16 ms·

GitHub confirms it has blocked developers in Iran, Syria and Crimea

284 points by jmsflknr 7y ago

dijit 7y ago
Same as Gitlab then[0]. US Sanctions should not affect internet services (so long as they are provided for free)[1], but political pressure appears to be very strong. Personally I find it quite abhorrent, and would cite this as a reason not to use US based companies in future. [0]: https://about.gitlab.com/2018/07/19/gcp-move-update/ https://about.gitlab.com/2018/07/19/gcp-move-update/ [1]: https://www.treasury.gov/resource-center/sanctions/Programs/Documents/ukraine_gl_9.pdf https://www.treasury.gov/resource-center/sanctions/Programs/...
- jlengrand 7y ago
  Well thanks for the extra info :). Sad news imho :S.
- krageon 7y ago
  There was already the privacy concerns and complete lack of ethical oversight. Now we have some more ethical reasons not to use them.
- marcthe12 7y ago
  The thing I am woried is that harfbuzz is developed by Iranian developer. It is an integral part of Linux font stack.
  - gtirloni 7y ago
    Well, for a well-known project, they won't miss GitHub visibility benefits. They can host the git repository anywhere. Self-host an issue tracking system or find a non-US company that does that (and is not required to follow US sanctions due to trade agreements, that'll be hard). It's an annoyance, for sure.
    - r3bl 7y ago
      The problem is that they'd require a payment method to rent the server somewhere else or to use a non-US company that doesn't offer a generous free plan. The most prominent payment providers (Visa, MasterCard, PayPal) are all US-based. > (and is not required to follow US sanctions due to trade agreements, that'll be hard). I really don't know much about sanctions against Syria and Crimea, but Iranian developers could use every country that hasn't withdrawn from the Iran deal: EU, UK (separate signature, regardless of Brexit), Russia, China.
      - quickthrower2 7y ago
        Enter... crypto
        jdbernard 7y ago
        Between the speculative get-rich-quick rollercoaster of Bitcoin and the fraud of other crypto currencies it feels like the promise of decentralization has been forgotten.
        r3bl 7y ago
        That's just shifting the problem one inconvenience further. How do you purchase cryptocurrencies without Visa/MasterCard/PayPal?
        quickthrower2 7y ago
        I'm not sure what options they have, but ideally, for convenience some kind of local country bank transfer, which could be to a local crypto dealer. That might take days but you might "stock up" on crypto to compensate. Or peer to peer cash/crypto swap might be required. Or businesses themselves sell some of their services with crypto.
      - chriswwweb 7y ago
        It's unfortunately not that easy. Iranian students studying in the UK for example, currently have a lot of trouble to pay their tuition fees. Because the U.S. insists that any bank (from the EU or wherever in the world) that wants to do business in the U.S. must comply to U.S. sanctions, which means an U.K. bank has to choose if it wants to block Iran or get blocked itself in/by the U.S. for doing business with Iran. More about this can be found on Wikipedia: https://en.wikipedia.org/wiki/United_States_sanctions_against_Iran https://en.wikipedia.org/wiki/United_States_sanctions_agains....
  - LeonidasXIV 7y ago
    Behdad Esfahbod lives in Canada though, also most of his FOSS contribution (pango, fontconfig etc) are on the freedesktop.org and GNOME git repo servers, not GitHub.
    - dijit 7y ago
      I know this is just nitpicking, but US Sanctions apply to sanctioned state nationals; regardless of location.
      - styx31 7y ago
        Are you sure ? Quoted from GitHub CEO Nat Friedman on Twitter: > The restrictions are based on place of residence and location, not on nationality or heritage. If someone was flagged in error, they can fill out a form to get the restrictions lifted on their account within hours.
        dijit 7y ago
        > Any company or national of Cuba, Iran, North Korea, Sudan, Syria, and the Crimea region. Export licensing of commodities or services intended for these countries is presumed denied; Wording like this appears on the treasury documents, Google cloud and Oracles official documentation on sanctions. I'll just link the Oracle one because ironically the one that google uses is really difficult to find: http://www.oracle.com/us/products/export/export-regulations-345813.html http://www.oracle.com/us/products/export/export-regulations-...
        jwieczorek 7y ago
        By that wording, who is a national of the Crimea region? Did they mean residents?
      - chriswwweb 7y ago
        No they don't! The sanction is against the country, not nationals. So if you are a developer from the U.S. with U.S. nationality and move to Cuba the sanctions would also apply to you. Actually there is a very good wikipedia page "United States sanctions against Iran" https://en.wikipedia.org/wiki/United_States_sanctions_against_Iran https://en.wikipedia.org/wiki/United_States_sanctions_agains... about this, if you want more info.
  - deleted 7y ago
    [deleted]
  - dijit 7y ago
    I would have said "move to git.kernel.org" but that's also hosted by a US based provider: organisation: ORG-PHI3-RIPE org-name: Packet Host Inc org-type: OTHER address: 30 Vesey Street, Suite 900, New York, NY 10007 US And, obviously GNOME git servers are US based, since they're owned by RedHat/IBM.
    - maze-le 7y ago
      Use a self hosted gogs installation (https://gogs.io/ https://gogs.io/) under your own domain and root server outside US jurisdiction.
      - swiley 7y ago
        Or just use ssh. That’s what I’ve always done with my friends when we didn’t want to use GitHub. There’s no need to over complicate things.
      - nerdponx 7y ago
        GitLab is self-hostable as well, although I imagine Gogs is easier.
        dijit 7y ago
        Gitlab is actually super easy if you keep to the omnibus installation methods or docker image. The only problem regarding gitlab is resource consumption.
    - cuillevel3 7y ago
      If your company operates in the US and uses a provider, who does not implement sanctions, does it have to enforce them on its own? I mean, something like selling a product, maybe based on open source tech in the US and cooperating with devs in sanctioned countries via a workaround provider..
  - cyphar 7y ago
    If we end up with a project like [1] actually taking off, then with Secure Scuttlebutt you wouldn't need to care about server hosting and the pub servers could be distributed globally. [1]: https://people.kernel.org/monsieuricon/patches-carved-into-developer-sigchains https://people.kernel.org/monsieuricon/patches-carved-into-d...
  - behdad 7y ago
    Hey. HarfBuzz maintainer here. I live in the States but one of our core developers is in Iran. This whole incident was a huge miscommunication on github. Fortunately they have addressed some of it. In short: Open Source and public repos are not affected at all. Cheers
- onetimemanytime 7y ago
  they took the easy way out...ban them all, just in case. Not worth the trouble or lawyer fees explaining it to DOJ
- murbard2 7y ago
  I don't think it is about political pressure in the sense that, I doubt the USG fundamentally cares about whether or not Iranians can use GitHub or not. For companies like Google or Microsoft, this is about minimising the attack surface because they do other (legal) things that the USG does care about. You can't punish a tech giant just for doing a tech giant, but you could try to make other things stick.
- wickerman 7y ago
  The amount of harassment that citizens of any state that the US claims to hate at any given time endure on a daily basis is disgusting. Exiled iranians living outside of Iran for 20 years have got their bank accounts closed solely for being Iranian. I can't help but think that these internet services will be going that way in the future. The fact that the "free software" community is not putting their foot down for this is disgusting. Especially when there's so much back-patting when it comes to "the value of the community". Where's the community for crimean or iranian developers?
  - AmericanChopper 7y ago
    Ya know what was actually disgusting? The war in Iraq, or any other recent regime change the US executed. If economic warfare is the way it’s done now, then that’s great. Let the casualties be inconvenienced github users, rather than ya know, actual casualties...
    - cdmckay 7y ago
      You realize that sanctions also kill people through lack of supplies like medicine being available, people being unable to economically support themselves, and, if the sanctions cause the government to collapse, all the death that results from that. So let’s not pretend sanctions are somehow nonviolent.
      - celticmusic 7y ago
        and yet, that will be less than the war in iraq. It's github. I would personally be inconvenienced, but not terribly so. I cannot imagine their life is going to crash in some meaningful way for not having access to github.
        tehbeard 7y ago
        > it's github. Are you naive enough to think the sanction is explicitly targeted exactly at github, and not any number of services, or part of a wider economic attack?
- AmericanChopper 7y ago
  > Personally I find it quite abhorrent, and would cite this as a reason not to use US based companies in future. Then I’d highly recommend that you try doing that. I consulted for a company once that tried this, and it was an absolute nightmare. Every single piece of technology they used was worse than second rate. Making comments on HN is really easy, backing them up with action, in this case, is not.
  - mugsie 7y ago
    Any company that does business in the US, or with another company that does business in the US. Not just US based companies are subject to these restrictions (if they want to sell into the US)
    - AmericanChopper 7y ago
      Don’t make it too hard on yourself. If you want to use your own economic clout to take a swing at the US, then just stick to boycotting US companies. See if it’s even possible to operate your project like that. You’ll be taking a step back in time by at least 10 years.
      - mugsie 7y ago
        I am not sure I could do it at all. The Linux Foundation is a US corporation, and that rules out nearly all my options for the work I personally do. (and, well working for one doesn't help it either)
        AmericanChopper 7y ago
        Then make it even easier. Only apply the principle to services or products you pay for.
