one possible problem, the NFIS website makes the following point rather clear:

Distribution of this software is subject to U.S. export control laws.

I’m not sure what this means, so I’ve done some research. The following may be incorrect – this is just my interpretation, which I’m seeking clarification on…

The most important point is that export control laws apply to almost everything that exits the United States – regardless of origin and regardless of transportation method (mail, internet, …). I was encouraged to read this, as surely the U.S. don’t place restrictions on source code — otherwise the whole open source thing would not be happening, however:

All exports should be classified with an ECCN number. If they can be classified, certain restrictions apply — mostly that you cannot export to certain countries.

Even if you can’t be classified with an ECCN, there are still restrictions. For example, you cannot export anything to any entities listed here, people listed here, etc. I find this immensely confusing considering that this effectively means a US-based open source software mirror site is violating export control laws if someone on one of those lists happens to download some software. How is open-source even possible in the US with these kinds of restrictions in place?

Anyway, going back to the NFIS2 thing. It seems fairly redundant for them to point out that NFIS2 is covered by export control laws, when software of any type automatically is. So I ventured further and looked into the ECCN classification lists. Unfortunately, some entries do explicitly cover fingerprint systems, although I’m having trouble determining if they are talking about hardware or software (would they apply to a software-only generic fingerprint matching library distribution?). These entries restrict distribution to a number of countries (for purposes of “crime control”, etc).

I’d be extremely grateful if anyone can confirm or deny any of the above. The question I’m looking to answer is: If I get my hands on NFIS2, can I include it in an open-source project and share it with the world?

Here are some sources which I used in the above research: