8 ms·

Ipmitool Repository Archived, Developer Suspended by GitHub

177 points by marcodiego 4y ago

TheDesolate0 4y ago
[dead]
_8j50 4y ago
There is a ton of Repos owned by Russians. It would be chaos if they suspended them for that alone. Maybe someone falsley reported one of his repos?
- oynqr 4y ago
  The fallout1-ce and fallout2-ce repos got archives fairly recently as well. Looking at the owner's name made me concerned that exactly this was happening.
- smsm42 4y ago
  Not all of them work for companies sanctioned by US government though.
bayandin 4y ago
It looks related to an organisation he linked to https://github.com/YADRO-KNS https://github.com/YADRO-KNS. All its repos and repos of other people from it are archived as well. https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20220915#:~:text=LIMITED%20LIABILITY%20COMPANY-,YADRO,-FAB%20DUBNA%20(a https://home.treasury.gov/policy-issues/financial-sanctions/...
- asciii 4y ago
  Spot on here. The CHANGELOG has comments for YADRO product ids. > https://github.com/ipmitool/ipmitool/search?q=YADRO https://github.com/ipmitool/ipmitool/search?q=YADRO
  - cft 4y ago
    It looks like YADRO is making server hardware. IPMI is just enumerating server hardware in the linked GitHub.
    - lamontcg 4y ago
      The author works for YADRO: https://ru.linkedin.com/in/aamelkin https://ru.linkedin.com/in/aamelkin Microsoft has to shut off his account due to his relationship with a company officially sanctioned by the US government.
      - chatmasta 4y ago
        It's ironic you link to his (apparently not suspended) profile on LinkedIn, which is also owned by Microsoft.
        mdaniel 4y ago
        I was curious if Microsoft perhaps had done some "offshore" shenanigans but nope, it resolves to an IP within their netrange $ host ru.linkedin.com. ru.linkedin.com is an alias for cctld.linkedin.com. cctld.linkedin.com is an alias for mix.linkedin.com. mix.linkedin.com is an alias for any-na-lx.mix.linkedin.com. any-na-lx.mix.linkedin.com has address 108.174.10.24 any-na-lx.mix.linkedin.com has IPv6 address 2620:109:c002::6cae:a18 $ whois 108.174.10.24 CIDR: 108.174.0.0/20 NetName: LINKEDIN NetHandle: NET-108-174-0-0-1 Organization: LinkedIn Corporation (LINKE-1) OrgName: LinkedIn Corporation OrgId: LINKE-1 Address: 1000 W Maude Ave City: Sunnyvale StateProv: CA PostalCode: 94085 maybe they can't prove the LinkedIn profile was created by the natural person, but the commit email ... or payment details? ... something something
        lamontcg 4y ago
        Linkedin is another BU and their actions are not going to be coordinated with GH, so they may be determining what to do about profiles like his, and about ru.linkedin.com in general. Or linkedin may simply not be important enough for the US government to care about. Nobody is going to hold them accountable for inconsistency, and they only really care about is actions towards achieving the effect they desire. It is all implemented by humans and not a computer problem. At some level of detail they'll stop caring because like everyone else employed in this country, they're too busy with more important things.
- rozab 4y ago
  Nice job, more info here https://sanctions.nazk.gov.ua/en/sanction-company/6813/ https://sanctions.nazk.gov.ua/en/sanction-company/6813/
  - smsm42 4y ago
    If Amelkin works for YADRO, could he not know his company got sanctioned? It's pretty big thing to happen, and judging from his LinkedIn comments, he knows it. Yet he writes the suspension was "without any explanation whatsoever". I think he knows the explanation, he doesn't like it but it's no mystery to anyone.
- kvathupo 4y ago
  That's very interesting: I'm not sure how to feel about this. On one hand, it aligns with my ethics to shut-down the operations of sanctioned companies to minimize their harm. On the other, 1. Ethics are relative 2. Should open-source contributions be dependent on such ethics? On (1), I'm sure non-Americans would have ethical qualms with our Defense companies. Would I be okay with the hypothetical of letting a non-American company stop open-source development on a useful Lockheed Martin tool? On (2), I have personally seen open-source contributions from sanctioned companies, e.g. Megvii. Is it fair to ban those employees (who may simply be unwilling to go through the hoops of immigration)? As an aside, perhaps this repo could move to GNU Savannah?
  - firebaze 4y ago
    > On one hand, it aligns with my ethics to shut-down the operations of sanctioned companies to minimize their harm. Only if the sanctions are warranted by ethics. Which they are not, in this case - there isn't anything online I can find which supports sanctioning this specific company. This is a repeating pattern in this conflict: even without substantial or even circumstantial proof that a russian company benefits from or at least tolerates the war, in the event Ukraine tells us to sanction the respective company, we have to obey or else. What do we expect? Should all russian companies shut down because of the war? Would this be what we expect from all western companies, like when we attacked Iraq because of Weapons of Mass Destruction? This is slowly really getting ridiculous. Even more so if this opens up an attack vector from even more non-friendlies because of an orphaned github account.
