13 ms·
An Apology and an Update
- deleted 8y ago[deleted]
- warent 8y agoI'm definitely living under a rock. Why is Slack being impacted by a trade embargo?
- rattray 8y agoAll US companies doing business internationally are impacted by US trade laws (eg; sanctions, trade embargoes), I believe. Eg; you're not allowed to sell stuff to Iran, or certain individuals.
- dylan604 8y agoThey can also bend those restrictions to non-US companies wanting to do business within the US. Just because the US embargoes/sanctions the sell of Iranian oil, or the sell of any nation's oil to North Korea, doesn't mean that it is illegal for other nation's companies to do so (unless their gov't also has similar restrictions). Here comes the but... the US then makes it illegal for those companies to do business within the US just because they were friendly to people the US doesn't like.
- IkmoIkmo 8y agoBecause that's how embargoes work? They impact not only goods, but also services. The US has one on Iran. And as Slack is a US company (or rather, a company which has an interest of maintaining operations in the US, regardless of where it is based), it complies, thereby blocking service to any entities (e.g. people) in Iran.
- larrysalibra 8y agoExactly. Embargos function by taking away the rights away of American businesses and people. Trade embargoes make it illegal for US entities and people to trade with certain groups of people.
- skywhopper 8y agoAny US company is not allowed to do business/operate in embargoed countries. That's what an embargo means.
- kerouanton 8y agoI'm puzzled. Does that mean nobody uses Windows in those countries? Same for Google/FB?
- toefraz 8y agoHow did they not block based on nationality when they literally blocked a nation?
- hprotagonist 8y agoi am an american national and i go to canada. my access to netflix changes for reasons that have nothing to do with my nationality (what passport i have), and everything to do with what nation i’m in.
- berbec 8y agoThey don't care about the nationality of the person, just the location of the IP address.
- bdibs 8y agoI think they meant nationality as in the person's nationality, they were blocking solely based on an IP based location.
- russell_h 8y agoThey were blocking everyone in that nation, regardless of nationality.
- EForEndeavour 8y agoI see it as a technically true statement: they blocked users who looked like they were connecting from within an embargoed nation, regardless of these users' actual nationality.
- munchbunny 8y agoThey likely blocked by whether you ever signed in from a blocked nation. That's not necessarily the same as blocking any users who would qualify as exporting software to a blocked nation, which is also not the same as blocking everyone whose nationality matches said nation.
- alangpierce 8y agoFor context, one of the original reports of this was from (I believe) an Iranian-American with US Citizenship living in the US: https://twitter.com/aaomidi/status/1075621119028314112 https://twitter.com/aaomidi/status/1075621119028314112 You might read that and infer that Slack is somehow tracking the national origin, ethnicity, or race of all of its users, which would be much fishier behavior than IP-based blocking. They're explicitly saying that they don't do that and that they don't have that information.
- berbec 8y agoA proper apology. These seem to have gone out of style.
- InclinedPlane 8y agoIndeed. Compare and contrast with "sorry again for something new this week" Facebook. "We let everyone and their uncle access all your private data, my B dog." "Oh no, guess we helped cause a genocide, oopsie doodle."
- pyrophane 8y agoThis is yet another good reason to prefer decentralized networks. When Slack or Facebook or whomever agrees to block someone there is no resolution other than appealing to a company with a closed decision making process, something I don't think any of us really want.
- pvg 8y agoWhat are the decentralized networks one should give preference to?
- orthecreedence 8y agoYep. Going to go ahead and throw Matrix/Riot out there as a great alternative.
- miaklesp 8y agoWhich platform would be better today from practical standpoint? for a remote team of developers. Matrix?
- orthecreedence 8y agoMatrix is the protocol, Riot is a Slack-like implementation of the protocol: https://riot.im/ https://riot.im/ You can use the default (free) Matrix homeserver with Riot and you'll basically have a free chat system without any setup (besides installing the client). I've been using Riot for a while now, and while Slack does seem a bit more polished, having client-side encryption for all my messages gives Riot the upper hand: I don't worry about sending passwords or sensitive info as much as I do with Slack.
