extant2000/flamenet-messenger-ios
1
0
Fork 0
Code Issues 13 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Export compliance: record the 2026-09-28 re-notification

Browse Source 
The source moved to gitlab.com/extant2000 and flamenet-elligator2 was
published, so BIS and NSA were notified again. The first entry is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Paul Hitt
2026-09-28 15:12:07 -04:00
co-authored by Claude Opus 5.5
parent 3e623e1fdd
commit 4d3b95eb7f
1 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
EXPORT-COMPLIANCE.md
+31
View File
@@ -84,6 +84,37 @@ The text as sent:
Re-notify if the source moves to a different location. Notification is about
where the code is, so a new commit needs nothing; a new URL does.
## The re-notification: sent 2026-09-28
On 28 September 2026 the source moved from `gitlab.com/paulhitt` to
`gitlab.com/extant2000`. On the same day `flamenet-elligator2`, which holds the
obfs4 bridge and the iPhone app's obfs4 transport, was published under MIT.
Both changes call for a new notification, so one was sent.
Sent to both addresses on 2026-09-28 at 19:10 UTC, in one message from
`security@flamenetmessenger.com`, and accepted by both:
- BIS, `crypt@bis.doc.gov`: `250 2.6.0 ... Queued mail for delivery`
- NSA, `enc@nsa.gov`: `250 ok: Message 199757828 accepted`
The locations it gave:
https://gitlab.com/extant2000/flamenet-messenger-ios
https://gitlab.com/extant2000/flamenet-messenger-android
https://gitlab.com/extant2000/flamenet-relay
https://gitlab.com/extant2000/flamenet-e2e
https://gitlab.com/extant2000/flamenet-elligator2
It also listed the four earlier locations above and said they now redirect.
The algorithm list repeats the one in the first notification, and adds what
the obfs4 transport uses: the Elligator2 encoding of Curve25519 public keys,
the ntor handshake (Curve25519 with HMAC-SHA256), XSalsa20-Poly1305 (NaCl
secretbox) and SipHash-2-4.
The same rule applies from here: a new commit needs nothing, and a new
location or a newly published repository with cryptography in it needs
another notification.
## Open question worth an hour of a lawyer
Whether the binary Apple distributes counts as the object code corresponding