4 ms·

> What did they do wrong? The argument probably is that they assisted a sanctioned entity by providing a contribution i.e. service to it. Quoting US Treasury "

> What did they do wrong? The argument probably is that they assisted a sanctioned entity by providing a contribution i.e. service to it. Quoting US Treasury "These prohibitions include the making of any contribution or provision of funds, goods, or services by, to, or for the benefit of any blocked person and the receipt of any contribution or provision of funds, goods, or services from any such person." However, the major factual question is whether they did violate any sanctions since the contributions generally were made before the sanctions were in effect - it's not that Github had to do it, but that they chose to be safe rather than sorry (in order to ensure that Github themselves don't violate the sanctions) and if they aren't absolutely sure they blocked people. [edit: apparently not everyone, some contributors are not blocked, so they apparently did some review before choosing whom to block] The key issue is that any collateral damage is considered acceptable, but any false negatives are absolutely not. If Github leaves even one actual agent of TornadoCash unblocked, Github has committed a crime, if they block a hundred unrelated accounts, that doesn't violate anything. > Are there open source licenses that protect the contributors from such unforeseeable damage? No, a contract or license can't absolve you from this prohibition if it applies to you. > Or are we to watch our step from now on as open source contributors? Yes, but not "from now on" but since before open source existed. There are entities you are not allowed to contribute to, and it's your responsibility to know and check who you are dealing with.

dingleberry420 4y ago
> The argument probably is that they assisted a sanctioned entity by providing a contribution i.e. service to it. And what if they did so before the sanctions? Is the US so happy to retroactively punish people who literally did nothing wrong?
- JumpCrisscross 4y ago
  > people who literally did nothing wrong? What on earth did people think a tumbler like Tornado Cash was going to be used for and by?
  - dingleberry420 4y ago
    Not sure, thoughtcrime is a thing now in modern America?
    - JumpCrisscross 4y ago
      > thoughtcrime is a thing now in modern America? Nothing wrong with writing code. Code is speech, that's settled law. But the Tornado Cash team wasn't just publishing. They were building a tool. Semenov styled himself as a co-founder and the group advertised open positions on its website.
      - dingleberry420 4y ago
        Okay, how does that relate to open source contributors? Can you retroactively read their minds and determine their intent? Why does their intent even matter? What they were doing was not illegal at the time, and now they are being punished by the US.
        bad416f1f5a2 4y ago
        > now they are being punished by the US. The US didn't mandate deletion of their Github account. The US isn't punishing them – you can tell because they didn't put them explicitly on the SDN list. Microsoft made the choice to remove their accounts. Their compliance team likely looked and said "$ we make from these devs < $$$ we'd pay to our lawyers to simply decide if we should keep them on our platform."
        JumpCrisscross 4y ago
        > Why does their intent even matter? It doesn’t. Tornado was used to launder money. That’s all that matters. My guess is the only people in real legal jeopardy are those who kept working on it after its involvement in laundering was exposed. (I’m assuming they weren’t in on the laundering.) For GitHub, figuring out who those people are is impossible. So they’re being cautious and cutting ties more broadly. There is a creep problem to sanctions. Some companies in Russia are banned. Suddenly everyone from Cyprus is under extra scrutiny, since you don’t want to be the dupe they used to launder their money. Tornado and its developers were those dupes. But it has been illegal to help North Koreans launder money since before Tornado was founded. It remained illegal when it became known North Korea used Tornado to launder money. Anyone going into money services knows, or is negligent in not knowing, that these laws apply to them. It’s tough to have sympathy for anyone who kept ties. Particularly when the punishment, so far, is simply ostracism.
mananaysiempre 4y ago
> The key issue is that any collateral damage is considered acceptable, but any false negatives are absolutely not. Even though “better 100 guilty persons should escape than that one innocent person should suffer”. Not that this was ever uncontroversial, but how did it ever go so wrong, that the very problems of government that modern laws sought to correct are gleefully recreated using private companies as enforcement proxies?
- WoahNoun 4y ago
  Companies try not to break laws in general. If they think doing business with you will create a liability for them, they have a freedom of association right to deny you service.
  - mananaysiempre 4y ago
    Giving a legal answer to a moral question is backwards, I think. I understand the mechanics of how it works, but I’m asking how it should, not whether it does. (Franklin’s opinions on how trials ought to go are also hardly representative of the legal practices of the late 18th century.) It is not at all a universal opinion that non-natural persons should have freedom of association at all or in this manner. I’m not trying to directly argue that they shouldn’t, though (as long as we allow that there is no moral principle that a non-natural person’s rights follow a natural one’s). I’m saying that it’s generally accepted to be a good thing that a (branch of) government can’t directly take away your livelihood without a good reason, and if you think the reason was not good there are reasonably unbiased ways to have your disagreement considered. For the most part, this applies to a government doing it by prohibiting a private party to deal with you. On the other hand, if the same state of affairs is reached by that government merely making it potentially very expensive for a private party to deal with you, somehow none of these standards apply anymore (or maybe they nominally do but nobody’s ever succeeded at enforcing them, which amounts to the same thing). That is what gives me the chills here.
    - WoahNoun 4y ago
      >government can’t directly take away your livelihood without a good reason, and if you think the reason was not good there are reasonably unbiased ways to have your disagreement considered OFAC sanctions can be appealed.
plq 4y ago
As an example, it seems plausible to me that a person who wants to enter the cryptocurrency sector could send a pull request and actually work with them to get merged to put it in their resume. This person can be totally oblivious to the illegal stuff that's happening behind the scenes. After all they were just trying to prove that they actually have experience with cryptocurrency code to potential future employers. It also can be some random security researcher who is preventing open source developers from shipping vulnerable code. I know for a fact that Github themselves employ such people that send security-related patches from time to time to open-source projects. You can work up more examples -- my point is that people who definitely have nothing to do with any illegal activity whatsoever could exist in the list of contributors of these repositories. It's nice that they didn't just nuke the whole contributors list, but it's still a bit unsettling. > it's your responsibility to know and check who you are dealing with. What can I say, duly noted.
- HeyLaughingBoy 4y ago
  The unfortunate reality is that there are no guarantees. I once inadvertently helped someone commit suicide. I had no idea until after he did the deed and there's no realistic way I could have known beforehand. Sometimes you just have to assume that everyone's operating in good faith.

