26 ms·

GitHub blocks entire company because one employee was in Iran

604 points by PhilipTrauner 6y ago

nanna 6y ago
To be fair Nat Friedman replied: > Hi Sebastian, sorry to hear about this. I will check into it right away and get your org unblocked. https://twitter.com/natfriedman/status/1346452935924846593?s=20 https://twitter.com/natfriedman/status/1346452935924846593?s... Pretty messed up that they built this kill switch in the first place though, if you ask me.
- Merman_Mike 6y ago
  This behavior shouldn't be praised. Having to go on twitter, get on the front page of HN, and make Github look bad seems like the only way to get help these days.
  - nanna 6y ago
    Yeah I mean, I completely agree.
  - draw_down 6y ago
    You guys can keep making this point, and I guess you probably will. But that ship has sailed folks. Doing it this way works, whether we like it or not.
EdwinLarkin 6y ago
Entrusting your business to an american entity is the stupidest idea you could have thought about. Especially us europeans should not rely on American services at all.It's not worth it. American corporations are just as much a liability as their counterparts in China.
- traveler01 6y ago
  I gotta agree with you. I understand GitHub doing that, they fear repercussions (remember that Huawei employee being arrested?). But, these things are too serious for a company to ignore. Chinese and USA services should be avoided...
  - drstewart 6y ago
    I assume this will be your last post on HN then...
- ChuckNorris89 6y ago
  >Especially us europeans should not rely on American services at all.It's not worth it. Sure, please let me know how the EU plans to build Office 365, AWS, GitHub competitors of similar scale, quality and success. We have no private investors that would pony up enough money to go against US tech titans and fat chance the EU would ever fund such initiatives and if they would, the money would evaporate over night to companies with political connections and overpriced consultants who would just produce documentation. Let's face it, the ship of EU dominance in tech has sailed a long time ago, we might as well get comfy with the US pulling the strings on that front. The only way the EU would ever stand a chance is if the EU would pull a Chinese style great firewall and outright ban foreign tech companies on their internal market, leaving space for local companies to spring up and fill the void but that will never happen.
  - icelancer 6y ago
    I generally agree with your post (we both made the mistake of posting during EU peak times and not US peak times, so downvotes incoming), but it's worth noting that Airbus is a success story bolstered by the now-EU to combat American aerospace dominance.
    - ChuckNorris89 6y ago
      I love Airbus, but they're not a software company and since we live in the age of cloud-everything, software has eaten the world and all our mobile tech is controlled by two US walled gardens (apple and google) that is a lot more potentially impactful on our daily lives on multiple levels of our society than what Airbus could do.
  - f6v 6y ago
    The Silicon Valley wasn’t built overnight. The software industry is just taking off in the EU. Mind you, nobody would have thought that the US would loose their leading role in the Middle East, look at them now. I can see the same happening in tech.
    - waihtis 6y ago
- BatteryMountain 6y ago
  I'm in Africa and most companies here host their systems either locally (very expensive and slow) or in America. The other day at work I had a pretty heated argument at work with a colleague when I mentioned it is really not good for us to host any of our stuff in America (all of it is currently in America). He basically freaked out about it. I just wanted to hear his thoughts about it, but he took personal offence (he's an aws fanboy). There are problems with the laws, copyright laws too, US gov agencies etc that are all incompatible with our own laws. If something bad were to happen, our own courts have zero power to help us. We also don't have a direct fiber line to America so all our traffic hops through Europe and more recently through South America, so about 200ms added to most requests. The only reasons to use American hosting companies is because of: 1) The financial cost can in some cases work out to be lower than local options. 2) It can be easier to scale your service vs self-hosting on premisses. 3) American hosting platforms have really nice GUI's and tooling, while being well integrated with the billing side - everything mostly just works as expected. But other than that, if money and skills are not a problem, then on-prem is best here.
  - jfrunyon 6y ago
    Money and skills are ALWAYS problems. Those are "cheap" and "fast" of the "cheap, fast, good, pick two".
    - cambalache 6y ago
      > Money and skills are ALWAYS problems. Those are "cheap" and "fast" of the "cheap, fast, good, pick two". Those are not problems, those are trade-offs. OP is right, you could be in a position in which those trade-offs dont apply to you (i.e. by buying a "expensive" but great solution, this happens all the time in all the industries) or you could sacrifice one item (say speed) in your solution if this is not a problem for your workflow ("so what if a open source tool runs 2x as slow as the best proprietary option, our daily batch processing take 2 hours and it is used in weekly buckets")
      - jfrunyon 6y ago
- jokethrowaway 6y ago
  This is ridiculous. China requires access to your company code and pretty much owns you. The USA government is interfering as much as Europeans government do, by making stupid laws and demanding access when they can think of an excuse. Sure, it's bad but it's not as bad as China. You can't trust any government, but some are better than others.
  - swayson 6y ago
    Indeed, gives me hope for decentralised technologies like gitcoin, that could perhaps give more agency to developers.
  - namelosw 6y ago
    You must be kidding. There’s no way companies like Apple would ever handout iCloud source code to China.
- icelancer 6y ago
  The top 33 "software and programming" companies by revenue in the world can be found below [0]. 28 of them are American. Two are in the EU. One is in the UK. One is in Australia. The last is Russian. One of the companies in the EU produces enterprise software almost no one on this website uses (SAP). The other is Dassault. In the US the top five companies are Microsoft, Oracle, ADP, Adobe, and Salesforce. If you include Alphabet and Amazon, well... When the EU or Asia (non-China, I guess) can offer mature alternatives even remotely competitive with the American companies, I guess your strategy could work. Until then, no one is going to flock to Hetzner over AWS. And I like Hetzner. [0]: https://en.wikipedia.org/wiki/List_of_the_largest_software_companies https://en.wikipedia.org/wiki/List_of_the_largest_software_c...
  - Erlich_Bachman 6y ago
    > One of the companies in the EU produces enterprise software almost no one on this website uses (SAP) What? SAP is a huge software that is used in a lot of companies.
    - icelancer 6y ago
      Correct. I'm also willing to bet the people on Hacker News are not typically in the circle of businesses that use SAP.
      - Closi 6y ago
        I'm willing to bet that they are. Do you think there is a huge tendency towards Oracle, Infor or MS Dynamics rather than SAP across hacker news, or are you just assuming that people who go on hacker news aren't in the 'circle of companies' which need an ERP? Most people on HN probably go work for companies that pay them the best compensation or offer them a good position, not based on what ERP they chose.
      - dtech 6y ago
        You underestimate the reach of SAP and overestimate the "SV-ness" of HN.
      - 6y ago
- MaxHoppersGhost 6y ago
  - Sent from my iPhone Ok buddy. Good luck with China and not using American software.
- bitzl 6y ago
  What do you suggest to use instead of GitHub?
pelasaco 6y ago
I had similar issue visiting Crimea. I was simply looking through my issues, while in holidays over there.
- mebr 6y ago
  What happened after? your account was unblocked later?
  - pelasaco 6y ago
    yes, it was unblocked later, after some email exchanges, but it took me some days and a lot of nerves.
- sparkling 6y ago
  How can one even reliably detect if one is loging in from crimea? There is no Ukranian/Russian ISP operating exclusively in crimea, is there?
optimalsolver 6y ago
Why do so many in the open source community use GitHub, a closed source platform?
- nuker 6y ago
  Do you have Gmail account? Nothing beats free service.
  - LockAndLol 6y ago
    Nothing? Really? Nothing? Nothing in the entire existence of the universe ever beats a free service? OK then...
    - dubcanada 6y ago
      It's a phrase, a commonly used one in English, obviously not nothing in the entire universe.
      - LockAndLol 6y ago
        It's unnecessary hyperbole and wrong too.
  - Tepix 6y ago
    No
- deleted 6y ago
  [deleted]
ykevinator 6y ago
They don't have a choice it's not githubs fault
traviscj 6y ago
I can’t imagine what a bad workday this is gonna be for the rest of the company.
jamesmishra 6y ago
I'm on GitHub/Microsoft's side here. They are not responsible for the content of US export control laws, and they have an incredible amount to lose if they are found to be in violation of US export control laws. Presumably GitHub needs some automated tool to prevent inbound traffic from sanctioned countries, and it's hard to be certain that they are complying with US law if such automated tools have some wiggle room allowing for a non-zero amount of usage from sanctioned countries. The whole situation isn't great, but none of it is GitHub/Microsoft's fault.
- zoobab 6y ago
  Github does not respect Schrems2 neither.
- u801e 6y ago
  > They are not responsible for the content of US export control law But they are responsible for understanding what's required under those laws. If they're going beyond what's required to comply with the law, then those further actions are entirely on them.
  - whimsicalism 6y ago
    Yes, so Github has to take on the assumption that they are visiting relatives, not resident in Iran. Or you get the alternate headline "Github facilitates Iran sanction evasion by allowing Iranian developers to mark themselves as 'visiting a relative'" and the associated charges.
    - u801e 6y ago
      There's nothing in the law that says that Github must block an entire company from accessing their company org because one member of that company logged into a separate account that happened to be a member of the company org. At most, the account that was accessed should be suspended.
- f6v 6y ago
  Companies routinely engage in activism. I’ve seen more than one software company cut off Trump campaign from their services, which was politically motivated. Now, US sanctions against Iran are clearly illegal. Yet, everyone is just fine with that, no activism whatsoever. I say people should revolt.
