17 ms·

GitHub shuts off access to Aurelia repository, citing trade sanctions

• firloop 7y ago
  This is pure speculation, but it seems that GitHub's ownership by Microsoft causes them to be significantly more strict with the types of content that they are comfortable hosting. Expect this to continue as they expand up and down the stack; once their npm acquisition closes you'll see this there too. I think this should be a wake-up call to anyone staking their open source project on GitHub — if I let someone from a US sanctioned country contribute to my repo will I be banned? Hopefully mindshare moves to alternatives in due time.
  • coliveira 7y ago
    Nobody should depend on GitHub, especially after it was taken over by Microsoft. If you have any repository on GH, create similar accounts on competing sites such as bitbucket. Also consider services hosted in other countries, since it seems that local political prejudices and propaganda are starting to creep out on the science and technology arena.
    • fartcannon 7y ago
      Better yet, self host. Post RSS feeds.
      • worble 7y ago
        Absolutely agree with this, and if Gitlab's hardware requirements seem a little expensive, I can highly recommend Gitea[0]. It runs very happily on a $5 Digital Ocean droplet. It doesn't have all the bells and whistles, but for my basic needs, and presumably as a panic backup, it's a great bit of software. [0]https://gitea.io/en-us/ https://gitea.io/en-us/
      • neop1x 7y ago
        Pull requests and collaboration would be a bit more complicated, I guess. But as long as "Log in with ..." works to quickly create an account, it may be ok.
    • shadowgovt 7y ago
      "local political prejudices and propaganda" is a fascinating way to interpret "The US list of sanctioned countries."
      • freeone3000 7y ago
        It's local to the US and it's prejudice and propaganda, so...?
        • shadowgovt 7y ago
          I think I'd need a citation on why "prejudice and propaganda" applies here. The US doesn't turn to sanctions flippantly (it's not in the US's economic interests, in general, to take a trading partner off the table).
          • slavik81 7y ago
            I probably wouldn't use language quite that strong, but the view from outside the US is definitely quite different. The US withdrawl from the Iran nuclear agreement was more a result of changes in the US than of changes in Iran. Barack Obama brokered the deal and he stated his clear opposition to Donald Trump's decision to end it. (https://facebook.com/barackobama/posts/10155854913976749 https://facebook.com/barackobama/posts/10155854913976749) The European Union was also a party to the Iran nuclear deal, and they thought so poorly of the resumption of US sanctions on Iran that they passed a law making it illegal for European companies to comply. (https://dw.com/en/eu-to-reactivate-blocking-statute-against-us-sanctions-on-iran-for-european-firms/a-43826992 https://dw.com/en/eu-to-reactivate-blocking-statute-against-...)
    • philliphaydon 7y ago
      What other company was better suited to take over? Google? FB? Amazon? None of them... MS is the only company I would trust at this point.
  • chatmasta 7y ago
    GitLab is fantastic, but GitHub has the most eyeballs and best discoverability features. As long as that remains true, GitHub will remain a better place to launch an open source product than alternatives.
    • enriquto 7y ago
      You can use any old git repo as your main source, and "dump" every commit into github for visibility. Any issues and pull request into the github site are replied by an automatic answer to use some other site.
      • shadowgovt 7y ago
        ... which diminishes the likelihood volunteers will join your project, because now they have to go learn another site.
        • vetinari 7y ago
          Is it really a thing, to have to learn another site? If you know the basic functionality of Github, do you really have to learn to use similar functionality of Gitlab, Gitea, etc? Is it not enough to be familiar with the concepts?
          • jan6 7y ago
            well, the UI is different, so you have to learn to use that... the concepts can be quite similar, but execution, isn't
            • vetinari 7y ago
              Sure, but the difference isn't that big. Just like when people were switching from the blue e to firefox/chrome: these were different browsers, with different UI, but the concept of browsing the internet was the same. So in the end, the different UI didn't matter.
          • 7y ago
  • stickfigure 7y ago
    This seems peculiar since Rob Eisenberg (author of that tweet and lead of Aurelia) works for Microsoft.
    • kemiller2002 7y ago
      ...and from what I understand, they actually use it on some of their sites.