    - deleted 4y ago
      [deleted]
    - kofejnik 4y ago
      Every Russian company needs to be sanctioned. Especially a tech one.
      - ChoGGi 4y ago
        Sad you're being down voted. I feel bad for Russian companies being sanctioned, but I feel worse for Ukranians defending their country.
ashishb 4y ago
Any recommended automated mirroring tools to keep a backup of private GitHub repos to avoid the situation where your GitHub account is suspended?
- coffeeri 4y ago
  If you are fine with self hosting a gitea instance, you'll be able to set up a pull mirror. https://docs.gitea.io/en-us/repo-mirror/#pulling-from-a-remote-repository https://docs.gitea.io/en-us/repo-mirror/#pulling-from-a-remo...
- Fatnino 4y ago
  Isn't your working copy a backup?
  - bob1029 4y ago
    A lot of people also use GH issues to track ideas/code snippets/etc.
  - ashishb 4y ago
    I have deleted local copies from my machine in the past. And when there are other contributors local copy is not guaranteed to be up to date unless you yourself are actively contributing as well.
- rsync 4y ago
  I keep interesting and valuable repos in my rsync.net account and I use git to pull them directly: ssh user@rsync.net git clone mirror … blah blah … … which is nice because I don’t use my own bandwidth.
- ofchnofc 4y ago
  [dead]
- mzur 4y ago
  I use this shell script with a cron job: https://gist.github.com/rodw/3073987 https://gist.github.com/rodw/3073987 It can back up repos, issues and wikis.
1MachineElf 4y ago
I'd bet GitHub's hardware, if they use any at all for their servers, has ipmitool installed. When you're in GitHub's position, how does your SBOM vulnerability management program handle it when you imperil your own infrastructure?
neilv 4y ago
I suppose this is due to economic sanctions, but of course there's also the infosec concern. Much of "tech" right now is still cavalier about software provenance in general. And IPMI is one of the more sensitive points. I have a pretty warm-fuzzy aspirations about open source at its best: being collective effort, of people of goodwill, around the world, working together, for the benefit of all. It's tragic that our world has so much conflict, aggression, inequity, and other ills. Open source is one place that we've sometimes formed bridges despite this, but it's not entirely immune to the larger world problems.
IYasha 4y ago
I love ipmitool (although it became extremely slow after Debian upgrade, but nonetheless)! Saves me so much trouble of using clunky web and java pages.
lakomen 4y ago
How did we allow Microsoft to have so much power of open source software that it can decide who gets to publish and who can't. Instead of "liberating" social media (sorry, Twitter) from corporate faschism we should've built an open platform resilient against corporate takeovers. Russia, time to create a github for people by the people.
- cryonier 4y ago
  [dead]
- smsm42 4y ago
  The irony of calling an actual fascist regime to fight "corporate fascism" is nothing but delicious.
LouisSaifer 4y ago
The software is not the tool, you are the tools, the pretentious smart who in reality are fools
br0ker 4y ago
These, to put it mildly, not very smart people have opened a pandora's box and if they do not understand this in their blind anger, desire to please or arrogance, then I sincerely feel sorry for them and in general the entire open source community that somehow depends on github.
trallnag 4y ago
Ridiculous. Why didn't they just remove the account link to the sanctioned organization?
newsclues 4y ago
Is he Russian? Looks like he may be in Moscow, and there is a war...
- denton-scratch 4y ago
  There are always wars. USA is not at war with Russia - at least, not openly.
- atomicUpdate 4y ago
  For anyone that didn't RTFA: > There is no clear indication why GitHub blocked Amelkin but may have to do with him being based out of Moscow, Russia as his repositories do not appear otherwise controversial.
  - rasz 4y ago
    Server management tool with a potential of pushing backdoored update being controlled by someone residing in Moscow is plenty controversial.
    - ghostoftiber 4y ago
      > a potential > residing in Moscow Guilty until proven innocent isn't a good look, especially when it comes down to where people live or their ethnic background.
      - sam_lowry_ 4y ago
        Ethnic? Rather succeptiple to thermo-rectile cryptoanslysis, as they call it jokingly in Russia.
      - jacob019 4y ago
        US law does not apply to foreign nationals residing in a foreign country. Russia is ruthlessly murdering their neighbors and has indicated that they are at war with the collective west. Russia has a long history of cyber espionage against the US and is actively engaged in Internet warfare. This is an entirely reasonable precaution by Microsoft. It's a sad moment.
dboreham 4y ago
For the curious, "archived" here means : repo is read-only but still exists.
- lakomen 4y ago
  It also means no other activities are allowed on it
  - randomguy54 4y ago
    Actions like forking?
    - jwilk 4y ago
      You can fork an archived repo.