      - dijit 7y ago
        The sensibility you have expressed is chiefly why we should fight US dominance of the tech sector. Not why we should lean in to it.
- cochne 7y ago
  It looks like the free services provided by GitHub are still available: "A selection of GitHub services such as access to public repositories will remain available to everyone, the company said in a statement on its website. “This includes limited access to GitHub public repository services (such as access to GitHub Pages and public repositories used for open source projects), for personal communications only, and not for commercial purposes.”
  - mieseratte 7y ago
    So what can't restricted foreign-nationals do? Private, paid-for repositories? Is there something else particularly important?
    - Algent 7y ago
      If I recall right from previous thread they can still create and commit to public repo but can't delete them. They also can't touch even their own private repo anymore.
      - theturtletalks 7y ago
        They added the option to make private repos public so you can back it up. But again, you can’t delete the now public repo.
        emilfihlman 7y ago
        >They added the option to make private repos public so you can back it up. And allow all to see their contents, likes business and trade secrets. Top tier.
        theturtletalks 7y ago
        Yep. If you want to access your blocked private repo, you literally have to let everyone access it. And you can’t even delete it afterwards.
- thenickperson 7y ago
  This affects companies that have US users too. Your only option is to move out of the US and not use products with any users in the US. That means your only option is China, which is far worse for online rights than the US.
- miracle2k 7y ago
  Like I wrote somewhere else, the Gitlab case is both worse and better. Gitlab did not make a specific decision to block Iranian users, it merely made a technical decision to move to Google Cloud, and Google Cloud is blocking sanctioned countries on a network level (which is abhorrent). But I don't see Gitlab making an active decision that they have to do this for sanctions compliance reasons, it was just a side-effect and they didn't care enough for it to change their minds about the move. Specifically, if I sign up to Gitlab, set my country of residence to Iran, and Gitlab lets me create private repositories, then they are not enforcing the sanctions the way Github does.
  - espeed 7y ago
    See comments in this previous thread from 31 days ago [1]... Google Safety & Security Blog: An update on state-sponsored activity (2018) ... Detecting and terminating activity on Google properties "Actors engaged in this type of influence operation violate our policies, and we swiftly remove such content from our services and terminate these actors’ accounts. Additionally, we use a number of robust methods, including IP blocking, to prevent individuals or entities in Iran from opening advertising accounts." ---//--- [1] "An Open Letter to Google and Apple: Stop Hindering Iranian Entrepreneurs" https://news.ycombinator.com/item?id=20302547 https://news.ycombinator.com/item?id=20302547
    - whoopdedo 7y ago
      Can we start calling this "The Great Reverse Firewall"?
      - espeed 7y ago
        Not all of it is US sanctions [1]. The US will protect its networks and will not allow a foreign adversary to use US platforms to target US citizens, but the US has no incentive to restrict the Iranian people's access to information or communications or ability to speak. Most of Iran's cyberspace restrictions are coming from within... https://en.wikipedia.org/wiki/Internet_censorship_in_Iran https://en.wikipedia.org/wiki/Internet_censorship_in_Iran [1] "Iran's Rulers Speak Of More Cyberspace Restrictions As Conditions Worsen" https://en.radiofarda.com/a/iran-s-rulers-speak-of-more-cyberspace-restrictions-as-conditions-worsen/29909929.html https://en.radiofarda.com/a/iran-s-rulers-speak-of-more-cybe...
- not_a_cop75 7y ago
  Yeah, it's totally abhorrent that the US blocks people that would prefer they get wiped off the face of the earth. How dare they!!!
  - syndacks 7y ago
    Your sentence uses "they" ambiguously, FYI. Two very different interpretations possible.
  - alt_f4 7y ago
    Have you considered that regular people that live under an oppressive totalitarian government have no control over said government and are actually just victims?
    - not_a_cop75 7y ago
      Have you ever lived in the US?
- csomar 7y ago
  I think non-US companies have to comply with the sanctions too. Your alternative will be the pool of sanctioned countries and friends. Which don’t have the infrastructure most people need.
- yxhuvud 7y ago
  There is no real difference between sanctions on internet service and any other thing, except things directly involved in the reasons for the sanctions (notably military material)
- deleted 7y ago
  [deleted]
jlengrand 7y ago
I'm curious to hear what Gitlab has to say about this, or if they will have some kind of official communication specifically on that matter.
- yuchi 7y ago
  See https://about.gitlab.com/2018/07/19/gcp-move-update/ https://about.gitlab.com/2018/07/19/gcp-move-update/
  - jlengrand 7y ago
    Yes, thanks!
    - miracle2k 7y ago
      Note that this is not quite the same. Gitlab made a technical decision to move to Google Cloud, and Google Cloud has its own, much more outrageous block on a network level. Gitlab not being accessible from Iran is a by-product of that move, not a conscious decision Gitlab made. Arguably, if I create a Gitlab Account using a VPN but put country of residence "Iran", and Gitlab lets me do that, then Gitlab does not have the same policy has Github.
      - jlengrand 7y ago
        Ha, good additional info indeed. I took the Github post as in "if I'm in Iran but use a VPN, and set Iran as country of residence I'm fine".
snitko 7y ago
We made it point now to avoid all US-based services. While we're not affected by the sanctions yet, it seems like it is a possibility in the future. There's really not a lot of reasons to use Gitlab or Github or Slack or a number of other services. They're not exceptional in any way and can be replaced by other open-source or commercial projects.
- nathanaldensr 7y ago
  Yep, and this is a sign of the ecosystem working well.
- ardani 7y ago
  In the same line, if there's any forum I take with a spoonful of salt it's Hacker News.
- diminoten 7y ago
  Convenience and speed aren't reasons? You're handicapping yourself against your competitors, and no one who does that lasts very long.
  - snitko 7y ago
    Don't see it that way. If I set up a process once, using software that's been tested and been around for a while, it's extremely convenient. And free. And there's no risk of deplatforming.
    - diminoten 7y ago
      You're completely ignoring feature parity, among many, many other things in your oversimplification... Ask any founder here: people don't generally randomly throw money without getting value; ergo these multibillion dollar services you're pretending are entirely replaceable with free tools offer some additional value .
      - snitko 7y ago
blodovnik 7y ago
I know lots of Iranian people and they are universally kind generous lovely people. I hate the way Iran is demonized so politicians can point out an enemy. We were flat out lied to about Iraq. Demonization of Iran is no different.
- ausbah 7y ago
  It's more like the Iranian government.
  - tapia 7y ago
    Not like the US government is any better right now
    - newshorts 7y ago
      Trump just needs a war to be in by election time...
    - fit2rule 7y ago
      At no point in the last 40 years has the US government held a higher moral ground than the Iranian government. The USA has killed far more innocent people under far worse pretext than any other nation on Earth.
    - raxxorrax 7y ago
      As long as the government just calls people names instead of invading them, I am completely fine with that. Progress, I guess.
      - lawn 7y ago
        Because the US government hasn't invaded other countries...? Of course they call it something different, but they do tend to start wars periodically. For flimsy reasons.
        7y ago
jokoon 7y ago
I wonder is those could be related to cyber security measures, not political measures.
- amiraliakbari 7y ago
  It's unlikely. GitHub hasn't banned Iranian IPs or completely closed Iranian users, but just blocked those users' access to their private repositories and Gists.
- red_admiral 7y ago
  Very unlikely in my opinion - if the Iranian Revolutionary Guard did want to attack something, I doubt they would do it from an IP address in their own country. I'm sure they have a decent botnet or two somewhere else, that's like opsec 101. Similarly, although Crimea specifically is now IP-banned, the rest of the Russian Federation is not. This is exactly what it looks like: a political sanction.
- espeed 7y ago
  Yes, some of it is. See previous thread... https://news.ycombinator.com/item?id=20302844 https://news.ycombinator.com/item?id=20302844
freestate 7y ago
How about someone build a platform that is freely available that pushes to github from a not banned Location. Or just stop using github and create or find a truly free platform.
- blodovnik 7y ago
  This really is reason to start thinking about alternatives to github. Now the vast majority of open source projects are controlled by Microsoft corporation which must obey the US goverent and this is the outcome.
  - red_admiral 7y ago
    Downvoted. Github was subject to US law before MS took it over; gitlab is not MS-owned but had to do the same (not sure about bitbucket but I imagine it's similar). Whether the #1 place to host open-source projects should be owned by a company that makes a closed-source OS is a good debate question but it's completely orthogonal to whether they have to comply with US law. I'm not saying I agree either with the sanctions or with Microsoft running github, but I'm saying you can't blame Microsoft for the current administration's sanctions on Iran.
    - blodovnik 7y ago
      So why haven't all websites cut off these countries? Why haven't the ISPs cut off these countries? Github has acted because github is under the control of a giant corporation, Microsoft or otherwise. So there's a line that runs precisely from Microsoft acquisition to cutting off countries from the world's largest open source repository. It's a direct outcome of the Microsoft acquisition.
      - viraptor 7y ago
