ECCN / FIPS - we can't be arsed.

[u/mdw/putty] / doc / faq.but

diff --git a/doc/faq.but b/doc/faq.but
index 9df4508..3ef3776 100644 (file)
--- a/doc/faq.but
+++ b/doc/faq.but
@@ -1210,18 +1210,10 @@ feel perfectly free not to donate. We don't mind.
 \S{faq-permission}{Question} Can I have permission to put PuTTY on a
 cover disk / distribute it with other software / etc?
 
-Yes. You need not bother asking us explicitly for permission. You
-already have permission. Redistribution of the unmodified PuTTY
-binary in this way is entirely permitted by our licence (see
-\k{licence}), and you are welcome to do it as much as you like.
-
-If you are distributing PuTTY within your own organisation, or for
-use with your own product, then we recommend (but do not insist)
-that you offer your own first-line technical support, to answer
-questions directly relating to the interaction of PuTTY with your
-particular environment. If your users mail us directly, we won't be
-able to give them very much help about things specific to your own
-setup.
+Yes. For most things, you need not bother asking us explicitly for
+permission; our licence already grants you permission.
+
+See \k{feedback-permission} for more details.
 
 \S{faq-indemnity}{Question} Can you sign an agreement indemnifying
 us against security problems in PuTTY?
@@ -1389,6 +1381,22 @@ closed-source and someone made an open-source fork, most people
 would switch to the latter. Therefore, it would be pretty stupid of
 us to try it.)
 
+\S{faq-export-cert}{Question} Can you provide us with export control
+information / FIPS certification for PuTTY?
+
+Some people have asked us for an Export Control Classification Number
+(ECCN) for PuTTY.  We don't know whether we have one, and as a team of
+free software developers based in the UK we don't have the time,
+money, or effort to deal with US bureaucracy to investigate any
+further.  We believe that PuTTY falls under 5D002 on the US Commerce
+Control List, but that shouldn't be taken as definitive.  If you need
+to know more you should seek professional legal advice.  The same
+applies to any other country's legal requirements and restrictions.
+
+Similarly, some people have asked us for FIPS certification of the
+PuTTY tools.  Unless someone else is prepared to do the necessary work
+and pay any costs, we can't provide this.
+
 \H{faq-misc} Miscellaneous questions
 
 \S{faq-openssh}{Question} Is PuTTY a port of \i{OpenSSH}, or based on