177 points by marcodiego 4y ago

[dead]

There is a ton of Repos owned by Russians. It would be chaos if they suspended them for that alone. Maybe someone falsley reported one of his repos?

oynqr 4y ago
The fallout1-ce and fallout2-ce repos got archives fairly recently as well. Looking at the owner's name made me concerned that exactly this was happening.
smsm42 4y ago
Not all of them work for companies sanctioned by US government though.

bayandin 4y ago

It looks related to an organisation he linked to https://github.com/YADRO-KNS https://github.com/YADRO-KNS. All its repos and repos of other people from it are archived as well. https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20220915#:~:text=LIMITED%20LIABILITY%20COMPANY-,YADRO,-FAB%20DUBNA%20(a https://home.treasury.gov/policy-issues/financial-sanctions/...

asciii 4y ago
Spot on here. The CHANGELOG has comments for YADRO product ids. > https://github.com/ipmitool/ipmitool/search?q=YADRO https://github.com/ipmitool/ipmitool/search?q=YADRO
- cft 4y ago
  It looks like YADRO is making server hardware. IPMI is just enumerating server hardware in the linked GitHub.
  - lamontcg 4y ago
    The author works for YADRO: https://ru.linkedin.com/in/aamelkin https://ru.linkedin.com/in/aamelkin Microsoft has to shut off his account due to his relationship with a company officially sanctioned by the US government.
    - chatmasta 4y ago
      It's ironic you link to his (apparently not suspended) profile on LinkedIn, which is also owned by Microsoft.
      - mdaniel 4y ago
        I was curious if Microsoft perhaps had done some "offshore" shenanigans but nope, it resolves to an IP within their netrange $ host ru.linkedin.com. ru.linkedin.com is an alias for cctld.linkedin.com. cctld.linkedin.com is an alias for mix.linkedin.com. mix.linkedin.com is an alias for any-na-lx.mix.linkedin.com. any-na-lx.mix.linkedin.com has address 108.174.10.24 any-na-lx.mix.linkedin.com has IPv6 address 2620:109:c002::6cae:a18 $ whois 108.174.10.24 CIDR: 108.174.0.0/20 NetName: LINKEDIN NetHandle: NET-108-174-0-0-1 Organization: LinkedIn Corporation (LINKE-1) OrgName: LinkedIn Corporation OrgId: LINKE-1 Address: 1000 W Maude Ave City: Sunnyvale StateProv: CA PostalCode: 94085 maybe they can't prove the LinkedIn profile was created by the natural person, but the commit email ... or payment details? ... something something
        lamontcg 4y ago
        Linkedin is another BU and their actions are not going to be coordinated with GH, so they may be determining what to do about profiles like his, and about ru.linkedin.com in general. Or linkedin may simply not be important enough for the US government to care about. Nobody is going to hold them accountable for inconsistency, and they only really care about is actions towards achieving the effect they desire. It is all implemented by humans and not a computer problem. At some level of detail they'll stop caring because like everyone else employed in this country, they're too busy with more important things.
rozab 4y ago
Nice job, more info here https://sanctions.nazk.gov.ua/en/sanction-company/6813/ https://sanctions.nazk.gov.ua/en/sanction-company/6813/
- smsm42 4y ago
  If Amelkin works for YADRO, could he not know his company got sanctioned? It's pretty big thing to happen, and judging from his LinkedIn comments, he knows it. Yet he writes the suspension was "without any explanation whatsoever". I think he knows the explanation, he doesn't like it but it's no mystery to anyone.
kvathupo 4y ago
That's very interesting: I'm not sure how to feel about this. On one hand, it aligns with my ethics to shut-down the operations of sanctioned companies to minimize their harm. On the other, 1. Ethics are relative 2. Should open-source contributions be dependent on such ethics? On (1), I'm sure non-Americans would have ethical qualms with our Defense companies. Would I be okay with the hypothetical of letting a non-American company stop open-source development on a useful Lockheed Martin tool? On (2), I have personally seen open-source contributions from sanctioned companies, e.g. Megvii. Is it fair to ban those employees (who may simply be unwilling to go through the hoops of immigration)? As an aside, perhaps this repo could move to GNU Savannah?
- firebaze 4y ago
  > On one hand, it aligns with my ethics to shut-down the operations of sanctioned companies to minimize their harm. Only if the sanctions are warranted by ethics. Which they are not, in this case - there isn't anything online I can find which supports sanctioning this specific company. This is a repeating pattern in this conflict: even without substantial or even circumstantial proof that a russian company benefits from or at least tolerates the war, in the event Ukraine tells us to sanction the respective company, we have to obey or else. What do we expect? Should all russian companies shut down because of the war? Would this be what we expect from all western companies, like when we attacked Iraq because of Weapons of Mass Destruction? This is slowly really getting ridiculous. Even more so if this opens up an attack vector from even more non-friendlies because of an orphaned github account.
  - deleted 4y ago
    [deleted]
  - kofejnik 4y ago
    Every Russian company needs to be sanctioned. Especially a tech one.
    - ChoGGi 4y ago
      Sad you're being down voted. I feel bad for Russian companies being sanctioned, but I feel worse for Ukranians defending their country.