LatteLazy 6y ago
You can't blame GitHub for intentionally over broad, OTT US sanctions.
xvilka 6y ago
Such cases highlight the importance of improving IPFS and Federation protocols, for example for Gitea[1][2] or GitLab[3][4]. Or just sponsoring them[5]. The source code for ForgeFed[6][7] might be also of interest for improvement. [1] https://github.com/go-gitea/gitea/issues/1612 https://github.com/go-gitea/gitea/issues/1612 [2] https://github.com/go-gitea/gitea/issues/9045 https://github.com/go-gitea/gitea/issues/9045 [3] https://gitlab.com/gitlab-org/gitlab/-/issues/6468 https://gitlab.com/gitlab-org/gitlab/-/issues/6468 [4] https://gitlab.com/gitlab-org/gitlab/-/issues/33665 https://gitlab.com/gitlab-org/gitlab/-/issues/33665 [5] https://opencollective.com/gitea https://opencollective.com/gitea [6] https://forgefed.peers.community/ https://forgefed.peers.community/ [7] https://notabug.org/peers/forgefed https://notabug.org/peers/forgefed
- gbrindisi 6y ago
  that was an interesting rabbit hole you sent me into, thanks for sharing!
- dweberz 6y ago
  also radicle.xyz
f6v 6y ago
Well, that’s what you get for doing business with an American company. The USA impose illegal sanctions and strongarm their allies in supporting the sanctions. Let this be a lesson for others.
JoshTko 6y ago
Seems like this policy would actually make sense for Russia.
londons_explore 6y ago
Can't really blame GitHub here... US laws are badly written.
- grumple 6y ago
  If Github is going to block people for accessing from Iran, why don't they just block all Iranian ips? I'd totally blame Github for this.
- asplake 6y ago
  They could have prevented the access they merely detected. Much less harm all round
- enriquto 6y ago
  It's alright to blame people for lawfully following harmful laws.
  - jokethrowaway 6y ago
    It's not. You have a literal state actor backed with an army demanding money if you don't comply. I'll pick the legal way unless the profits I can make somehow outweigh the sanctions (legislators can make mistakes too) and there are no penal repercussions.
    - grumple 6y ago
      It is. We established this quite clearly in Nuremberg.
      - jokethrowaway 6y ago
        You're comparing state sanctioned killing and torturing with sanctioning people trading with each other. The first one is a violent crime against individuals, the second one is basically a tax. I'm against both but they carry a different weight.
300 6y ago
They could have blocked the user in Iran. It's without sense to block the organization's account.
- freeone3000 6y ago
  OFAC sanctions are transitive.
1337shadow 6y ago
Just wondering, does it also happen when connecting with Tor ? Would like to warn my friends and eventually tell them the workaround ...
- capableweb 6y ago
  My guess would be that either GitHub outright blocks connections if they think it's via Tor. Second guess is that if your Tor exit node happens to be in Iran (or any other embargoed country), you'll get blocked as well, as they most likely looks at the source IP to get the location.
- znpy 6y ago
  Just tell your friends to use gitlabon prem or another eu-hosted got service.
0xmohit 6y ago
GitHub might start blocking countries doing any trade with Iran in order to comply with "laws".
- JJJollyjim 6y ago
  unfortunately this is a real thing the US imposes on the world (it's called Secondary Sanctions)
zed88 6y ago
What's the difference between a Chinese company and a US company? None. Both work for the state, although US ones operate under the guise of democracy. This sort of union between tech and politics is not going to take us anywhere.
- Daho0n 6y ago
  No there are big differences. For example in China FAANG could easily be stopped from doing things they shouldn't while in the US it takes years and years of lobbying, talking to the media, making backroom deals, sitting on ones arse, changing the laws so it isn't unlawful anymore, etc.
- numlock86 6y ago
  Nice phrasing. A bit edgy and exaggerated, though. But since they are the same, I bet you can show us where the USA holds a few (at least 5 digit range) people in abduction camps, just to name one difference. Now that would be interesting.
  - zed88 6y ago
    Well...human memory is certainly weak or biased or both. Let's not forget Guantánamo bay, which is just one among many examples.
  - asddubs 6y ago
    the US prefers using drone strikes to inflict suffering, I believe
    - zed88 6y ago
      Yeah you forgot to add 'extra-judicial' to the drone strikes, breaching every international law.
  - 10000truths 6y ago
    Surely you’ve heard of ICE and the sorry state of their “detention facilities” by now?
benjaminwootton 6y ago
Github refused to help me regain access to an 11 year old account when I changed jobs so lost access to 2FA and email account at the same time. We lost access to tens of thousands of dollars worth of project code which we had to rewrite. The customer service support was Google style brick wall. I wish this guy luck in getting access.
- a254613e 6y ago
  To me that sounds perfectly reasonable, and in fact a good policy. It seems like you lost access to your company account, based on your comment, so who is "we" that lost thousands of dollars worth of project code? If it was your employer that you had the email with, why couldn't you just restore the email? What in your opinion should github do when an employee loses access to their company email, and 2FA, because they're fired? Should the employee gain access to all the code and the account by just contacting github via their personal email?
- otagekki 6y ago
  Rewrite? Wow. Hopefully for them it is just code so all they'd have to do is push their branches to a new self-hosted server.
  - wccrawford 6y ago
    Right? Why wasn't there a backup somewhere other than Github? Even just a repo that was checked out somewhere.
    - richardwhiuk 6y ago
      Feels like this code was owned by the company was the author no longer worked for....
  - elwell 6y ago
    Code is (almost) always better when it's re-written. So, maybe it was a blessing in disguise...
- 6y ago
jeroenhd 6y ago
If the Iranian employee logged into the Github account, isn't blocking the account exactly what the law says they should do? If all they did was apply a merge request in one of the repos then would reverting the merge and blocking the account would be enough to comply? Is there some alternative way to comply with US export restrictions? The real question here is why people even consider using US cloud companies when they know they have employees working in countries subject to severe US trade restrictions. If you're willing to risk your company being denied business with American companies, then you should also have a mitigation strategy when you get caught. It sucks that you have to work around US regulation to do normal business but this is just how the world works right now.
- canofbars 6y ago
  Would it not be sufficient to just block requests from Iran rather than shut down the account and the groups they are in? That way when they return home they can still access the site.
  - ceejayoz 6y ago
    Given the legal penalties for violating sanctions and the vigor with which they are pursued, probably not. Should it be this way? No. Is it entirely Github’s fault they overreact to any sign they’re serving Iranian users? Also no.
  - austincheney 6y ago
    I believe that would be illegal. I suspect the reasoning is that the US is not on friendly terms with the government of Iran, which is a political squabble and not a conflict with the people therein, even though the practical consequences are indecipherable. The US military has been wrestling with that reasoning for about 20 years. If the majority of attacks and intrusions on military infrastructure originate from a single nation state and there exists evidence that most such attacks are sponsored by that nation state it would make sense to simply block all IP addresses originating from that nation state. This does not occur because the attorneys will not allow it due to both diplomatic and legal reasons.
  - 6y ago
papier2020 6y ago
Since MS owns github does the same rule ban happen if a company uses office365-onöline/azure - and one employee opens email from Iran?
- znpy 6y ago
  Probably yes
- reallydontask 6y ago
  Tangentially related but one of my guys when to Cuba when we were using G-suite and he couldn't access gmail, it seemed to be ip-blocked. Maybe Cuba has a very well known set of IP addresses and it's easy to block?
  - paranoidrobot 6y ago
    A company I used to work for got acquired by a US-owned organisation. We were required to block traffic from sanctioned countries, and were allowed to use a Geolocation IP Database to do so. Lots of lawyers reviewed it, as well as external consultants.
factorialboy 6y ago
So many dimensions come to play here. 1. There's the obvious legal aspect i.e. how these laws are framed and interpreted. 2. Then there's the geopolitical aspect. Is it fair to impose sanctions on Iran. 3. There's another aspect around GitHub policy that asks if an entire organization be banned for the location of one team member. 4. Finally, there's the aspect of relinquishing control. Your app development is on the cloud. IDEs are on the cloud. Deployments are on the cloud. App stores are on the cloud. You have relinquished so much control, why be surprised if that stares you back in the face? Ironically, Git is a decentralized version control system.
- cies 6y ago
  > Ironically, Git is a decentralized version control system. And Git is open source. Github is a US-registered company under MS. The US has a history of weaponizing its economic power. Stallman (RMS) was right once again.
  - throwaway4good 6y ago
    But Github is reason why git is popular ...
    - jhasse 6y ago
      I doubt it.
      - richardwhiuk 6y ago
        There's definitely an argument that GitHub is one of the primary reasons that Git beat Mercurial.
        ajsnigrutin 6y ago
        Yep! "One click" fork + "one click" pull request are its killer features.
        6y ago
Proven 6y ago
Why wouldn't they block the entire company? Can the company guarantee the employee isn't directly or indirectly using Github?
rathel 6y ago
At work I had to take a course on US export control. The restrictions they bully everyone into are pretty nazi. Likewise with SWIFT. As evidenced by TFA it's always regular citizens that suffer. Compare this with EU sanctions that are targeted to particular companies and individuals.
- 2Gkashmiri 6y ago
  Yeah. A few days ago I asked why was us demanding kyc/aml regulations from countries when in us itself its easy to set up an anonymous corporation because laws. Its supposed to protect people from doing transactions and getting your "privacy violated".
numlock86 6y ago
