One is the mirror image of the other and neither economy can exist in its current state in isolation.
So China has the US over a barrel when it comes to actually building stuff, rare earths and all of that, but equally US sanctions still have real bite (a lot more than China would like) because China does have to do a huge amount of international trade to export and externalise its surpluses.
They're stuck in this unhappy marriage
Who says they’re stuck or unhappy?
This is politics. We’re all just bait. In reality they’re friends.
US and China have made more gains by pretending to be enemies than friends and they likely plotted it all together.
> Open source standards provide great benefits to U.S. taxpayers in reducing the cost of advanced military system development, and also increases security by allowing the government to build their own trusted implementations at low cost.
About their move to Switzerland, they say:
> RISC-V International has not incorporated in Switzerland based on any one country, company, government, or event. This move is reflective of community concern and managing strategic risk for our community investing in RISC-V for the next 50+ years.Anonymity and encrypted communication are two very, very different things. Have one but not the other and you're essentially handing off your private data incl. passwords to whoever that has a tap on the communication between you and the server can fetch them, too. Have the other but not the one and everyone will know who you are, but they can't eavesdrop.
This is most likely OFAC. Lets Encrypt could apply for a license to do business with sanctioned entities, and given their use case it would most likely be approved.
I disagree with that ruling, and I have some serious problems with sanctions against entire countries/regions, but it definitely makes sense that LE would interpret it as being impacted by OFAC.
In an alternate universe, Let’s Encrypt has a chat with someone and then states, publicly, like a speech, that they think that person owns a domain.
In our universe, Let’s Encrypt lets a client open an “account”, enters into a contract with the client (the contract is the topic of this entire post), and gives the client an API by which the client requests a certificate. Then Let’s Encrypt grants the certificate. Maybe the certificate is somehow speech. The rest sure doesn’t sound like speech to me.
And here: https://github.blog/news-insights/policy-news-and-insights/a...
Now, does this serve a policy purpose? Perhaps not--US computers trust plenty of non-US CAs that could continue to serve these customers. But that's not how comprehensive sanctions are set up, they are effectively a complete embargo.
A better question is whether telecom carveouts (general licenses) in the sanctions may allow this. That is a country by country question as each one is worded differently.
They might be compelled to issue a certificate to an unauthorized (by browser PKI policies, not local law) entity, but that would be very conspicuous due to Certificate Transparency.
Let me introduce you to the phrase "I don't see a mechanism."
I'm not familiar with this phrase, but I think I did a good job citing a comparable example in my original post.
Things that definitely don't happen. Those same encryption standards are used by the US military, and the international cryptography community can pretty readily rule out keyed backdoors.
The thought that supercomputers could break Internet encryption by brute force is laughable. One would have to be innumerate to think such a thing.
Citation please? There's been documented instances of exactly that, and extraordinary claims require extraordinary evidence.
Most of our sanctions-related blocks apply only to the governments of certain sanctioned countries, not their general population.
This subscriber agreement update was intended to better reflect our legal requirements. It does not reflect a major change in the service we provide. Our compliance program does evolve over time, and part of that is communicating about it better in our terms of service. It's clear from some of the comments here that we have more work to do to make that text more understandable, we'll work on that.
"That said, pretty sure this is stems from the insane US legal requirement to not export SSL technology to enemy countries. I'm sure some of y'all are old enough to remember when web browsers came in "international friendly" versions that supported 40 bit encryption, or "fancy secure" versions with 128 bit encryption."
It doesn't.
Wouldn't the more rational response to this legal situation be to leave the USA and move somewhere more willing to respect international law?
[0] https://www.whitehouse.gov/presidential-actions/2025/02/impo...
Soon they might be pushing for Operating Systems to gather political party preference information, so they can know who should be restricted from the use of strong encryption. The options being:
1. I love america
2. Radical left looney
3. Neither male nor female.
4. Those that tremble as if they were mad[0]
[0]: https://thewhippet.org/the-whippet-134-those-that-tremble/#c...
Some of these sanctions are required by international law (i.e. sanctions imposed by UNSC). For the other ones, international law generally lets countries have whatever trade policy they see fit including sanctions, unless they violate some other rule of international law or treaty obligation.
The USA signed the Rome Statute but never ratified it, and then withdrew its signatory status. There's an argument to be made that there was a treaty obligation there, but it's pretty weak.
I think article 18(a) of the vienna convention of the law of treaties means that once you withdraw your signature, you no longer have any obligations in regards to the treaty.
Maybe you could make some sort of argument that the sanctions violate the purpose of the geneva convention as they are designed to prevent bringing to justice people accused of grave breaches of the geneva convention. Like its an attempt to frustrate the application of article 49 of the first geneva convention [Ianal]
The agreement very plainly says otherwise:
> You are not a person or entity that is: (a) located in, organized under the laws of, or ordinarily resident in any country or territory that is the target of comprehensive U.S. sanctions
The general population of those countries are absolutely "persons" "located in" a "country or territory that is the target of comprehensive U.S. sanctions."
> communicating about it better in our terms of service. It's clear from some of the comments here that we have more work to do to make that text more understandable, we'll work on that.
This tries to frame it as a comprehension issue. It's not.
