4 ms·

This is dangerously inaccurate information. To those reading this, the US absolutely considers blocking Iranian IPs a required action under the sanctions. The p

This is dangerously inaccurate information. To those reading this, the US absolutely considers blocking Iranian IPs a required action under the sanctions. The person posting this could get you in serious legal trouble. With that said, most companies do not start blocking these IPs until they are either contacted by US authorities and asked to comply or via the recommendations of an audit by an outside private company. Please do not trust what this person is saying. Remember, violating sanctions can get you a prison sentence, not just a fine.

miracle2k 6y ago
Prominent examples disagree with you. Gmail for example. They even allow accounts! Now maybe Google wants to argue that Gmail qualifies for the personal communication tools exception. But wait, GitHub doesn't block Iranian IPs either! They allow free accounts as well! Call in the feds! Is there any government guidance or legal precedent that says IP blocking is required? There is not. Any evidence that the government warned companies privately? And is this the way things are done in the US? Private threats while the citizenry at large is left on the dark about what the law requires? A Gitlab executive facing prison time over failure to block Iranian IPs would be unjust even with clear guidance, on the import of the offense alone. But given the lack of legal clarity, this would be banana republic stuff. One of my main points here is, Americans should not accept such a state of affairs. It's bad enough that there is so much over compliance, it's disappointing to see people running to normalize the idea that fear of jail time in the face of legal uncertainty is a way to run a country.
- DetroitThrow 6y ago
  >Prominent examples disagree with you. Gmail for example. They even allow accounts! Now maybe Google wants to argue that Gmail qualifies for the personal communication tools exception. But wait, GitHub doesn't block Iranian IPs either! They allow free accounts as well! Call in the feds! Both Google and Github block accounts by Iranian IPs, and this is easily verifiable if you know anyone who lives in Iran and can access a website - attempting to use Github functionality for anything other than viewing repositories right now is currently blocked, and enterprise accounts are entirely blocked. Personal Gmail accounts are the exception to Google services available in Iran, and some functionality is also blocked by IP - if you live in Iran currently you might know that almost all other Google services and enterprise accounts are outright blocked by IP too: https://support.google.com/a/thread/4870330?hl=en https://support.google.com/a/thread/4870330?hl=en https://docs.github.com/en/free-pro-team@latest/github/site-policy/github-and-trade-controls https://docs.github.com/en/free-pro-team@latest/github/site-... Here is a non-comprehensive list of sites that block Iranian IPs, most outright disallowing access to websites: https://gist.github.com/alibo/dfd7c258bcc44a0e8c9f7c5bfd3bd2c3 https://gist.github.com/alibo/dfd7c258bcc44a0e8c9f7c5bfd3bd2... Please do not pay attention to this fellow, he is spreading legal misinformation that is dangerous.
  - miracle2k 6y ago
    Your own link from the Github docs has this to say: > GitHub is committed to continuing to offer free public repository services to developers with individual and organizational accounts in U.S.-sanctioned regions. This includes limited access to free services, such as public repositories for open source projects (and associated public Pages), public gists, and allotted free Action minutes, for personal communications only, and not for commercial purposes. They do not ban Iranian IPs from accessing their site on a network level, and they do allow Iranians to have accounts to work on open source projects. These are both things that Gitlab is accused of doing here. This leaves us with a couple of options: 1. Github is not in compliance. 2. Gitlab, not allowing any Iranian to access their accounts, and blocking IPs, is over-complying. 3. It is not clear what is required to be in compliance, and Americans think that having to fear prison time in the face of such uncertainty is normal.
  - Kranar 6y ago
    >Personal Gmail accounts are the exception to Google services available in Iran, and some functionality is also blocked by IP - if you live in Iran currently you might know that almost all other Google services and enterprise accounts are outright blocked by IP too: Google services in Iran are not blocked by Google or the U.S., they are blocked by Iran. It's the Iranian regime that seeks to block the use of things like Google's search engine, not the U.S.
    - miracle2k 6y ago
