4 ms·

> GitHub should get flak for that in the same way Paypal regularly get flak for randomly freezing accounts. Random? I think the problem with Paypal was that th

by cies 6y ago

> GitHub should get flak for that in the same way Paypal regularly get flak for randomly freezing accounts. Random? I think the problem with Paypal was that they do not warn or provide reasons for freezing. GH's reasons are clear. > Blocking a whole European company not conducting business with Iran because one of its employee tried to login while there is not respecting the embargo, it's just overreach. Says who? There is a law, the law is unclear and IHMO a bad law. The law is overreach. Blaming GH for shitty US laws is akin to killing the messenger.

astura 6y ago
> I think the problem with Paypal was that they do not warn or provide reasons for freezing Which is par for the course for financial companies.
another-dave 6y ago
> Says who? There is a law, the law is unclear and IHMO a bad law. Says the US Department of the Treasury, as mentioned in the Twitter thread further down: > 118. I have a client that is in Iran to visit a relative. Do I need to restrict the account? > No. As long as you are satisfied that the client is not ordinarily resident in Iran, then the account does not need to be restricted. from their "FAQs: Iran sanctions" page — https://home.treasury.gov/policy-issues/financial-sanctions/faqs/topic/1551 https://home.treasury.gov/policy-issues/financial-sanctions/...
- darkwater 6y ago
  And now is when GP should reply saying "oh gee, you are right and I was wrong. thanks for pointing that out."
  - jimmydorry 6y ago
    Github shoulders all the responsibility if they get it wrong. They appear to be doing the reasonable thing, up until this could not be resolved through customer support (as the company bears the burden of satisfying github that they are not violating the embargo).
    - harperlee 6y ago
      Yes, the core problem here is that unblocking the preventive block in 7 days is both unacceptable for the client and a big OPEX ask for github. What I’m not sure at all is that github had the obligation to preventively block cases instead of the alternative to investigate high risk cases prior to block. As long as they had a sound Compliance process for determining sanction enforcement needs in a reasonable time it should be enough - though for sure more expensive than autoblock followed by non-specialized, non-time sensitive (for github!) customer service followup.
- Sacho 6y ago
  Is Github on the hook if the client is actually a resident? If so, the law is still bad and github's response may be appropriate(just blocking login from Iran sounds better though). You can't expect them to investigate the personal details of their users.
  - Dylan16807 6y ago
    They could at least have a grace period for country changes. But I sure as hell can expect them to investigate before cutting service to a long-time customer.
- delfinom 6y ago
  GitHub didn't decide in their actions blindly. They have lawyers who review the laws, look at their services and write the rules to follow internally. The lawyers obviously have a reason to disagree with the Treasury and GitHub under Microsoft aren't exactly going to be using cheap lawyers either.
  - diebeforei485 6y ago
    They have since restored the account, so your argument is invalid. Keep in mind that US Government agencies that administer sanctions laws (the Treasury, in this case) are the ones interpreting what these laws mean. See https://en.m.wikipedia.org/wiki/Chevron_U.S.A.,_Inc._v._Natural_Resources_Defense_Council,_Inc https://en.m.wikipedia.org/wiki/Chevron_U.S.A.,_Inc._v._Natu....
deleted 6y ago
[deleted]
ffpip 6y ago
> Says who? The same law you're stating. https://home.treasury.gov/policy-issues/financial-sanctions/faqs/118 https://home.treasury.gov/policy-issues/financial-sanctions/...

by cies 6y ago

astura 6y ago

> I think the problem with Paypal was that they do not warn or provide reasons for freezing Which is par for the course for financial companies.

another-dave 6y ago

> Says who? There is a law, the law is unclear and IHMO a bad law. Says the US Department of the Treasury, as mentioned in the Twitter thread further down: > 118. I have a client that is in Iran to visit a relative. Do I need to restrict the account? > No. As long as you are satisfied that the client is not ordinarily resident in Iran, then the account does not need to be restricted. from their "FAQs: Iran sanctions" page — https://home.treasury.gov/policy-issues/financial-sanctions/faqs/topic/1551 https://home.treasury.gov/policy-issues/financial-sanctions/...

darkwater 6y ago
And now is when GP should reply saying "oh gee, you are right and I was wrong. thanks for pointing that out."
- jimmydorry 6y ago
  Github shoulders all the responsibility if they get it wrong. They appear to be doing the reasonable thing, up until this could not be resolved through customer support (as the company bears the burden of satisfying github that they are not violating the embargo).
  - harperlee 6y ago
    Yes, the core problem here is that unblocking the preventive block in 7 days is both unacceptable for the client and a big OPEX ask for github. What I’m not sure at all is that github had the obligation to preventively block cases instead of the alternative to investigate high risk cases prior to block. As long as they had a sound Compliance process for determining sanction enforcement needs in a reasonable time it should be enough - though for sure more expensive than autoblock followed by non-specialized, non-time sensitive (for github!) customer service followup.
Sacho 6y ago
Is Github on the hook if the client is actually a resident? If so, the law is still bad and github's response may be appropriate(just blocking login from Iran sounds better though). You can't expect them to investigate the personal details of their users.
- Dylan16807 6y ago
  They could at least have a grace period for country changes. But I sure as hell can expect them to investigate before cutting service to a long-time customer.
delfinom 6y ago
GitHub didn't decide in their actions blindly. They have lawyers who review the laws, look at their services and write the rules to follow internally. The lawyers obviously have a reason to disagree with the Treasury and GitHub under Microsoft aren't exactly going to be using cheap lawyers either.
- diebeforei485 6y ago
  They have since restored the account, so your argument is invalid. Keep in mind that US Government agencies that administer sanctions laws (the Treasury, in this case) are the ones interpreting what these laws mean. See https://en.m.wikipedia.org/wiki/Chevron_U.S.A.,_Inc._v._Natural_Resources_Defense_Council,_Inc https://en.m.wikipedia.org/wiki/Chevron_U.S.A.,_Inc._v._Natu....

deleted 6y ago

[deleted]

ffpip 6y ago

> Says who? The same law you're stating. https://home.treasury.gov/policy-issues/financial-sanctions/faqs/118 https://home.treasury.gov/policy-issues/financial-sanctions/...