30 ms·
GitHub deleted accounts of people who contributed to Tornado Cash repos
- bkq 4y agoFor those wondering Tornado here appears to refer to Tornado Cash [1]. [1]: https://www.aljazeera.com/news/2022/8/8/us-announces-sanctions-against-currency-mixer-tornado-cash https://www.aljazeera.com/news/2022/8/8/us-announces-sanctio...
- Freak_NL 4y agoOof. The confusing title could do with some editing then (capitalize 'Tornado' for one).
- uranusjr 4y agoI thought they were contributing to the Python web framework called Tornado (quite popular especially before asyncio caught on, but still well-known nowadays).
- exikyut 4y agoI was like "what's a tornado repo? a reference I don't know about to a whirlwind of activity? maybe a bot attack of some kind." +1 disambiguation needed
- aaronchall 4y agoJust reading the comments, I also was thinking this was about Python's tornado library until I recognized it wasn't that. The title needs improvement. CC @dang
- tedmiston 4y agoI emailed a title suggestion switching to "... Tornado Cash ..." for clarification. I wish typing "cc @dang" did something, but to the best of my knowledge it does not / isn't monitored vs email.
- tedmiston 4y agoSame. Confusing title.
- seydor 4y agotornado repos sounds like some kind of evil financial product
- 3np 4y ago@dang could be worth a s/tornado/Tornado Cash/ in the title
- fuzzythinker 4y agoYa, really need to change the title. Tornado is known to many as the python web server.
- Genbox 4y agoYeah... and you know... a natural weather phenomenon. I thought this was about storm chasers or something.
- dang 4y agoWe've put that in the title now.
- r721 4y agoRelated discussions: >GitHub suspends Tornado Cash developer account https://news.ycombinator.com/item?id=32389706 https://news.ycombinator.com/item?id=32389706 >U.S. Treasury sanctions virtual currency mixer Tornado Cash https://news.ycombinator.com/item?id=32386189 https://news.ycombinator.com/item?id=32386189
- deleted 4y ago[deleted]
- JumpCrisscross 4y agoThis probably protects those users. Contributing to the project at this point opens one up to the international reach of U.S. law enforcement.
- sschueller 4y agoYou are going to open a huge can of worms if you are going to start prosecuting people for software pull requests. Are we going to prosecute people who manufacture phosphor bombs for the US military as well now?
- robin_reala 4y agoHonestly, that sounds like a good idea. White phosphorous munitions are generally illegal under the Convention on Certain Conventional Weapons.
- capableweb 4y agoHere is where the missunderstanding seems to keep happening (regarding White Phosphorous and Tornado Cash). The mere existence of tools like Tornado Cash or White Phosphorous is not illegal (at least wasn't until yesterday), but illegal use of those always was. The distinction is important, but seems to have been lost somewhere along the way.
- blackoil 4y agoProviding `White Phosphorous` manufacturing service for people who you know use it for illegal acts is also illegal.
- capableweb 4y agoReading through "The Convention on Certain Conventional Weapons" again, since it was a long time ago, I don't find anything supporting this. Its main purpose is to ban/restrict usage of inhumane weapons, not the production of such. But I might have missed something. If so, mind pointing me to the right section?
- junon 4y agoPeople on Twitter are either wilfully dumb or simply ignorant. GitHub had to do this. It was required of them by law. Tornado was sanctioned. > These prohibitions include the making of any contribution or provision of funds, goods, or services by, to, or for the benefit of any blocked person and the receipt of any contribution or provision of funds, goods, or services from any such person. This is, unambiguously, directed toward entities such as GitHub providing them service. I'm not a fan of GH these days but they did the only thing they could do in this situation. You can be upset about it, but you can't be upset at GitHub about it.
- deleted 4y ago[deleted]
- paulgb 4y agoDoes Tornado being sanctioned mean that everyone who has contributed in the past also needs to be blocked? (It’s not clear from the thread whether the people blocked contributed after, or only before, the sanction.) For what it’s worth, I don’t see much evidence of people being upset at GitHub in the thread. There’s talk about decentralized alternatives, but not much actual pinning the blame on them.
