15 ms·

Hi HN, I'm the CEO of GitHub. Flagging this account was obviously a terrible mistake, and I apologize to anyone who was affected by it. We're investigating why

Hi HN, I'm the CEO of GitHub. Flagging this account was obviously a terrible mistake, and I apologize to anyone who was affected by it. We're investigating why it occurred and will make changes to make sure it doesn't happen again. I am glad that we restored access to the account in less than an hour after Aurelia filed their appeal. For context on why any account flagging is ever necessary, unfortunately, every company in the world is required to comply with US sanctions if they do any business at all in the United States, e.g. serving US-based customers. This includes even interacting with US banking infrastructure. So being headquartered somewhere else doesn't help; you have to comply. And US sanctions as written do not allow us to provide commercial services or services which could be used commercially to sanctioned countries. We are taking the broadest possible interpretation of US sanctions law to allow as much access to GitHub as possible and we are, as far as I know, the only major vendor to offer public repo access in US-sanctioned countries like Iran, Syria, and Cuba. I'm proud that we are taking this strong position to ensure developers everywhere can participate in open source. I wish we could also offer access to private repos and still comply with government requirements. We have been advocating and will continue to advocate for broader developer access with the various government agencies involved.

nabakin 7y ago
Thank you for the response and swift action.
jackpirate 7y ago
... to offer public repo access in US-sanctioned countries like Iran, Syria, and Cuba. You should also add North Korea to that list. Three years ago I spent a semester in Pyongyang teaching a course on open source software development, and as part of the course students created git repos and contributed to other repos that are hosted on github. So that you're not put in an awkward position, though, I won't tell you which repos these are :)
- deleted 7y ago
  [deleted]
- dathinab 7y ago
  I wonder do they use VPN to obfuscate where they come from?
  - dsl 7y ago
    All North Korean internet traffic originates from 175.45.176.0/22. They have no reason to hide (except for the massive amount of cyber crime they originate, where VPNs are used)
    - tlrobinson 7y ago
      > They have no reason to hide (except for the massive amount of cyber crime they originate, where VPNs are used) And, well, trade sanctions, which is why the parent comment wondered if they used VPNs.
      - dsl 7y ago
        I used to use an Iranian based VPN. Sanctions are almost always implemented by billing address, not by IP address. Geolocation services are crap when you start getting in to third world countries.
        mirimir 7y ago
        Billing addresses are easy to fake.
        mike_d 7y ago
        Ok? I'm sure most e-commerce websites would scoff at the idea of having shoppers mail in a notarized copy of their passport before they can make a purchase.
        vinay427 7y ago
        A passport generally doesn't even indicate where someone lives or has lived.
luckylion 7y ago
> I am glad that we restored access to the account in less than an hour after Aurelia filed their appeal. You mean after they went semi-viral on Twitter and landed on the HN front page. But I'm sure it doesn't happen again (to this repository, for this reason, in this year; everything else is on the table). Using Twitter, FB, HN etc as your support-priority-queue system is a terrible idea.
- shadowgovt 7y ago
  As we've seen with all major internet service providing companies, getting customer service right 100% of the time does not scale. Errors happen. The mean time between errors approaches 0 hours as the ratio of users to human beings on the planet approaches 100%.
  - luckylion 7y ago
    Sure, but there's plenty of space between offering Google-level support and getting it 100% right. Aim for 100%, not for Google. It's not their terrible support that made them successful, don't copy that part of their operation.
    - shadowgovt 7y ago
      Setting the tradeoff in cost / effectiveness where Google did is probably part of the alchemy of what made them successful in the way they are successful (though offering better customer service and "white glove" treatment to a smaller customer base is also extremely likely to be a viable business model).
- tomxor 7y ago
  They reinstated the account 1hr after official appeal. You comment is only relevant to those posts who are used as a last resort, usually after waiting days or weeks without any human response. AFAICT the tweet was done pretty much simultaneously, perhaps in an attempt to hasten response time.
  - 7y ago
RegnisGnaw 7y ago
Do you think as the EU and PRC grows politically and economically, they will start throwing around similar sanction requirements as the USA? Will GitHub be forced to obey those as well?
- ljm 7y ago
  The EU has GDPR which has a provision against making automated decisions, which has been outlined by the UK as such: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/rights-related-to-automated-decision-making-including-profiling/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
- johannes1234321 7y ago
  GitHub hast to follow EU legislation already - see GDPR for a famous one.
- qaq 7y ago
  RPC already does it from forcing brands to remove Taiwan from list of countries on their sites to having Hollywood alter things they don't like in movies.
Sephr 7y ago