- sandGorgon 8y agoModular.im is their hosted product. Much cheaper than slack as well.
- 8y ago
- Santosh83 8y agoWhat does Slack propose to do about access through a VPN so your real IP is hidden? Of course in the long term this is just incentive for countries to support balkanisation of the Internet.
- traskjd 8y agoReading between the lines, I think that's what they're suggesting.
- morpheuskafka 8y agoThey just do whatever the bare minimum is to comply with export laws.
- yellow_postit 8y agoIt’s an arms race but can always invest in detecting VPN access — see for example trying to watch Netflix through a VPN.
- tgsovlerkhgsel 8y agoClosing their eyes and pretending it doesn't happen, because with VPN they have plausible deniability/can claim they had no way to detect that they were actually providing the service to someone in a sanctioned country.
- martindale 8y agoThey should apologize for the cowardice displayed in adopting the discriminatory policies foist upon them by bad actors.
- kodablah 8y agoWhat changed recently that hadn't been the case for past years that made them add these new measures? A true, earnest apology would at least touch on the justifications for the changes more than just "become legal". But I understand that, sadly, that kind of transparency is a bit much to ask of any company these days. Still curious though if it was just an internal decision or spurred via government/legal threat/request.
- gk1 8y agoThree or four years ago I helped investigate application usage from embargoed countries as part of an acquisition. The acquirer was performing due diligence, and this was a liability they needed to assess. So, to answer your question, I doubt anything serious changed outside of Slack. Inside, however, maybe they got a new legal team that flagged this as a liability, or they're getting serious about compliance, or they're preparing for an IPO[1], or whatever... [1] https://www.cnbc.com/2018/12/07/slack-has-hired-goldman-sachs-for-2019-ipo.html https://www.cnbc.com/2018/12/07/slack-has-hired-goldman-sach...
- chomp 8y agoI worked at a couple companies where these "sudden pushes" to knock out embargoed countries were made. They both came when new legal counsel joined the staff. It's very clear to me that this is some housekeeping attached to their IPO.
- epc 8y agoThe US elected Donald Trump as President, who then reversed the Obama Administration approach to Iran and reimposed sanctions. With respect to Slack, if they intend to IPO in 2019 they may be going through a due diligence checklist as others have suggested.
- austenallred 8y agoPreparing to IPO would be my guess
- Wowfunhappy 8y ago> We will soon begin blocking access to our service from IP addresses associated with an embargoed country. Users who travel to a sanctioned country may not be able to access Slack while they remain in that country. Is Slack legally required to do this? As long as they aren't knowingly accepting payment from these countries, shouldn't they be in the clear? How are other tech companies dealing with this? Does Google block access from embargoed countries? Does Windows refuse to work?
- pests 8y agoNo it only does Google do it themselves but if you host at GCP then they automatically do it for you as well.
- da_chicken 8y ago> Is Slack legally required to do this? Yes, absolutely. Breaking sanctions is not just illegal, it's a criminal offense. There have been sanctions against Iran since roughly when Trump withdrew the US from the Joint Comprehensive Plan of Action [1] in May of this year. The CFO of Huawei was arrested in Canada per a request by the US because of their dealings with Iran [2]. [1]: https://en.wikipedia.org/wiki/Joint_Comprehensive_Plan_of_Action https://en.wikipedia.org/wiki/Joint_Comprehensive_Plan_of_Ac... [2]: https://www.bloomberg.com/news/articles/2018-12-05/huawei-cfo-arrested-in-canada-as-u-s-seeks-her-extradition https://www.bloomberg.com/news/articles/2018-12-05/huawei-cf...
- aaomidi 8y agoThe CFO was arrested in relation to Iran but not because of it. She was arrested because she lied to banks and sold American made technology to Iran. Slack is actually not required to do this as IM applications are exempt from sanctions.
- briandear 8y agoIs Slack just an IM application?
- 8y ago
- deleted 8y ago[deleted]
- ouid 8y agoWhat would the penalty for non-compliance here be?