        A lot of pages have. Or at least they don't take payments from them. Larger CDN providers will maintain "US sanctions" blacklists which you can enable with one click. A lot of companies just don't care.
tomohawk 7y ago
Crimea: Illegal occupation by Russia. Ethnic cleansing. Syria: Using chemical weapons, sponsoring terrorism Iran: Assisting Syria; Actively developing nukes they say they will use, nuclear proliferation, biggest sponsor of terrorism, .... On the other hand, some people can't use an internet service. Oh! The inhumanity! Get a sense of proportion.
- deleted 7y ago
  [deleted]
- antisemiotic 7y ago
  By that logic USA should be blocked too, right?
  - tomohawk 7y ago
    Oh, yeah - forgot about Crimea/Russia shooting down MH17 airliner.
    - whataboutist 7y ago
      Did you also forget about the US shooting down Iran Air Flight 655?
      - free652 7y ago
        So Russians apologized for MH17?
      - 24gttghh 7y ago
        So, you mean where the US at least kinda-sorta apologized and paid restitution? I hate the Regan years as much as the next person, but this is a false equivalence. I didn't see Russia/Donblast apologize after MH-17...
        whataboutist 7y ago
        Fair, besides the fact that they took 8 years and did not admit legal liability or formally apologize to Iran. However, this is not true for every crime that the US has committed. OP could've explained why those crimes might not be relevant to the discussion, instead he tried to one-up them with the crimes of other regimes. In the case of the US, or every other great power; that game can go on indefinitely.
majia 7y ago
If Crimea was unwillingly annexed by Russia, then the sanction is punishing the victim instead of the criminal. If Crimea people genuinely supported the unification with Russia and received sanction for that, then it is a blatant attack on Crimean people's freedom.
- PunchTornado 7y ago
  pff, ridiculous comment. a region doesn't have the right to attach itself to another state. think about it. a bunch of russians move to somewhere near grand canion, do a referendum and then proclaim it russian territory.
  - dijit 7y ago
    There aren't many examples of Unification, but there are examples, maybe this wouldn't be considered one of them. My home country for instance is the "United Kingdom" which is made of up of countries/territories that unified many hundreds of years ago. There's other examples such as the formation of Italy: https://en.wikipedia.org/wiki/Italian_unification https://en.wikipedia.org/wiki/Italian_unification However, if it's not annexation it's probably better described as "ceding"; an American example: France ceded Louisiana to the United States by the treaty of Paris, of April 30, 1803. Spain made a cession of East and West Florida by the treaty of February 22, 1819. Cessions have been severally made of a part of their territory by New York, Virginia, Massachusetts, Connecticut, South Carolina, North Carolina, and Georgia.
    - galangalalgol 7y ago
      unified is a proper term perhaps but at the time the gaelic speaking peoples would have probably used conquered or maybe colonized.
      - dijit 7y ago
        This is not an appreciable understanding of history. If talking about the UK specifically.
stunt 7y ago
I think that's a fair answer and is totally understandable from Github's standing point. Wish they could give a heads up earlier.
raesene9 7y ago
To me, this is another example of the "splinternet" phenomenon where the Internet is, in some ways, moving to become less of a universal resource and more regional in nature. It's a shame, as a lot of benefit has been derived from having globally available information exchange, but it seems the trend is for regions or nation states to want more control over Internet based resources, as they become more important to the operation of those countries.
deleted 7y ago
[deleted]
deleted 7y ago
[deleted]
floor_ 7y ago
How are private repos handled in this situation? From what I remember private repos go public if you fail to pay for them after a month.
petercooper 7y ago
I'm curious.. why is this very suddenly an issue? Haven't countries like Iran and Syria been under embargo for years? Have more restrictive laws around sanctions been passed in recent weeks?
- umanwizard 7y ago
  I’m not sure but I suspect the change is due to GitHub having been bought by MS which has more competent (or more paranoid.... or maybe just more) lawyers.
- viraptor 7y ago
  MS with their lawyers caring about things that GitHub on its own didn't?
- deleted 7y ago
  [deleted]
- peanutgal2600 7y ago
  Trump has begun attacking his corporate enemies in the courts, namely Facebook and Google. Microsoft is terrified of getting on his bad side, and Trump needs to stir hatred of Iran to make sure AIPAC stays on his side. Basically, Trump said jump so Github dropped their drawers, bent over and grabbed their ankles.
  - philzook 7y ago
    That's an interesting way to jump.
resters 7y ago
By participating in the sanctions, Github is allowing itself to be an arm of Donald Trump's white supremacist, Christian supremacist political campaign. The only acceptable response for tech companies to this kind of stuff is to refuse to comply. Sanctions are acts of violence that directly harm the people who are the victims of the regimes the US takes issue with. Now, another generation of young tech workers will be materially harmed by US warmongering. When Github first launched there were concerns about centralization. We can see now how Linus made a wise decision to design git as a decentralized system. Fortunately, for any teams hiring Iranian, Syrian, or Crimean workers, commits and branches can be synced with an easy to configure git peer via ssh. The morally bankrupt US war posturing is bad enough, but it really irritates me when it starts to impact the day to day lives of people who are just trying to live their lives peacefully and write code or contribute to open source.
- tomtompl 7y ago
  you people are sick
  - resters 7y ago
    Please explain :)
    - tomtompl 7y ago
      pardon, I should've said, you people are religious fanatics
    - DanielShaffen 7y ago
      You're a mentally unstable extreme leftist. You really need this explained? I'd bet yes because you live in a bubble ;)
sbhn 7y ago
Poor America, always shouting it’s under attack, is that because it’s war machine is the second largest money spinner on earth. Its drooling for your hard earned American tax payer dollars. Its for your security, you know that.
- tomtompl 7y ago
  tell that to ukrainians, ok?
mr__y 7y ago
Thankfully github is not a walled garden and repo can be moved to any other public or self-hosted git (well, at least the code itself). Or, as someone already suggested, use an external service/server that pushes the commits into git(hub|lab) repo. Git also seems to be relatively easy to work in a federated ecosystem - the only problem to be solved is read/write access in such environment.
Reason077 7y ago
Wait, Crimea's on the sh*tlist now too? Is this new?
- NovemberWhiskey 7y ago
  No; this goes back to 2014. https://www.treasury.gov/resource-center/sanctions/Programs/Documents/ukraine.pdf https://www.treasury.gov/resource-center/sanctions/Programs/...
- A4ET8a8uTh0 7y ago
  The timing is interesting, but same action could have been taken say 4 years ago and it would technically still be true. Whatever the reason is, it is not the recent SDN update.
TazeTSchnitzel 7y ago
‘[…] services such as access to public repositories will remain available to everyone, […] “This includes limited access to GitHub public repository services (such as access to GitHub Pages and public repositories used for open source projects), for personal communications only, and not for commercial purposes.”’
mugsie 7y ago
The US trade restrictions are pretty far reaching. They block companies trading with countries and companies on entity list . It also bans US companies from dealing with companies that deal with countries and companies on the list. So let us look at this: 1. GitHub becomes a Maltese company. 2. GitHub allows Iranian users to use all features 3. No US company could buy a GitHub Enterprise licence, or a private org. The export restrictions don't let them notify people that the ban is coming - once they identify the users that are under the Export Restrictions, allowing them to download (aka export) their repos is a breach. They did as much as they could to allow them to keep their accounts at all (and this is only due to export restrictions having exclusions that cover "publicly available source"). GitHub did what they had to do to avoid being censured by the US Gov, and did it better than a lot of other tech companies recently, by leaving some level of access. If you don't like the ban, and you are in the US, contact your elected representatives, and let them know - it is the only way it changes.
- miracle2k 7y ago
  That's not true. There are already many non-US companies who are providing services to Iran in the same sense that Github is providing services, and those companies are also having US clients, proving that it can be done. Now, if a Maltese-Github were specifically designated by OFAC, then sure. But that's fairly unlikely.
  - mugsie 7y ago
    > and those companies are also having US clients, proving that it can be done. Proving they haven't been caught, or may not even know about the US Dept of Commerce entity list.
    - miracle2k 7y ago
      Yes, in a way they haven't been caught. However, I want to point out that only US companies and persons are obligated to follow the sanctions. The reason why foreign companies might also follow them is because they don't want to end up being designated themselves. And this is not realistically going to happen unless you are a large multinational, bank, or doing business in sensitive sectors. Not actively blocking accounts identified as Iranian is not even the same as specifically trading with Iran. Like many smaller US-based web-services who also do not actively block, Github might well have gotten away with it as well, like the did the last couple of years. A Maltese-based company not blocking Iranian users might be designated, but unless they are, and it is pretty unlikely that they would be, they are doing nothing wrong under US law.
Alir3z4 7y ago
There's a repository that has made many aware of such problem https://github.com/1995parham/github-do-not-ban-us https://github.com/1995parham/github-do-not-ban-us As an alternative for Iranian developers and any other who was affected by such problem, I've setup https://gitfoo.com/ https://gitfoo.com/ It's a hosted version of gitea. I have enough resources and interest to maintain and keep it going.