Do you believe that trade regulations such as ITAR apply to publicly-available open source software? I do not¹, and it appears that your employees do not believe this either. GitHub is currently hosting multiple GPS implementations² that are clearly against this line in your ToS, in addition to also being against ITAR by not implementing speed limits for missiles: "GitHub may not be used for purposes prohibited under applicable export control laws, including purposes related to the development, production, or use of […] long range missiles or unmanned aerial vehicles." I think you should probably make a blog post explaining GitHub's stance on this issue. [1]: https://www.unr.edu/sponsored-projects/compliance/export-controls/publicly-available https://www.unr.edu/sponsored-projects/compliance/export-con... [2]: One of which is https://github.com/gnss-sdr/gnss-sdr https://github.com/gnss-sdr/gnss-sdr. This repository does not implement ITAR-required GPS speed limits. Even if it was ITAR-compliant, the limits could easily be removed as it is open source software. ---------------------------- Update: GitHub has updated their ToS to remove this line. It was present on July 27, 2019. The issue still stands with this current statement from their ToS ( https://help.github.com/en/github/site-policy/github-and-trade-controls https://help.github.com/en/github/site-policy/github-and-tra...), which forbids ITAR-regulated software: "Users are responsible for ensuring that the content they develop and share on GitHub.com complies with the U.S. export control laws, including the EAR and the U.S. International Traffic in Arms Regulations (ITAR). The cloud-hosted service offering available at GitHub.com has not been designed to host data subject to the ITAR and does not currently offer the ability to restrict repository access by country."
- xxpor 7y ago
  The difference is companies actually get in a LOT of trouble for sanctions violations. When was the last time someone was prosecuted for an illegal GPS implementation?
  - jiggawatts 7y ago
    The minute someone uses an open-source GPS radio to build a cruise missile in their garage, and uses it for assassinations. Given the current tech level available to hobbyists, this isn't that far fetched.
notlukesky 7y ago
So how do you plan to not overreact going forward? Or did the Microsoft acquisition play a role?
ljm 7y ago
How would this have been resolved if the post on Twitter/other social media didn't get enough traction? Is this just a terrible mistake because it has much more visibility than all of the other terrible mistakes?
- ajross 7y ago
  That's not a fair argument. You're demanding that GitHub prove the absence of any other mistakes. All they can do is fix bugs when they find them, the same as anyone else. If there's a systemic problem with the way they do sanction flagging, that needs evidence.
  - ljm 7y ago
    I disagree; it is a fair argument. This is the Tweet: > I woke up this morning and you shut off the Aurelia site, archived tons of our repos, and I can no longer access admin settings. You sited US trade sanctions and sent me a non-descriptive email with no remediation information. What is going on? This is devastating for us! "No remediation information," to me sounds like Twitter outrage was the remedy. A follow up reply is this: > The project has been public for 5yrs+, managed by a US company, whose owner is even a GitHub Insider and long time open source leader (15+ yrs). Okay, there's the terrible mistake. It targeted someone with credentials, not a nobody.
    - zokier 7y ago
      > If a user or organization believes that they have been flagged in error, then that user or organization owner has the opportunity to appeal the flag by providing verification information to GitHub. Please see our FAQ for the appeals request form https://help.github.com/en/github/site-policy/github-and-trade-controls#frequently-asked-questions https://help.github.com/en/github/site-policy/github-and-tra... https://twitter.com/GitHubHelp/status/1240682163193942018 https://twitter.com/GitHubHelp/status/1240682163193942018 > If an individual user or organization administrator believes that they have been flagged in error, then that user has the opportunity to appeal the flag by providing verification information to GitHub. If GitHub receives sufficient information to verify that the user or organization is not affiliated with a U.S.-sanctioned jurisdiction or otherwise restricted by U.S. economic sanctions, then the flag will be removed. Please see individual account appeals request form and organizational account appeals request form.
tmpz22 7y ago
I appreciate the difficult position you're in, wanting to provide and advocate access while also forced hard by government regulations which are heavy handed and often over-reaching. I wonder though, as cool as it is that the CEO of Github posts here, maybe you shouldn't be making this comment. Now a bunch of commentators have raised similar issues and you are now obligated to some degree to contact your legal and engineering teams to look into it - this may result in you having to take down MORE content which was clearly nobody's intention. Rock meet hard place.
sneak 7y ago
> We are taking the broadest possible interpretation of US sanctions law to allow as much access to GitHub as possible and we are, as far as I know, the only major vendor to offer public repo access in US-sanctioned countries like Iran, Syria, and Cuba. Does this mean that users in sanctioned countries can create accounts and use the site noncommercially as normal, just as long as they don’t have private repos? It was my understanding that you will nuke ANY account possessed by someone from a sanctioned country. PS: Please stop doing business with ICE.
- deleted 7y ago
  [deleted]
anm89 7y ago
Responses like this are so disgusting to me. It perfectly highlights that the only way to get treated fairly on the system is to be important enough to make the CEO look bad and get a direct response from him. They have unlimited resources more or less to review sanctions cases, they choose to spend them on buybacks, and executive bonuses, and private jets. They are not ever going to take the time to do this properly because the interests of their users are their last priority. Sounds like a great time to get off the github platform as soon as possible before your repos dissappear because some iranian guy posted an issue. Note they didn't mention why they incorrectly flagged the repo or take any responisbility for doing so, or make any claim that it's not going to happen in the future. They just claim it's the government's fault. Bullshit.