- dylan604 8y agoFines if it's not a criminal violation, or potential prison time if it is. Since it's a corp, and the group think here is that corps are shields from jail time for the employees, then probably no jail time. There's also the negative PR that comes with being labeled as "aiding and abetting the enemy".
- zbentley 8y agoSlack missed an excellent opportunity here: to be first US company to suspend services momentarily due to egregious and broken* sanctions imposed by the US on other countries. * Broken in that they are levied against random individual citizens of sanctioned countries instead of groups trading with or state entities otherwise interacting with the US.
- mabbo 8y agoI'm a big fan and critic of apologies. This one is pretty good. They admit the mistake was theirs and they take responsibility for it. They say sorry. They explain what they're going to do to fix the situation. They say they're going to learn from this and not have similar mistakes in the future. Pretty solid. The only thing that is missing, in my view, is personalization. Tell me who you are, speaking for the organization. This humanizes the apology, and also gives a face to who it is saying they're going to improve. Ideally the CEO. Still, I give it 8/10.
- LeoNatan25 8y agoI'd subtract a few points for taking so long. Lawyers have gawked on this for hours to find holes, rendering the sincerity mute. 5/10 It's Slack, so actually 2/10.
- azhenley 8y agoThis apology seems very generic and sterile to me. People are boycotting their product so they apologized. They should have communicated with their users to begin with before taking such harsh actions.
- geofft 8y agoAre people actually boycotting their product? They very clearly see their free users as their non-primary market (no automatic invites, no tools for individuals to block individuals because your HR department is supposed to deal with it, limited archives, etc.) and I'm not sure a "boycott" of a free service even counts anyway. And a paying customer is not going to be able to drop Slack on one day's notice any more than they could drop email on one day's notice. Were there actually paying / potentially paying customers who cited this as a reason to stop using Slack?
- azhenley 8y agoMy Twitter is full of academics with students and collaborators from all over the world that are complaining that Slack just eliminated their ability for them to communicate over the service. I'm not sure how many of them were free or paid though.
- roadkillon101 8y agoWhile "banning by ip" will work for discouraging most users, a VPN service or a Proxy service (Socks, ssh, etc) would make it irrelevant if someone wants to use a service like slack, facebook or google...It just inconveniences those who do want to use it bad enough. To me, it's a "band-aid of compliance" to whatever agency has requested them to do a ban on certain countries IPs.
- vharuck 8y agoIANAL, but the legal standard is often "enough effort to show you tried, but it doesn't have to be perfect." Which is usually taken as, "enough to inconvenience unintended targets, even if intended targets can easily avoid the punishment."
- paulschreiber 8y agoI want to see a post-incident analysis, like GitHub published: https://blog.github.com/2018-10-30-oct21-post-incident-analysis/ https://blog.github.com/2018-10-30-oct21-post-incident-analy...
- malloryerik 8y agoFaith in Slack mostly restored.
- rootkea 8y agoNope sorry. Slack is a walled garden. And relying on a walled garden means handing over your control, freedom and privacy which eventually gonna lead to similar kind of exploitation/abuse. As another HN commenter @SamWhited put it, "Using a proprietary protocol that doesn't allow any form of federation is an unacceptable way to build a global community". We need to develop and use FLOSS protocols/tools as much as possible.
- function_seven 8y agoDoes an IPv6 world prevent IP-based location sniffing? It seems odd to me that IPs can still be used to (semi-)reliably determine a client's geographical location. With the immensely larger address space that comes with IPv6, does that give the Internet a chance to completely sever the link between geography and IP address? Or do we still have issues with aggregating routes in a space-efficient way?
- dylz 8y agoThe commercial internet does not want to sever the link. It wants to be able to lock users out in certain ways, have blackout dates, etc.
- ndnxhs 8y agoIn my limited understanding I believe that ipv6 blocks are given out to organisations such as your local ISP which let's you know the location because you can see who owns the block. I don't think limited addresses was ever the reason for assigning in blocks but the real reason is it makes routing easier. Instead of having every router know the path to 128² addresses it only needs to know that everything starting with these few bytes goes to this port which saves memory on routers.