      Iran is blocking some things (though not search), but here we are talking about the opposite, and Google is indeed blocking a huge amount of their stuff, say, for example, the entirety of developer.google.com.
    - DetroitThrow 6y ago
      Google is also blocking many services endpoints by IP; try to switch to your enterprise Gmail account when using Gmail in any city in Iran. Iran is not blocking anything on GSuite here.
Kranar 6y ago
In the absence of an authority who can comment on this or an authoritative reference, I think your comment is just as dangerous and inaccurate as the parent comment. Unfortunately everyone is using very strong language to silence the other side and no one is offering up any kind of evidence to substantiate their position. Different groups of people get harmed when such strong assertions are made without any kind of evidence. >With that said, most companies do not start blocking these IPs until they are either contacted by US authorities and asked to comply or via the recommendations of an audit by an outside private company. Most companies don't block IPs from within Iran, including Github, Google, or Microsoft. Is it your suggestion that GitLab's legal team knows something that Microsoft's and Google's legal team doesn't? Now I am not an expert myself, so no one should consider my post authoritative, but the evidence that is available suggests that there is not only any requirement by U.S. companies to restrict access to people in Iran for a wide variety of software and Internet services, there actually appears to be a section regarding "Expanding Internet and Communications Freedoms" which in 2010 was used to promote the spread of mass communication technologies and internet services within Iran without the need for a company to apply for a waiver. Now once again, I am not claiming to be right on this issue, but at the very least I am willing to provide evidence for my claims that come from authoritative sources. Here is the interpretative guidance by the Treasury Department which authorizes the export to Iran of online services such as, and I quote "instant messaging, chat and email, social networking, sharing of photos and movies, web browsing, and blogging, provided that such services are publicly available at no cost to the user." And there are additional examples of software that may be exported to Iran for personal use, with specific examples provided including Dropbox. https://www.treasury.gov/press-center/press-releases/Pages/tg1456.aspx https://www.treasury.gov/press-center/press-releases/Pages/t... Here is an FAS report prepared for Congress that explains the kinds of software that is legally permissible to export to Iran (page 34): https://fas.org/sgp/crs/mideast/RS20871.pdf https://fas.org/sgp/crs/mideast/RS20871.pdf It appears that companies are permitted to export online services to individuals in Iran so long as, and I quote " is classified by the Department of Commerce as mass market software under export control classification number 5D992, and is publicly available at no cost to the user." Given that this is the only authoritative evidence anyone has bothered to present in this discussion, it appears a case can be made that GitLab is over-enforcing trade restrictions with Iran. Now the reason they may have for doing so is that it's not worth serving that part of the world and so be it... but the counter argument is that there are people living in Iran who can use these technologies especially during times of protest to share communications technologies with one another and so if it's not a major burden for Github, or Dropbox, or Slack to keep their services available, then they can be of great benefit to that part of the world. At the very least the Treasury Department's own interpretation of the law agrees with my position as it is documented in the link I provided.
Aeolun 6y ago
> Please do not trust what this person is saying. I don’t trust what you are saying either until you show me the sources of the claims. I think it’s fair to say that everyone in a position to comply with US sanctions will carefully check what they need to do to comply with them.
- DetroitThrow 6y ago
  Here's some additional background in an official document from Github describing the nature of what sanctions typically do, which also describes how and why some websites opt to create "downgraded" experiences rather than outright blocks in those countries: https://docs.github.com/en/free-pro-team@latest/github/site-policy/github-and-trade-controls https://docs.github.com/en/free-pro-team@latest/github/site-... https://github.blog/2019-09-12-global-software-collaboration-in-the-face-of-sanctions/ https://github.blog/2019-09-12-global-software-collaboration... Additionally, descriptions of what types of software might be sanctioned: https://fas.org/sgp/crs/mideast/RS20871.pdf https://fas.org/sgp/crs/mideast/RS20871.pdf As you might guess, enterprise accounts are the most targeted aspect of these sanctions.