rezonant 7y ago
You need to do a post-mortem on this. What exactly did Aurelia do to trigger this to start with? A contribution from a sanctioned country? A github issue posted by someone from a sanctioned country? How exactly are open source projects supposed to avoid this possibility if they don't happen to literally be Rob Eisenberg? How many other project repositories have been disabled because of this problem? Is Github doing a review of the processes? Highly doubtful Aurelia's the only one affected, but it might be the only one so far to be able to make it to HN front page.
- djsumdog 7y ago
  Yea, there's a real lack of information in Github's response. I hope we get something more complete. But really, if your project is mature enough and you have the bandwidth, just host it yourself. Gogs, Gitlab, cgit .. lots of FOSS implementations to choose from.
  - 40four 7y ago
    I agree. This is the second story list this we have seen come across the front page of HN this week. I'm glad they sorted it out quickly, but it is almost certainly a result of Mr. Eisenberg's high profile. We saw another story like this come across the front page this week. The author is less well known (also happens to reside in Russia), and claimed that he had trouble even getting an e-mail response from the given support pathways for appeal. Sounds like it eventually got sorted out, but not without much waiting and effort from the maintainer. So when GitHub CEO Mr. Friedman jumps in and pats himself on the back for getting this account restored in less than an hour, I can only roll my eyes. To try to sell it like this is an 'average' response to these type of appeals is a little disingenuous. If I were starting a company today, I would absolutely self-host my repository to guarantee my business is never harmed by some automated flag that could total lock me out of my own work. We use GitLab Community Edition at my company. It is fantastic, and we are in full control.
    - marcinkuzminski 7y ago
      Here at RhodeCode we strongly believe in self-hosting, this is why we started as an on-premise product for source code management. You should check out RhodeCode too for self-hosting your own code, with extra security features to make sure it's well protected
bilekas 7y ago
Really good to see a proper response here. Thanks, and I'm sure this will be cleared up, but it is really strange how this flagging is taking place..
dwheeler 7y ago
Thanks so much for the swift fix, apology, and the current work to try to find out what happened & prevent the recurrence of the mistake. Mistakes are inevitable, especially at scale. I think taking those steps, when the inevitable mistake happens, is all we can ask of anyone. Good job!!
bogomipz 7y ago
Is there really no process in place to first notify an organization that you will need to close their account down? Or is there something in existing sanction law that prevents extending such a courtesy when account is flagged?
duckmysick 7y ago
> unfortunately, every company in the world is required to comply with US sanctions if they do any business at all in the United States, e.g. serving US-based customers. This includes even interacting with US banking infrastructure. So being headquartered somewhere else doesn't help; you have to comply. And US sanctions as written do not allow us to provide commercial services or services which could be used commercially to sanctioned countries. How come DHL is able to ship packages to sanctioned countries? I understand there are some limitations to what can be sent there from the US, but it seems like they are able to do so from other countries. Is the DHL US a separate entity or is there something else I'm missing?
- dylz 7y ago
  Wikipedia article says this: > DHL offers worldwide services, including deliveries to countries such as Iraq, Afghanistan and Myanmar (formerly Burma). As it is German-owned, DHL is not affected by U.S. embargoes or sanctions and will ship to Cuba and North Korea. However, there are strict codes for delivering to North Korea, as the country has shaky relations with the West. As DHL is no longer a United States company, it is not allowed to make domestic flights between U.S. airports. DHL contracts these services to other providers. > DHL ended domestic pickup and delivery service in the United States in 2009
Aeolun 7y ago
I don’t think any company headquartered outside the US has to comply with those laws. It’s only if they value doing business in the US enough to do so.
miduil 7y ago
GitHub, DROP ICE!
- epse 7y ago
  I'm sorry, I understand why you don't like the ICE, but why should they start "randomly" arbitration what can and can't appear on their platform? That's just a massive can of worms nobody wants to open
  - M2Ys4U 7y ago
    I think denying access to organisations that are EXPRESSLY DESIGNED to violate human rights is a good enough reason.
nulbyte 7y ago
> And US sanctions as written do not allow us to provide commercial services or services which could be used commercially to sanctioned countries. This statement is so wide-sweeping as to be patently false. Some sanctions target specific activities. Others target specific entities that may or may not be entire countries. Many sanctions do not apply to information and communication services. To make such a wide statememt as you did suggests you're oversimplifying to placate the masses. Either way, not a good look.
- animalnewbie 7y ago
  Or maybe he's just paraphrasing in simple terms things his lawyers explained to him because he doesn't want to go write 20 pages of specifics?