- oliwary 4y agoThis is the crux of the issue in my opinion. It seems ridiculous that the sanctions should apply retroactively to anyone who has dealt with a sanctioned entity at any time in the past - if the people contributed before the sanctions, they were not contributing to a “blocked person”, as the project was not blocked at the time. Imagine if, say, A foreign electronics company is sanctioned by the government - does this mean that anyone who has previously worked with them or bought their electronics has done so illegally? If so, that sounds like a significant impediment to commerce, since nobody can predict who will be sanctioned in the future.
- withinboredom 4y agoA government can pretty much do whatever it wants in the realm of foreign relations, things it can't usually do to it's citizens (such as retroactively applying sanctions). If you have a problem with it, take it up with the government.
- moron4hire 4y ago
- prvit 4y ago“Money laundering” is a fake crime designed to make it easier to prosecute people who may or may not also have committed real crimes.
- moron4hire 4y agoYeah, sure, and taxation is theft. Got it.
- drexlspivey 4y agoYeah, sure, and sending money to protestors means you are a terrorist. Got it.
- dang 4y agoPlease don't respond to a bad comment by breaking the site guidelines yourself. That only makes things worse. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- dang 4y agoWould you please stop breaking the site guidelines like this? We've had to ask you several times before. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- Barrin92 4y agoSorry to disappoint but money laundering is very much a real, federal offense. (most other jurisdictions have equivalent laws) https://en.wikipedia.org/wiki/Money_Laundering_Control_Act https://en.wikipedia.org/wiki/Money_Laundering_Control_Act
- 4y ago
- meltyness 4y agoThis is an overreach, and it is going to backfire. The target here is a software package, essentially speech so, one step down That hill. At least congress isn't deluded, corrupt, and senile enough to try this. Edit: further, it seems they're going to have to shut down Ethereum too, because Tornado Cash's contract is a person, and subgroup of Ethereum under the definition of entity which falls under the definition of person. [1] Apparently Treasury is also accusing this tiny piece of code of being engaged in activities that form "... a significant threat to the national security, foreign policy, or economic health or financial stability ..." [1]: https://obamawhitehouse.archives.gov/the-press-office/2015/04/01/executive-order-blocking-property-certain-persons-engaging-significant-m https://obamawhitehouse.archives.gov/the-press-office/2015/0...
- deleted 4y ago[deleted]
- Bedon292 4y agoIf the software is performing actions that are illegal, such as money laundering, for an entity that is a threat to national security, that is no longer covered by free speech. Right? Having or writing the code may be covered by free speech but actually using it to do something is not the same thing. I don't believe that EO is related to this case. These are OFAC sanctions against the entity Tornado Cash and its related ETH addresses. A US person or Entity cannot interact with them any more. But that does not sanction the entire ETH network. That would be like shutting down an entire bank, or the entire banking network, because a couple accounts were sanctioned. That's not what happens. Or are you more concerned with additional sanctions against the entire ETH network coming in the future?
- tremon 4y agoIf the software is performing actions that are illegal But no software is performing any action; A system running said software could, but the software by itself cannot. And regarding a system performing actions: didn't the USPTO similarly declare that an AI (=software system) can never be qualified as an inventor, because it has no agency?
- chrischattin 4y agoAny constitutional law experts care to comment? If the US government put pressure on Github to remove the code and delete their accounts, it seems like a clear violation of the developer's first amendment rights – "code is speech" being precedent.
- root_axis 4y agoNot all speech is legal. If I write a virus and unleash it on the internet it's not unconstitutional to arrest me.
- whatisweb3 4y agoIt could be argued the sole intent of unleashing a virus on the internet is malicious. The sole intent of publishing a privacy protocol on GitHub is not. Look at Tor for comparison. GitHub has a section on this[1]. There should be no problem with allowing this software online for research and educational purposes. [1] https://docs.github.com/en/site-policy/acceptable-use-policies/github-active-malware-or-exploits https://docs.github.com/en/site-policy/acceptable-use-polici...
- moron4hire 4y agoDoes anyone want to dispute that Tornado Cash is a money laundering tool? When at least 20% of the money that has moved through it is already known to be ill-gotten gains, with the rest being indeterminant, it's kind of hard to say it's a anything but a money laundering tool. I've only seen childish arguments that "money laundering is a fake crime", not that Tornado Cash isn't a money laundering tool.
- whatisweb3 4y agoIt is a tool for privacy, full stop. Criminals can use this for criminal activity, law abiding citizens can use this for law abiding activity. Also see end-to-end encrypted chat apps, VPNs, onion routing and other privacy tools that are widely used by criminals. also consider applications that might be illegal but often considered moral like paying for an abortion with tornado cash ETH in a state where abortion is illegal, or donating to a state that your current regime is at war with.