- lmm 8y agoIPv6 address space is less fragmented than IPv4 (that's part of the point), so inferring location from IPv6 address is if anything easier. Addresses should correspond to network topology in order to be useful for, you know, routing. And network topology tends to correspond to physical location for practical engineering reasons. Of course there's no reason someone couldn't run a cable halfway around the world to use IP space in one country from a different one (or use a VPN, is what people do in practice), but realistically what would they gain from that?
- function_seven 8y agoThanks. I had some fuzzy idea backwards in my mind: that part of the reason IP blocks are correlated to location had to do with address space constraints. But that’s wrong. Having a massive address space makes it trivial to keep routable blocks contiguous no matter how many IPs they contain.
- dbg31415 8y agoThis disturbs me. So Slack is a communications platform. If we have an embargo against a country, we have to shut off any services we offer to that country? Including communications platforms. Doesn't seem like that will help improve things in that country, or help the people in that country communicate. I'm all for not sending a dictatorship steel or guns, but why would we cut off communications platforms? That seems batshit.
- ssnistfajen 8y agoMaybe KJU, Khamenei, and Raul Castro has a secret slack group for plotting USA's downfall. You never know! /s I'm betting that Slack only had to do this to comply with some dumb laws regarding sanctions because I am unable to see why anyone from these countries using civilian, commercial, non-sensitive services such as Slack would have any impact on sanction enforcement.
- dbg31415 8y agoNah, they're on WhatsApp.
- chatmasta 8y ago> Users who travel to a sanctioned country may not be able to access Slack while they remain in that country. However, we will not deactivate their account and they will be able to access Slack when they return to countries or regions for which no blocking is required. So why ban any account? Why not just drop connections from IP addresses in embargoed countries?
- akerl_ 8y agoThat’s what they said they’re going to do.
- chatmasta 8y agoIt remains unclear. From the blog post, it sounds like they banned a number of accounts, and now are manually unbanning some of them.
- akerl_ 8y agoThe line you quoted is specifically clarifying what they will be doing moving forward, which is blocking connections from sanctioned countries. Their post as a whole is their apology for the prior method, which did deactivate accounts.
- chatmasta 8y agoRight, and their blog post also says that after de-activating accounts, they have restored access to some of them. So what about all the accounts they banned but have not unbanned? What if one of those accounts has only ever connected from an embargoed country, but travels in the future to a non-embargoed country? Will it be able to use Slack? (Put another way, it seems like they’re saying some accounts remain de-activated. So which is it? Accounts are de-activated or IP addresses are blocked?)
- akerl_ 8y agoThat’s a hedge in case they missed somebody. If they said “we unbanned all the accounts” but via a search error they’d missed one, and that person commented “no, liars, I’m still banned”, it would be a whole new round of controversy. So instead they say that they got most of them and if they missed you, ping their support team and they’ll fix it.
- derefr 8y agoI'm curious whether IP blocking is actually enough to comply with the spirit of a trade embargo. Surely, the point of "not trading with Iran" is to avoid, through one's economic activity, enriching the citizens or corporations of Iran; and has nothing to do with preventing access to people who just happen to currently be within the geographic boundaries of Iran. (So: email blocking by detection of Iranian-ISP mail host = sensible; Iranian IP blocking = not-so-much.) Unless, I suppose, you expect that a tourist accessing your service through an Iranian ISP, will be enriching the Iranian ISP to exactly the degree that you are serving them, and therefore, you are legally required to not serve the tourist, lest they enrich the ISP thereby. (That would be a hard point to prove.) But actually, even if it was just the letter of the sanctions that you had to obey, I would expect that "not trading with Iran" would be a lot harder than it sounds—it would require, for example, that you do not trade with an Iranian citizen who is currently geographically located in, say, Mexico. How would you know? Your random IM webapp would need a KYC process (submission of ID documents, etc.) to be "sanction-compliant", wouldn't it?
- AlfeG 8y agoIts actually pretty funny. US and others says that Russia forcibly occupy Crimea. But now all people of Crimea is under embargo, not Russia. It like if its not enough, lets beat them harder.
- yani 8y agoInternet should not be censored.
- Annatar 8y agoWhy should anyone even bother using "Slack" when there is internet relay chat?