nabakin 7y ago

Thank you for the response and swift action.

jackpirate 7y ago

... to offer public repo access in US-sanctioned countries like Iran, Syria, and Cuba. You should also add North Korea to that list. Three years ago I spent a semester in Pyongyang teaching a course on open source software development, and as part of the course students created git repos and contributed to other repos that are hosted on github. So that you're not put in an awkward position, though, I won't tell you which repos these are :)

deleted 7y ago
[deleted]
dathinab 7y ago
I wonder do they use VPN to obfuscate where they come from?
- dsl 7y ago
  All North Korean internet traffic originates from 175.45.176.0/22. They have no reason to hide (except for the massive amount of cyber crime they originate, where VPNs are used)
  - tlrobinson 7y ago
    > They have no reason to hide (except for the massive amount of cyber crime they originate, where VPNs are used) And, well, trade sanctions, which is why the parent comment wondered if they used VPNs.
    - dsl 7y ago
      I used to use an Iranian based VPN. Sanctions are almost always implemented by billing address, not by IP address. Geolocation services are crap when you start getting in to third world countries.
      - mirimir 7y ago
        Billing addresses are easy to fake.
        mike_d 7y ago
        Ok? I'm sure most e-commerce websites would scoff at the idea of having shoppers mail in a notarized copy of their passport before they can make a purchase.
        vinay427 7y ago
        A passport generally doesn't even indicate where someone lives or has lived.