While GitHub is not really to blame (following the laws and all, no matter how silly they are) why would your employees login from Iran with their work laptops into their work accounts while "visiting their parents" anyway? Why is that not the actual problem? Lack of policies?
- cookieswumchorr 6y ago
  depending on what the company does, different levels of security are appropriate. but, yeah, I would avoid taking valuable data with me on a flight to shady countries (the US being among the top 10 of that list)
- rightbyte 6y ago
  You can't have policies for everything. Their main problem is using SaaS for something as basic and important as version control. Than you have to deal with silly US laws.
dustinmoris 6y ago
Why don't we have internet havens yet? Companies are so clever in legally avoiding tax by registering companies in the most favourable jurisdictions and only running the absolute minimum of operations through tax expensive countries and so on, why don't we have the equivalent for avoiding dumb laws such as US trade wars, DMCA takedowns, etc.? Can most internet operations not run through companies who are registered and have servers in a country where most of those laws don't apply to customers who are not US citizen?
- est31 6y ago
  The reward for dodging taxes is pretty high. What's the reward of letting a few folks open their laptop while at their parents? If you are ideologically motivated, you might do it. Apparently project Gutenberg has set up servers in locations with shorter copyright durations so that they can mirror public domain books. https://news.ycombinator.com/item?id=25610024 https://news.ycombinator.com/item?id=25610024
- arghwhat 6y ago
  > Why don't we have internet havens yet? Companies pull tricks to optimize profits. Evading tax increases profit, but so does controlling the internet and sending blanket DMCA takedown requests instead of spending money on case-by-case review. Heck, if the big companies wanted to avoid these things, they'd probably wouldn't be lobbying for these things.
dustinmoris 6y ago
Is GitHub going to take itself down when one of their employees goes to Iran for holiday and logs into their GitHub account? If not, then why are they treating others with such contempt?
- deleted 6y ago
  [deleted]
- ceejayoz 6y ago
  GitHub is in possession of substantial additional information in that scenario, namely, "we're quite certain we don't have Iranian employees on staff".
  - viseztrance 6y ago
    Do they keep an up to date database on who's dating whom?
    - IThinkImOKAY 6y ago
      yes
    - offtop5 6y ago
      Funny Story. When I went to London for the first time I meet a ridiculously attractive Swedish Arab girl. She had mentioned she really wanted to visit America, but with the recent election of Donald Trump she was a bit scared. Not all of us like Eastern European women, Trump blocked my game right there. The point of this story is anyone can meet anyone from anywhere and the nasty racist system the US has for blocking certain people because they have the wrong last names or whatever doesn't do anyone any service. I also don't think embargo serve anything aside from radicalizing other people's. Take Vietnam, now you have Coca-Cola, and McDonald's succeeding to do what 20 to 30 years of Western imposition couldn't, they've made Vietnam capitalist. That was accomplished once the embargoes were removed in the nineties. Even with Cuba ,I'd imagine if the embargo didn't exist you'd see much more reform as individuals would eventually be able to succeed on their own merits.
kkapelon 6y ago
This means that as a disgruntled employee I can simply visit Iran, log in my company Github account and boom! I have now taken revenge on my whole company with minimal effort.
- wccrawford 6y ago
  Only if you're okay with the legal consequences of sabotaging the company. They absolutely can sue you for it, and you might even face criminal prosecution for such a thing.
  - kkapelon 6y ago
    There is also another scenario. I steal with social engineering (or phishing or other method) the GitHub credentials of an employee from a company I wish to harm. And then I simply log in GitHub(or use a VPN to appear in Iran) with those stolen credentials. Sounds like a very easy DOS method.
  - afroboy 6y ago
    On what basis they are going to sue him? he visited a specific country and than boom. how in the hell are going to prove that he did it in purpose.?
    - kkapelon 6y ago
      Exactly. Somebody who wanted to do this could simply book a flight where Iran in an intermediate destination. And then they would say "I had 30 minutes of waiting time in transit and I just wanted to add a comment on my Pull Request".
    - richardwhiuk 6y ago
      On the basis of this comment thread :)
- Illniyar 6y ago
  Or just use a vpn that has servers in Iran? I think there are a few, hidemyass is one also I think, services designed to test access from different countries.
sebastiancoe 6y ago
Nat Friedman, the CEO of Github has always been followed around by rumors of racism against dark skinned people. I remember someone saying he was saying racist stuff about Indians being rapist while literally visiting India. His whole eagerness to replace the terms master/slave has always stunk of someone trying to mask something.
jonny383 6y ago
Please please PLEASE add at least one other provider to your remotes if you're going all in on cloud. Consider also doing a regular local backup of all your repos. A quick Google search will yield you tools that will automate this entire process on platforms such as GitHub , BitBucket and GitLab. I personally delegated this to a Cron job. I check the backups manually once a month to check all is in order.
- grumple 6y ago
  This is good advise. Maybe even self-host a backup server.
- kkapelon 6y ago
  While this is good advice of course, it is not clear to me if the problem is just the source code. The twitter message says "We are completely blocked from deploying!." Maybe they already have the source code elsewhere but use GitHub actions?
  - RyJones 6y ago
    Heroku, maybe?
wolfretcrap 6y ago
How long before someone gets an Iran VPN so that their company is knocked out and they get a day off.
- willis936 6y ago
  My first thought was that this could have been avoided if a VPN was used. Why bother with such a weakly enforceable policy?
  - dspillett 6y ago
    > Why bother with such a weakly enforceable policy? To show they've done what they can to enforce the embargo, in the hope that the policy is enough to satisfy the authorities wrt doing enough. They can't tell is a user is circumventing the policy via a VPN, but such a user is actively circumventing the enforcement of the policy so can't try pass the buck with a "well they let us, so we just assumed it was OK" based excuse.
sebslomski 6y ago
Shit happens, but I would really appreciate if you would re-activate our Github Org now, @github. You know, some PRs are waiting there for me.
- mro_name 6y ago
  can't you just push elsewhere, be it a self-hosted location or the one of a reliable 3rd party and tell Microsoft to go f§ck themselves? I mean, what do you need github for to integrate and deploy?
trapexit 6y ago
Geolocation databases are frequently inaccurate, even at the country level of granularity! I use a ISP in the Netherlands that was founded only recently, I and frequently encounter sites that think I'm in Dubai, which is apparently where the previous owner of my IP block was located. Fortunately, the only problems this seems to cause for the moment are that I occasionally get geo-blocked by some sites' overly-aggressive firewall rules, and I get Twitter ads in Arabic. But I shudder to think what might happen should the UAE find itself under sanction.
williesleg 6y ago
"facebook blocks entire company because one employee is liberal" "twitter blocks entire company because one employee is conservative" Who cares?
amir734jj 6y ago
I'm an iranian-american and this saddens me deeply. When you travel to Iran you need to make sure you don't get arrested by iranian regime because they have a history of taking dual nationals as hostage. Then you open your laptop and suddenly you have taken down your company and potentially lost your job.
- Triv888 6y ago
  > When you travel to Iran you need to make sure you don't get arrested by iranian regime because they have a history of taking dual nationals as hostage. Isn't it trivial for them to catch you at the border if they wanted to do it?
  - amir734jj 6y ago
    They usually arrest people at the airport when they are leaving. It's called "hostage diplomacy"[0]. There is a whole Wikipedia page dedicated to it. [0] https://en.wikipedia.org/wiki/Hostage_diplomacy#Iran https://en.wikipedia.org/wiki/Hostage_diplomacy#Iran
nbzso 6y ago
Let me see. You have a business in which you cannot control access to your Intellectual Property? And you take money from people for services? What can go wrong here? I really don't get this. Git is free. Setting up dedicated server with redundancy backup is de facto the standard since SVN era. In this case I don't blame GitHub at all. It is responsibility of the business owner to make a judgement with all "bad case scenarios" in mind. In production the idea of trusting third party infrastructure without alternative is unprofessional.
davidg109 6y ago
How do you manage this kind of risk? Are there other options other than don’t use GitHub to begin with?
darkwater 6y ago
I really wonder why economical penalties enforced to a country through its citizens or people born there or with ancestors like the USA does with all of its embargos aren't considered just as terrorism. You are punishing other people for something they didn't do just to pressure on their governments. Just like terrorists injuring people. (Yeah I know terrorists usually kill people but I'm pretty sure many people died due to economic embargo as well)
- Chris2048 6y ago
  > You are punishing other people.. Just like terrorists injuring people. Because terrorism implies violence. What kind of deaths result from economic embargo?
  - srtjstjsj 6y ago
    Starvation and disease.
    - Chris2048 6y ago
      So Iran cannot support it's own population wrt food without imports?
- Santosh83 6y ago
  At this level "might makes right" is the only reality. Don't let anyone tell you otherwise. Oh yeah they went through UN for the sanctions... right... as if the UN isn't little better than a rubber stamp agency in these areas. On the flip side the US can do little if someone like China or Russia decide to trade with and help out Iran. The problem is the software sector is heavily dominated by the US, so they can disproportionately affect Iran.
aaomidi 6y ago
Reminder that Microsoft has the power to ask the state department for an exemption from these sanctions for github. They have refused to do that. Google did that with Gmail and made the argument that Gmail is an important utility for freedom of the people there. Microsoft can do the same.
- aaomidi 6y ago
  I'm glad that Microsoft finally reversed their stance on this.
dweberz 6y ago
