6 ms·

The thing I am woried is that harfbuzz is developed by Iranian developer. It is an integral part of Linux font stack.

gtirloni 7y ago
Well, for a well-known project, they won't miss GitHub visibility benefits. They can host the git repository anywhere. Self-host an issue tracking system or find a non-US company that does that (and is not required to follow US sanctions due to trade agreements, that'll be hard). It's an annoyance, for sure.
- r3bl 7y ago
  The problem is that they'd require a payment method to rent the server somewhere else or to use a non-US company that doesn't offer a generous free plan. The most prominent payment providers (Visa, MasterCard, PayPal) are all US-based. > (and is not required to follow US sanctions due to trade agreements, that'll be hard). I really don't know much about sanctions against Syria and Crimea, but Iranian developers could use every country that hasn't withdrawn from the Iran deal: EU, UK (separate signature, regardless of Brexit), Russia, China.
  - quickthrower2 7y ago
    Enter... crypto
    - jdbernard 7y ago
      Between the speculative get-rich-quick rollercoaster of Bitcoin and the fraud of other crypto currencies it feels like the promise of decentralization has been forgotten.
    - r3bl 7y ago
      That's just shifting the problem one inconvenience further. How do you purchase cryptocurrencies without Visa/MasterCard/PayPal?
      - quickthrower2 7y ago
        I'm not sure what options they have, but ideally, for convenience some kind of local country bank transfer, which could be to a local crypto dealer. That might take days but you might "stock up" on crypto to compensate. Or peer to peer cash/crypto swap might be required. Or businesses themselves sell some of their services with crypto.
  - chriswwweb 7y ago
    It's unfortunately not that easy. Iranian students studying in the UK for example, currently have a lot of trouble to pay their tuition fees. Because the U.S. insists that any bank (from the EU or wherever in the world) that wants to do business in the U.S. must comply to U.S. sanctions, which means an U.K. bank has to choose if it wants to block Iran or get blocked itself in/by the U.S. for doing business with Iran. More about this can be found on Wikipedia: https://en.wikipedia.org/wiki/United_States_sanctions_against_Iran https://en.wikipedia.org/wiki/United_States_sanctions_agains....
  - rjzzleep 7y ago
    Even before the US withdrew a lot of financial institutions wouldn't allow doing any kind of transactions with iran. It's not like the sanctions were actually dropped even though they were supposed to. That was the whole point of the critiques of the JCPOA.
  - gtirloni 7y ago
    These are very good points. Especially the one about the major payment providers. Re: countries that have withdrawn from the Iran deal. Even those who haven't (AFAIK, Brazil) are still in grey waters because local companies with business in the US are afraid to do business with Iranian companies. For example, two ships weren't allowed to be refilled in Brazil for 50 days while a legal battle at the supreme court was ongoing to decide if the Brazilian oil company could even refill them, because it was afraid to be sanctioned by the US govt (while doing business in the US or with US companies in the future).
LeonidasXIV 7y ago
Behdad Esfahbod lives in Canada though, also most of his FOSS contribution (pango, fontconfig etc) are on the freedesktop.org and GNOME git repo servers, not GitHub.
- dijit 7y ago
  I know this is just nitpicking, but US Sanctions apply to sanctioned state nationals; regardless of location.
  - styx31 7y ago
    Are you sure ? Quoted from GitHub CEO Nat Friedman on Twitter: > The restrictions are based on place of residence and location, not on nationality or heritage. If someone was flagged in error, they can fill out a form to get the restrictions lifted on their account within hours.
    - dijit 7y ago
      > Any company or national of Cuba, Iran, North Korea, Sudan, Syria, and the Crimea region. Export licensing of commodities or services intended for these countries is presumed denied; Wording like this appears on the treasury documents, Google cloud and Oracles official documentation on sanctions. I'll just link the Oracle one because ironically the one that google uses is really difficult to find: http://www.oracle.com/us/products/export/export-regulations-345813.html http://www.oracle.com/us/products/export/export-regulations-...
      - jwieczorek 7y ago
        By that wording, who is a national of the Crimea region? Did they mean residents?
  - chriswwweb 7y ago
    No they don't! The sanction is against the country, not nationals. So if you are a developer from the U.S. with U.S. nationality and move to Cuba the sanctions would also apply to you. Actually there is a very good wikipedia page "United States sanctions against Iran" https://en.wikipedia.org/wiki/United_States_sanctions_against_Iran https://en.wikipedia.org/wiki/United_States_sanctions_agains... about this, if you want more info.
deleted 7y ago
[deleted]
dijit 7y ago
I would have said "move to git.kernel.org" but that's also hosted by a US based provider: organisation: ORG-PHI3-RIPE org-name: Packet Host Inc org-type: OTHER address: 30 Vesey Street, Suite 900, New York, NY 10007 US And, obviously GNOME git servers are US based, since they're owned by RedHat/IBM.
- maze-le 7y ago
  Use a self hosted gogs installation (https://gogs.io/ https://gogs.io/) under your own domain and root server outside US jurisdiction.
  - swiley 7y ago
    Or just use ssh. That’s what I’ve always done with my friends when we didn’t want to use GitHub. There’s no need to over complicate things.
  - nerdponx 7y ago
    GitLab is self-hostable as well, although I imagine Gogs is easier.
    - dijit 7y ago
      Gitlab is actually super easy if you keep to the omnibus installation methods or docker image. The only problem regarding gitlab is resource consumption.
- cuillevel3 7y ago
  If your company operates in the US and uses a provider, who does not implement sanctions, does it have to enforce them on its own? I mean, something like selling a product, maybe based on open source tech in the US and cooperating with devs in sanctioned countries via a workaround provider..
cyphar 7y ago
If we end up with a project like [1] actually taking off, then with Secure Scuttlebutt you wouldn't need to care about server hosting and the pub servers could be distributed globally. [1]: https://people.kernel.org/monsieuricon/patches-carved-into-developer-sigchains https://people.kernel.org/monsieuricon/patches-carved-into-d...
behdad 7y ago
Hey. HarfBuzz maintainer here. I live in the States but one of our core developers is in Iran. This whole incident was a huge miscommunication on github. Fortunately they have addressed some of it. In short: Open Source and public repos are not affected at all. Cheers