ashishb 4y ago

Any recommended automated mirroring tools to keep a backup of private GitHub repos to avoid the situation where your GitHub account is suspended?

coffeeri 4y ago
If you are fine with self hosting a gitea instance, you'll be able to set up a pull mirror. https://docs.gitea.io/en-us/repo-mirror/#pulling-from-a-remote-repository https://docs.gitea.io/en-us/repo-mirror/#pulling-from-a-remo...
Fatnino 4y ago
Isn't your working copy a backup?
- bob1029 4y ago
  A lot of people also use GH issues to track ideas/code snippets/etc.
- ashishb 4y ago
  I have deleted local copies from my machine in the past. And when there are other contributors local copy is not guaranteed to be up to date unless you yourself are actively contributing as well.
rsync 4y ago
I keep interesting and valuable repos in my rsync.net account and I use git to pull them directly: ssh user@rsync.net git clone mirror … blah blah … … which is nice because I don’t use my own bandwidth.
ofchnofc 4y ago
[dead]
mzur 4y ago
I use this shell script with a cron job: https://gist.github.com/rodw/3073987 https://gist.github.com/rodw/3073987 It can back up repos, issues and wikis.

1MachineElf 4y ago

I'd bet GitHub's hardware, if they use any at all for their servers, has ipmitool installed. When you're in GitHub's position, how does your SBOM vulnerability management program handle it when you imperil your own infrastructure?

neilv 4y ago

I suppose this is due to economic sanctions, but of course there's also the infosec concern. Much of "tech" right now is still cavalier about software provenance in general. And IPMI is one of the more sensitive points. I have a pretty warm-fuzzy aspirations about open source at its best: being collective effort, of people of goodwill, around the world, working together, for the benefit of all. It's tragic that our world has so much conflict, aggression, inequity, and other ills. Open source is one place that we've sometimes formed bridges despite this, but it's not entirely immune to the larger world problems.

IYasha 4y ago

I love ipmitool (although it became extremely slow after Debian upgrade, but nonetheless)! Saves me so much trouble of using clunky web and java pages.

lakomen 4y ago

How did we allow Microsoft to have so much power of open source software that it can decide who gets to publish and who can't. Instead of "liberating" social media (sorry, Twitter) from corporate faschism we should've built an open platform resilient against corporate takeovers. Russia, time to create a github for people by the people.

cryonier 4y ago
[dead]
smsm42 4y ago
The irony of calling an actual fascist regime to fight "corporate fascism" is nothing but delicious.

LouisSaifer 4y ago

The software is not the tool, you are the tools, the pretentious smart who in reality are fools

br0ker 4y ago

These, to put it mildly, not very smart people have opened a pandora's box and if they do not understand this in their blind anger, desire to please or arrogance, then I sincerely feel sorry for them and in general the entire open source community that somehow depends on github.

trallnag 4y ago

Ridiculous. Why didn't they just remove the account link to the sanctioned organization?

newsclues 4y ago

Is he Russian? Looks like he may be in Moscow, and there is a war...

denton-scratch 4y ago
There are always wars. USA is not at war with Russia - at least, not openly.
atomicUpdate 4y ago
For anyone that didn't RTFA: > There is no clear indication why GitHub blocked Amelkin but may have to do with him being based out of Moscow, Russia as his repositories do not appear otherwise controversial.
- rasz 4y ago
  Server management tool with a potential of pushing backdoored update being controlled by someone residing in Moscow is plenty controversial.
  - ghostoftiber 4y ago
    > a potential > residing in Moscow Guilty until proven innocent isn't a good look, especially when it comes down to where people live or their ethnic background.
    - sam_lowry_ 4y ago
      Ethnic? Rather succeptiple to thermo-rectile cryptoanslysis, as they call it jokingly in Russia.
    - jacob019 4y ago
      US law does not apply to foreign nationals residing in a foreign country. Russia is ruthlessly murdering their neighbors and has indicated that they are at war with the collective west. Russia has a long history of cyber espionage against the US and is actively engaged in Internet warfare. This is an entirely reasonable precaution by Microsoft. It's a sad moment.

dboreham 4y ago

For the curious, "archived" here means : repo is read-only but still exists.

lakomen 4y ago
It also means no other activities are allowed on it
- randomguy54 4y ago
  Actions like forking?
  - jwilk 4y ago
    You can fork an archived repo.