dingleberry420 4y ago

> The argument probably is that they assisted a sanctioned entity by providing a contribution i.e. service to it. And what if they did so before the sanctions? Is the US so happy to retroactively punish people who literally did nothing wrong?

JumpCrisscross 4y ago
> people who literally did nothing wrong? What on earth did people think a tumbler like Tornado Cash was going to be used for and by?
- dingleberry420 4y ago
  Not sure, thoughtcrime is a thing now in modern America?
  - JumpCrisscross 4y ago
    > thoughtcrime is a thing now in modern America? Nothing wrong with writing code. Code is speech, that's settled law. But the Tornado Cash team wasn't just publishing. They were building a tool. Semenov styled himself as a co-founder and the group advertised open positions on its website.
    - dingleberry420 4y ago
      Okay, how does that relate to open source contributors? Can you retroactively read their minds and determine their intent? Why does their intent even matter? What they were doing was not illegal at the time, and now they are being punished by the US.
      - bad416f1f5a2 4y ago
        > now they are being punished by the US. The US didn't mandate deletion of their Github account. The US isn't punishing them – you can tell because they didn't put them explicitly on the SDN list. Microsoft made the choice to remove their accounts. Their compliance team likely looked and said "$ we make from these devs < $$$ we'd pay to our lawyers to simply decide if we should keep them on our platform."
      - JumpCrisscross 4y ago
        > Why does their intent even matter? It doesn’t. Tornado was used to launder money. That’s all that matters. My guess is the only people in real legal jeopardy are those who kept working on it after its involvement in laundering was exposed. (I’m assuming they weren’t in on the laundering.) For GitHub, figuring out who those people are is impossible. So they’re being cautious and cutting ties more broadly. There is a creep problem to sanctions. Some companies in Russia are banned. Suddenly everyone from Cyprus is under extra scrutiny, since you don’t want to be the dupe they used to launder their money. Tornado and its developers were those dupes. But it has been illegal to help North Koreans launder money since before Tornado was founded. It remained illegal when it became known North Korea used Tornado to launder money. Anyone going into money services knows, or is negligent in not knowing, that these laws apply to them. It’s tough to have sympathy for anyone who kept ties. Particularly when the punishment, so far, is simply ostracism.

mananaysiempre 4y ago

> The key issue is that any collateral damage is considered acceptable, but any false negatives are absolutely not. Even though “better 100 guilty persons should escape than that one innocent person should suffer”. Not that this was ever uncontroversial, but how did it ever go so wrong, that the very problems of government that modern laws sought to correct are gleefully recreated using private companies as enforcement proxies?

WoahNoun 4y ago
Companies try not to break laws in general. If they think doing business with you will create a liability for them, they have a freedom of association right to deny you service.
- mananaysiempre 4y ago
  Giving a legal answer to a moral question is backwards, I think. I understand the mechanics of how it works, but I’m asking how it should, not whether it does. (Franklin’s opinions on how trials ought to go are also hardly representative of the legal practices of the late 18th century.) It is not at all a universal opinion that non-natural persons should have freedom of association at all or in this manner. I’m not trying to directly argue that they shouldn’t, though (as long as we allow that there is no moral principle that a non-natural person’s rights follow a natural one’s). I’m saying that it’s generally accepted to be a good thing that a (branch of) government can’t directly take away your livelihood without a good reason, and if you think the reason was not good there are reasonably unbiased ways to have your disagreement considered. For the most part, this applies to a government doing it by prohibiting a private party to deal with you. On the other hand, if the same state of affairs is reached by that government merely making it potentially very expensive for a private party to deal with you, somehow none of these standards apply anymore (or maybe they nominally do but nobody’s ever succeeded at enforcing them, which amounts to the same thing). That is what gives me the chills here.
  - WoahNoun 4y ago
    >government can’t directly take away your livelihood without a good reason, and if you think the reason was not good there are reasonably unbiased ways to have your disagreement considered OFAC sanctions can be appealed.

plq 4y ago

As an example, it seems plausible to me that a person who wants to enter the cryptocurrency sector could send a pull request and actually work with them to get merged to put it in their resume. This person can be totally oblivious to the illegal stuff that's happening behind the scenes. After all they were just trying to prove that they actually have experience with cryptocurrency code to potential future employers. It also can be some random security researcher who is preventing open source developers from shipping vulnerable code. I know for a fact that Github themselves employ such people that send security-related patches from time to time to open-source projects. You can work up more examples -- my point is that people who definitely have nothing to do with any illegal activity whatsoever could exist in the list of contributors of these repositories. It's nice that they didn't just nuke the whole contributors list, but it's still a bit unsettling. > it's your responsibility to know and check who you are dealing with. What can I say, duly noted.

HeyLaughingBoy 4y ago
The unfortunate reality is that there are no guarantees. I once inadvertently helped someone commit suicide. I had no idea until after he did the deed and there's no realistic way I could have known beforehand. Sometimes you just have to assume that everyone's operating in good faith.