kekebo 7y ago
Are there currently any serious competitors to Github/Gitlab (or instances of the latter) outside the reach of US politics?
peanutgal2600 7y ago
Nate bent over for Trump just as we expected he would. He became a billionaire stepping on the backs of better people, parasitically enriching himself off of open source then selling out an entire community to the most anti open-source company ever, Microsoft. This isn't a surprise. O Captain! My Captain!
- sschueller 7y ago
  The US putting countries on shit lists didn't start with Trump. Just ask Cuba.
  - peanutgal2600 7y ago
    I love whataboutism and deflection. It shows a lot about your character. Screw the world, I got mine, and someone else did it before me, so it's not my fault!
    - dang 7y ago
      We've banned this account for breaking the site guidelines. Could you please stop creating accounts to do that with? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
Flip-per 7y ago
That's a great opportunity to build similar code-hosting platforms (and other software/services) outside of the US. Just for political reasons many people might like to switch...
PopeDotNinja 7y ago
Will they start blocking VPN access ;(
njudah 7y ago
This thread is a useful reminder to US citizens that if you haven’t registered to vote, its a great idea to do so. The margins of victory in 2016 were small enough (in swing states) that a mobilized hackernews community could have made the difference.
- kickopotomus 7y ago
  This move has little to do with the current political climate and is more so associated with risk reduction from Microsoft as technology and regulations regarding technology (see Facebook) are coming into focus. All companies that do business with the US are required to abide by the Export Administration Regulations (EAR)[1] which prohibits exports (unless explicitly exempt) to sanctioned countries. The US has had sanctions on Iran since 1987[2]. This move would have likely happened regardless of who is in the White House. [1]: https://en.wikipedia.org/wiki/Export_Administration_Regulations https://en.wikipedia.org/wiki/Export_Administration_Regulati... [2]: https://en.wikipedia.org/wiki/United_States_sanctions https://en.wikipedia.org/wiki/United_States_sanctions
kerkeslager 7y ago
As far as I know, SourceHut[1] is still available everywhere. [1] https://sourcehut.org/ https://sourcehut.org/ EDIT: I stand corrected.
- Sir_Cmpwn 7y ago
  Sourcehut is US operated and I cannot accept users from sanctioned countries. You can run your own instance if your legal circumstances differ, but you cannot use the official hosted version.
  - kerkeslager 7y ago
    As other users have pointed out, the sanctions don't apply to internet services as long as they are provided for free[1]. So this is political pressure, not legal requirement. I'm disappointed that you've chosen to give in to the political pressure. I posted about SourceHut to promote your service because I thought you were doing something better than the big guys. [1] https://www.treasury.gov/resource-center/sanctions/Programs/Documents/ukraine_gl_9.pdf https://www.treasury.gov/resource-center/sanctions/Programs/...
    - Sir_Cmpwn 7y ago
      SourceHut accepts payments and will eventually become paid-only. I am a one-man operation and I don't have the legal wherewithal to stand up to the government. You can tell me how this legal fight fits into our budget, the finances are public: https://lists.sr.ht/~sircmpwn/sr.ht-discuss/%3CBVRVZEWYB30Q.3HGIC803LDBH7%40homura%3E https://lists.sr.ht/~sircmpwn/sr.ht-discuss/%3CBVRVZEWYB30Q.... I have to prioritize the health of the service for everyone above the needs of a few people.
ksajadi 7y ago
Is there an easy to understand guide for SaaS businesses to be compliant with these specific sanctions?
- sdinsn 7y ago
  Yes: don't provide any products or services to Iran, Syria, North Korea, or Crimea.
  - A4ET8a8uTh0 7y ago
    Uhh. I am sure you know that there exception to every rule. Hell, even current set of Iranian sanctions have them.
aerojoe23 7y ago
I think it is interesting and a shame that we accept centralized issue tracking at all. Git is wonderfully distributed, probably in more than most of the github users realize. Unless they've gone out of their way to learn about it. When things like this (github's ban) happen, I think it is too bad that we don't have a widely accepted issue tracker built into git. To be a little more clear, you'd get all of the source and all the issues when you clone or pull. Updating would work just like updating files when you push. Microsoft has appeared to start loving open source. I'm sure there are people there that do, but Microsoft itself I wouldn't be so sure. The are certainly embracing it. https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguish https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguis...
- jayshua 7y ago
  I mean, you could just make a folder with a text file in it for each issues. People can write comments in it. Move them into a "complete" folder when done. Write down who it's assigned to at the top. You wouldn't get some of the more complex features of course, but I'm not sure a git built in issue tracker could do most of that anyway. Not clear how it could send email notifications?
- czechdeveloper 7y ago
  It's not Microsoft choice. They have to listen to US laws.
- rkeene2 7y ago
  You could also switch from Git to Fossil which supports issues and wikis as part of its decentralized nature, in addition to unversioned artifacts (e.g., for release artifacts)
kerblang 7y ago
Saw some other debate in here about whether the law applies only to countries or also to individuals... Here's two federal govt lists of banned individuals: https://www.bis.doc.gov/index.php/the-denied-persons-list https://www.bis.doc.gov/index.php/the-denied-persons-list https://www.treasury.gov/resource-center/sanctions/SDN-List/Pages/default.aspx https://www.treasury.gov/resource-center/sanctions/SDN-List/...
cardigan 7y ago
Posting Nat Friedman's tweets here so they're easier to read - they're doing more than most companies about the whole thing, not sure where the vitriol in these comments is coming from: It is painful for me to hear how trade restrictions have hurt people. We have gone to great lengths to do no more than what is required by the law, but of course people are still affected. GitHub is subject to US trade law, just like any company that does business in the US. To comply with US sanctions, we unfortunately had to implement new restrictions on private repos and paid accounts in Iran, Syria, and Crimea. Public repos remain available to developers everywhere – open source repos are NOT affected. The restrictions are based on place of residence and location, not on nationality or heritage. If someone was flagged in error, they can fill out a form to get the restrictions lifted on their account within hours. Users with restricted private repos can also choose to make them public. Our understanding of the law does not give us the option to give anyone advance notice of restrictions. We're not doing this because we want to; we're doing it because we have to. GitHub will continue to advocate vigorously with governments around the world for policies that protect software developers and the global open source community.
- hkai 7y ago
  It's crazy how Trump imposed these restrictions against innocent people and got away with it.
  - mrtksn 7y ago
    I don’t think that it would have been different if someone else was the president. Pre-Trump I had a vacation in Cuba and since I knew that the internet is a luxury there I made Spanish available offline on Google Translate. Works great, then I made the mistake to launch the app when I hade one hour access to the internet in Havana and puff translate is gone. I’m not allowed to use it there. That surely destroyed the communists.
    - yxhuvud 7y ago
      When it comes to Iran, it definitely would have been different, considering that it was Obama that made the deal that Trump decided to break.
ralmidani 7y ago
I despise all 3 regimes, but these sanctions harm the people more than they harm the regimes. Sanctioning Crimea specifically makes no sense whatsoever. Why not instead sanction Putin who, you know, is the one who occupied Crimea?
jhthenerd 7y ago
Looks like it's time to switch to decentralized git repositories
mehdix 7y ago
Assuming that this is a Cuba, Iran or Syria problem is misleading, even though it renders most of things that I've made in my free time useless. Having free access to open source code is important. As a developer I'd try to self-host more and try decentralized solutions instead of relying on corporate entites to protect my interests.
mohas 7y ago
This is what happens when mega companies take over, they helped to make github what it is today just like every body else, and banning them without any notice just to see them suffer, that's low
mythz 7y ago
There's a lot of misinformation in this thread, from GitHub CEO [1]: "It is painful for me to hear how trade restrictions have hurt people. We have gone to great lengths to do no more than what is required by the law, but of course people are still affected. GitHub is subject to US trade law, just like any company that does business in the US." "To comply with US sanctions, we unfortunately had to implement new restrictions on private repos and paid accounts in Iran, Syria, and Crimea. Public repos remain available to developers everywhere – open source repos are NOT affected." "The restrictions are based on place of residence and location, not on nationality or heritage. If someone was flagged in error, they can fill out a form to get the restrictions lifted on their account within hours. More info is on our policy page: https://help.github.com/en/articles/github-and-trade-controls https://help.github.com/en/articles/github-and-trade-control... " GitHub is just complying with US trade law, it's not just because they're a US company, any company doing business in the US also has to comply. [1] https://twitter.com/natfriedman/status/1155311121038864384 https://twitter.com/natfriedman/status/1155311121038864384
unnouinceput 7y ago
"GitHub confirms it has blocked developers in Iran, Syria and Crimea" - you mean Microsoft, right? Because last I checked Microsoft bought GitHub, fully!
badrabbit 7y ago
Good time to advocate ipfs! https://docs.ipfs.io/guides/examples/git/ https://docs.ipfs.io/guides/examples/git/

