Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub shuts off access to Aurelia repository, citing trade sanctions

twitter.com

Post reply on HN
Print view View original

181–190 of 312 posts

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#181

Post by xxpor »

Sephr wrote: post #143
natfriedman wrote: post #113

Hi HN, I'm the CEO of GitHub. Flagging this account was obviously a terrible mistake, and I apologize to anyone who was affected by it. We're investigating why it occurred and will make changes to make sure it doesn't happen again. I am glad that we restored access to the account in less than an hour after Aurelia filed their appeal. For context on why any account flagging is ever necessary, unfortunately, every comp…

Do you believe that trade regulations such as ITAR apply to publicly-available open source software? I do not¹, and it appears that your employees do not believe this either. GitHub is currently hosting multiple GPS implementations² that are clearly against this line in your ToS, in addition to also being against ITAR by not implementing speed limits for missiles: "GitHub may not be used for purposes prohibited under…

The difference is companies actually get in a LOT of trouble for sanctions violations. When was the last time someone was prosecuted for an illegal GPS implementation?

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#182

Post by notafraudster »

ajross wrote: post #156
ljm wrote: post #153

Earlier quoted context omitted.

How would this have been resolved if the post on Twitter/other social media didn't get enough traction? Is this just a terrible mistake because it has much more visibility than all of the other terrible mistakes?

That's not a fair argument. You're demanding that GitHub prove the absence of any other mistakes. All they can do is fix bugs when they find them, the same as anyone else. If there's a systemic problem with the way they do sanction flagging, that needs evidence.

It would be pretty easy to prove the absence of other mistakes here by simply providing a public list of all repositories affected by sanctions flags. If the number is, say, thousands, then it's almost certain this is a deeply automated process and there are other errors. If it's, say, 10, then this is probably a human-driven process.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#183

Post by bdcravens »

relaunched wrote: post #178
sytse wrote: post #154

GitLab CEO here, thanks Nat for doing everything you can do to keep open source accessible around the world. We have to comply with the same restrictions and respect greatly that GitHub is taking the broadest possible interpretation of US sanctions law to help users.

Do you though? Really? https://www.wsj.com/articles/resignation-at-gitlab-highlight...

I'm not sure what those hiring practices have to do with the legally-mandated sanctions being referenced.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#184

Post by djsumdog »

rezonant wrote: post #172
natfriedman wrote: post #113

Hi HN, I'm the CEO of GitHub. Flagging this account was obviously a terrible mistake, and I apologize to anyone who was affected by it. We're investigating why it occurred and will make changes to make sure it doesn't happen again. I am glad that we restored access to the account in less than an hour after Aurelia filed their appeal. For context on why any account flagging is ever necessary, unfortunately, every comp…

You need to do a post-mortem on this. What exactly did Aurelia do to trigger this to start with? A contribution from a sanctioned country? A github issue posted by someone from a sanctioned country? How exactly are open source projects supposed to avoid this possibility if they don't happen to literally be Rob Eisenberg? How many other project repositories have been disabled because of this problem? Is Github doing a…

Yea, there's a real lack of information in Github's response. I hope we get something more complete.

But really, if your project is mature enough and you have the bandwidth, just host it yourself. Gogs, Gitlab, cgit .. lots of FOSS implementations to choose from.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#185

Post by larrik »

bartread wrote: post #128

WTH? GitHub is owned by Microsoft. Rob Eisenberg, who posted that tweet, works for Microsoft. There's so much about this I don't get, not least of which is the fact that despite what the headline suggests, along with the amount of bile still being spewed on this thread, Aurelia is back up and running, as are all its repos: https://aurelia.io/ , https://github.com/aurelia . So, yes, GitHub properly effed up here, but…

It got fixed quickly because of the very high profile nature of the project. What happens when it's one of our projects, and we aren't some bigwig at Github's parent company to complain?

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#186

Post by tomxor »

luckylion wrote: post #132
natfriedman wrote: post #113

Hi HN, I'm the CEO of GitHub. Flagging this account was obviously a terrible mistake, and I apologize to anyone who was affected by it. We're investigating why it occurred and will make changes to make sure it doesn't happen again. I am glad that we restored access to the account in less than an hour after Aurelia filed their appeal. For context on why any account flagging is ever necessary, unfortunately, every comp…

> I am glad that we restored access to the account in less than an hour after Aurelia filed their appeal. You mean after they went semi-viral on Twitter and landed on the HN front page. But I'm sure it doesn't happen again (to this repository, for this reason, in this year; everything else is on the table). Using Twitter, FB, HN etc as your support-priority-queue system is a terrible idea.

They reinstated the account 1hr after official appeal.

You comment is only relevant to those posts who are used as a last resort, usually after waiting days or weeks without any human response. AFAICT the tweet was done pretty much simultaneously, perhaps in an attempt to hasten response time.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#187

Post by bdcravens »

firloop wrote: post #2

This is pure speculation, but it seems that GitHub's ownership by Microsoft causes them to be significantly more strict with the types of content that they are comfortable hosting. Expect this to continue as they expand up and down the stack; once their npm acquisition closes you'll see this there too. I think this should be a wake-up call to anyone staking their open source project on GitHub — if I let someone from…

> Microsoft causes them to be significantly more strict with the types of content that they are comfortable hosting

The law as written doesn't allow subjective decision based on what they're comfortable with.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#188

Post by bdcravens »

antoncohen wrote: post #109
jedberg wrote: post #62

Earlier quoted context omitted.

Unfortunately US law dictates that you nuke first and ask questions later. You loose your platform protections if you don't.

Does the law actually require a fully automated means of detection? For example to "nuke first" means you need to know that sanctions apply. If the law doesn't require it to be fully automated, "know that sanctions apply" could involve a human doing verification.

With over 100M repos, manually reviewing (even if the flagging for review is automated) is likely just not practical. I suspect that once they are aware (the automated flagging) they are then legally on the hook for as long as it takes to perform the review.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#189

Post by zapttt »

zokier wrote: post #179
ljm wrote: post #159

Earlier quoted context omitted.

I disagree; it is a fair argument. This is the Tweet: > I woke up this morning and you shut off the Aurelia site, archived tons of our repos, and I can no longer access admin settings. You sited US trade sanctions and sent me a non-descriptive email with no remediation information. What is going on? This is devastating for us! "No remediation information," to me sounds like Twitter outrage was the remedy. A follow up…

> If a user or organization believes that they have been flagged in error, then that user or organization owner has the opportunity to appeal the flag by providing verification information to GitHub. Please see our FAQ for the appeals request form https://help.github.com/en/github/site-policy/github-and-tra... https://twitter.com/GitHubHelp/status/1240682163193942018 > If an individual user or organization administra…

which involves sending them documents and even selfies.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#190

Post by dependenttypes »

firloop wrote: post #2

This is pure speculation, but it seems that GitHub's ownership by Microsoft causes them to be significantly more strict with the types of content that they are comfortable hosting. Expect this to continue as they expand up and down the stack; once their npm acquisition closes you'll see this there too. I think this should be a wake-up call to anyone staking their open source project on GitHub — if I let someone from…

This is true, and not only for US regulation-related reasons. They also removed multiple political writings about people criticising their authoritarian governments as well as games with sexually explicit content (but no images).
Post reply on HN