[prev in list] [next in list] [prev in thread] [next in thread] 

List:       poi-user
Subject:    RE: About workbook and sheet protection
From:       "Andrew C. Oliver" <andy () superlinksoftware ! com>
Date:       2002-09-15 0:57:10
[Download RAW message or body]

The legal issue is not with us encrypting the password, its distributing
the encryption libraries.  In this case say the JCE...  Not only do I not
have the money to front for the Export License, but Apache doesn't have
the infrastructure required to safeguard against people from countries
that it can't be exported to downloading it.  

If someone wants to front the money to secure council, get the export
licenses and infrastructure set up (and possibly deal with sun to license
the JCE or some other library) then cool, we'll do our best to
accomidate.

If someone wants to develop this offshore and host it as a plugin on an
offshore server, cool, we'll work with you on the plugin interfaces.

But I've got very little interest in doing prison time for the POI
community...sorry guys ;-)

-Andy

On Fri, 13 Sep 2002 21:07:07 -0400, Kennedy, Niall wrote:

>     The 40 bit RC4 encryption in Excel 97 is below the 64 bits that are
> classified under Export Control Classification Numbers (ECCNs) 5A992 and
> 5D992 by the Bureau of Industry and Security (BIS). Reference:
> http://www.bxa.doc.gov/Encryption/guidance.htm
> 
>     I have heard reports from developers in the EU regarding country
> specific encryption within Excel.  France and Germany seem to have a
> different algorithm than the standard MD5 and RC4 method.  These issues
> came up during OpenOffice Calc development.  Any implementation of
> workbook and sheet protection in POI may not work for users in these
> countries.
> 
>     All my research points to the implementation as within legal
>     boundaries.
> Public interviews with Microsoft seem to reconfirm the idea.
> 
> To quote Network World 12/17/2001:
> 
> """
> Microsoft officials say the ability to password-protect and hide data is
> not a "security" feature but a "display" feature. That means that while
> creators of spreadsheets can hide data from display, or protect it from
> manipulation on the original document, they cannot safeguard or secure
> it from view or manipulation if another user copies and pastes the data.
> """
> 
> 
> Niall Kennedy
> Callan Associates Inc.
> 
> 
> -----Original Message-----
> From: Andrew C. Oliver [mailto:acoliver@apache.org] Sent: Friday,
> September 13, 2002 5:25 PM To: POI Users List Subject: RE: About
> workbook and sheet protection
> 
> 
> Yes you've now used CIA and FBI in this email and I'm sure somewhere its
> being sniffed an matched against other hits.  And probably at some point
> it will be in a mail list archive where someone says POI "bombed out"
> and the men in black suits will come knocking on my door to detain me
> indefinitely under the pretense of checking to make sure I'm in the
> country legally (I was born in Nebraska....that counts for citizenship
> right?).  But at least we'll be safe right? heh.
> 
> Anyhow...Politics aside.  If this patch indeed has no encryption you
> need only submit it per the instructions:
> 
> http://jakarta.apache.org/poi/getinvolved/index.html
> 
> scroll to the last section.
> 
> The protection we're talking about is the kind where excel encrypts half
> the workbook.
> 
> -Andy



--
To unsubscribe, e-mail:   <mailto:poi-user-unsubscribe@jakarta.apache.org>
For additional commands, e-mail: <mailto:poi-user-help@jakarta.apache.org>

[prev in list] [next in list] [prev in thread] [next in thread]