284 points by jmsflknr 7y ago

Same as Gitlab then[0]. US Sanctions should not affect internet services (so long as they are provided for free)[1], but political pressure appears to be very strong. Personally I find it quite abhorrent, and would cite this as a reason not to use US based companies in future. [0]: https://about.gitlab.com/2018/07/19/gcp-move-update/ https://about.gitlab.com/2018/07/19/gcp-move-update/ [1]: https://www.treasury.gov/resource-center/sanctions/Programs/Documents/ukraine_gl_9.pdf https://www.treasury.gov/resource-center/sanctions/Programs/...

jlengrand 7y ago
Well thanks for the extra info :). Sad news imho :S.
krageon 7y ago
There was already the privacy concerns and complete lack of ethical oversight. Now we have some more ethical reasons not to use them.
marcthe12 7y ago
The thing I am woried is that harfbuzz is developed by Iranian developer. It is an integral part of Linux font stack.
- gtirloni 7y ago
  Well, for a well-known project, they won't miss GitHub visibility benefits. They can host the git repository anywhere. Self-host an issue tracking system or find a non-US company that does that (and is not required to follow US sanctions due to trade agreements, that'll be hard). It's an annoyance, for sure.
  - r3bl 7y ago
    The problem is that they'd require a payment method to rent the server somewhere else or to use a non-US company that doesn't offer a generous free plan. The most prominent payment providers (Visa, MasterCard, PayPal) are all US-based. > (and is not required to follow US sanctions due to trade agreements, that'll be hard). I really don't know much about sanctions against Syria and Crimea, but Iranian developers could use every country that hasn't withdrawn from the Iran deal: EU, UK (separate signature, regardless of Brexit), Russia, China.
    - quickthrower2 7y ago
      Enter... crypto
      - jdbernard 7y ago
        Between the speculative get-rich-quick rollercoaster of Bitcoin and the fraud of other crypto currencies it feels like the promise of decentralization has been forgotten.
      - r3bl 7y ago
        That's just shifting the problem one inconvenience further. How do you purchase cryptocurrencies without Visa/MasterCard/PayPal?
        quickthrower2 7y ago
        I'm not sure what options they have, but ideally, for convenience some kind of local country bank transfer, which could be to a local crypto dealer. That might take days but you might "stock up" on crypto to compensate. Or peer to peer cash/crypto swap might be required. Or businesses themselves sell some of their services with crypto.
    - chriswwweb 7y ago
      It's unfortunately not that easy. Iranian students studying in the UK for example, currently have a lot of trouble to pay their tuition fees. Because the U.S. insists that any bank (from the EU or wherever in the world) that wants to do business in the U.S. must comply to U.S. sanctions, which means an U.K. bank has to choose if it wants to block Iran or get blocked itself in/by the U.S. for doing business with Iran. More about this can be found on Wikipedia: https://en.wikipedia.org/wiki/United_States_sanctions_against_Iran https://en.wikipedia.org/wiki/United_States_sanctions_agains....
- LeonidasXIV 7y ago
  Behdad Esfahbod lives in Canada though, also most of his FOSS contribution (pango, fontconfig etc) are on the freedesktop.org and GNOME git repo servers, not GitHub.
  - dijit 7y ago
    I know this is just nitpicking, but US Sanctions apply to sanctioned state nationals; regardless of location.
    - styx31 7y ago
      Are you sure ? Quoted from GitHub CEO Nat Friedman on Twitter: > The restrictions are based on place of residence and location, not on nationality or heritage. If someone was flagged in error, they can fill out a form to get the restrictions lifted on their account within hours.
      - dijit 7y ago
        > Any company or national of Cuba, Iran, North Korea, Sudan, Syria, and the Crimea region. Export licensing of commodities or services intended for these countries is presumed denied; Wording like this appears on the treasury documents, Google cloud and Oracles official documentation on sanctions. I'll just link the Oracle one because ironically the one that google uses is really difficult to find: http://www.oracle.com/us/products/export/export-regulations-345813.html http://www.oracle.com/us/products/export/export-regulations-...
        jwieczorek 7y ago
        By that wording, who is a national of the Crimea region? Did they mean residents?
    - chriswwweb 7y ago
      No they don't! The sanction is against the country, not nationals. So if you are a developer from the U.S. with U.S. nationality and move to Cuba the sanctions would also apply to you. Actually there is a very good wikipedia page "United States sanctions against Iran" https://en.wikipedia.org/wiki/United_States_sanctions_against_Iran https://en.wikipedia.org/wiki/United_States_sanctions_agains... about this, if you want more info.
- deleted 7y ago
  [deleted]
- dijit 7y ago
  I would have said "move to git.kernel.org" but that's also hosted by a US based provider: organisation: ORG-PHI3-RIPE org-name: Packet Host Inc org-type: OTHER address: 30 Vesey Street, Suite 900, New York, NY 10007 US And, obviously GNOME git servers are US based, since they're owned by RedHat/IBM.
  - maze-le 7y ago
    Use a self hosted gogs installation (https://gogs.io/ https://gogs.io/) under your own domain and root server outside US jurisdiction.
    - swiley 7y ago
      Or just use ssh. That’s what I’ve always done with my friends when we didn’t want to use GitHub. There’s no need to over complicate things.
    - nerdponx 7y ago
      GitLab is self-hostable as well, although I imagine Gogs is easier.
      - dijit 7y ago
        Gitlab is actually super easy if you keep to the omnibus installation methods or docker image. The only problem regarding gitlab is resource consumption.
  - cuillevel3 7y ago
    If your company operates in the US and uses a provider, who does not implement sanctions, does it have to enforce them on its own? I mean, something like selling a product, maybe based on open source tech in the US and cooperating with devs in sanctioned countries via a workaround provider..
- cyphar 7y ago
  If we end up with a project like [1] actually taking off, then with Secure Scuttlebutt you wouldn't need to care about server hosting and the pub servers could be distributed globally. [1]: https://people.kernel.org/monsieuricon/patches-carved-into-developer-sigchains https://people.kernel.org/monsieuricon/patches-carved-into-d...
- behdad 7y ago
  Hey. HarfBuzz maintainer here. I live in the States but one of our core developers is in Iran. This whole incident was a huge miscommunication on github. Fortunately they have addressed some of it. In short: Open Source and public repos are not affected at all. Cheers
onetimemanytime 7y ago
they took the easy way out...ban them all, just in case. Not worth the trouble or lawyer fees explaining it to DOJ
murbard2 7y ago
I don't think it is about political pressure in the sense that, I doubt the USG fundamentally cares about whether or not Iranians can use GitHub or not. For companies like Google or Microsoft, this is about minimising the attack surface because they do other (legal) things that the USG does care about. You can't punish a tech giant just for doing a tech giant, but you could try to make other things stick.
wickerman 7y ago
The amount of harassment that citizens of any state that the US claims to hate at any given time endure on a daily basis is disgusting. Exiled iranians living outside of Iran for 20 years have got their bank accounts closed solely for being Iranian. I can't help but think that these internet services will be going that way in the future. The fact that the "free software" community is not putting their foot down for this is disgusting. Especially when there's so much back-patting when it comes to "the value of the community". Where's the community for crimean or iranian developers?
- AmericanChopper 7y ago
  Ya know what was actually disgusting? The war in Iraq, or any other recent regime change the US executed. If economic warfare is the way it’s done now, then that’s great. Let the casualties be inconvenienced github users, rather than ya know, actual casualties...
  - cdmckay 7y ago
    You realize that sanctions also kill people through lack of supplies like medicine being available, people being unable to economically support themselves, and, if the sanctions cause the government to collapse, all the death that results from that. So let’s not pretend sanctions are somehow nonviolent.
    - celticmusic 7y ago
      and yet, that will be less than the war in iraq. It's github. I would personally be inconvenienced, but not terribly so. I cannot imagine their life is going to crash in some meaningful way for not having access to github.
      - tehbeard 7y ago
        > it's github. Are you naive enough to think the sanction is explicitly targeted exactly at github, and not any number of services, or part of a wider economic attack?
AmericanChopper 7y ago
> Personally I find it quite abhorrent, and would cite this as a reason not to use US based companies in future. Then I’d highly recommend that you try doing that. I consulted for a company once that tried this, and it was an absolute nightmare. Every single piece of technology they used was worse than second rate. Making comments on HN is really easy, backing them up with action, in this case, is not.
- mugsie 7y ago
  Any company that does business in the US, or with another company that does business in the US. Not just US based companies are subject to these restrictions (if they want to sell into the US)
  - AmericanChopper 7y ago
    Don’t make it too hard on yourself. If you want to use your own economic clout to take a swing at the US, then just stick to boycotting US companies. See if it’s even possible to operate your project like that. You’ll be taking a step back in time by at least 10 years.
    - mugsie 7y ago
      I am not sure I could do it at all. The Linux Foundation is a US corporation, and that rules out nearly all my options for the work I personally do. (and, well working for one doesn't help it either)
      - AmericanChopper 7y ago
        Then make it even easier. Only apply the principle to services or products you pay for.
    - dijit 7y ago
      The sensibility you have expressed is chiefly why we should fight US dominance of the tech sector. Not why we should lean in to it.
cochne 7y ago
It looks like the free services provided by GitHub are still available: "A selection of GitHub services such as access to public repositories will remain available to everyone, the company said in a statement on its website. “This includes limited access to GitHub public repository services (such as access to GitHub Pages and public repositories used for open source projects), for personal communications only, and not for commercial purposes.”
- mieseratte 7y ago
  So what can't restricted foreign-nationals do? Private, paid-for repositories? Is there something else particularly important?
  - Algent 7y ago
    If I recall right from previous thread they can still create and commit to public repo but can't delete them. They also can't touch even their own private repo anymore.
    - theturtletalks 7y ago
      They added the option to make private repos public so you can back it up. But again, you can’t delete the now public repo.
      - emilfihlman 7y ago
        >They added the option to make private repos public so you can back it up. And allow all to see their contents, likes business and trade secrets. Top tier.
        theturtletalks 7y ago
        Yep. If you want to access your blocked private repo, you literally have to let everyone access it. And you can’t even delete it afterwards.
thenickperson 7y ago
This affects companies that have US users too. Your only option is to move out of the US and not use products with any users in the US. That means your only option is China, which is far worse for online rights than the US.
miracle2k 7y ago
Like I wrote somewhere else, the Gitlab case is both worse and better. Gitlab did not make a specific decision to block Iranian users, it merely made a technical decision to move to Google Cloud, and Google Cloud is blocking sanctioned countries on a network level (which is abhorrent). But I don't see Gitlab making an active decision that they have to do this for sanctions compliance reasons, it was just a side-effect and they didn't care enough for it to change their minds about the move. Specifically, if I sign up to Gitlab, set my country of residence to Iran, and Gitlab lets me create private repositories, then they are not enforcing the sanctions the way Github does.
- espeed 7y ago
  See comments in this previous thread from 31 days ago [1]... Google Safety & Security Blog: An update on state-sponsored activity (2018) ... Detecting and terminating activity on Google properties "Actors engaged in this type of influence operation violate our policies, and we swiftly remove such content from our services and terminate these actors’ accounts. Additionally, we use a number of robust methods, including IP blocking, to prevent individuals or entities in Iran from opening advertising accounts." ---//--- [1] "An Open Letter to Google and Apple: Stop Hindering Iranian Entrepreneurs" https://news.ycombinator.com/item?id=20302547 https://news.ycombinator.com/item?id=20302547
  - whoopdedo 7y ago
    Can we start calling this "The Great Reverse Firewall"?
    - espeed 7y ago
      Not all of it is US sanctions [1]. The US will protect its networks and will not allow a foreign adversary to use US platforms to target US citizens, but the US has no incentive to restrict the Iranian people's access to information or communications or ability to speak. Most of Iran's cyberspace restrictions are coming from within... https://en.wikipedia.org/wiki/Internet_censorship_in_Iran https://en.wikipedia.org/wiki/Internet_censorship_in_Iran [1] "Iran's Rulers Speak Of More Cyberspace Restrictions As Conditions Worsen" https://en.radiofarda.com/a/iran-s-rulers-speak-of-more-cyberspace-restrictions-as-conditions-worsen/29909929.html https://en.radiofarda.com/a/iran-s-rulers-speak-of-more-cybe...
not_a_cop75 7y ago
Yeah, it's totally abhorrent that the US blocks people that would prefer they get wiped off the face of the earth. How dare they!!!
- syndacks 7y ago
  Your sentence uses "they" ambiguously, FYI. Two very different interpretations possible.
- alt_f4 7y ago
  Have you considered that regular people that live under an oppressive totalitarian government have no control over said government and are actually just victims?
  - not_a_cop75 7y ago
    Have you ever lived in the US?
csomar 7y ago
I think non-US companies have to comply with the sanctions too. Your alternative will be the pool of sanctioned countries and friends. Which don’t have the infrastructure most people need.
yxhuvud 7y ago
There is no real difference between sanctions on internet service and any other thing, except things directly involved in the reasons for the sanctions (notably military material)
deleted 7y ago
[deleted]