- andybak 4y agoOP - more context in the title next time please. Some of us have no idea which "tornado" this refers to and or were unaware of a crypto project called "Tornado".
- shkkmo 4y agoThe title is literally just the content of the tweet, which seems like it was deliberately crafted to stoke outrage through being misleading.
- _8j50 4y agoIs there a decentralized git service off of ipfs or something?
- SXX 4y agoThere are other version control systems that can work in P2P mode, e.g Monotone.
- lima 4y agoRadicle Not that it's very functional, but it exists
- blueflow 4y agoGit is decentralized per default.
- ChadNauseam 4y agonot really, it’s very inconvenient to use git without a centralized server
- deleted 4y ago[deleted]
- naniwaduni 4y agoYes, this is a pretty common problem with decentralized services and I'm not sure we can fault git for at least making it viable.
- neilalexander 4y agoYou can pull and push to pretty much anywhere, including directly to another person or workstation, over SSH. It's admittedly harder to have a single source of truth by doing so but it is still very possible to use in a decentralised fashion if you needed to.
- _8j50 4y agoBut Git hosting isn't. As in the server/infra.
- SXX 4y agoThis is a good time time for EFF to step in. This is open huge so many terrible ways for abuse. 1. Make some random crypto project. 2. Motivate people contribute to it, see DigitalOcean hacktoberfest. 3. Replace the code with Tornado.Cash source. Everyone's account is banned by Microsoft. Also I wonder what happen if you didnt sent PR yourself, but someone crafted git commit with your email and added it to such repository.
- ngetchell 4y agoWhat would be the motivation to pull off that heist?
- zekica 4y agoTo prove a point I assume? Nothing else comes to mind.
- mhh__ 4y agoChaos, ransom etc.
- a_t48 4y agoGood ole trolling
- SXX 4y agoWhat motivation do someone have for swatting people? Problem is that Microsoft is certainly overreaching here and this precedent will be abused by malicious actors. One day someone will come to work and find out that whole organization was banned on github just by forging to commits.
- trinovantes 4y agoUnless they enabled PGP signed commits, can't you just forge their commits?
- SXX 4y agoYeah you can and I mentioned I curios who exactly Github has banned. It's possible they only banned people who created PRs under their own account.
- 5350-uiop-1130 4y agoIt's ironic, Tornado cash is something closer to the true spirit of "crypto" currency. guess only rich insiders are allowed to launder money.
- ncmncm 4y agoLately real estate has been the favored avenue for money laundering, as it retains all the necessary loopholes. Or did, last I checked. Houses in Vancouver BC have, e.g., been favored among mainland Chinese. Dunno the current status.
- 8note 4y agoI imagine it helps to launder money in countries that done honour the predicate crime's illegality
- Rackedup 4y agoYou have to go through the big banks so that they can get their fees (but you have to launder huge amounts, too).
- bilekas 4y agoI am by no means a fan of Tornado and what it represents in the crypto community - I think crypto has enough cretins already. But this is definitely a bit of a stretch to go after the creator(s) in this way. Reminds me of the US Gov trying to ban/limit all encryption. Didn't seem okay then and this doesn't seem okay now.
- egorfine 4y agoNot after the creators. The contributors. People who were submitting code changes to an absolutely legal piece of software.
- darkcha0s 4y ago...that enabled nefarious people to go about their deeds unpunished.
- break_the_bank 4y agoThe nefarious people were probably on a unix system or a windows system. Should we go about and delete their contributors accounts as well? I’m not at all pro crypto but this enforcement does seem extreme. I do understand that Microsoft is just following the sanctions.
- cmeacham98 4y agoThis is disingenuous. It's like responding to someone arguing for gun control with "all the shooters drank water, should we ban that?". We can argue about the legit/legal uses of Tornado Cash and whether it deserves to be sanctioned - but do so in good faith rather than pretending like it is equivalent to a general purpose tool like Microsoft Windows.