Support peer-to-peer alternatives. The technology to realize a peer-to-peer alternative to GH is here. We just need to make it happen. IMO radicle.xyz is the most promising one right now.
eplanit 6y ago
Don't let your business depend on cloud services. If they're really important, then self-host your servers. There are so many stories of the cloud being a single point of failure (ironically) due to arbitrary and capricious rules, and/or bad support.
kkoncevicius 6y ago
A bit off topic, but seems like at some point these sanctions start helping instead of harming. If you are "sanctioned" by GitHub, Facebook, Twitter, Reddit, Instagram, PornHub, what have you, then in the end you will probably gain productivity, not loose it.
stunt 6y ago
What a disproportionate reaction from Github. They could simply block network access from Iran to make it easier. Otherwise, blocking without giving warning is wrong. Even banks give warning and deadline to their clients before closing accounts that are linked to sanctions. Why Github blocked the entire organization without proper communication and deadline to fix or clarify the issue?
sebyx07 6y ago
use vpn bois, it's 2020 not 1999
eesmith 6y ago
Whoo-hoo! Set up a free wi-fi node outside of a tech conference (perhaps with cheap pastries for conference goers), routed through a proxy in Iran. Don't need to decode https or anything - assuming you can proxy https through Iran. Then watch as bunches of companies are blocked from GitHub. If the Iranian government wanted to have fun with US laws, they could totally set this up. And it wouldn't even be illegal.
jjd33 6y ago
>Iran wants to buy COVID vaccine with their own money that is in South Korea >South Korea refuses money access due to US sanctions Yes it is not directly related to this post. But this witch hunt against Iran is beyond retarded. I get why Saudi Arabia and Israel would join ties against Iran it makes sense. But for US, Japan and South Korea to join just due to personal and financial motives is a literal disgrace to humanity.
beshrkayali 6y ago
So are we not going to talk about how economic sanctions end up as a way to use the people of these countries as a way to pressure their governments for political gains? How these sanctions directly and indirectly cause an increased poverty gap and negatively impact the living standards? How the governments of these sanctioned countries magnify this economic pressure to prevent people from revolting and to entrench their presence even more?
- mc32 6y ago
  You can make the same arguments against capricious Google and YouTube delisting, Facebook or Instagram bans, Twitter bans, App Store takedowns etc.
  - beshrkayali 6y ago
    True, and I'd agree. But these companies are private entities. I can disagree with them but I can't force them to do anything, aside from not using them. Economic sanctions are introduced by governments, supposedly from and for the people.
    - whimsicalism 6y ago
      > companies are private entities. Private entities chartered and regulated by the government, of course.
      - beshrkayali 6y ago
        Businesses have the right to refuse service.
        mc32 6y ago
        By that logic, so do governments have the right to exercise their prerogatives...
        6y ago
jitbit 6y ago
GitHub: "Lets rename master to main because Inclusion & Equality" Also GitHub: "sorry you're from a wrong country"
- jpxw 6y ago
  Github’s help text when opening a new repo irks me. It contains the following: git branch -m master main With absolutely no explanation of what they are doing, or why. I can imagine this being confusing to beginners, and it requires mental effort for me to ignore it each time.
  - skrebbel 6y ago
    This cost me 20 minutes + lots of confusion when teaching a Git course to newbies some weeks ago. I switched to GitLab for the next group.
  - apta_ 6y ago
    They seriously think "master" is a bad word? That's crazy.
    - jey 6y ago
      To be fair, our industry brought this on itself -- we did use "master" and "slave" together as technical terms in various contexts. Now even the innocent uses of "master" that don't involve any reference to slavery are tainted too, at least from the perspective of a non-technical outsider. I'm sure their eyes will glaze over well before one can finish explaining what a version control system is, why you would want one, why it has branches and what they are used for, and that all this involves no references to slavery.
  - weka 6y ago
    Well, just think of how many tutorials (aka 99.9%) iterate git master branch. When new people start, they are going to wonder what master vs main branch is -- I guarantee it.
- Voloskaya 6y ago
deleted 6y ago
[deleted]
NovemberWhiskey 6y ago
It looks like the company has now gotten access to their GitHub account again, according to the original poster on the Twitter thread. I don't know, it just looks like some kind of surveillance automation kicked in, froze the account, and customer service was slow.
tehwebguy 6y ago
Microsoft should boycott the sanctions, they are cruel and the only reason they exist is that our current president hates our previous president. They are way too big to actually be penalized in a meaningful way and doing the right thing once in a while feels great.
mzs 6y ago
resolved: https://twitter.com/sebslomski/status/1346467442428530691 https://twitter.com/sebslomski/status/1346467442428530691
exabrial 6y ago
I have _a lot_ of questions... * Is this a US Company? * What was the employee doing in Iran? * Is the employee an Iranian national? * Was the company aware of this? Headlines like this make me really scratch my head.
ballenf 6y ago
So GH has effectively given admin-level repo DELETE permissions to everyone in the organization. Not sure they really thought this one through. Here comes a new employee onboarding document to sign: no Iranian VPN nor travel to Iran.
arthurmorgan 6y ago
Was the employee logged in with the organization account? When I visited Iran my personal and work account got locked but the org account was untouched.
umarniz 6y ago
The US sanctions on Iran has such a massive impact on Iranians that most of us don't realise. All US companies have to comply and majority of the tech companies are unfortunately in the US. I know you can use a VPN and configure it on a router level to make sure that you are always connected via a VPN but just the fact that 1 slip-up can result in account level blocks (which google is notoriously good at and can essentially shut down your business) means no company would want to work with someone working from Iran. Coming from a 3rd world country, I know the problems of internet censorship which Iranians also face but being too toxic to touch for everyone outside Iran because the US leadership thinks so is just infuriating and heart breaking. Imagine being a programmer in Iran. Not only do you have less resources to learn and grow, you have a massive handicap to find good work as most work is outside of the country. Only bet is to leave the country but even there you have a very low probability as you basically can't have a trial period for your job as most companies don't want to risk having their accounts blocked. Most of us here know how degrading and infuriating the tech recruiting processes can be and now add to it the horrors of working from Iran. Wars are not supposed to have civilian casualties but this one has a generation of civilians being starved of information and experience critical for them to grow.
- factorialboy 6y ago
  (Controversial comment) I am not condoning the actions of the United States government, but arguably the Iranian Islamic theocratic regime has unleashed more horrors on the Iranian people in the last 50 years than any other foreign government.
  - edumucelli 6y ago
    Imagine the horror US has unleashed "invading" almost every country in the world (except 3) with formal or hidden missions.
    - bogomipz 6y ago
      You realize that there are between 194 and 197 countries in the world depending on who is doing the recognizing[1]. Could you please provide a citation for the 191+ countries you say the US has invaded? [1] https://www.worldatlas.com/articles/how-many-countries-are-in-the-world.html https://www.worldatlas.com/articles/how-many-countries-are-i...
mcguire 6y ago
Outsourcing anything has its own set of risks. Understand them before you commit to living with them.
prepperdev 6y ago
From the company perspective, it's an arbitrary disruption. It could happen to any company. While it's certainly very convenient and economically reasonable to use cloud services for development and production, every company should have a plan B. In this case, it's an absolute must to have daily backups of all repositories / all branches which are stored on premise. If your company is not doing that, you play the lottery of losing access to your own source code.
michaeltimo 6y ago
What I don't understand is why not blocking access to those regions which are affected by US sactions (in this case Iran). The current situation in which you can access the website, but if you do, your account will be banned immediately is more like a detective scenario than respecting the laws. You can simply block all Iranian IPs.
robinhood 6y ago
Just happened: https://github.blog/2021-01-05-advancing-developer-freedom-github-is-fully-available-in-iran/ https://github.blog/2021-01-05-advancing-developer-freedom-g...
- tirthapatel 6y ago
  That's huge! > we are working with the US government to secure similar licenses for developers in Crimea and Syria as well That's also super cool to hear! Related Thread: https://news.ycombinator.com/item?id=25648585 https://news.ycombinator.com/item?id=25648585
  - floatingatoll 6y ago
    "We were working for two years to get this license." https://news.ycombinator.com/item?id=25648849 https://news.ycombinator.com/item?id=25648849
siculars 6y ago
Github obviously did not do enough due diligence here. IANAL but am familiar with Sanctions considerations and IMHO, this does not rise to the level of the action taken.
Dotnaught 6y ago
GitHub has just announced a license for developers in Iran: https://github.blog/2021-01-05-advancing-developer-freedom-github-is-fully-available-in-iran/ https://github.blog/2021-01-05-advancing-developer-freedom-g...
talal7860 6y ago
Well, GitHub is now fully available in Iran: https://github.blog/2021-01-05-advancing-developer-freedom-github-is-fully-available-in-iran/ https://github.blog/2021-01-05-advancing-developer-freedom-g...
deleted 6y ago
[deleted]
pelasaco 6y ago
It looks like they are reading hacker news :) https://github.blog/2021-01-05-advancing-developer-freedom-github-is-fully-available-in-iran/ https://github.blog/2021-01-05-advancing-developer-freedom-g...
bigphishy 6y ago
What happened to the 'master main' comment thread? It was just silently deleted from this thread. Massive censorship going on, I am moving to a new website. Good riddance hackernews, take your censorship and stick it!