    • khuey 7y ago
      Sounds like a mistake.
    • frankdenbow 7y ago
      Makes sense if you think of them as separate companies (which is how they are run)
      • jslakro 7y ago
        https://nouhailler.tumblr.com/image/21516226342 https://nouhailler.tumblr.com/image/21516226342
        • frankdenbow 7y ago
          Maybe >5 years ago, culture has changed under Satya :)
    • itronitron 7y ago
      well, that helps explain the CEO's responsiveness in sorting it out
  • frankdenbow 7y ago
    Microsoft lets Github run independently https://www.businessinsider.com/github-coo-microsoft-azure-erica-brescia-2020-1 https://www.businessinsider.com/github-coo-microsoft-azure-e...
    • shadowgovt 7y ago
      There's independently and independently. MS is on the hook for violations of US sanctions by any of its subsidiaries and constituent organizations; one can assume the legal team keeps an eye on Github's operations even if the main operations team allows for independent goals and direction of work.
  • tw04 7y ago
    I'm not sure why you'd lay the blame at Microsoft's feet. You could self-host and your ISP would still take you down if you were violating US sanctions in most parts of the world. If they did this by accident, and you've got some proof the decisions was made by someone that's actually FROM Microsoft and not a legacy Github employee, by all means present it. Otherwise you're just gas-lighting.
    • vetinari 7y ago
      > your ISP would still take you down if you were violating US sanctions in most parts of the world No, they would not. These are US sanctions, not most parts of the world sanctions. You could have problems with companies in the jurisdiction of US, but most parts of the world are not it.
      • tw04 7y ago
        If that's not an idealists view of how the world works. So you think if you're in Japan that NTT is going to risk losing ALL of their US contracts for a random home user that's violating US sanctions? Good luck with that. Just because you aren't in US jurisdictions doesn't mean your ISP doesn't make a LOT of money off the US market. Not to mention the mass exodus of customers if they were banned from all US based content: All Microsoft properties All facebook properties All Google and Amazon properties etc. etc. etc.
        • ta999999171 7y ago
          Great job at summarizing the problem with centralization.
        • vetinari 7y ago
          Does not work that way. How do you think Iran and North Korea are connected to Internet in the first place? For NTT and US, such a situation would be a PR disaster. It would be very difficult for them to explain to the public, why they are applying foreign laws to Japanese citizens. Even US knows that, and they would never push for such draconian thing.
  • solinent 7y ago
    Yes, these trade sanctions will definitely cause these issues--if they operate a business or do any dealings with businesses in countries which are embargo'd they will lose their ability to sell their product internationally, since Microsoft also fulfills defense contracts it probably makes these obligations even stronger, though I am not a lawyer. I think at this point Fossil is looking really really good.
  • deleted 7y ago
    [deleted]
  • bdcravens 7y ago
    > Microsoft causes them to be significantly more strict with the types of content that they are comfortable hosting The law as written doesn't allow subjective decision based on what they're comfortable with.
  • dependenttypes 7y ago
    This is true, and not only for US regulation-related reasons. They also removed multiple political writings about people criticising their authoritarian governments as well as games with sexually explicit content (but no images).
  • dopamean 7y ago
    > This is pure speculation > Expect this to continue I'm not expecting anything to continue based on "pure speculation."
  • Twirrim 7y ago
    Note: This is the company that is acquiring NPM. Which now also is going to have to deal with the messy reality of us sanctions, if they'd been dodging them before. Prior to this it wouldn't have been entirely beyond the pale for NPM to move ownership to another country if it proved to onerous. The threshold for "too onerous" is likely to be significantly higher at Microsoft / Github.
  • bbrree66 7y ago
    Unsubstantiated speculation that is simply confirmation bias of what you want to be true without evidence.
  • DreamScatter 7y ago
    That's why i push my git to both github and gitlab simultaneously. Git makes this easy to do, there is no reason to not use both.