luckylion 7y ago

> I am glad that we restored access to the account in less than an hour after Aurelia filed their appeal. You mean after they went semi-viral on Twitter and landed on the HN front page. But I'm sure it doesn't happen again (to this repository, for this reason, in this year; everything else is on the table). Using Twitter, FB, HN etc as your support-priority-queue system is a terrible idea.

shadowgovt 7y ago
As we've seen with all major internet service providing companies, getting customer service right 100% of the time does not scale. Errors happen. The mean time between errors approaches 0 hours as the ratio of users to human beings on the planet approaches 100%.
- luckylion 7y ago
  Sure, but there's plenty of space between offering Google-level support and getting it 100% right. Aim for 100%, not for Google. It's not their terrible support that made them successful, don't copy that part of their operation.
  - shadowgovt 7y ago
    Setting the tradeoff in cost / effectiveness where Google did is probably part of the alchemy of what made them successful in the way they are successful (though offering better customer service and "white glove" treatment to a smaller customer base is also extremely likely to be a viable business model).
tomxor 7y ago
They reinstated the account 1hr after official appeal. You comment is only relevant to those posts who are used as a last resort, usually after waiting days or weeks without any human response. AFAICT the tweet was done pretty much simultaneously, perhaps in an attempt to hasten response time.
- 7y ago

RegnisGnaw 7y ago

Do you think as the EU and PRC grows politically and economically, they will start throwing around similar sanction requirements as the USA? Will GitHub be forced to obey those as well?

ljm 7y ago
The EU has GDPR which has a provision against making automated decisions, which has been outlined by the UK as such: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/rights-related-to-automated-decision-making-including-profiling/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
johannes1234321 7y ago
GitHub hast to follow EU legislation already - see GDPR for a famous one.
qaq 7y ago
RPC already does it from forcing brands to remove Taiwan from list of countries on their sites to having Hollywood alter things they don't like in movies.

Sephr 7y ago

Do you believe that trade regulations such as ITAR apply to publicly-available open source software? I do not¹, and it appears that your employees do not believe this either. GitHub is currently hosting multiple GPS implementations² that are clearly against this line in your ToS, in addition to also being against ITAR by not implementing speed limits for missiles: "GitHub may not be used for purposes prohibited under applicable export control laws, including purposes related to the development, production, or use of […] long range missiles or unmanned aerial vehicles." I think you should probably make a blog post explaining GitHub's stance on this issue. [1]: https://www.unr.edu/sponsored-projects/compliance/export-controls/publicly-available https://www.unr.edu/sponsored-projects/compliance/export-con... [2]: One of which is https://github.com/gnss-sdr/gnss-sdr https://github.com/gnss-sdr/gnss-sdr. This repository does not implement ITAR-required GPS speed limits. Even if it was ITAR-compliant, the limits could easily be removed as it is open source software. ---------------------------- Update: GitHub has updated their ToS to remove this line. It was present on July 27, 2019. The issue still stands with this current statement from their ToS ( https://help.github.com/en/github/site-policy/github-and-trade-controls https://help.github.com/en/github/site-policy/github-and-tra...), which forbids ITAR-regulated software: "Users are responsible for ensuring that the content they develop and share on GitHub.com complies with the U.S. export control laws, including the EAR and the U.S. International Traffic in Arms Regulations (ITAR). The cloud-hosted service offering available at GitHub.com has not been designed to host data subject to the ITAR and does not currently offer the ability to restrict repository access by country."

xxpor 7y ago
The difference is companies actually get in a LOT of trouble for sanctions violations. When was the last time someone was prosecuted for an illegal GPS implementation?
- jiggawatts 7y ago
  The minute someone uses an open-source GPS radio to build a cruise missile in their garage, and uses it for assassinations. Given the current tech level available to hobbyists, this isn't that far fetched.

notlukesky 7y ago

So how do you plan to not overreact going forward? Or did the Microsoft acquisition play a role?