jlengrand 7y ago

I'm curious to hear what Gitlab has to say about this, or if they will have some kind of official communication specifically on that matter.

yuchi 7y ago
See https://about.gitlab.com/2018/07/19/gcp-move-update/ https://about.gitlab.com/2018/07/19/gcp-move-update/
- jlengrand 7y ago
  Yes, thanks!
  - miracle2k 7y ago
    Note that this is not quite the same. Gitlab made a technical decision to move to Google Cloud, and Google Cloud has its own, much more outrageous block on a network level. Gitlab not being accessible from Iran is a by-product of that move, not a conscious decision Gitlab made. Arguably, if I create a Gitlab Account using a VPN but put country of residence "Iran", and Gitlab lets me do that, then Gitlab does not have the same policy has Github.
    - jlengrand 7y ago
      Ha, good additional info indeed. I took the Github post as in "if I'm in Iran but use a VPN, and set Iran as country of residence I'm fine".

snitko 7y ago

We made it point now to avoid all US-based services. While we're not affected by the sanctions yet, it seems like it is a possibility in the future. There's really not a lot of reasons to use Gitlab or Github or Slack or a number of other services. They're not exceptional in any way and can be replaced by other open-source or commercial projects.

nathanaldensr 7y ago
Yep, and this is a sign of the ecosystem working well.
ardani 7y ago
In the same line, if there's any forum I take with a spoonful of salt it's Hacker News.
diminoten 7y ago
Convenience and speed aren't reasons? You're handicapping yourself against your competitors, and no one who does that lasts very long.
- snitko 7y ago
  Don't see it that way. If I set up a process once, using software that's been tested and been around for a while, it's extremely convenient. And free. And there's no risk of deplatforming.
  - diminoten 7y ago
    You're completely ignoring feature parity, among many, many other things in your oversimplification... Ask any founder here: people don't generally randomly throw money without getting value; ergo these multibillion dollar services you're pretending are entirely replaceable with free tools offer some additional value .
    - snitko 7y ago

blodovnik 7y ago

I know lots of Iranian people and they are universally kind generous lovely people. I hate the way Iran is demonized so politicians can point out an enemy. We were flat out lied to about Iraq. Demonization of Iran is no different.

ausbah 7y ago
It's more like the Iranian government.
- tapia 7y ago
  Not like the US government is any better right now
  - newshorts 7y ago
    Trump just needs a war to be in by election time...
  - fit2rule 7y ago
    At no point in the last 40 years has the US government held a higher moral ground than the Iranian government. The USA has killed far more innocent people under far worse pretext than any other nation on Earth.
  - raxxorrax 7y ago
    As long as the government just calls people names instead of invading them, I am completely fine with that. Progress, I guess.
    - lawn 7y ago
      Because the US government hasn't invaded other countries...? Of course they call it something different, but they do tend to start wars periodically. For flimsy reasons.
      - 7y ago

jokoon 7y ago

I wonder is those could be related to cyber security measures, not political measures.

amiraliakbari 7y ago
It's unlikely. GitHub hasn't banned Iranian IPs or completely closed Iranian users, but just blocked those users' access to their private repositories and Gists.
red_admiral 7y ago
Very unlikely in my opinion - if the Iranian Revolutionary Guard did want to attack something, I doubt they would do it from an IP address in their own country. I'm sure they have a decent botnet or two somewhere else, that's like opsec 101. Similarly, although Crimea specifically is now IP-banned, the rest of the Russian Federation is not. This is exactly what it looks like: a political sanction.
espeed 7y ago
Yes, some of it is. See previous thread... https://news.ycombinator.com/item?id=20302844 https://news.ycombinator.com/item?id=20302844

freestate 7y ago

How about someone build a platform that is freely available that pushes to github from a not banned Location. Or just stop using github and create or find a truly free platform.

blodovnik 7y ago
This really is reason to start thinking about alternatives to github. Now the vast majority of open source projects are controlled by Microsoft corporation which must obey the US goverent and this is the outcome.
- red_admiral 7y ago
  Downvoted. Github was subject to US law before MS took it over; gitlab is not MS-owned but had to do the same (not sure about bitbucket but I imagine it's similar). Whether the #1 place to host open-source projects should be owned by a company that makes a closed-source OS is a good debate question but it's completely orthogonal to whether they have to comply with US law. I'm not saying I agree either with the sanctions or with Microsoft running github, but I'm saying you can't blame Microsoft for the current administration's sanctions on Iran.
  - blodovnik 7y ago
    So why haven't all websites cut off these countries? Why haven't the ISPs cut off these countries? Github has acted because github is under the control of a giant corporation, Microsoft or otherwise. So there's a line that runs precisely from Microsoft acquisition to cutting off countries from the world's largest open source repository. It's a direct outcome of the Microsoft acquisition.
    - viraptor 7y ago
      A lot of pages have. Or at least they don't take payments from them. Larger CDN providers will maintain "US sanctions" blacklists which you can enable with one click. A lot of companies just don't care.