• rolph 7y ago
  time to migrate and redeploy, perhaps reface things and setup a new repository. the trade sanctions thing is about this repository involving paid service: https://github.com/aurelia/aurelia https://github.com/aurelia/aurelia "Due to U.S. trade controls law restrictions, paid GitHub organization services have been restricted. For free organization accounts, you may have access to free GitHub public repository services (such as access to GitHub Pages and public repositories used for open source projects) for personal communications only, and not for commercial purposes. " so it looks like its not the most stable place to make money.
• ISL 7y ago
  What is Aurelia? Why would it be sanctioned?
  • strictnein 7y ago
    https://github.com/aurelia https://github.com/aurelia "A standards-based, front-end framework designed for high-performing, ambitious applications."
  • dwohnitmok 7y ago
    It looks like a JS frontend framework. I've never used it. I have no idea why it would be sanctioned. Bizarrely Aurelia 1.0 at https://github.com/aurelia/framework https://github.com/aurelia/framework has a banner across its top indicating trade sanctions, but the new version Aurelia 2.0 doesn't https://github.com/aurelia/aurelia https://github.com/aurelia/aurelia. Aurelia's developers suspect it's because they have contributors from sanctioned countries. That's the first I've ever heard of such a thing. https://twitter.com/AureliaEffect/status/1240664151753551873 https://twitter.com/AureliaEffect/status/1240664151753551873 EDIT: And the banner is gone... Just when I was going to save some screenshots.
    • save_ferris 7y ago
      My first question is: how does Github know that certain committers are from sanctioned countries? Do they have Github profiles showing they're from sanctioned countries? Given the number of huge FOSS projects on Github, it's feasible to imagine that many major repos have code contributed by people from sanctioned countries. I have no idea what their motive is, but it smells really political to me. I could see Github's argument if they violated labor laws by hiring or contracting with individuals illegally, but that doesn't sound like what happened here.
      • GordonS 7y ago
        > how does Github know that certain committers are from sanctioned countries? Do they have Github profiles showing they're from sanctioned countries? Even if not in their profiles, you can pretty reliably detect a user's country from their IP address.
• droopyEyelids 7y ago
  Have black hat people figured out what triggers this yet? Looks like a new attack, where you make a few contributions to a project, then start proxying your logins through Iran for a while till everything you touch shuts down.
• antoncohen 7y ago
  What frustrates me about these kind of things is how impersonal they are. How many orgs/users does GitHub sanction a day? Too many for it to be able to email the users and ask clarifying questions? Or even have a human dig in and double check what the algorithm says. Basic human interaction would seemingly solve 99% of false account lockouts and takedowns. Even basic heuristics like this org has a repo with 11,000 stars, it isn't a new user that just signed up yesterday, we need to look into this deeper.
  • cryptonector 7y ago
    In a world in which online presence is an essential attribute of... commerce, professionalism, etc., deplatforming cannot be allowed to be so trivial to effect and difficult (in many cases impossible) to challenge. At some point human rights have got to include sufficient due process to deal with accidental or unjust deplatforming.
    • shadowgovt 7y ago
      It's an interesting thought, but at the moment at least, things are still too fluid to really nail down how that would work. What is a "platform?" What is "deplatforming?" If Github kicks me off and I can migrate easily to GitLab, have I been "deplatformed?" Is it morally correct to tie Github's hands from locking someone's account if they're using their git repo to host CP? We're getting there, but pulling it off is going to require a level of international cooperation that is rarely seen (and tends to give a few key players a lot of power; if we do this, I hope everyone's excited to be living under the US's notion of what morality looks like. Or Europe's. or China's).
      • cryptonector 7y ago
        > If Github kicks me off and I can migrate easily to GitLab, have I been "deplatformed?" Most definitely you have. Especially if the reason and process used by GH is likely to also be in use at GL. > Is it morally correct to tie Github's hands from locking someone's account if they're using their git repo to host CP? The relevant question is: is it constitutional. In the U.S. I believe the answer would be a solid "yes" as to a Federal statute that adds due process protections for this, no different than with the many many Federal and State laws and regulations that have created civil justice recourse for specific kinds of torts. Morality is a different issue, and it's much too easy to flip your question on its head: is it moral to deplatform people if doing so damages their ability to earn a living? Indeed, there's no need to frame this as a moral question, and it's arguably foolish to do so. It is and should be only a question of policy, politics, and constitutional law. Regarding politics, mine is a political argument. Regarding policy, I think it's a good idea to give "little people" some minimal protections from "big people". This is quite standard around the world. There are going to be policy details to debate, but writ large, this is a no-brainer. I already address the very likely U.S. consitutionality of such a policy. > We're getting there, but pulling it off is going to require a level of international cooperation that is rarely seen (and tends to give a few key players a lot of power; if we do this, I hope everyone's excited to be living under the US's notion of what morality looks like. Or Europe's. or China's). No. This can be done in each country w/o internaltional cooperation. Granted, GH might pull out of France, say, if they don't like French laws, and so on. But U.S. business will not leave the U.S. over this.