ljm 7y ago

How would this have been resolved if the post on Twitter/other social media didn't get enough traction? Is this just a terrible mistake because it has much more visibility than all of the other terrible mistakes?

ajross 7y ago
That's not a fair argument. You're demanding that GitHub prove the absence of any other mistakes. All they can do is fix bugs when they find them, the same as anyone else. If there's a systemic problem with the way they do sanction flagging, that needs evidence.
- ljm 7y ago
  I disagree; it is a fair argument. This is the Tweet: > I woke up this morning and you shut off the Aurelia site, archived tons of our repos, and I can no longer access admin settings. You sited US trade sanctions and sent me a non-descriptive email with no remediation information. What is going on? This is devastating for us! "No remediation information," to me sounds like Twitter outrage was the remedy. A follow up reply is this: > The project has been public for 5yrs+, managed by a US company, whose owner is even a GitHub Insider and long time open source leader (15+ yrs). Okay, there's the terrible mistake. It targeted someone with credentials, not a nobody.
  - zokier 7y ago
    > If a user or organization believes that they have been flagged in error, then that user or organization owner has the opportunity to appeal the flag by providing verification information to GitHub. Please see our FAQ for the appeals request form https://help.github.com/en/github/site-policy/github-and-trade-controls#frequently-asked-questions https://help.github.com/en/github/site-policy/github-and-tra... https://twitter.com/GitHubHelp/status/1240682163193942018 https://twitter.com/GitHubHelp/status/1240682163193942018 > If an individual user or organization administrator believes that they have been flagged in error, then that user has the opportunity to appeal the flag by providing verification information to GitHub. If GitHub receives sufficient information to verify that the user or organization is not affiliated with a U.S.-sanctioned jurisdiction or otherwise restricted by U.S. economic sanctions, then the flag will be removed. Please see individual account appeals request form and organizational account appeals request form.

tmpz22 7y ago

I appreciate the difficult position you're in, wanting to provide and advocate access while also forced hard by government regulations which are heavy handed and often over-reaching. I wonder though, as cool as it is that the CEO of Github posts here, maybe you shouldn't be making this comment. Now a bunch of commentators have raised similar issues and you are now obligated to some degree to contact your legal and engineering teams to look into it - this may result in you having to take down MORE content which was clearly nobody's intention. Rock meet hard place.

sneak 7y ago

> We are taking the broadest possible interpretation of US sanctions law to allow as much access to GitHub as possible and we are, as far as I know, the only major vendor to offer public repo access in US-sanctioned countries like Iran, Syria, and Cuba. Does this mean that users in sanctioned countries can create accounts and use the site noncommercially as normal, just as long as they don’t have private repos? It was my understanding that you will nuke ANY account possessed by someone from a sanctioned country. PS: Please stop doing business with ICE.

deleted 7y ago
[deleted]

anm89 7y ago

Responses like this are so disgusting to me. It perfectly highlights that the only way to get treated fairly on the system is to be important enough to make the CEO look bad and get a direct response from him. They have unlimited resources more or less to review sanctions cases, they choose to spend them on buybacks, and executive bonuses, and private jets. They are not ever going to take the time to do this properly because the interests of their users are their last priority. Sounds like a great time to get off the github platform as soon as possible before your repos dissappear because some iranian guy posted an issue. Note they didn't mention why they incorrectly flagged the repo or take any responisbility for doing so, or make any claim that it's not going to happen in the future. They just claim it's the government's fault. Bullshit.

rezonant 7y ago

You need to do a post-mortem on this. What exactly did Aurelia do to trigger this to start with? A contribution from a sanctioned country? A github issue posted by someone from a sanctioned country? How exactly are open source projects supposed to avoid this possibility if they don't happen to literally be Rob Eisenberg? How many other project repositories have been disabled because of this problem? Is Github doing a review of the processes? Highly doubtful Aurelia's the only one affected, but it might be the only one so far to be able to make it to HN front page.