tomohawk 7y ago

Crimea: Illegal occupation by Russia. Ethnic cleansing. Syria: Using chemical weapons, sponsoring terrorism Iran: Assisting Syria; Actively developing nukes they say they will use, nuclear proliferation, biggest sponsor of terrorism, .... On the other hand, some people can't use an internet service. Oh! The inhumanity! Get a sense of proportion.

deleted 7y ago
[deleted]
antisemiotic 7y ago
By that logic USA should be blocked too, right?
- tomohawk 7y ago
  Oh, yeah - forgot about Crimea/Russia shooting down MH17 airliner.
  - whataboutist 7y ago
    Did you also forget about the US shooting down Iran Air Flight 655?
    - free652 7y ago
      So Russians apologized for MH17?
    - 24gttghh 7y ago
      So, you mean where the US at least kinda-sorta apologized and paid restitution? I hate the Regan years as much as the next person, but this is a false equivalence. I didn't see Russia/Donblast apologize after MH-17...
      - whataboutist 7y ago
        Fair, besides the fact that they took 8 years and did not admit legal liability or formally apologize to Iran. However, this is not true for every crime that the US has committed. OP could've explained why those crimes might not be relevant to the discussion, instead he tried to one-up them with the crimes of other regimes. In the case of the US, or every other great power; that game can go on indefinitely.

majia 7y ago

If Crimea was unwillingly annexed by Russia, then the sanction is punishing the victim instead of the criminal. If Crimea people genuinely supported the unification with Russia and received sanction for that, then it is a blatant attack on Crimean people's freedom.

PunchTornado 7y ago
pff, ridiculous comment. a region doesn't have the right to attach itself to another state. think about it. a bunch of russians move to somewhere near grand canion, do a referendum and then proclaim it russian territory.
- dijit 7y ago
  There aren't many examples of Unification, but there are examples, maybe this wouldn't be considered one of them. My home country for instance is the "United Kingdom" which is made of up of countries/territories that unified many hundreds of years ago. There's other examples such as the formation of Italy: https://en.wikipedia.org/wiki/Italian_unification https://en.wikipedia.org/wiki/Italian_unification However, if it's not annexation it's probably better described as "ceding"; an American example: France ceded Louisiana to the United States by the treaty of Paris, of April 30, 1803. Spain made a cession of East and West Florida by the treaty of February 22, 1819. Cessions have been severally made of a part of their territory by New York, Virginia, Massachusetts, Connecticut, South Carolina, North Carolina, and Georgia.
  - galangalalgol 7y ago
    unified is a proper term perhaps but at the time the gaelic speaking peoples would have probably used conquered or maybe colonized.
    - dijit 7y ago
      This is not an appreciable understanding of history. If talking about the UK specifically.

stunt 7y ago

I think that's a fair answer and is totally understandable from Github's standing point. Wish they could give a heads up earlier.

raesene9 7y ago

To me, this is another example of the "splinternet" phenomenon where the Internet is, in some ways, moving to become less of a universal resource and more regional in nature. It's a shame, as a lot of benefit has been derived from having globally available information exchange, but it seems the trend is for regions or nation states to want more control over Internet based resources, as they become more important to the operation of those countries.

deleted 7y ago

[deleted]

deleted 7y ago

[deleted]

floor_ 7y ago

How are private repos handled in this situation? From what I remember private repos go public if you fail to pay for them after a month.

petercooper 7y ago

I'm curious.. why is this very suddenly an issue? Haven't countries like Iran and Syria been under embargo for years? Have more restrictive laws around sanctions been passed in recent weeks?

umanwizard 7y ago
I’m not sure but I suspect the change is due to GitHub having been bought by MS which has more competent (or more paranoid.... or maybe just more) lawyers.
viraptor 7y ago
MS with their lawyers caring about things that GitHub on its own didn't?
deleted 7y ago
[deleted]
peanutgal2600 7y ago
Trump has begun attacking his corporate enemies in the courts, namely Facebook and Google. Microsoft is terrified of getting on his bad side, and Trump needs to stir hatred of Iran to make sure AIPAC stays on his side. Basically, Trump said jump so Github dropped their drawers, bent over and grabbed their ankles.
- philzook 7y ago
  That's an interesting way to jump.

resters 7y ago

By participating in the sanctions, Github is allowing itself to be an arm of Donald Trump's white supremacist, Christian supremacist political campaign. The only acceptable response for tech companies to this kind of stuff is to refuse to comply. Sanctions are acts of violence that directly harm the people who are the victims of the regimes the US takes issue with. Now, another generation of young tech workers will be materially harmed by US warmongering. When Github first launched there were concerns about centralization. We can see now how Linus made a wise decision to design git as a decentralized system. Fortunately, for any teams hiring Iranian, Syrian, or Crimean workers, commits and branches can be synced with an easy to configure git peer via ssh. The morally bankrupt US war posturing is bad enough, but it really irritates me when it starts to impact the day to day lives of people who are just trying to live their lives peacefully and write code or contribute to open source.

tomtompl 7y ago
you people are sick
- resters 7y ago
  Please explain :)
  - tomtompl 7y ago
    pardon, I should've said, you people are religious fanatics
  - DanielShaffen 7y ago
    You're a mentally unstable extreme leftist. You really need this explained? I'd bet yes because you live in a bubble ;)

sbhn 7y ago

Poor America, always shouting it’s under attack, is that because it’s war machine is the second largest money spinner on earth. Its drooling for your hard earned American tax payer dollars. Its for your security, you know that.

tomtompl 7y ago
tell that to ukrainians, ok?

mr__y 7y ago

Thankfully github is not a walled garden and repo can be moved to any other public or self-hosted git (well, at least the code itself). Or, as someone already suggested, use an external service/server that pushes the commits into git(hub|lab) repo. Git also seems to be relatively easy to work in a federated ecosystem - the only problem to be solved is read/write access in such environment.

Reason077 7y ago

Wait, Crimea's on the sh*tlist now too? Is this new?

NovemberWhiskey 7y ago
No; this goes back to 2014. https://www.treasury.gov/resource-center/sanctions/Programs/Documents/ukraine.pdf https://www.treasury.gov/resource-center/sanctions/Programs/...
A4ET8a8uTh0 7y ago
The timing is interesting, but same action could have been taken say 4 years ago and it would technically still be true. Whatever the reason is, it is not the recent SDN update.

TazeTSchnitzel 7y ago

‘[…] services such as access to public repositories will remain available to everyone, […] “This includes limited access to GitHub public repository services (such as access to GitHub Pages and public repositories used for open source projects), for personal communications only, and not for commercial purposes.”’

mugsie 7y ago

The US trade restrictions are pretty far reaching. They block companies trading with countries and companies on entity list . It also bans US companies from dealing with companies that deal with countries and companies on the list. So let us look at this: 1. GitHub becomes a Maltese company. 2. GitHub allows Iranian users to use all features 3. No US company could buy a GitHub Enterprise licence, or a private org. The export restrictions don't let them notify people that the ban is coming - once they identify the users that are under the Export Restrictions, allowing them to download (aka export) their repos is a breach. They did as much as they could to allow them to keep their accounts at all (and this is only due to export restrictions having exclusions that cover "publicly available source"). GitHub did what they had to do to avoid being censured by the US Gov, and did it better than a lot of other tech companies recently, by leaving some level of access. If you don't like the ban, and you are in the US, contact your elected representatives, and let them know - it is the only way it changes.

miracle2k 7y ago
That's not true. There are already many non-US companies who are providing services to Iran in the same sense that Github is providing services, and those companies are also having US clients, proving that it can be done. Now, if a Maltese-Github were specifically designated by OFAC, then sure. But that's fairly unlikely.
- mugsie 7y ago
  > and those companies are also having US clients, proving that it can be done. Proving they haven't been caught, or may not even know about the US Dept of Commerce entity list.
  - miracle2k 7y ago
    Yes, in a way they haven't been caught. However, I want to point out that only US companies and persons are obligated to follow the sanctions. The reason why foreign companies might also follow them is because they don't want to end up being designated themselves. And this is not realistically going to happen unless you are a large multinational, bank, or doing business in sensitive sectors. Not actively blocking accounts identified as Iranian is not even the same as specifically trading with Iran. Like many smaller US-based web-services who also do not actively block, Github might well have gotten away with it as well, like the did the last couple of years. A Maltese-based company not blocking Iranian users might be designated, but unless they are, and it is pretty unlikely that they would be, they are doing nothing wrong under US law.