• kylecordes 7y ago
  What a debacle. If GitHub believes this is necessary to comply with sanctions, they should provide a "rather than shut me down, please block contributions that GitHub would consider sanctioned” switch.
  • oefrha 7y ago
    Can’t speak for others, but I for one wouldn’t want this switch, and would be offended by it. I would defend people’s rights to contribute to open source regardless of their nationalities by taking my project elsewhere.
    • jannotti 7y ago
      Then you'd probably still want this switch, but expect to be notified of the block. Then you could move in an orderly fashion.
    • klohto 7y ago
      Then take the project elsewhere but the leave the switch
  • alexellisuk 7y ago
    Where can I read about the guidelines that "contributions from certain people break trade sanctions". Am I reading that right?
• unlinked_dll 7y ago
  I thought this was about the music education software by the same name
• Touche 7y ago
  What am I missing? Seems fine to me: https://github.com/aurelia/framework https://github.com/aurelia/framework
  • save_ferris 7y ago
    Github just reversed their decision.
    • deleted 7y ago
      [deleted]
  • codetrotter 7y ago
    The repos are back, but the site http://aurelia.io http://aurelia.io which is also hosted on GitHub servers is still showing 404.
• deleted 7y ago
  [deleted]
• deleted 7y ago
  [deleted]
• peterkelly 7y ago
  And they've just bought npm! https://news.ycombinator.com/item?id=22594549 https://news.ycombinator.com/item?id=22594549
• tanilama 7y ago
  This is laughable. What trade sanctions would apply to a JS frontend framework? Insane.
• vasco 7y ago
  Sanctions for online services are one of the worst things about working in this industry. Being forced to implement and maintain technical solutions to block access to every day citizens of certain regions because some guys in suits decided these are second tier humans is demoralizing as hell. How are people supposed to rise up and depose or vote for less tyranical governments if they cannot access information, or use services that'll boost their businesses in the global market? Having had to implement things like this myself in the past, I just feel like puking when I do it. And don't think about just ignoring these, as soon as you get bigger than tiny, your bank will threaten to freeze all your accounts and stop doing business with you if for some reason you let some Crimean or Iranian get onto your service and pay you for it. What exactly is the plan? Are we expecting that individuals who disagree with their regimes would leave their country and their families? It just feels like cold blooded retribution with no care for the regular every day population.
  • woofcat 7y ago
    >What exactly is the plan? Are we expecting that individuals who disagree with their regimes would leave their country and their families? It just feels like cold blooded retribution with no care for the regular every day population. That it will impact the country economically and hopefully result in the Government changing coarse or for the People of the country to not want to live in a shitty place with a poor economy. I find sanctions vastly better than the alternative at that level, which would be some sort of blockade or other military intervention.
    • TheSpiceIsLife 7y ago
      Ostensibly. But the reality is probably more like the top levels of governments bullying, and they don’t give a flying fuck about the impacts on the average citizen.
    • anigbrowl 7y ago
      Sounds good in theory but the evidence is lacking.
    • kelnos 7y ago
• tastroder 7y ago
  Let's take a moment and appreciate the copy and paste support response "If a user or organization believes that they have been flagged in error, then that user or organization owner has the opportunity to appeal the flag by providing verification information to GitHub. Please see our FAQ for the appeals request form." https://twitter.com/GitHubHelp/status/1240682163193942018 https://twitter.com/GitHubHelp/status/1240682163193942018 Is that an official GH account? It's old and the answers look legitimate but that one is certainly a really off-putting reaction.