Well, for a well-known project, they won't miss GitHub visibility benefits. They can host the git repository anywhere. Self-host an issue tracking system or find a non-US company that does that (and is not required to follow US sanctions due to trade agreements, that'll be hard). It's an annoyance, for sure.

r3bl 7y ago
The problem is that they'd require a payment method to rent the server somewhere else or to use a non-US company that doesn't offer a generous free plan. The most prominent payment providers (Visa, MasterCard, PayPal) are all US-based. > (and is not required to follow US sanctions due to trade agreements, that'll be hard). I really don't know much about sanctions against Syria and Crimea, but Iranian developers could use every country that hasn't withdrawn from the Iran deal: EU, UK (separate signature, regardless of Brexit), Russia, China.
- quickthrower2 7y ago
  Enter... crypto
  - jdbernard 7y ago
    Between the speculative get-rich-quick rollercoaster of Bitcoin and the fraud of other crypto currencies it feels like the promise of decentralization has been forgotten.
  - r3bl 7y ago
    That's just shifting the problem one inconvenience further. How do you purchase cryptocurrencies without Visa/MasterCard/PayPal?
    - quickthrower2 7y ago
      I'm not sure what options they have, but ideally, for convenience some kind of local country bank transfer, which could be to a local crypto dealer. That might take days but you might "stock up" on crypto to compensate. Or peer to peer cash/crypto swap might be required. Or businesses themselves sell some of their services with crypto.
- chriswwweb 7y ago
  It's unfortunately not that easy. Iranian students studying in the UK for example, currently have a lot of trouble to pay their tuition fees. Because the U.S. insists that any bank (from the EU or wherever in the world) that wants to do business in the U.S. must comply to U.S. sanctions, which means an U.K. bank has to choose if it wants to block Iran or get blocked itself in/by the U.S. for doing business with Iran. More about this can be found on Wikipedia: https://en.wikipedia.org/wiki/United_States_sanctions_against_Iran https://en.wikipedia.org/wiki/United_States_sanctions_agains....
- rjzzleep 7y ago
  Even before the US withdrew a lot of financial institutions wouldn't allow doing any kind of transactions with iran. It's not like the sanctions were actually dropped even though they were supposed to. That was the whole point of the critiques of the JCPOA.
- gtirloni 7y ago
  These are very good points. Especially the one about the major payment providers. Re: countries that have withdrawn from the Iran deal. Even those who haven't (AFAIK, Brazil) are still in grey waters because local companies with business in the US are afraid to do business with Iranian companies. For example, two ships weren't allowed to be refilled in Brazil for 50 days while a legal battle at the supreme court was ongoing to decide if the Brazilian oil company could even refill them, because it was afraid to be sanctioned by the US govt (while doing business in the US or with US companies in the future).