Alir3z4 7y ago

There's a repository that has made many aware of such problem https://github.com/1995parham/github-do-not-ban-us https://github.com/1995parham/github-do-not-ban-us As an alternative for Iranian developers and any other who was affected by such problem, I've setup https://gitfoo.com/ https://gitfoo.com/ It's a hosted version of gitea. I have enough resources and interest to maintain and keep it going.

kekebo 7y ago

Are there currently any serious competitors to Github/Gitlab (or instances of the latter) outside the reach of US politics?

peanutgal2600 7y ago

Nate bent over for Trump just as we expected he would. He became a billionaire stepping on the backs of better people, parasitically enriching himself off of open source then selling out an entire community to the most anti open-source company ever, Microsoft. This isn't a surprise. O Captain! My Captain!

sschueller 7y ago
The US putting countries on shit lists didn't start with Trump. Just ask Cuba.
- peanutgal2600 7y ago
  I love whataboutism and deflection. It shows a lot about your character. Screw the world, I got mine, and someone else did it before me, so it's not my fault!
  - dang 7y ago
    We've banned this account for breaking the site guidelines. Could you please stop creating accounts to do that with? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

Flip-per 7y ago

That's a great opportunity to build similar code-hosting platforms (and other software/services) outside of the US. Just for political reasons many people might like to switch...

PopeDotNinja 7y ago

Will they start blocking VPN access ;(

njudah 7y ago

This thread is a useful reminder to US citizens that if you haven’t registered to vote, its a great idea to do so. The margins of victory in 2016 were small enough (in swing states) that a mobilized hackernews community could have made the difference.

kickopotomus 7y ago
This move has little to do with the current political climate and is more so associated with risk reduction from Microsoft as technology and regulations regarding technology (see Facebook) are coming into focus. All companies that do business with the US are required to abide by the Export Administration Regulations (EAR)[1] which prohibits exports (unless explicitly exempt) to sanctioned countries. The US has had sanctions on Iran since 1987[2]. This move would have likely happened regardless of who is in the White House. [1]: https://en.wikipedia.org/wiki/Export_Administration_Regulations https://en.wikipedia.org/wiki/Export_Administration_Regulati... [2]: https://en.wikipedia.org/wiki/United_States_sanctions https://en.wikipedia.org/wiki/United_States_sanctions

kerkeslager 7y ago

As far as I know, SourceHut[1] is still available everywhere. [1] https://sourcehut.org/ https://sourcehut.org/ EDIT: I stand corrected.

Sir_Cmpwn 7y ago
Sourcehut is US operated and I cannot accept users from sanctioned countries. You can run your own instance if your legal circumstances differ, but you cannot use the official hosted version.
- kerkeslager 7y ago
  As other users have pointed out, the sanctions don't apply to internet services as long as they are provided for free[1]. So this is political pressure, not legal requirement. I'm disappointed that you've chosen to give in to the political pressure. I posted about SourceHut to promote your service because I thought you were doing something better than the big guys. [1] https://www.treasury.gov/resource-center/sanctions/Programs/Documents/ukraine_gl_9.pdf https://www.treasury.gov/resource-center/sanctions/Programs/...
  - Sir_Cmpwn 7y ago
    SourceHut accepts payments and will eventually become paid-only. I am a one-man operation and I don't have the legal wherewithal to stand up to the government. You can tell me how this legal fight fits into our budget, the finances are public: https://lists.sr.ht/~sircmpwn/sr.ht-discuss/%3CBVRVZEWYB30Q.3HGIC803LDBH7%40homura%3E https://lists.sr.ht/~sircmpwn/sr.ht-discuss/%3CBVRVZEWYB30Q.... I have to prioritize the health of the service for everyone above the needs of a few people.

ksajadi 7y ago

Is there an easy to understand guide for SaaS businesses to be compliant with these specific sanctions?

sdinsn 7y ago
Yes: don't provide any products or services to Iran, Syria, North Korea, or Crimea.
- A4ET8a8uTh0 7y ago
  Uhh. I am sure you know that there exception to every rule. Hell, even current set of Iranian sanctions have them.

aerojoe23 7y ago

I think it is interesting and a shame that we accept centralized issue tracking at all. Git is wonderfully distributed, probably in more than most of the github users realize. Unless they've gone out of their way to learn about it. When things like this (github's ban) happen, I think it is too bad that we don't have a widely accepted issue tracker built into git. To be a little more clear, you'd get all of the source and all the issues when you clone or pull. Updating would work just like updating files when you push. Microsoft has appeared to start loving open source. I'm sure there are people there that do, but Microsoft itself I wouldn't be so sure. The are certainly embracing it. https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguish https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguis...

jayshua 7y ago
I mean, you could just make a folder with a text file in it for each issues. People can write comments in it. Move them into a "complete" folder when done. Write down who it's assigned to at the top. You wouldn't get some of the more complex features of course, but I'm not sure a git built in issue tracker could do most of that anyway. Not clear how it could send email notifications?
czechdeveloper 7y ago
It's not Microsoft choice. They have to listen to US laws.
rkeene2 7y ago
You could also switch from Git to Fossil which supports issues and wikis as part of its decentralized nature, in addition to unversioned artifacts (e.g., for release artifacts)

kerblang 7y ago

Saw some other debate in here about whether the law applies only to countries or also to individuals... Here's two federal govt lists of banned individuals: https://www.bis.doc.gov/index.php/the-denied-persons-list https://www.bis.doc.gov/index.php/the-denied-persons-list https://www.treasury.gov/resource-center/sanctions/SDN-List/Pages/default.aspx https://www.treasury.gov/resource-center/sanctions/SDN-List/...

cardigan 7y ago

Posting Nat Friedman's tweets here so they're easier to read - they're doing more than most companies about the whole thing, not sure where the vitriol in these comments is coming from: It is painful for me to hear how trade restrictions have hurt people. We have gone to great lengths to do no more than what is required by the law, but of course people are still affected. GitHub is subject to US trade law, just like any company that does business in the US. To comply with US sanctions, we unfortunately had to implement new restrictions on private repos and paid accounts in Iran, Syria, and Crimea. Public repos remain available to developers everywhere – open source repos are NOT affected. The restrictions are based on place of residence and location, not on nationality or heritage. If someone was flagged in error, they can fill out a form to get the restrictions lifted on their account within hours. Users with restricted private repos can also choose to make them public. Our understanding of the law does not give us the option to give anyone advance notice of restrictions. We're not doing this because we want to; we're doing it because we have to. GitHub will continue to advocate vigorously with governments around the world for policies that protect software developers and the global open source community.

hkai 7y ago
It's crazy how Trump imposed these restrictions against innocent people and got away with it.
- mrtksn 7y ago
  I don’t think that it would have been different if someone else was the president. Pre-Trump I had a vacation in Cuba and since I knew that the internet is a luxury there I made Spanish available offline on Google Translate. Works great, then I made the mistake to launch the app when I hade one hour access to the internet in Havana and puff translate is gone. I’m not allowed to use it there. That surely destroyed the communists.
  - yxhuvud 7y ago
    When it comes to Iran, it definitely would have been different, considering that it was Obama that made the deal that Trump decided to break.

ralmidani 7y ago

I despise all 3 regimes, but these sanctions harm the people more than they harm the regimes. Sanctioning Crimea specifically makes no sense whatsoever. Why not instead sanction Putin who, you know, is the one who occupied Crimea?

jhthenerd 7y ago

Looks like it's time to switch to decentralized git repositories

mehdix 7y ago

Assuming that this is a Cuba, Iran or Syria problem is misleading, even though it renders most of things that I've made in my free time useless. Having free access to open source code is important. As a developer I'd try to self-host more and try decentralized solutions instead of relying on corporate entites to protect my interests.

mohas 7y ago

This is what happens when mega companies take over, they helped to make github what it is today just like every body else, and banning them without any notice just to see them suffer, that's low

mythz 7y ago

There's a lot of misinformation in this thread, from GitHub CEO [1]: "It is painful for me to hear how trade restrictions have hurt people. We have gone to great lengths to do no more than what is required by the law, but of course people are still affected. GitHub is subject to US trade law, just like any company that does business in the US." "To comply with US sanctions, we unfortunately had to implement new restrictions on private repos and paid accounts in Iran, Syria, and Crimea. Public repos remain available to developers everywhere – open source repos are NOT affected." "The restrictions are based on place of residence and location, not on nationality or heritage. If someone was flagged in error, they can fill out a form to get the restrictions lifted on their account within hours. More info is on our policy page: https://help.github.com/en/articles/github-and-trade-controls https://help.github.com/en/articles/github-and-trade-control... " GitHub is just complying with US trade law, it's not just because they're a US company, any company doing business in the US also has to comply. [1] https://twitter.com/natfriedman/status/1155311121038864384 https://twitter.com/natfriedman/status/1155311121038864384

unnouinceput 7y ago

"GitHub confirms it has blocked developers in Iran, Syria and Crimea" - you mean Microsoft, right? Because last I checked Microsoft bought GitHub, fully!

badrabbit 7y ago

Good time to advocate ipfs! https://docs.ipfs.io/guides/examples/git/ https://docs.ipfs.io/guides/examples/git/