What happened
On October 18, Greg Kroah-Hartman, who maintains the Linux kernel's stable releases, submitted a short patch that removed about a dozen entries from the kernel's MAINTAINERS file. The commit message gave the reason as "various compliance requirements." The people removed were maintainers associated with Russian companies subject to international sanctions. Linus Torvalds merged it.
There was a loud reaction, including a flood of posts from anonymous accounts demanding a reversal. On October 23 Torvalds answered on the mailing list. The change wasn't going to be reverted, the compliance requirements weren't only American, and, he added, "I'm Finnish. Did you think I'd be supporting Russian aggression?"
What it does and doesn't mean
It's worth being precise, because the headlines weren't.
- It's about maintainer roles, not nationality. The kernel didn't ban Russian people. The people removed were tied to specific sanctioned organizations. Developers in Russia, like developers everywhere, can still send patches, which are judged on their merits.
- It's about legal exposure. Maintainers have authority over parts of the kernel and work closely with the organizations that fund kernel development, many of which are US or European companies bound by sanctions law. Having maintainers employed by sanctioned entities creates real legal risk for those companies and for the Linux Foundation.
- It was done quietly. The original commit gave almost no explanation, which fed the outrage. More transparency at the time would have helped.
Why I think it's justified
Legally, there wasn't much choice. Sanctions imposed by the US, the EU and others since Russia's full-scale invasion of Ukraine in 2022 restrict dealings with specific companies, including technology firms. An open source project hosted and funded by organizations in those jurisdictions doesn't get an exemption because its code is public. "Open source" isn't a legal category that sits above the law.
Morally, neutrality has limits. Open source's commitment to collaborating with anyone, anywhere, is one of its finest qualities, and setting it aside is never a small thing. But the sanctions here are a response to a war of aggression, including documented attacks on civilians and other war crimes. Continuing to give organizations tied to that war a formal role in a project that runs much of the world's infrastructure isn't neutrality. It's a choice too.
It's narrowly targeted. Removing maintainer roles tied to sanctioned companies, while leaving the door open to individual contributions, is about as narrow as compliance can be. That's the right shape for a measure like this: aimed at institutions, not at people for where they were born.
The honest discomfort
None of this is costless. Some of the people removed were skilled, long-standing contributors who did nothing wrong as individuals. Open source loses something every time politics draws a line through it, as I argued in How Politics Threaten Innovation. It's possible to believe both that the decision was right and that it's a sad one.
But software at the scale of Linux sits inside the real world, with its laws and its wars. Torvalds' decision recognized that, and did so without turning a compliance requirement into a ban on a nationality. That's the right line, drawn in the right place.