- break_the_bank 4y agoThe tweet is very low information for me to comment. I can't tell whether these people contributed to Tornado cash before/after the sanctions were in place. I think a fairer analogy would be, some devs contributed to signal, signal or a derivative of it got used by North Korea/Terrorist/current enemy of choice of the political class. Do we go around and delete the developers GitHub accounts? Having never used tornado.cash or much of crypto (apart from making some money doing spot trades) I can't comment on what the good use cases are. Here's a sample thread of Vitalik claiming to use Tornado.cash to donate to people in Ukraine https://twitter.com/VitalikButerin/status/1556925602233569280 https://twitter.com/VitalikButerin/status/155692560223356928.... I can find some other threads like this on Twitter. This is just another case of Government choosing "security" over privacy and should be scary to folks on HN than be cheered upon. As a side, I am not sure whether Tornado.cash was marketed specifically for "bad" use cases. In the example below I'd support the DoJ in fining & imprisoning a software engineer for his visit to Pyongyang https://www.justice.gov/opa/pr/us-citizen-who-conspired-assist-north-korea-evading-sanctions-sentenced-over-five-years-and https://www.justice.gov/opa/pr/us-citizen-who-conspired-assi...
- damsta 4y agoMods please change "tornado" to "tornado cash". People explaining in the thread that some tornado was sanctioned got me confused even more.
- randlet 4y agoNot to mention Tornado is a very popular open source Python web server.
- yosito 4y agoHonest question: was GitHub legally obligated to delete the accounts of anyone who had contributed to the repos? I get that contributing to the repos would be a violation of the sanctions, but it's not clear to me when the project was sanctioned and whether all the contributors were aware that they were contributing to a sanctioned project. Would it have been enough for GitHub just to remove the projects? I ask as someone who has a lot of developer friends from Cuba who run into problems with accounts on platforms being deleted all the time. IIRC there was an episode awhile ago when accounts were being deleted simply for logging in from Cuba. It seems like the legal obligation would be to block logins from Cuba (and/or Cuban people), but deletion of accounts seems more like a CYA move than a strict obligation.
- kube-system 4y agoI’m not sure that there’s been a ton of cases exactly like this that have made it to court. If someone asked you to pick between [maybe going to prison] or [definitely not going to prison], which button would you press?
- bad416f1f5a2 4y agoIt’s a gray area. These sanctions went against Tornado Cash, the entity. Does that extend to core devs? Anyone who did a PR? That’s the question GH’s counsel has to interpret. > deletion of accounts seems more like a CYA move than a strict obligation. Microsoft is prohibited from giving any good or service to a blocked entity. It’s very possible their lawyers will say “the easiest way to meet this obligation is to delete accounts related to the blocked entity.” The legal system is CYA, after all.
- deleted 4y ago[deleted]
- bluGill 4y agoProbably not, but it is in their best interest. By blocking all these accounts, if it is later discovered they missed something else related to this they can bring all those blocked accounts up as evidence they were trying to obey the law and this was an honest mistake. The courts understand mistakes happen, but you need to prove it was a mistake and not an attempt to evade the law by ignoring something. The more you do to ensure mistakes don't happen, the more likely the courts are to decide you weren't trying to evade the law, but just made a mistake.
- dec0dedab0de 4y agoI wonder how they know if they actually contributed, or if someone just used their info in the commits?
- whatisweb3 4y agoGitHub has the right to do whatever it wants, and it makes sense they would take this action to avoid getting into legal concerns. But it is deeply concerning. Whether or not you like crypto, you should not be supporting this if you are a researcher, academic, technologist, cryptographer, or privacy advocate. The code for Tornado Cash is a series of cryptographic and mathematical functions that can be repurposed for a variety of applications unrelated to privatizing user wallets. Having it open source and accessible is a net benefit for the entire world. EDIT: A comparison would be that US decides to sanction the open Matrix protocol and any developer that has contributed to it, as it can facilitate end-to-end encrypted terrorist communication.
- whitepaint 4y agoAbsolutely. Just because it is legal doesn't mean that it is not absolutely morally deplorable. Which in this case - it obviously is.
- kube-system 4y agoIt’s morally deplorable to demand office workers risk jail time just because you want a free service. If you want to run git for free, run it on your own computer.
- whitepaint 4y agoI am not demanding anything. I am just saying they have clearly done the wrong thing.
- kube-system 4y agoThere is no moral obligation for someone to provide web services for free for any reason. There’s definitely no moral obligation for someone to do the same at risk of prison time. They do have a moral obligation to follow the laws of the country they operate in, though.
- m00dy 4y agoWe need a decentralized and permissionless github
- hyperhopper 4y agoI can't find a definitive answer: did they also ban people that _only_ contributed pre-sanction?