604 points by PhilipTrauner 6y ago

To be fair Nat Friedman replied: > Hi Sebastian, sorry to hear about this. I will check into it right away and get your org unblocked. https://twitter.com/natfriedman/status/1346452935924846593?s=20 https://twitter.com/natfriedman/status/1346452935924846593?s... Pretty messed up that they built this kill switch in the first place though, if you ask me.

Merman_Mike 6y ago
This behavior shouldn't be praised. Having to go on twitter, get on the front page of HN, and make Github look bad seems like the only way to get help these days.
- nanna 6y ago
  Yeah I mean, I completely agree.
- draw_down 6y ago
  You guys can keep making this point, and I guess you probably will. But that ship has sailed folks. Doing it this way works, whether we like it or not.

EdwinLarkin 6y ago

Entrusting your business to an american entity is the stupidest idea you could have thought about. Especially us europeans should not rely on American services at all.It's not worth it. American corporations are just as much a liability as their counterparts in China.

traveler01 6y ago
I gotta agree with you. I understand GitHub doing that, they fear repercussions (remember that Huawei employee being arrested?). But, these things are too serious for a company to ignore. Chinese and USA services should be avoided...
- drstewart 6y ago
  I assume this will be your last post on HN then...
ChuckNorris89 6y ago
>Especially us europeans should not rely on American services at all.It's not worth it. Sure, please let me know how the EU plans to build Office 365, AWS, GitHub competitors of similar scale, quality and success. We have no private investors that would pony up enough money to go against US tech titans and fat chance the EU would ever fund such initiatives and if they would, the money would evaporate over night to companies with political connections and overpriced consultants who would just produce documentation. Let's face it, the ship of EU dominance in tech has sailed a long time ago, we might as well get comfy with the US pulling the strings on that front. The only way the EU would ever stand a chance is if the EU would pull a Chinese style great firewall and outright ban foreign tech companies on their internal market, leaving space for local companies to spring up and fill the void but that will never happen.
- icelancer 6y ago
  I generally agree with your post (we both made the mistake of posting during EU peak times and not US peak times, so downvotes incoming), but it's worth noting that Airbus is a success story bolstered by the now-EU to combat American aerospace dominance.
  - ChuckNorris89 6y ago
    I love Airbus, but they're not a software company and since we live in the age of cloud-everything, software has eaten the world and all our mobile tech is controlled by two US walled gardens (apple and google) that is a lot more potentially impactful on our daily lives on multiple levels of our society than what Airbus could do.
- f6v 6y ago
  The Silicon Valley wasn’t built overnight. The software industry is just taking off in the EU. Mind you, nobody would have thought that the US would loose their leading role in the Middle East, look at them now. I can see the same happening in tech.
  - waihtis 6y ago
BatteryMountain 6y ago
I'm in Africa and most companies here host their systems either locally (very expensive and slow) or in America. The other day at work I had a pretty heated argument at work with a colleague when I mentioned it is really not good for us to host any of our stuff in America (all of it is currently in America). He basically freaked out about it. I just wanted to hear his thoughts about it, but he took personal offence (he's an aws fanboy). There are problems with the laws, copyright laws too, US gov agencies etc that are all incompatible with our own laws. If something bad were to happen, our own courts have zero power to help us. We also don't have a direct fiber line to America so all our traffic hops through Europe and more recently through South America, so about 200ms added to most requests. The only reasons to use American hosting companies is because of: 1) The financial cost can in some cases work out to be lower than local options. 2) It can be easier to scale your service vs self-hosting on premisses. 3) American hosting platforms have really nice GUI's and tooling, while being well integrated with the billing side - everything mostly just works as expected. But other than that, if money and skills are not a problem, then on-prem is best here.
- jfrunyon 6y ago
  Money and skills are ALWAYS problems. Those are "cheap" and "fast" of the "cheap, fast, good, pick two".
  - cambalache 6y ago
    > Money and skills are ALWAYS problems. Those are "cheap" and "fast" of the "cheap, fast, good, pick two". Those are not problems, those are trade-offs. OP is right, you could be in a position in which those trade-offs dont apply to you (i.e. by buying a "expensive" but great solution, this happens all the time in all the industries) or you could sacrifice one item (say speed) in your solution if this is not a problem for your workflow ("so what if a open source tool runs 2x as slow as the best proprietary option, our daily batch processing take 2 hours and it is used in weekly buckets")
    - jfrunyon 6y ago
jokethrowaway 6y ago
This is ridiculous. China requires access to your company code and pretty much owns you. The USA government is interfering as much as Europeans government do, by making stupid laws and demanding access when they can think of an excuse. Sure, it's bad but it's not as bad as China. You can't trust any government, but some are better than others.
- swayson 6y ago
  Indeed, gives me hope for decentralised technologies like gitcoin, that could perhaps give more agency to developers.
- namelosw 6y ago
  You must be kidding. There’s no way companies like Apple would ever handout iCloud source code to China.
icelancer 6y ago
The top 33 "software and programming" companies by revenue in the world can be found below [0]. 28 of them are American. Two are in the EU. One is in the UK. One is in Australia. The last is Russian. One of the companies in the EU produces enterprise software almost no one on this website uses (SAP). The other is Dassault. In the US the top five companies are Microsoft, Oracle, ADP, Adobe, and Salesforce. If you include Alphabet and Amazon, well... When the EU or Asia (non-China, I guess) can offer mature alternatives even remotely competitive with the American companies, I guess your strategy could work. Until then, no one is going to flock to Hetzner over AWS. And I like Hetzner. [0]: https://en.wikipedia.org/wiki/List_of_the_largest_software_companies https://en.wikipedia.org/wiki/List_of_the_largest_software_c...
- Erlich_Bachman 6y ago
  > One of the companies in the EU produces enterprise software almost no one on this website uses (SAP) What? SAP is a huge software that is used in a lot of companies.
  - icelancer 6y ago
    Correct. I'm also willing to bet the people on Hacker News are not typically in the circle of businesses that use SAP.
    - Closi 6y ago
      I'm willing to bet that they are. Do you think there is a huge tendency towards Oracle, Infor or MS Dynamics rather than SAP across hacker news, or are you just assuming that people who go on hacker news aren't in the 'circle of companies' which need an ERP? Most people on HN probably go work for companies that pay them the best compensation or offer them a good position, not based on what ERP they chose.
    - dtech 6y ago
      You underestimate the reach of SAP and overestimate the "SV-ness" of HN.
    - 6y ago
MaxHoppersGhost 6y ago
- Sent from my iPhone Ok buddy. Good luck with China and not using American software.
bitzl 6y ago
What do you suggest to use instead of GitHub?

pelasaco 6y ago

I had similar issue visiting Crimea. I was simply looking through my issues, while in holidays over there.

mebr 6y ago
What happened after? your account was unblocked later?
- pelasaco 6y ago
  yes, it was unblocked later, after some email exchanges, but it took me some days and a lot of nerves.
sparkling 6y ago
How can one even reliably detect if one is loging in from crimea? There is no Ukranian/Russian ISP operating exclusively in crimea, is there?

optimalsolver 6y ago

Why do so many in the open source community use GitHub, a closed source platform?

nuker 6y ago
Do you have Gmail account? Nothing beats free service.
- LockAndLol 6y ago
  Nothing? Really? Nothing? Nothing in the entire existence of the universe ever beats a free service? OK then...
  - dubcanada 6y ago
    It's a phrase, a commonly used one in English, obviously not nothing in the entire universe.
    - LockAndLol 6y ago
      It's unnecessary hyperbole and wrong too.
- Tepix 6y ago
  No
deleted 6y ago
[deleted]

ykevinator 6y ago

They don't have a choice it's not githubs fault

traviscj 6y ago

I can’t imagine what a bad workday this is gonna be for the rest of the company.

jamesmishra 6y ago

I'm on GitHub/Microsoft's side here. They are not responsible for the content of US export control laws, and they have an incredible amount to lose if they are found to be in violation of US export control laws. Presumably GitHub needs some automated tool to prevent inbound traffic from sanctioned countries, and it's hard to be certain that they are complying with US law if such automated tools have some wiggle room allowing for a non-zero amount of usage from sanctioned countries. The whole situation isn't great, but none of it is GitHub/Microsoft's fault.

zoobab 6y ago
Github does not respect Schrems2 neither.
u801e 6y ago
> They are not responsible for the content of US export control law But they are responsible for understanding what's required under those laws. If they're going beyond what's required to comply with the law, then those further actions are entirely on them.
- whimsicalism 6y ago
  Yes, so Github has to take on the assumption that they are visiting relatives, not resident in Iran. Or you get the alternate headline "Github facilitates Iran sanction evasion by allowing Iranian developers to mark themselves as 'visiting a relative'" and the associated charges.
  - u801e 6y ago
    There's nothing in the law that says that Github must block an entire company from accessing their company org because one member of that company logged into a separate account that happened to be a member of the company org. At most, the account that was accessed should be suspended.
f6v 6y ago
Companies routinely engage in activism. I’ve seen more than one software company cut off Trump campaign from their services, which was politically motivated. Now, US sanctions against Iran are clearly illegal. Yet, everyone is just fine with that, no activism whatsoever. I say people should revolt.