  • jhare 7y ago
    This and this. Next thing you know they'll require a Windows Live login to make that appeal. Github used to be good. What a waste.
  • jtvjan 7y ago
    > Is that an official GH account Yes. It is linked to from github.community, which is linked to from support.github.com.
  • fenwick67 7y ago
    It doesn't seem off-putting to me. The form is there for a reason. Filling it out is literally easier than explaining everything to a support person on Twitter point-by-point. If you want help, you can spend 60 seconds and fill out a damn web form.
    • deleted 7y ago
      [deleted]
    • filleduchaos 7y ago
      "60 seconds and fill out a damn web form" that demands you submit a government-issued photo ID and selfie? Hell no.
• dwheeler 7y ago
  This looks like a terrible but honest mistake. The repo is already back, after something like an hour and a half. The . io website is not back yet, but I suspect that takes a moment to get back running.
  • xvector 7y ago
    It doesn’t matter if it’s an honest mistake, this sort of action alongside the canned HR response is completely unacceptable. Honest mistakes don’t exempt your actions from being disgusting.
    • dwheeler 7y ago
      An action that is an honest mistake isn't disgusting; it is simply a mistake. We all make mistakes. Anyone who makes no mistakes is not doing anything useful. What matters is doing the right thing after the mistake is discovered. I agree that the canned HR response wasn't acceptable, but that is not all that happened. GitHub quickly restored the project - and that was the most important issue. In addition, GitHub has now posted an apology, and has also said that they will try to figure out how to prevent its recurrence in the future. THAT is exactly the right way to handle a mistake: fix the problem, say sorry, and try to prevent its recurrence. Good show. I am actually impressed with GitHub's response to this!! I get the impression that part of your complaint is that "flagging" itself is disgusting. If that's the case, your ire is completely misdirected. This is required by US law for anyone doing business in the US. If you don't like it, that's fine; complain to the US Congress, who create the US laws. GitHub is simply doing what it must do. In the US, and in most of the western world, the rule of law is still a thing (and a good thing it is!). Please point your disagreement at those who are responsible for it.
      • luckylion 7y ago
        > What matters is doing the right thing after the mistake is discovered. They didn't. They only did "the right thing" after it went viral on HN. They did the same thing a few days ago to another developer, and only after it went viral on HN did they do the right thing. They were very aware that a) their flagging process is broken and b) their support process is non-existant unless you make your complaint go viral. The canned response is part of their strategy to filter out everyone that isn't large enough and they'll just ignore those complaints. > This is required by US law for anyone doing business in the US. It's required to do it automatically and wrong? I have some serious doubts.
• longstation 7y ago
  Would having a decentralized repository be a good idea (one that is not subject to this kind of corporate/political issue)?
• Kiro 7y ago
  Read the whole Twitter thread and all comments here and I still don't understand what trade sanctions are applicable here.
  • detaro 7y ago
    Probably none, and some automatic thing triggered in error.
• iamleppert 7y ago
  So disgusting their response: "If a user" Addressing someone in the third person is about a far from empathy as one could get. Clearly, the signal is strong to begin the exodus from Github as soon as practical. They can no longer be trusted, and are no longer developer friendly.
• pragmatic 7y ago
  And in that moment Hacker News was enlightened.
• jtokoph 7y ago
  It looks to be restored: https://twitter.com/EisenbergEffect/status/1240700062939791362?s=20 https://twitter.com/EisenbergEffect/status/12407000629397913...
  • nabakin 7y ago
    I guess it was a mistake.
• Lorin 7y ago
  TIL about Aurelia - the streisand effect in full force :)
• cfv 7y ago
  Without even delving on the perverse sanctions part, it should never be forgotten that the whole point of git is that it's a distributed source control system. Grab your source and move it elsewhere. Heck, even an old forked gitlab community instance should work. Github is good for the exposure, but it's their house, and so their rules apply, not ours. Don't rely on them to always be OK with you staying.
  • driverdan 7y ago
    Every time something like this happens someone has to make this argument. This isn't just about the source, it's all the other tools like pull requests that Github provides. Git is only one part of Github.