- lloydatkinson 4y agoPerhaps for the greater good as this is some crypto bullshit.
- yrro 4y agoWhat is Tornado? Some context would be useful.
- paulproteus 4y agoHappy to see this! I’ve been disturbed by GitHub hosting financial infrastructure optimized for criminal activity.
- Rackedup 4y agoIt could be used for privacy purposes also...
- wrigby 4y agoIt’s worth pointing out that “tornado” in this context is a crypto project, NOT the popular Python web server/event loop library.
- craigc 4y agoCan someone edit the title of this to say “tornado cash“? As a one-time contributor to the python tornado web framework, I had a bit of a scare waking up to see this!
- jacooper 4y agoI mean. If the US wants to sanction math and code, what's stopping them froM sanctioning Encryption projects that don't submit to the NSA?
- trasz 4y agoThis would be fine if it only affected developers that live in US. I suspect it doesn’t though, and this means it’s yet another proof that we need companies that are outside the US jurisdiction, same reason we need those outside Russian jurisdiction.
- thankful69 4y ago
- throwaway290 4y agoThis should be a wake-up call for all Russian Github users. If Github suspects you're Russian (e.g. like me you sponsored using a card with Russian billing address), today you are frozen out from all paid features, tomorrow your acc may be gone. And since creating more than one acc is against Github ToS, the best move is to stop using it ASAP except if required for work.
- hestefisk 4y agoNothing stops these folks from hosting their own Git repo somewhere. It’s supposed to be decentralised after all.
- devmor 4y agoReplies to the tweet saying "we need a decentralized git" strike me as bafflingly dense. Do these people think that the website, Github is the only way to interact with a repository? Are they entirely unaware of git's default decentralized nature, or even that there are other central repository sites?
- mint2 4y agoThis is about how private companies work now that the project has been officially declared a “toxic entity”. But really did anyone really expect working on a money laundering project would be a good idea? Sure it was a new method of money laundering but it’s pretty obviously money laundering
- prosim 4y agoHN post title is misleading. GitHub suspended (and not deleted) the 3 accounts of the org owners of the tornadocash org on GitHub. Going through the commit history, I have not found a single contributor (i.e. other than the 3 owners) which got suspended or deleted.
- boredumb 4y agoRegardless of what you think about github or tornado... If you are going to build software that has a huge feature set that will be used for money laundering or other sanction-able activities, host your own git server somewhere.
- dogman144 4y agoThe commenters saying be reasonable, they were sanctioned, GitHub had to do this, should look into the last time code was made illegal or similar turmoil and what the developer community did in response…It was not accepting sanctions or govt failures to understand code as “well that’s that.” - Phil Zimmerman (PGP) was under criminal investigation for arms exports by releasing the code for consumer encryption. The case escalated and was eventually dropped, included POTUS attention. - Aaron Swartz passed away via suicide in 2013 under threat of 35 years in prison and a lot else for downloading from JSTOR programmatically - Clifford Stole spent several years being ignored by every govt agency under the Sun, except for CIA, for finding, attributing and then exposing a widespread KGB hack of govt systems in the 80s - L0pht testified in front of congress to expose significant internet security risks that were otherwise ignored. I’m not saying Tornado Cash and related devs were doing a purely moral action. But the automatic siding with the heavy hand of govt sanctions on code the govt doesn’t really understand is pretty shameful for a nuanced technical audience.
- Bedon292 4y agoI think its important to make a distinction between GitHub attempting to ensure they are in legal compliance with a sanction and approving of the sanction happening at all. You can disagree with the sanction while still being understanding of GitHub trying to cut ties with the sanctioned entity. Or be critical of them being heavy handed in their compliance but agree with the sanction in general.
- dogman144 4y agoYou’d be on the “be reasonable” side of this I suppose. Plenty of organizations in the past have chosen what side of this conceptual line to stand on. One can end up looking like the EFF with a long term, very strong reputation of standing up for clear boundaries of what’s right in the legal<>code context and go to court over it, or you can end up looking like GitHub.
- revscat 4y agoHonestly, I don’t care what happens to crypto bros. They put profit before environment. Fuck em.
- deleted 4y ago[deleted]
- birracerveza 4y agoBe careful what you cheer for.
- muaytimbo 4y agoWe need a decentralized replacement for GH.