djsumdog 7y ago
Yea, there's a real lack of information in Github's response. I hope we get something more complete. But really, if your project is mature enough and you have the bandwidth, just host it yourself. Gogs, Gitlab, cgit .. lots of FOSS implementations to choose from.
- 40four 7y ago
  I agree. This is the second story list this we have seen come across the front page of HN this week. I'm glad they sorted it out quickly, but it is almost certainly a result of Mr. Eisenberg's high profile. We saw another story like this come across the front page this week. The author is less well known (also happens to reside in Russia), and claimed that he had trouble even getting an e-mail response from the given support pathways for appeal. Sounds like it eventually got sorted out, but not without much waiting and effort from the maintainer. So when GitHub CEO Mr. Friedman jumps in and pats himself on the back for getting this account restored in less than an hour, I can only roll my eyes. To try to sell it like this is an 'average' response to these type of appeals is a little disingenuous. If I were starting a company today, I would absolutely self-host my repository to guarantee my business is never harmed by some automated flag that could total lock me out of my own work. We use GitLab Community Edition at my company. It is fantastic, and we are in full control.
  - marcinkuzminski 7y ago
    Here at RhodeCode we strongly believe in self-hosting, this is why we started as an on-premise product for source code management. You should check out RhodeCode too for self-hosting your own code, with extra security features to make sure it's well protected

bilekas 7y ago

Really good to see a proper response here. Thanks, and I'm sure this will be cleared up, but it is really strange how this flagging is taking place..

dwheeler 7y ago

Thanks so much for the swift fix, apology, and the current work to try to find out what happened & prevent the recurrence of the mistake. Mistakes are inevitable, especially at scale. I think taking those steps, when the inevitable mistake happens, is all we can ask of anyone. Good job!!

bogomipz 7y ago

Is there really no process in place to first notify an organization that you will need to close their account down? Or is there something in existing sanction law that prevents extending such a courtesy when account is flagged?

duckmysick 7y ago

> unfortunately, every company in the world is required to comply with US sanctions if they do any business at all in the United States, e.g. serving US-based customers. This includes even interacting with US banking infrastructure. So being headquartered somewhere else doesn't help; you have to comply. And US sanctions as written do not allow us to provide commercial services or services which could be used commercially to sanctioned countries. How come DHL is able to ship packages to sanctioned countries? I understand there are some limitations to what can be sent there from the US, but it seems like they are able to do so from other countries. Is the DHL US a separate entity or is there something else I'm missing?

dylz 7y ago
Wikipedia article says this: > DHL offers worldwide services, including deliveries to countries such as Iraq, Afghanistan and Myanmar (formerly Burma). As it is German-owned, DHL is not affected by U.S. embargoes or sanctions and will ship to Cuba and North Korea. However, there are strict codes for delivering to North Korea, as the country has shaky relations with the West. As DHL is no longer a United States company, it is not allowed to make domestic flights between U.S. airports. DHL contracts these services to other providers. > DHL ended domestic pickup and delivery service in the United States in 2009

Aeolun 7y ago

I don’t think any company headquartered outside the US has to comply with those laws. It’s only if they value doing business in the US enough to do so.

miduil 7y ago

GitHub, DROP ICE!

epse 7y ago
I'm sorry, I understand why you don't like the ICE, but why should they start "randomly" arbitration what can and can't appear on their platform? That's just a massive can of worms nobody wants to open
- M2Ys4U 7y ago
  I think denying access to organisations that are EXPRESSLY DESIGNED to violate human rights is a good enough reason.

nulbyte 7y ago

> And US sanctions as written do not allow us to provide commercial services or services which could be used commercially to sanctioned countries. This statement is so wide-sweeping as to be patently false. Some sanctions target specific activities. Others target specific entities that may or may not be entire countries. Many sanctions do not apply to information and communication services. To make such a wide statememt as you did suggests you're oversimplifying to placate the masses. Either way, not a good look.

animalnewbie 7y ago
Or maybe he's just paraphrasing in simple terms things his lawyers explained to him because he doesn't want to go write 20 pages of specifics?