    • cfv 7y ago
      Merge requests have been a gitlab feature since forever though. Like issues, and webhooks
      • webo 7y ago
        Code search, access permissions, code owners, 3rd party integrations?
        • cfv 7y ago
          If you tried looking it up yourself instead of making me feed you info in what totally looks like bad faith that would be awesome.
          • shadowgovt 7y ago
            FWIW, I have attempted to look it up myself, and unlike Github, GitLab doesn't appear to allow me a transparent view into their offerings in action without signing up to start my free trial. Which is a lot more engagement than Github requires of someone just trying to discover capabilities.
• mullingitover 7y ago
  Isn't this a first amendment violation? Are we not on board with the notion that code is speech, and that the constitution applies to everyone, not just US citizens? With those things in mind, I don't understand how the Iranian peoples' free speech rights can be infringed just because their speech is in the form of code.
  • driverdan 7y ago
    That's not how the First Amendment works. It applies to the government, not private businesses.
    • hyperpape 7y ago
      I think that's not right, because the reason the company is doing the censoring is to comply with sanctions imposed by the government. If the US says you can't host content praising Iran, and GitHub takes it down to comply, that's a 1st Amendment violation. However, code seems to be in a strange place, neither clearly speech nor clearly not-speech.
      • mullingitover 7y ago
        I argue code is absolutely protected speech. The government ran away[1] from a recent case that would've settled the matter conclusively. [1] https://www.pbs.org/wgbh/nova/article/is-code-free-speech/ https://www.pbs.org/wgbh/nova/article/is-code-free-speech/
  • jkaplowitz 7y ago
    Whatever free speech rights apply to Iranians in Iran don't come from the US Constitution, not even from its First Amendment. The US Constitution protects US citizens (and maybe non-citizen nationals) anywhere and anyone of any nationality within the US, with respect to their dealings with the US federal/ state / local governments or those private entities exercising the authority of these governments. That's it.
  • ben509 7y ago
    If Github is acting as agents of the USG, they're bound by 1A. Here, there's a direct instruction from the government telling them to do this thing. But I'm not sure there's a 1A case against this form of trade sanctions. The government isn't saying Iranians (as an example) can't write code, or that US citizens can't write code. They're saying they Iranian citizens can't use a US service. It's being denied as an economic transaction, not as speech. Art I Sec 8 specifically enumerates the power "To regulate Commerce with foreign Nations...", and arguably sanctions are further allowed under the power "To define and punish Piracies and Felonies committed on the high Seas, and Offenses against the Law of Nations;"
• forkLding 7y ago
  Weirdest part of this is that the Lead Developer at Aurelia and the guy who posted this on twitter works at Microsoft which again is weird now that Github is part of Microsoft.
• gtrubetskoy 7y ago
  Github was cool when git was new years back - but these days, and especially given how git inherently is not centralized, it is not very clear to me why we all cling to github. With a little work, all that it offers can be done without any help of a centralized server/corporation.
• kujaomega 7y ago
  Seems that Github has automated some repository banning actions. 3 days ago, the author of a repo got removed his account without reason and hours later got his account reactivated (https://news.ycombinator.com/item?id=22593595 https://news.ycombinator.com/item?id=22593595), after posting to hackernews. As we see, the Aurelia repository were also removed, and hours later reactivated. What caught my attention is that the banned user is from Russia and that Aurelia repository has got developers from Iran. Is this a sign of Github country discrimination? Or is this a sign of Machine learning bias?
  • marcinzm 7y ago
    >Is this a sign of Github country discrimination? It's a sign that Github strictly follows US sanctions which currently impact Crimea and Iran. They literally say in the messages for these closures that it's due to sanctions.