The wording in your agreement is actually quite clear. I think it's reckless, if not disingenuous to frame this as "we really only mean government entities".
Apropos of anything else, it's also not how US sanctions work - they are absolutely aimed at both the populace as well as the government itself.
Obviously (to the rest of us) if the agreement says otherwise, then they're saying that it's LE that is forbidding the citizens of these countries, and it's not (entirely) the government's fault, which completely contradicts what they're trying to say.
We should probably be clear that this document is most likely a backside-covering exercise; it exists so that people can't sue LE for denial of service without a just cause, and so that the US can't prosecute them for intentionally shipping cryptographic services, or some such rubbish.
If you live entirely outside the US legal system, or its multifaceted tendrils, and if you don't make too much noise, you may be fine. Obviously that's a far cry from a "right to free speech" level of protection, but then LE have no obligation to provide that to people outside the US, and arguably non-rich citizens within the US lost that a long time ago.
This is not something that you apply for; a general license already applies to everyone. The legalese or restrictions companies use exist because they cannot (or will not) validate everyone is who they say they are. This obviously doesn't apply to companies who deal with controlled exports, where they are responsible for whoever ultimately receives the controlled export.
I am not a lawyer and this is not legal advice.
https://ofac.treasury.gov/selected-general-licenses-issued-o...
Generally the software carveouts are very limited - it's not just "providing IT services or technology to individuals for personal use", i.e. Sudan:
> software updates for medical devices to Sudan
Indeed, of the software carveouts listed on that page, only two are not related to the operation or update of medical devices:
- provision of Internet services to the people of the Ukraine (read: "Starlink")
- provision of messaging services to members of the Government of Venezuela.
https://crt.sh/?id=26878583197 (06/04/2026 smtp.star-co.net.kp) https://crt.sh/?id=20256841119 (08/11/2025 *.star.net.kp)
Star Joint Venture is the manager of the .kp TLD and one of DPRK's two email providers (the other is silibank.net.kp) [1], used as the official email for various government bodies ex. [email protected] (IP Office), [email protected] (Sci/Tech Commission), [email protected] (Ministry of Culture and Sports), [email protected] (Atomic Energy). It is also widely used by those universities and companies that engage with the outside world.
How did you determine that issuing a certificate to this domain or any .kp domain was compliant with the general ban on exporting goods and services to DPRK?
You can see them all on crt.sh, because LE has to upload them to a CT log for browsers to trust them. (That’s how most of those subdomain finder websites work too.) The email servers seem to have gotten certs from a for profit CA back in 2015, but I’m not sure if they ever used them. Most of their webspace seems to be HTTP only. (And it’s a good thing, because some of their Apache versions are potentially old enough to have Heartbleed.)
The architects website has some pretty cool PDF magazines btw. They also have several websites for their insurance company’s (perhaps some intl org needs them to have a website for listing)—that’s a core hard currency stream for them and they previously have been accused of submitting false losses.
http://www.koreanarchitecture.gov.kp/index.php?kt=TWFnYXppbm...
> Most of our sanctions-related blocks apply only to the governments of certain sanctioned countries, not their general population.
It doesn't work that way.
Blocking governments from getting certs doesn't hurt them in the slightest. The government can just create their own pki.
But it hurts the general population instead. People do not live in vacuum, they still need to access government sites. And thus people are forced to install root certificates of questionable trust.
When Let's Encrypt blocks government entities, it instead puts respective vulnerable population in even less secure environment.
Although, given the current events, I am not sure Let's Encrypt continues to deserve the trust it had.
http://www.cypherspace.org/adam/uk-shirt.html
A t-shirt with a Perl script that implemented RSA encryption strong enough to be technically illegal to export from the US.
(I must sadly admit to being too cowardly/sensible to have taken that shirt to the US in the late 90s...)
OpenBSD being based in Canada ships strong crypto, but has had a sometimes troubled relationship with certain regimes.
If complying with the law gets in the way of the mission I’m not sure that counts as a change to the mission.
It's already illegal to use in NK, but if it's the US, well it's time to steer the mission around it? Gross.
Should NRA hand out guns to everyone who can’t get a permit where permits are required? Of course not. If they are against gun permits they have to fight the law, not break it.
That is a specific US-internal stance.
There's a list of organizations that started in the US, ultimately having had to work around the US legal system, in pursuit of their missions:
re Planned Parenthood Global, WikiLeaks, International Campaign to Ban Landmines, Center for Reproductive Rights, selected programs of the Human Rights Campaign Foundation, et al
tattoo yourself with crypto code to become munitions
Google had a similar dilemma - do they want to offer a (censored) service in China, and have a hope of keeping some marketshare, or not (and be kicked out immediately).
In this case though, it seems to be an unforced move by letsencrypt ? Or was it compelled by LEAs?
to not export SSL technology to enemy countries
TLS is awesome, one of the most valuable developments in Internet history. But, it is important to undewrstand that it is a double edged sword. Requiring a CA, which in practical terms means requiring a publicly known CA, is a choke point of freedom.
That said, pretty sure this is stems from the insane US legal requirement to not export SSL technology to enemy countries. I'm sure some of y'all are old enough to remember when web browsers came in "international friendly" versions that supported 40 bit encryption, or "fancy secure" versions with 128 bit encryption.