LeonidasXIV 7y ago

Behdad Esfahbod lives in Canada though, also most of his FOSS contribution (pango, fontconfig etc) are on the freedesktop.org and GNOME git repo servers, not GitHub.

dijit 7y ago
I know this is just nitpicking, but US Sanctions apply to sanctioned state nationals; regardless of location.
- styx31 7y ago
  Are you sure ? Quoted from GitHub CEO Nat Friedman on Twitter: > The restrictions are based on place of residence and location, not on nationality or heritage. If someone was flagged in error, they can fill out a form to get the restrictions lifted on their account within hours.
  - dijit 7y ago
    > Any company or national of Cuba, Iran, North Korea, Sudan, Syria, and the Crimea region. Export licensing of commodities or services intended for these countries is presumed denied; Wording like this appears on the treasury documents, Google cloud and Oracles official documentation on sanctions. I'll just link the Oracle one because ironically the one that google uses is really difficult to find: http://www.oracle.com/us/products/export/export-regulations-345813.html http://www.oracle.com/us/products/export/export-regulations-...
    - jwieczorek 7y ago
      By that wording, who is a national of the Crimea region? Did they mean residents?
- chriswwweb 7y ago
  No they don't! The sanction is against the country, not nationals. So if you are a developer from the U.S. with U.S. nationality and move to Cuba the sanctions would also apply to you. Actually there is a very good wikipedia page "United States sanctions against Iran" https://en.wikipedia.org/wiki/United_States_sanctions_against_Iran https://en.wikipedia.org/wiki/United_States_sanctions_agains... about this, if you want more info.

deleted 7y ago

[deleted]

dijit 7y ago

I would have said "move to git.kernel.org" but that's also hosted by a US based provider: organisation: ORG-PHI3-RIPE org-name: Packet Host Inc org-type: OTHER address: 30 Vesey Street, Suite 900, New York, NY 10007 US And, obviously GNOME git servers are US based, since they're owned by RedHat/IBM.

maze-le 7y ago
Use a self hosted gogs installation (https://gogs.io/ https://gogs.io/) under your own domain and root server outside US jurisdiction.
- swiley 7y ago
  Or just use ssh. That’s what I’ve always done with my friends when we didn’t want to use GitHub. There’s no need to over complicate things.
- nerdponx 7y ago
  GitLab is self-hostable as well, although I imagine Gogs is easier.
  - dijit 7y ago
    Gitlab is actually super easy if you keep to the omnibus installation methods or docker image. The only problem regarding gitlab is resource consumption.
cuillevel3 7y ago
If your company operates in the US and uses a provider, who does not implement sanctions, does it have to enforce them on its own? I mean, something like selling a product, maybe based on open source tech in the US and cooperating with devs in sanctioned countries via a workaround provider..

cyphar 7y ago

If we end up with a project like [1] actually taking off, then with Secure Scuttlebutt you wouldn't need to care about server hosting and the pub servers could be distributed globally. [1]: https://people.kernel.org/monsieuricon/patches-carved-into-developer-sigchains https://people.kernel.org/monsieuricon/patches-carved-into-d...

behdad 7y ago

Hey. HarfBuzz maintainer here. I live in the States but one of our core developers is in Iran. This whole incident was a huge miscommunication on github. Fortunately they have addressed some of it. In short: Open Source and public repos are not affected at all. Cheers