• natfriedman 7y ago
  Hi HN, I'm the CEO of GitHub. Flagging this account was obviously a terrible mistake, and I apologize to anyone who was affected by it. We're investigating why it occurred and will make changes to make sure it doesn't happen again. I am glad that we restored access to the account in less than an hour after Aurelia filed their appeal. For context on why any account flagging is ever necessary, unfortunately, every company in the world is required to comply with US sanctions if they do any business at all in the United States, e.g. serving US-based customers. This includes even interacting with US banking infrastructure. So being headquartered somewhere else doesn't help; you have to comply. And US sanctions as written do not allow us to provide commercial services or services which could be used commercially to sanctioned countries. We are taking the broadest possible interpretation of US sanctions law to allow as much access to GitHub as possible and we are, as far as I know, the only major vendor to offer public repo access in US-sanctioned countries like Iran, Syria, and Cuba. I'm proud that we are taking this strong position to ensure developers everywhere can participate in open source. I wish we could also offer access to private repos and still comply with government requirements. We have been advocating and will continue to advocate for broader developer access with the various government agencies involved.
  • nabakin 7y ago
    Thank you for the response and swift action.
  • jackpirate 7y ago
    ... to offer public repo access in US-sanctioned countries like Iran, Syria, and Cuba. You should also add North Korea to that list. Three years ago I spent a semester in Pyongyang teaching a course on open source software development, and as part of the course students created git repos and contributed to other repos that are hosted on github. So that you're not put in an awkward position, though, I won't tell you which repos these are :)
    • deleted 7y ago
      [deleted]
    • 7y ago
• Kydlaw 7y ago
  It's back https://twitter.com/EisenbergEffect/status/1240705256389890048 https://twitter.com/EisenbergEffect/status/12407052563898900...
• greut 7y ago
  It's been removed from AUR packages as well, https://lists.archlinux.org/pipermail/aur-requests/2020-March/038625.html https://lists.archlinux.org/pipermail/aur-requests/2020-Marc...
• bartread 7y ago
  WTH? GitHub is owned by Microsoft. Rob Eisenberg, who posted that tweet, works for Microsoft. There's so much about this I don't get, not least of which is the fact that despite what the headline suggests, along with the amount of bile still being spewed on this thread, Aurelia is back up and running, as are all its repos: https://aurelia.io/ https://aurelia.io/, https://github.com/aurelia https://github.com/aurelia. So, yes, GitHub properly effed up here, but they do at least appear to have backpedalled and fixed the problem quickly.
  • larrik 7y ago
    It got fixed quickly because of the very high profile nature of the project. What happens when it's one of our projects, and we aren't some bigwig at Github's parent company to complain?
• EisenbergEffect 7y ago
  GitHub has corrected the issue, restoring our organization access and web site. They have reported that the org was flagged as part of an automated process. The flagging occurred because we have two external contributors from Iran (non GH org members). They told me that there should have been a warning and they are investigating why that didn't happen. The CEO of GitHub also reached out personally to try to speedily rectify the situation.
  • willvarfar 7y ago
    So Iran could sponsor programmers to contribute to as many repos as possible? Then they can win a propaganda war of why Iran is progressive and good and the US is bad?
    • jessaustin 7y ago
      Haven't they already won that war? USA created ISIS, gave ISIS lots of weapons and logistical support, then assassinated the guy who beat ISIS while he was in diplomatic talks with supposed USA ally Iraq. In response, Iran says "we will destroy buildings at the following addresses", allows time for those buildings to be evacuated, then their guided missiles destroy exactly those buildings. USA military brass then downgraded Iran from their "let's go to war now" list...
  • swiley 7y ago
    Thank goodness with git you can just change your remote. This is beginning to sound like YouTube!
  • rezonant 7y ago
    How are we supposed to vet Github accounts to know whose contributions we can accept? This is crazy.
  • alireza94 7y ago
    Well, this sounds bad. A few months ago GitHub banned access of Iranian developers (and devs who live in a few other countries) to private repositories and gists and now, with actions like this, even if it's by accident, they are threatening our chance of collaboration to public open-source repos because maintainers would be afraid that if they accept our contribution they may face consequences.
• scalableUnicon 7y ago
  And I just finished setting up gitea(https://gitea.io/en-us/ https://gitea.io/en-us/) on my server and mirrored all my repos. An elegant piece of software, setup was straightforward and took less than an hour.
• sytse 7y ago
  GitLab CEO here, thanks Nat for doing everything you can do to keep open source accessible around the world. We have to comply with the same restrictions and respect greatly that GitHub is taking the broadest possible interpretation of US sanctions law to help users.
