I literally linked one. For quite a while, OpenBSD banned US citizen from contributing to any cryptography code.

Other projects that do stuff that would be illegal under US patent law (including some of my own) do the same today.

Even other projects that use the EU law that allows decompilation, but which would be illegal in the US, do the same.

But OpenBSD's hackathons are the only project that I want to specifically name. See the footnote 1 in my original comment.

According to that page, some (early) hackathons were held in the US. Also, that page does not explain the reasoning why they're held outside the US. So that page is only a source for the existence of the hackathons, not for the reasons for their non-US location or for why they don't allow US citizens to contribute. (I wasn't the one who downvoted your GGP post.)

Oh, I thought that was included.

The reason for hackathons in Canada are the US crypto export restrictions. You can't export stronger than 128 bit crypto out of the US today without a permit (and even then only to a few countries, which is why many libraries including the Java stdlib only ship with 128-bit crypto by default, and you need to sign a form with the US DoD to unlock 256-bit crypto in Java).

Back in the day it was worse, the limit was at 56-bit, which was easily cracked, and so some countries such as South Korea invented their own crypto (which they implemented as plugin for Netscape and IE5, and which is the reason IE is still used there today), and in yet other situations people simply wrote crypto code outside the US.

In the end, people printed out the algorithms and source code for an RSA implementation, shipped that book to Europe, and typed it back into a computer. This quickly enabled people outside the US to get access to strong cryptography, and soon the crypto regulations became less strict.

https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...

Even today if you have a product, app, program, etc that includes cryptography (even using HTTPS counts) and that is at some point exported from the US to other countries, you need a permit from the US DoD. For example, if you have an app on the Apple AppStore that is sold outside the US.

https://news.ycombinator.com/item?id=10835045

Are you talking about http://www.oracle.com/technetwork/java/javase/downloads/jce8...?

I didn't sign any form.

Nowadays you just have to accept ToS that you will not use it to encrypt criminal stuff, that you will not use it in nuclear submarines, and that you will never export it to a country that Oracle hasn't licensed you to export it to.

But a while ago, you still had to fill out DoD forms for this. (You still have to do that for other kinds of software, though, Xilinx ISE is a common example of software that requires filling out 5-6 DoD forms)