miracle2k 6y ago

Prominent examples disagree with you. Gmail for example. They even allow accounts! Now maybe Google wants to argue that Gmail qualifies for the personal communication tools exception. But wait, GitHub doesn't block Iranian IPs either! They allow free accounts as well! Call in the feds! Is there any government guidance or legal precedent that says IP blocking is required? There is not. Any evidence that the government warned companies privately? And is this the way things are done in the US? Private threats while the citizenry at large is left on the dark about what the law requires? A Gitlab executive facing prison time over failure to block Iranian IPs would be unjust even with clear guidance, on the import of the offense alone. But given the lack of legal clarity, this would be banana republic stuff. One of my main points here is, Americans should not accept such a state of affairs. It's bad enough that there is so much over compliance, it's disappointing to see people running to normalize the idea that fear of jail time in the face of legal uncertainty is a way to run a country.

DetroitThrow 6y ago
>Prominent examples disagree with you. Gmail for example. They even allow accounts! Now maybe Google wants to argue that Gmail qualifies for the personal communication tools exception. But wait, GitHub doesn't block Iranian IPs either! They allow free accounts as well! Call in the feds! Both Google and Github block accounts by Iranian IPs, and this is easily verifiable if you know anyone who lives in Iran and can access a website - attempting to use Github functionality for anything other than viewing repositories right now is currently blocked, and enterprise accounts are entirely blocked. Personal Gmail accounts are the exception to Google services available in Iran, and some functionality is also blocked by IP - if you live in Iran currently you might know that almost all other Google services and enterprise accounts are outright blocked by IP too: https://support.google.com/a/thread/4870330?hl=en https://support.google.com/a/thread/4870330?hl=en https://docs.github.com/en/free-pro-team@latest/github/site-policy/github-and-trade-controls https://docs.github.com/en/free-pro-team@latest/github/site-... Here is a non-comprehensive list of sites that block Iranian IPs, most outright disallowing access to websites: https://gist.github.com/alibo/dfd7c258bcc44a0e8c9f7c5bfd3bd2c3 https://gist.github.com/alibo/dfd7c258bcc44a0e8c9f7c5bfd3bd2... Please do not pay attention to this fellow, he is spreading legal misinformation that is dangerous.
- miracle2k 6y ago
  Your own link from the Github docs has this to say: > GitHub is committed to continuing to offer free public repository services to developers with individual and organizational accounts in U.S.-sanctioned regions. This includes limited access to free services, such as public repositories for open source projects (and associated public Pages), public gists, and allotted free Action minutes, for personal communications only, and not for commercial purposes. They do not ban Iranian IPs from accessing their site on a network level, and they do allow Iranians to have accounts to work on open source projects. These are both things that Gitlab is accused of doing here. This leaves us with a couple of options: 1. Github is not in compliance. 2. Gitlab, not allowing any Iranian to access their accounts, and blocking IPs, is over-complying. 3. It is not clear what is required to be in compliance, and Americans think that having to fear prison time in the face of such uncertainty is normal.
- Kranar 6y ago
  >Personal Gmail accounts are the exception to Google services available in Iran, and some functionality is also blocked by IP - if you live in Iran currently you might know that almost all other Google services and enterprise accounts are outright blocked by IP too: Google services in Iran are not blocked by Google or the U.S., they are blocked by Iran. It's the Iranian regime that seeks to block the use of things like Google's search engine, not the U.S.
  - miracle2k 6y ago
    Iran is blocking some things (though not search), but here we are talking about the opposite, and Google is indeed blocking a huge amount of their stuff, say, for example, the entirety of developer.google.com.
  - DetroitThrow 6y ago
    Google is also blocking many services endpoints by IP; try to switch to your enterprise Gmail account when using Gmail in any city in Iran. Iran is not blocking anything on GSuite here.

Kranar 6y ago

In the absence of an authority who can comment on this or an authoritative reference, I think your comment is just as dangerous and inaccurate as the parent comment. Unfortunately everyone is using very strong language to silence the other side and no one is offering up any kind of evidence to substantiate their position. Different groups of people get harmed when such strong assertions are made without any kind of evidence. >With that said, most companies do not start blocking these IPs until they are either contacted by US authorities and asked to comply or via the recommendations of an audit by an outside private company. Most companies don't block IPs from within Iran, including Github, Google, or Microsoft. Is it your suggestion that GitLab's legal team knows something that Microsoft's and Google's legal team doesn't? Now I am not an expert myself, so no one should consider my post authoritative, but the evidence that is available suggests that there is not only any requirement by U.S. companies to restrict access to people in Iran for a wide variety of software and Internet services, there actually appears to be a section regarding "Expanding Internet and Communications Freedoms" which in 2010 was used to promote the spread of mass communication technologies and internet services within Iran without the need for a company to apply for a waiver. Now once again, I am not claiming to be right on this issue, but at the very least I am willing to provide evidence for my claims that come from authoritative sources. Here is the interpretative guidance by the Treasury Department which authorizes the export to Iran of online services such as, and I quote "instant messaging, chat and email, social networking, sharing of photos and movies, web browsing, and blogging, provided that such services are publicly available at no cost to the user." And there are additional examples of software that may be exported to Iran for personal use, with specific examples provided including Dropbox. https://www.treasury.gov/press-center/press-releases/Pages/tg1456.aspx https://www.treasury.gov/press-center/press-releases/Pages/t... Here is an FAS report prepared for Congress that explains the kinds of software that is legally permissible to export to Iran (page 34): https://fas.org/sgp/crs/mideast/RS20871.pdf https://fas.org/sgp/crs/mideast/RS20871.pdf It appears that companies are permitted to export online services to individuals in Iran so long as, and I quote " is classified by the Department of Commerce as mass market software under export control classification number 5D992, and is publicly available at no cost to the user." Given that this is the only authoritative evidence anyone has bothered to present in this discussion, it appears a case can be made that GitLab is over-enforcing trade restrictions with Iran. Now the reason they may have for doing so is that it's not worth serving that part of the world and so be it... but the counter argument is that there are people living in Iran who can use these technologies especially during times of protest to share communications technologies with one another and so if it's not a major burden for Github, or Dropbox, or Slack to keep their services available, then they can be of great benefit to that part of the world. At the very least the Treasury Department's own interpretation of the law agrees with my position as it is documented in the link I provided.

Aeolun 6y ago

> Please do not trust what this person is saying. I don’t trust what you are saying either until you show me the sources of the claims. I think it’s fair to say that everyone in a position to comply with US sanctions will carefully check what they need to do to comply with them.

DetroitThrow 6y ago
Here's some additional background in an official document from Github describing the nature of what sanctions typically do, which also describes how and why some websites opt to create "downgraded" experiences rather than outright blocks in those countries: https://docs.github.com/en/free-pro-team@latest/github/site-policy/github-and-trade-controls https://docs.github.com/en/free-pro-team@latest/github/site-... https://github.blog/2019-09-12-global-software-collaboration-in-the-face-of-sanctions/ https://github.blog/2019-09-12-global-software-collaboration... Additionally, descriptions of what types of software might be sanctioned: https://fas.org/sgp/crs/mideast/RS20871.pdf https://fas.org/sgp/crs/mideast/RS20871.pdf As you might guess, enterprise accounts are the most targeted aspect of these sanctions.