  • deleted 7y ago
    [deleted]
  • relaunched 7y ago
    Do you though? Really? https://www.wsj.com/articles/resignation-at-gitlab-highlights-concerns-over-corporate-espionage-11573686134 https://www.wsj.com/articles/resignation-at-gitlab-highlight...
    • bdcravens 7y ago
      I'm not sure what those hiring practices have to do with the legally-mandated sanctions being referenced.
      • relaunched 7y ago
        Glad you asked. Since Sid respects the broadest interpretation, take a look at https://www.export.pitt.edu/sites/default/files/6.%20Anti-boycott%20Regulations.pdf https://www.export.pitt.edu/sites/default/files/6.%20Anti-bo... It seems like, if a VP wants to discriminate hiring within certain countries, based on a pending customer contract, as stated by Mr. Johnson - it's reasonable to assume that GitLab should report, as per the EAR requirement, that: Any person under U.S. Jurisdiction who is asked to enter into an agreement or provide information that would violate anti-boycott laws must report this to BIS using a form BIS-621-P or form BIS-6051P in accordance with 15 C.F.R. § 760.5.
        • bdcravens 7y ago
          That's not an interpretation of sanctions, you're pulling in a second set of laws. Additionally, I'm pretty sure a country being on a boycotted list doesn't prohibit a company from making hiring decisions for reasons outside of the boycott.
• deleted 7y ago
  [deleted]
• castorp 7y ago
  Are there any European hosted (and owned by a European company) alternatives to GitHub or GitLab?
  • deleted 7y ago
    [deleted]
  • guug 7y ago
    Not european, but the non-US ones I know of are - https://gitea.com/ https://gitea.com/ by the gitea project is hosted in China by a Chinese company. It's probably the safest one to use. - https://bitbucket.org/ https://bitbucket.org/ by Atlassian is probably hosted in the US but is owned by a company headquartered in Australia. Personally, I don't think searching for alternatives in other jurisdictions is the right way to tackle this issue. With the way things are devolving in terms of hosting reliability (i.e. getting automatically banned by big tech for vague reasons) and US laws that overstep their boundaries, the best way is to host mirrors across as many services and networks as possible and switch your workflow (incl. issues) to a mail-based one.
• bilekas 7y ago
  Does any license in particular effect the trade sanctions? MIT for example in my eyes would be the most lax, does that mean that it does not apply for trade sanctions ? Open source based on government sanctions kinda feels like some oxymoron.
• adultSwim 7y ago
  Note: sanctions against Iran are preventing them from buying medical supplies. Millions could die there from COVID-19.
  • amir734jj 7y ago
    My relatives live in Iran. Sanctions devasted the people's lives, not the government!
• type0 7y ago
  Are there any hints on what other countries/regions might be getting on that sanctions list soon?
• justlexi93 7y ago
  I wonder what their timeline for fixing a mistake like this is when it's just some plebe. I bet it aint an hour.
• jtms 7y ago
  I had never heard of this framework until this happened, but now I am going to check it out. Probably a very good bit of accidental publicity
• emptysongglass 7y ago
  If people just used git the way it was intended, as a decentralized protocol for editing and sending patches by email, we wouldn't have this issue. See https://git-send-email.io https://git-send-email.io
• mrastro 7y ago
  I can empathize that GitHub has to abide by laws more stringently now that it's part of Microsoft but oh boy does it's automatic flagging system need work. One day I was randomly permanently banned because a hacker starred some of my public repos from hacked accounts (only ~6 stars btw). I had no involvement whatsoever, it was likely an attempt by the hacker to dilute the target of the repos they were trying to star. It took me ~2 weeks to appeal and they still blamed me for hacking even though the IPs of those accounts were different. My ban was eventually lifted but I doubt their system works nearly as well as it should.
• adim86 7y ago
  The funniest thing to me is that the twitter account complaining is a Microsoft employee and Github is owned by Microsoft but the only way he could complain and be heard is via twitter? Amazing!
• thatgerhard 7y ago
  Since when is it Github's job to lock others repos at all?