- throwaway12iii 8y agoSlack employees participated in indiscriminate warfare against innocent people. Because economic sanctions are a means of warfare by definition. Like often happens in warfare, collateral damage of other innocent people happened. There wasn't even a requirement that they had to do it in such a cruel way. Anyone still working there... fuck you.
- teepo 8y agoMy theory: Slack did this rough shot to get a deal signed with a major new client and to support the due dil. Also note that all the major cloud providers in the US do not do business with embargoed countries. They all block IP from Iran, et al. to compute within the US, but allow it to compute within other geos, this extends to tech support, sales, etc. I'm honestly surprised that Slack users within Iran could access the service running in US to begin with. In all likelihood they could only access edge servers located in other geos in APAC or the EU. Look closely at everything Slack says in this message and others. "Enterprise Software" is tossed around a lot. They want to be the communications platform for the enterprise and have to meet these standards to compete with other offerings that exist today.
- hrktb 8y agoIt’s still profoundly disturbing to my eyes. Technically their underlying problem is relying on IP ranges, wich is flawed and raises false positives all the time. They seem to recognize they shouldn’t be doing irreversible and critical action with only that info, yet will still use it to drop traffic. To me their message is “sorry we screwed with your accounts, going forward we’ll only screw with your messages”. Am I supposed to be that reassured ?
- whoisjuan 8y agoMy guess is that this was a poorly thought and prioritized issue. Probably they asked some junior engineer to write a database query looking for a list of accounts with IP logs that matched a range of IPs coming from the banned countries, and then they passed that list to another junior employee who deactivated the accounts. Of course, there are many reasons for those IPs that are not your default/work/home, to be logged against your Slack account. They probably didn't think this throughly.
- Gibbon1 8y agoI find it profoundly disturbing the US foreign policy has been hijacked by Israel and Saudi Arabia.
- mirimir 8y agoI totally agree. But the problem then is what they ought to rely on. If in fact they are legally required to deny service to those in sanctioned countries. The whole thing is silly. I mean, anyone in a sanctioned country who was truly up to no good would be spoofing their IP address in some way. So most of the users that they ban or block will be innocent.
- daveFNbuck 8y agoSanctions aren't about stopping people who are up to no good. They're supposed to hurt the country as a whole, which mostly means hurting the innocent. The idea is that this will incentivize the country to stop doing the thing it's being sanctioned for.
- chx 8y agoReports from the affected are a bit imprecise and often heated. Do we know whether Slack here banned based on IPs from the past and if so, do we know how long they keep that data?
- drawkbox 8y agoSanctions and embargos are getting out of hand. Blanket, rather than targeted individual sanctions/actions, truly only harm the people of a country that have little to no say in what their government or country does. As seen here, sanctions turn companies that provide services into poor customer service scenarios through forced compliance for what reason ultimately? All that does is make it harder to track since we now live in a surveillance society. What a waste of time and energy. We are living in an age of the abuse of economic sanctions, that ultimately harm the wrong people and make companies/products look bad.
- kortilla 8y ago>Truly they only harm the people of a country that have little to no say in what their government or country does. That’s the whole point. It’s not an unintended side effect. You’re targeting an entire country’s economy to pressure the government regardless of whether or not it’s elected. Disclaimer: This is not an endorsement of embargoes.
- drawkbox 8y agoSanctions today are like someone committing a crime in your city and then you invoke martial law until that person gives themselves up without going after that person specifically, making everyone in the city suffer who are simply trying to survive and are powerless to resolve the situation. It is a bit medieval and tribal if you ask me and doesn't work today. Targeting individuals that actually cause the problems is a better strategy. Ultimately, we live in a surveillance society now, blocking people with reckless abandon only limits access to individuals causing issues for all. Technology is being used by authoritarians in frightening ways, somehow this has to get fixed, companies/people need to stop falling in line.
- filleduchaos 8y agoIt takes a special kind of naivete to think that a country worth placing this sort of embargo on is a country where "pressuring the government" would lead to any tangible results. That or a special kind of callousness, because most often the only way the citizenry can effect change is through violent revolt after reaching the boiling point of poverty and/or oppression.