LatteLazy 6y ago

You can't blame GitHub for intentionally over broad, OTT US sanctions.

xvilka 6y ago

Such cases highlight the importance of improving IPFS and Federation protocols, for example for Gitea[1][2] or GitLab[3][4]. Or just sponsoring them[5]. The source code for ForgeFed[6][7] might be also of interest for improvement. [1] https://github.com/go-gitea/gitea/issues/1612 https://github.com/go-gitea/gitea/issues/1612 [2] https://github.com/go-gitea/gitea/issues/9045 https://github.com/go-gitea/gitea/issues/9045 [3] https://gitlab.com/gitlab-org/gitlab/-/issues/6468 https://gitlab.com/gitlab-org/gitlab/-/issues/6468 [4] https://gitlab.com/gitlab-org/gitlab/-/issues/33665 https://gitlab.com/gitlab-org/gitlab/-/issues/33665 [5] https://opencollective.com/gitea https://opencollective.com/gitea [6] https://forgefed.peers.community/ https://forgefed.peers.community/ [7] https://notabug.org/peers/forgefed https://notabug.org/peers/forgefed

gbrindisi 6y ago
that was an interesting rabbit hole you sent me into, thanks for sharing!
dweberz 6y ago
also radicle.xyz

f6v 6y ago

Well, that’s what you get for doing business with an American company. The USA impose illegal sanctions and strongarm their allies in supporting the sanctions. Let this be a lesson for others.

JoshTko 6y ago

Seems like this policy would actually make sense for Russia.

londons_explore 6y ago

Can't really blame GitHub here... US laws are badly written.

grumple 6y ago
If Github is going to block people for accessing from Iran, why don't they just block all Iranian ips? I'd totally blame Github for this.
asplake 6y ago
They could have prevented the access they merely detected. Much less harm all round
enriquto 6y ago
It's alright to blame people for lawfully following harmful laws.
- jokethrowaway 6y ago
  It's not. You have a literal state actor backed with an army demanding money if you don't comply. I'll pick the legal way unless the profits I can make somehow outweigh the sanctions (legislators can make mistakes too) and there are no penal repercussions.
  - grumple 6y ago
    It is. We established this quite clearly in Nuremberg.
    - jokethrowaway 6y ago
      You're comparing state sanctioned killing and torturing with sanctioning people trading with each other. The first one is a violent crime against individuals, the second one is basically a tax. I'm against both but they carry a different weight.

300 6y ago

They could have blocked the user in Iran. It's without sense to block the organization's account.

freeone3000 6y ago
OFAC sanctions are transitive.

1337shadow 6y ago

Just wondering, does it also happen when connecting with Tor ? Would like to warn my friends and eventually tell them the workaround ...

capableweb 6y ago
My guess would be that either GitHub outright blocks connections if they think it's via Tor. Second guess is that if your Tor exit node happens to be in Iran (or any other embargoed country), you'll get blocked as well, as they most likely looks at the source IP to get the location.
znpy 6y ago
Just tell your friends to use gitlabon prem or another eu-hosted got service.

0xmohit 6y ago

GitHub might start blocking countries doing any trade with Iran in order to comply with "laws".

JJJollyjim 6y ago
unfortunately this is a real thing the US imposes on the world (it's called Secondary Sanctions)

zed88 6y ago

What's the difference between a Chinese company and a US company? None. Both work for the state, although US ones operate under the guise of democracy. This sort of union between tech and politics is not going to take us anywhere.

Daho0n 6y ago
No there are big differences. For example in China FAANG could easily be stopped from doing things they shouldn't while in the US it takes years and years of lobbying, talking to the media, making backroom deals, sitting on ones arse, changing the laws so it isn't unlawful anymore, etc.
numlock86 6y ago
Nice phrasing. A bit edgy and exaggerated, though. But since they are the same, I bet you can show us where the USA holds a few (at least 5 digit range) people in abduction camps, just to name one difference. Now that would be interesting.
- zed88 6y ago
  Well...human memory is certainly weak or biased or both. Let's not forget Guantánamo bay, which is just one among many examples.
- asddubs 6y ago
  the US prefers using drone strikes to inflict suffering, I believe
  - zed88 6y ago
    Yeah you forgot to add 'extra-judicial' to the drone strikes, breaching every international law.
- 10000truths 6y ago
  Surely you’ve heard of ICE and the sorry state of their “detention facilities” by now?

benjaminwootton 6y ago

Github refused to help me regain access to an 11 year old account when I changed jobs so lost access to 2FA and email account at the same time. We lost access to tens of thousands of dollars worth of project code which we had to rewrite. The customer service support was Google style brick wall. I wish this guy luck in getting access.

a254613e 6y ago
To me that sounds perfectly reasonable, and in fact a good policy. It seems like you lost access to your company account, based on your comment, so who is "we" that lost thousands of dollars worth of project code? If it was your employer that you had the email with, why couldn't you just restore the email? What in your opinion should github do when an employee loses access to their company email, and 2FA, because they're fired? Should the employee gain access to all the code and the account by just contacting github via their personal email?
otagekki 6y ago
Rewrite? Wow. Hopefully for them it is just code so all they'd have to do is push their branches to a new self-hosted server.
- wccrawford 6y ago
  Right? Why wasn't there a backup somewhere other than Github? Even just a repo that was checked out somewhere.
  - richardwhiuk 6y ago
    Feels like this code was owned by the company was the author no longer worked for....
- elwell 6y ago
  Code is (almost) always better when it's re-written. So, maybe it was a blessing in disguise...
6y ago

jeroenhd 6y ago

If the Iranian employee logged into the Github account, isn't blocking the account exactly what the law says they should do? If all they did was apply a merge request in one of the repos then would reverting the merge and blocking the account would be enough to comply? Is there some alternative way to comply with US export restrictions? The real question here is why people even consider using US cloud companies when they know they have employees working in countries subject to severe US trade restrictions. If you're willing to risk your company being denied business with American companies, then you should also have a mitigation strategy when you get caught. It sucks that you have to work around US regulation to do normal business but this is just how the world works right now.

canofbars 6y ago
Would it not be sufficient to just block requests from Iran rather than shut down the account and the groups they are in? That way when they return home they can still access the site.
- ceejayoz 6y ago
  Given the legal penalties for violating sanctions and the vigor with which they are pursued, probably not. Should it be this way? No. Is it entirely Github’s fault they overreact to any sign they’re serving Iranian users? Also no.
- austincheney 6y ago
  I believe that would be illegal. I suspect the reasoning is that the US is not on friendly terms with the government of Iran, which is a political squabble and not a conflict with the people therein, even though the practical consequences are indecipherable. The US military has been wrestling with that reasoning for about 20 years. If the majority of attacks and intrusions on military infrastructure originate from a single nation state and there exists evidence that most such attacks are sponsored by that nation state it would make sense to simply block all IP addresses originating from that nation state. This does not occur because the attorneys will not allow it due to both diplomatic and legal reasons.
- 6y ago

papier2020 6y ago

Since MS owns github does the same rule ban happen if a company uses office365-onöline/azure - and one employee opens email from Iran?

znpy 6y ago
Probably yes
reallydontask 6y ago
Tangentially related but one of my guys when to Cuba when we were using G-suite and he couldn't access gmail, it seemed to be ip-blocked. Maybe Cuba has a very well known set of IP addresses and it's easy to block?
- paranoidrobot 6y ago
  A company I used to work for got acquired by a US-owned organisation. We were required to block traffic from sanctioned countries, and were allowed to use a Geolocation IP Database to do so. Lots of lawyers reviewed it, as well as external consultants.

factorialboy 6y ago

So many dimensions come to play here. 1. There's the obvious legal aspect i.e. how these laws are framed and interpreted. 2. Then there's the geopolitical aspect. Is it fair to impose sanctions on Iran. 3. There's another aspect around GitHub policy that asks if an entire organization be banned for the location of one team member. 4. Finally, there's the aspect of relinquishing control. Your app development is on the cloud. IDEs are on the cloud. Deployments are on the cloud. App stores are on the cloud. You have relinquished so much control, why be surprised if that stares you back in the face? Ironically, Git is a decentralized version control system.

cies 6y ago
> Ironically, Git is a decentralized version control system. And Git is open source. Github is a US-registered company under MS. The US has a history of weaponizing its economic power. Stallman (RMS) was right once again.
- throwaway4good 6y ago
  But Github is reason why git is popular ...
  - jhasse 6y ago
    I doubt it.
    - richardwhiuk 6y ago
      There's definitely an argument that GitHub is one of the primary reasons that Git beat Mercurial.
      - ajsnigrutin 6y ago
        Yep! "One click" fork + "one click" pull request are its killer features.
      - 6y ago

Proven 6y ago

Why wouldn't they block the entire company? Can the company guarantee the employee isn't directly or indirectly using Github?

rathel 6y ago

At work I had to take a course on US export control. The restrictions they bully everyone into are pretty nazi. Likewise with SWIFT. As evidenced by TFA it's always regular citizens that suffer. Compare this with EU sanctions that are targeted to particular companies and individuals.

