I wish the world were more peaceful—truly. But as long as people keep prioritizing their lizard brain, greed, or whatever you want to call it, I don’t think that will ever happen. It’s best to stay vigilant.

Purging of contributors just because they originate from a country is not how leadership of an open source project should act. Really sad to see.

This isn’t about “purging contributors just because they originate from a country”—it’s about addressing real security risks and complying with international sanctions. Open-source projects, especially something as critical as the Linux kernel, don’t exist in a vacuum. They are part of a global infrastructure that is deeply intertwined with national security and legal obligations.

Russia’s actions on the global stage, from its involvement in cyber warfare to the invasion of Ukraine, have resulted in widespread sanctions for good reason. When individuals or organizations tied to sanctioned entities are involved, it becomes a matter of compliance and risk management, not arbitrary exclusion. The leadership of open-source projects has a responsibility to protect the project’s security and integrity, especially from potential threats that are well-documented.

It’s unfortunate that good contributors are caught in the crossfire, but that’s a consequence of the political reality created by Russia’s actions. The Linux Foundation, being U.S.-based, has to comply with these sanctions, and more importantly, must take steps to safeguard critical infrastructure from potential compromise. It’s not about nationality—it’s about mitigating risks and ensuring compliance with international laws. That’s just how responsible leadership works.

The contributor above works at Baikal Electronics, which are a defense supplier in/for Russia, and therefore sanctioned.

The Linux Foundation is based in the US and have to bide by those sanctions.

Kudos to this guy for nailing it. The connection between Baikal Electronics, a sanctioned defense supplier for Russia, and the compliance the Linux Foundation must adhere to under U.S. sanctions makes perfect sense. It’s not about personal vendettas—it’s about following legal obligations and protecting the integrity of critical projects like the Linux kernel. Well said!

Infosec reasons, allegedly.

Saying “Infosec reasons, allegedly” is not only dismissive but also incredibly irresponsible given the current global security climate. There’s nothing “alleged” about the cyber threats posed by Russia. The evidence is overwhelming, documented, and spans decades of hostile actions across Europe and the U.S.

Russia has engaged in full-scale cyber warfare against Western infrastructure, ranging from the NotPetya attacks that caused billions in damages, to election interference in multiple countries, and the continuous disinformation campaigns meant to destabilize democratic institutions. In the cybersecurity world, you don’t wait around for damage to occur before addressing vulnerabilities—prevention is key. It’s not “alleged” when we have mountains of evidence of Russian cyber operations targeting everything from defense industries to healthcare systems.

Your dismissal of the very real “infosec reasons” undermines a fundamental understanding of modern cybersecurity. Espionage, sabotage, and cyberattacks aren’t just hypothetical scenarios; they are ongoing, constant threats. By brushing off legitimate concerns with a sarcastic “allegedly,” you’re either willfully ignoring these realities or grossly underestimating the scale of the issue. Russia has weaponized the digital space, and whether you like it or not, contributions to critical open-source projects like the Linux kernel are absolutely a potential vector for compromise.

When you throw around “allegedly” as if these are mere conspiracy theories, you demonstrate a lack of understanding about how covert operations work. They don’t come with red flags and announcements—they rely on subtlety, deception, and exploiting weaknesses in systems, both technological and human.

Infosec concerns are serious. They aren’t alleged. They are proven, documented, and ongoing. If you don’t see the logic in taking proactive steps to secure critical infrastructure projects from a country that has made espionage and cyber warfare a cornerstone of its foreign policy, then you’re missing the bigger picture entirely. The Linux kernel is too important to global infrastructure to take any risks, and infosec reasons are very much real, not some “alleged” excuse.

I understand the sanctions part and wanting to head off any potential state interference with projects like this, but “infosec reasons” feels very hand wavy.

I think I’d be a lot more comfortable if we had seen malicious/bad faith actions/communications or maybe some more specific and tangible reasons to suspect them being compromised on the part of the Russian maintainers before they were just removed.

Your understanding of the sanctions is a good start, but dismissing “infosec reasons” as merely “hand-wavy” shows a serious lack of awareness about the global security threats that Russia, and by extension, its citizens, pose—especially when it comes to technology and infrastructure. To suggest that we need to “see malicious or bad faith actions” first before taking precautionary steps demonstrates a complete misunderstanding of how cybersecurity and threat prevention work.

Let’s get real: Russia has been systematically involved in espionage operations for decades. This isn’t speculation—it’s fact. They have a proven track record of conducting cyber warfare, engaging in disinformation campaigns, and launching full-on hybrid attacks across Europe and the U.S. From burning down munition factories to assassinating journalists with polonium, to paying off right-wing influencers and politicians in the West, the Russian state and its network of operatives have relentlessly undermined democratic societies. And you think we should wait for more tangible evidence before removing people from sensitive projects? That’s beyond naïve—it’s reckless.