- bad_user 8y agoBad apologies make things worse, but good apologies don’t make things better. Actions speak louder than words. Blocking people accounts was a management level decision that they are only regretting due to this coming to the public’s attention.
- Jare 8y ago"Mistakes were made" is a good apology, but with no personalization, no reparations for the people impacted, and no reflection on the process and context that allowed those mistakes to happen, it still leaves Slack in a lower place in my mind compared to where it was before this incident. It may sound like there's no way to win for them, but well, mistakes have consequences. Time will heal the wounds.
- tjoff 8y agoMissing the why the mistakes were made. What assumptions they made didn't hold up etc. Since they don't dare to even touch that subject incompetence is about the most charitable I can think of.
- paulgrimes1 8y agoI understand the necessity of embargoes, but I’m a little torn on this one, given the ubiquity of Slack, IP crackdown mistakes aside. Hypothetical: If you build a product meant for use in other countries than (also as well as) the one it’s been built in, should you be allowed embargo its use based on the (possibly arbitrary) politics of a single one of those countries? I suppose the makers can do as they please/are required to in their home country. However, it opens another costly-to-startups hypothetical: If the politics of our home country swing to the (insert x-axis direction) and we decide (insert country Y) are baddies, do we have the resources to comply with an enforced embargo?
- baybal2 8y agoOffering a free service is not "trading" by definition
- pozzed420 8y agoIran is a terrorist state and anyone providing aid to them can be tried under the PATRIOT act: https://en.wikipedia.org/wiki/Providing_material_support_for_terrorism https://en.wikipedia.org/wiki/Providing_material_support_for...
- lispm 8y ago> In fact, we also apologize to the people whose accounts we intended to disable in order to comply with these regulations Misguided politics of the Trump 'administration'. This stuff is highly unpopular outside the US. For me a reason to avoid US services which actually enforce these politics. Slack can do whatever they want, but these actions make sure that I never want to be a customer of theirs and I would never recommend to use their services.
- googamooga 8y agoI wonder why Slack so cares about blocking poor Crimeans from its service and at the same time Visa and MasterCard are accepted freely in any town of Crimea. Why these payment schemes are allowed to work there despite the embargo?
- meshr 8y agoWhy do you think so? Visa and MasterCard are banned in Crimea. Visa and MasterCard can't track its holder location.
- googamooga 8y agoBanned or not, there are ATMs and POSes across whole Crimea, accepting Visa and MasterCard. There was a brief period in 2014 when the schemes withdrew from the peninsula, but they get back pretty soon in 2015.
- phyzome 8y agoCan someone provide backstory on this? I missed it because I blinked. :-)
- teddyh 8y agoSlack 'bans users' who have visited US sanctioned countries https://news.ycombinator.com/item?id=18730314 https://news.ycombinator.com/item?id=18730314
- colejohnson66 8y agoSlack banned anyone who had accessed their account from an embargoed country, regardless of if they were citizens or not and if they were there or not.
- mirimir 8y agoAs apologies go, this is a decent one. But they still say: > We would also like to notify our users that as we continue to update our systems over the next several weeks, we will soon begin blocking access to our service from IP addresses associated with an embargoed country. I'm no expert, but I did spend a couple months checking alleged locations of VPN servers. I compared: 1) location alleged by the VPN provider; 2) location from various geolocation databases; and 3) ping results from several hundred servers (from various providers). Bottom line, locations alleged by VPN providers and locations from geolocation databases were generally in agreement. But for some VPN providers, such as HideMyAss, ping results demonstrated that those locations were very often implausible. Because they implied signal transmission faster than the speed of light. So anyway, basing life-altering decisions on IP-based geolocation is an extremely stupid (or at least, unjust) thing to do.
- unethical_ban 8y agoWhat countries are embargoed for chat? I work in banking, and when we discuss certain kinds of remote access, it's notable that there is no "OFAC" list. There are shit tons of lists for different things. I wonder which list Slack uses.
- shutdown57 8y agoSlack also banned people who are just nationality of iran and they dont live in iran.