2Gkashmiri 6y ago
Yeah. A few days ago I asked why was us demanding kyc/aml regulations from countries when in us itself its easy to set up an anonymous corporation because laws. Its supposed to protect people from doing transactions and getting your "privacy violated".

numlock86 6y ago

While GitHub is not really to blame (following the laws and all, no matter how silly they are) why would your employees login from Iran with their work laptops into their work accounts while "visiting their parents" anyway? Why is that not the actual problem? Lack of policies?

cookieswumchorr 6y ago
depending on what the company does, different levels of security are appropriate. but, yeah, I would avoid taking valuable data with me on a flight to shady countries (the US being among the top 10 of that list)
rightbyte 6y ago
You can't have policies for everything. Their main problem is using SaaS for something as basic and important as version control. Than you have to deal with silly US laws.

dustinmoris 6y ago

Why don't we have internet havens yet? Companies are so clever in legally avoiding tax by registering companies in the most favourable jurisdictions and only running the absolute minimum of operations through tax expensive countries and so on, why don't we have the equivalent for avoiding dumb laws such as US trade wars, DMCA takedowns, etc.? Can most internet operations not run through companies who are registered and have servers in a country where most of those laws don't apply to customers who are not US citizen?

est31 6y ago
The reward for dodging taxes is pretty high. What's the reward of letting a few folks open their laptop while at their parents? If you are ideologically motivated, you might do it. Apparently project Gutenberg has set up servers in locations with shorter copyright durations so that they can mirror public domain books. https://news.ycombinator.com/item?id=25610024 https://news.ycombinator.com/item?id=25610024
arghwhat 6y ago
> Why don't we have internet havens yet? Companies pull tricks to optimize profits. Evading tax increases profit, but so does controlling the internet and sending blanket DMCA takedown requests instead of spending money on case-by-case review. Heck, if the big companies wanted to avoid these things, they'd probably wouldn't be lobbying for these things.

dustinmoris 6y ago

Is GitHub going to take itself down when one of their employees goes to Iran for holiday and logs into their GitHub account? If not, then why are they treating others with such contempt?

deleted 6y ago
[deleted]
ceejayoz 6y ago
GitHub is in possession of substantial additional information in that scenario, namely, "we're quite certain we don't have Iranian employees on staff".
- viseztrance 6y ago
  Do they keep an up to date database on who's dating whom?
  - IThinkImOKAY 6y ago
    yes
  - offtop5 6y ago
    Funny Story. When I went to London for the first time I meet a ridiculously attractive Swedish Arab girl. She had mentioned she really wanted to visit America, but with the recent election of Donald Trump she was a bit scared. Not all of us like Eastern European women, Trump blocked my game right there. The point of this story is anyone can meet anyone from anywhere and the nasty racist system the US has for blocking certain people because they have the wrong last names or whatever doesn't do anyone any service. I also don't think embargo serve anything aside from radicalizing other people's. Take Vietnam, now you have Coca-Cola, and McDonald's succeeding to do what 20 to 30 years of Western imposition couldn't, they've made Vietnam capitalist. That was accomplished once the embargoes were removed in the nineties. Even with Cuba ,I'd imagine if the embargo didn't exist you'd see much more reform as individuals would eventually be able to succeed on their own merits.

kkapelon 6y ago

This means that as a disgruntled employee I can simply visit Iran, log in my company Github account and boom! I have now taken revenge on my whole company with minimal effort.

wccrawford 6y ago
Only if you're okay with the legal consequences of sabotaging the company. They absolutely can sue you for it, and you might even face criminal prosecution for such a thing.
- kkapelon 6y ago
  There is also another scenario. I steal with social engineering (or phishing or other method) the GitHub credentials of an employee from a company I wish to harm. And then I simply log in GitHub(or use a VPN to appear in Iran) with those stolen credentials. Sounds like a very easy DOS method.
- afroboy 6y ago
  On what basis they are going to sue him? he visited a specific country and than boom. how in the hell are going to prove that he did it in purpose.?
  - kkapelon 6y ago
    Exactly. Somebody who wanted to do this could simply book a flight where Iran in an intermediate destination. And then they would say "I had 30 minutes of waiting time in transit and I just wanted to add a comment on my Pull Request".
  - richardwhiuk 6y ago
    On the basis of this comment thread :)
Illniyar 6y ago
Or just use a vpn that has servers in Iran? I think there are a few, hidemyass is one also I think, services designed to test access from different countries.

sebastiancoe 6y ago

Nat Friedman, the CEO of Github has always been followed around by rumors of racism against dark skinned people. I remember someone saying he was saying racist stuff about Indians being rapist while literally visiting India. His whole eagerness to replace the terms master/slave has always stunk of someone trying to mask something.

jonny383 6y ago

Please please PLEASE add at least one other provider to your remotes if you're going all in on cloud. Consider also doing a regular local backup of all your repos. A quick Google search will yield you tools that will automate this entire process on platforms such as GitHub , BitBucket and GitLab. I personally delegated this to a Cron job. I check the backups manually once a month to check all is in order.

grumple 6y ago
This is good advise. Maybe even self-host a backup server.
kkapelon 6y ago
While this is good advice of course, it is not clear to me if the problem is just the source code. The twitter message says "We are completely blocked from deploying!." Maybe they already have the source code elsewhere but use GitHub actions?
- RyJones 6y ago
  Heroku, maybe?

wolfretcrap 6y ago

How long before someone gets an Iran VPN so that their company is knocked out and they get a day off.

willis936 6y ago
My first thought was that this could have been avoided if a VPN was used. Why bother with such a weakly enforceable policy?
- dspillett 6y ago
  > Why bother with such a weakly enforceable policy? To show they've done what they can to enforce the embargo, in the hope that the policy is enough to satisfy the authorities wrt doing enough. They can't tell is a user is circumventing the policy via a VPN, but such a user is actively circumventing the enforcement of the policy so can't try pass the buck with a "well they let us, so we just assumed it was OK" based excuse.

sebslomski 6y ago

Shit happens, but I would really appreciate if you would re-activate our Github Org now, @github. You know, some PRs are waiting there for me.

mro_name 6y ago
can't you just push elsewhere, be it a self-hosted location or the one of a reliable 3rd party and tell Microsoft to go f§ck themselves? I mean, what do you need github for to integrate and deploy?

trapexit 6y ago

Geolocation databases are frequently inaccurate, even at the country level of granularity! I use a ISP in the Netherlands that was founded only recently, I and frequently encounter sites that think I'm in Dubai, which is apparently where the previous owner of my IP block was located. Fortunately, the only problems this seems to cause for the moment are that I occasionally get geo-blocked by some sites' overly-aggressive firewall rules, and I get Twitter ads in Arabic. But I shudder to think what might happen should the UAE find itself under sanction.

williesleg 6y ago

"facebook blocks entire company because one employee is liberal" "twitter blocks entire company because one employee is conservative" Who cares?

amir734jj 6y ago

I'm an iranian-american and this saddens me deeply. When you travel to Iran you need to make sure you don't get arrested by iranian regime because they have a history of taking dual nationals as hostage. Then you open your laptop and suddenly you have taken down your company and potentially lost your job.

Triv888 6y ago
> When you travel to Iran you need to make sure you don't get arrested by iranian regime because they have a history of taking dual nationals as hostage. Isn't it trivial for them to catch you at the border if they wanted to do it?
- amir734jj 6y ago
  They usually arrest people at the airport when they are leaving. It's called "hostage diplomacy"[0]. There is a whole Wikipedia page dedicated to it. [0] https://en.wikipedia.org/wiki/Hostage_diplomacy#Iran https://en.wikipedia.org/wiki/Hostage_diplomacy#Iran

nbzso 6y ago

Let me see. You have a business in which you cannot control access to your Intellectual Property? And you take money from people for services? What can go wrong here? I really don't get this. Git is free. Setting up dedicated server with redundancy backup is de facto the standard since SVN era. In this case I don't blame GitHub at all. It is responsibility of the business owner to make a judgement with all "bad case scenarios" in mind. In production the idea of trusting third party infrastructure without alternative is unprofessional.

davidg109 6y ago

How do you manage this kind of risk? Are there other options other than don’t use GitHub to begin with?

darkwater 6y ago

I really wonder why economical penalties enforced to a country through its citizens or people born there or with ancestors like the USA does with all of its embargos aren't considered just as terrorism. You are punishing other people for something they didn't do just to pressure on their governments. Just like terrorists injuring people. (Yeah I know terrorists usually kill people but I'm pretty sure many people died due to economic embargo as well)

Chris2048 6y ago
> You are punishing other people.. Just like terrorists injuring people. Because terrorism implies violence. What kind of deaths result from economic embargo?
- srtjstjsj 6y ago
  Starvation and disease.
  - Chris2048 6y ago
    So Iran cannot support it's own population wrt food without imports?
Santosh83 6y ago
At this level "might makes right" is the only reality. Don't let anyone tell you otherwise. Oh yeah they went through UN for the sanctions... right... as if the UN isn't little better than a rubber stamp agency in these areas. On the flip side the US can do little if someone like China or Russia decide to trade with and help out Iran. The problem is the software sector is heavily dominated by the US, so they can disproportionately affect Iran.

aaomidi 6y ago

Reminder that Microsoft has the power to ask the state department for an exemption from these sanctions for github. They have refused to do that. Google did that with Gmail and made the argument that Gmail is an important utility for freedom of the people there. Microsoft can do the same.