Cybersecurity doesn’t work by waiting until something catastrophic happens. You don’t wait for a hacker to exploit a vulnerability before patching it, just as you don’t wait for a spy to steal sensitive information before tightening your security protocols. Russia is actively involved in cyber warfare, and pretending that this doesn’t extend to individuals who might seem disconnected from their government is dangerously shortsighted. Espionage is embedded into Russian statecraft—it operates through layers of deception, often utilizing individuals who appear innocent or disconnected.

And we’re not talking about abstract threats. Russian actors have been implicated in numerous high-profile cyberattacks, including those that targeted Western infrastructure, democratic processes, and industrial sectors. If anything, the decision to remove Russian maintainers from the Linux project for “infosec reasons” is prudent. It’s not hand-wavy—it’s a necessary step to protect the integrity of a globally important project from potential compromise by a nation that has shown no qualms about leveraging technology for malicious purposes.

Moreover, the idea that you would need to see overt acts of bad faith from these maintainers before taking action completely ignores the covert nature of cyber espionage. Russia’s hybrid warfare tactics often operate in the shadows—by the time you see the problem, it’s far too late. You’re essentially asking to see the explosion before you start investigating the bomb, which is absurd in any cybersecurity context.

Your dismissal of these concerns as “hand-wavy” highlights a disturbing lack of understanding about the real and present threats posed by Russian actors, whether state-sponsored or not. Pretending otherwise is not just foolish, it’s an invitation for disaster. Ignorance is not an excuse in matters of national security, and being “comfortable” with this situation is exactly what Russia counts on when it comes to exploiting vulnerabilities.

Infosec reasons are not some vague excuse—they are at the heart of protecting projects like the Linux kernel, which are critical to global infrastructure. If you don’t understand that, you’re either blissfully unaware of the reality of cyber threats or willfully ignorant of the risks. Either way, it’s a dangerous position to take.

While I understand that the manner in which your removal from the Linux kernel maintainer list was handled may feel frustrating, there are much larger issues at stake here. The fact that you would leave a project you claimed to have volunteered for “in good faith” as soon as your country’s role in a horrific war of aggression comes into question is deeply troubling.

Let’s be clear: Russia’s invasion of Ukraine is an unprovoked act of war, involving systematic atrocities and crimes against humanity. No matter how you frame your individual involvement as a contributor to open-source projects, by remaining silent and failing to stand against the actions of your government, you and others in Russia are complicit. You cannot separate your personal or professional activities from the larger geopolitical realities—especially not when your country is committing genocidal acts.

Furthermore, the issue of trust cannot be overstated. The Linux Foundation and broader open-source community depend on trust and collaboration. With Russian state-sponsored espionage, cyberattacks, and covert operations frequently targeting Western infrastructure, it’s impossible to ignore the risks associated with contributors from a country that has made subterfuge and disinformation a central part of its strategy. How can the community trust that your contributions are made in good faith when so many Russian actors have been implicated in espionage and manipulation efforts?

The Linux Foundation does not exist in a vacuum. It stands for more than just code—it represents the principles of openness, transparency, and ethical responsibility. Allowing contributions from individuals tied to a state engaging in war crimes sends the wrong message. It would compromise the integrity of the entire community.

As for the comparison to U.S. support for Israel, the situations are entirely different. The U.S. is not driving soldiers into Gaza to kill Palestinians. While we provide material and military support to Israel—largely aimed at combating Hamas, a recognized terrorist organization—that is not the same as directly engaging in the conflict. The idea that the U.S. is the sole proprietor of the war in Gaza is absurd and fueled by Iranian and other hostile propaganda. The U.S. government has not declared war on Gaza, and no congressional vote has sanctioned such an action.

It’s important to note that U.S. policy toward Israel has been consistent for decades, across multiple administrations. The complexities of this relationship go far beyond any single conflict or war. Furthermore, while atrocities committed by any state must be condemned, we are not responsible for every action taken by Israel, just as Russians like yourself should not dismiss your government’s role in the atrocities being committed in Ukraine.

In the end, it’s about accountability. You chose to walk away from the Linux community because of a necessary and justified action aimed at holding people accountable for their involvement, directly or indirectly, in a war of aggression. Your departure speaks volumes about where your priorities and loyalties truly lie.

That god isn’t real and religion is a lie. It has made me more of an atheist than I’d ever care to proclaim and even more interested in science.