aaomidi 6y ago
I'm glad that Microsoft finally reversed their stance on this.

dweberz 6y ago

Support peer-to-peer alternatives. The technology to realize a peer-to-peer alternative to GH is here. We just need to make it happen. IMO radicle.xyz is the most promising one right now.

eplanit 6y ago

Don't let your business depend on cloud services. If they're really important, then self-host your servers. There are so many stories of the cloud being a single point of failure (ironically) due to arbitrary and capricious rules, and/or bad support.

kkoncevicius 6y ago

A bit off topic, but seems like at some point these sanctions start helping instead of harming. If you are "sanctioned" by GitHub, Facebook, Twitter, Reddit, Instagram, PornHub, what have you, then in the end you will probably gain productivity, not loose it.

stunt 6y ago

What a disproportionate reaction from Github. They could simply block network access from Iran to make it easier. Otherwise, blocking without giving warning is wrong. Even banks give warning and deadline to their clients before closing accounts that are linked to sanctions. Why Github blocked the entire organization without proper communication and deadline to fix or clarify the issue?

sebyx07 6y ago

use vpn bois, it's 2020 not 1999

eesmith 6y ago

Whoo-hoo! Set up a free wi-fi node outside of a tech conference (perhaps with cheap pastries for conference goers), routed through a proxy in Iran. Don't need to decode https or anything - assuming you can proxy https through Iran. Then watch as bunches of companies are blocked from GitHub. If the Iranian government wanted to have fun with US laws, they could totally set this up. And it wouldn't even be illegal.

jjd33 6y ago

>Iran wants to buy COVID vaccine with their own money that is in South Korea >South Korea refuses money access due to US sanctions Yes it is not directly related to this post. But this witch hunt against Iran is beyond retarded. I get why Saudi Arabia and Israel would join ties against Iran it makes sense. But for US, Japan and South Korea to join just due to personal and financial motives is a literal disgrace to humanity.

beshrkayali 6y ago

So are we not going to talk about how economic sanctions end up as a way to use the people of these countries as a way to pressure their governments for political gains? How these sanctions directly and indirectly cause an increased poverty gap and negatively impact the living standards? How the governments of these sanctioned countries magnify this economic pressure to prevent people from revolting and to entrench their presence even more?

mc32 6y ago
You can make the same arguments against capricious Google and YouTube delisting, Facebook or Instagram bans, Twitter bans, App Store takedowns etc.
- beshrkayali 6y ago
  True, and I'd agree. But these companies are private entities. I can disagree with them but I can't force them to do anything, aside from not using them. Economic sanctions are introduced by governments, supposedly from and for the people.
  - whimsicalism 6y ago
    > companies are private entities. Private entities chartered and regulated by the government, of course.
    - beshrkayali 6y ago
      Businesses have the right to refuse service.
      - mc32 6y ago
        By that logic, so do governments have the right to exercise their prerogatives...
        6y ago

jitbit 6y ago

GitHub: "Lets rename master to main because Inclusion & Equality" Also GitHub: "sorry you're from a wrong country"

jpxw 6y ago
Github’s help text when opening a new repo irks me. It contains the following: git branch -m master main With absolutely no explanation of what they are doing, or why. I can imagine this being confusing to beginners, and it requires mental effort for me to ignore it each time.
- skrebbel 6y ago
  This cost me 20 minutes + lots of confusion when teaching a Git course to newbies some weeks ago. I switched to GitLab for the next group.
- apta_ 6y ago
  They seriously think "master" is a bad word? That's crazy.
  - jey 6y ago
    To be fair, our industry brought this on itself -- we did use "master" and "slave" together as technical terms in various contexts. Now even the innocent uses of "master" that don't involve any reference to slavery are tainted too, at least from the perspective of a non-technical outsider. I'm sure their eyes will glaze over well before one can finish explaining what a version control system is, why you would want one, why it has branches and what they are used for, and that all this involves no references to slavery.
- weka 6y ago
  Well, just think of how many tutorials (aka 99.9%) iterate git master branch. When new people start, they are going to wonder what master vs main branch is -- I guarantee it.
Voloskaya 6y ago

deleted 6y ago

[deleted]

NovemberWhiskey 6y ago

It looks like the company has now gotten access to their GitHub account again, according to the original poster on the Twitter thread. I don't know, it just looks like some kind of surveillance automation kicked in, froze the account, and customer service was slow.

tehwebguy 6y ago

Microsoft should boycott the sanctions, they are cruel and the only reason they exist is that our current president hates our previous president. They are way too big to actually be penalized in a meaningful way and doing the right thing once in a while feels great.

mzs 6y ago

resolved: https://twitter.com/sebslomski/status/1346467442428530691 https://twitter.com/sebslomski/status/1346467442428530691

exabrial 6y ago

I have _a lot_ of questions... * Is this a US Company? * What was the employee doing in Iran? * Is the employee an Iranian national? * Was the company aware of this? Headlines like this make me really scratch my head.

ballenf 6y ago

So GH has effectively given admin-level repo DELETE permissions to everyone in the organization. Not sure they really thought this one through. Here comes a new employee onboarding document to sign: no Iranian VPN nor travel to Iran.

arthurmorgan 6y ago

Was the employee logged in with the organization account? When I visited Iran my personal and work account got locked but the org account was untouched.

umarniz 6y ago

The US sanctions on Iran has such a massive impact on Iranians that most of us don't realise. All US companies have to comply and majority of the tech companies are unfortunately in the US. I know you can use a VPN and configure it on a router level to make sure that you are always connected via a VPN but just the fact that 1 slip-up can result in account level blocks (which google is notoriously good at and can essentially shut down your business) means no company would want to work with someone working from Iran. Coming from a 3rd world country, I know the problems of internet censorship which Iranians also face but being too toxic to touch for everyone outside Iran because the US leadership thinks so is just infuriating and heart breaking. Imagine being a programmer in Iran. Not only do you have less resources to learn and grow, you have a massive handicap to find good work as most work is outside of the country. Only bet is to leave the country but even there you have a very low probability as you basically can't have a trial period for your job as most companies don't want to risk having their accounts blocked. Most of us here know how degrading and infuriating the tech recruiting processes can be and now add to it the horrors of working from Iran. Wars are not supposed to have civilian casualties but this one has a generation of civilians being starved of information and experience critical for them to grow.

factorialboy 6y ago
(Controversial comment) I am not condoning the actions of the United States government, but arguably the Iranian Islamic theocratic regime has unleashed more horrors on the Iranian people in the last 50 years than any other foreign government.
- edumucelli 6y ago
  Imagine the horror US has unleashed "invading" almost every country in the world (except 3) with formal or hidden missions.
  - bogomipz 6y ago
    You realize that there are between 194 and 197 countries in the world depending on who is doing the recognizing[1]. Could you please provide a citation for the 191+ countries you say the US has invaded? [1] https://www.worldatlas.com/articles/how-many-countries-are-in-the-world.html https://www.worldatlas.com/articles/how-many-countries-are-i...

mcguire 6y ago

Outsourcing anything has its own set of risks. Understand them before you commit to living with them.

prepperdev 6y ago

From the company perspective, it's an arbitrary disruption. It could happen to any company. While it's certainly very convenient and economically reasonable to use cloud services for development and production, every company should have a plan B. In this case, it's an absolute must to have daily backups of all repositories / all branches which are stored on premise. If your company is not doing that, you play the lottery of losing access to your own source code.

michaeltimo 6y ago

What I don't understand is why not blocking access to those regions which are affected by US sactions (in this case Iran). The current situation in which you can access the website, but if you do, your account will be banned immediately is more like a detective scenario than respecting the laws. You can simply block all Iranian IPs.

robinhood 6y ago

Just happened: https://github.blog/2021-01-05-advancing-developer-freedom-github-is-fully-available-in-iran/ https://github.blog/2021-01-05-advancing-developer-freedom-g...

tirthapatel 6y ago
That's huge! > we are working with the US government to secure similar licenses for developers in Crimea and Syria as well That's also super cool to hear! Related Thread: https://news.ycombinator.com/item?id=25648585 https://news.ycombinator.com/item?id=25648585
- floatingatoll 6y ago
  "We were working for two years to get this license." https://news.ycombinator.com/item?id=25648849 https://news.ycombinator.com/item?id=25648849

siculars 6y ago

Github obviously did not do enough due diligence here. IANAL but am familiar with Sanctions considerations and IMHO, this does not rise to the level of the action taken.

Dotnaught 6y ago

GitHub has just announced a license for developers in Iran: https://github.blog/2021-01-05-advancing-developer-freedom-github-is-fully-available-in-iran/ https://github.blog/2021-01-05-advancing-developer-freedom-g...

talal7860 6y ago

Well, GitHub is now fully available in Iran: https://github.blog/2021-01-05-advancing-developer-freedom-github-is-fully-available-in-iran/ https://github.blog/2021-01-05-advancing-developer-freedom-g...

deleted 6y ago

[deleted]

pelasaco 6y ago

It looks like they are reading hacker news :) https://github.blog/2021-01-05-advancing-developer-freedom-github-is-fully-available-in-iran/ https://github.blog/2021-01-05-advancing-developer-freedom-g...

bigphishy 6y ago

What happened to the 'master main' comment thread? It was just silently deleted from this thread. Massive censorship going on, I am moving to a new website. Good riddance hackernews, take your censorship and stick it!