Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub shuts off access to Aurelia repository, citing trade sanctions

twitter.com

Post reply on HN
Print view View original

211–220 of 312 posts

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#211

Post by mirimir »

cortesoft wrote: post #194
relaunched wrote: post #178

Earlier quoted context omitted.

Do you though? Really? https://www.wsj.com/articles/resignation-at-gitlab-highlight...

Yes, they do. If you are suggesting they should do what those employees did and quit in protest (which for a company would be to shut itself down), then I guess you are right they don't HAVE to comply with US law... but they do if they want to continue to exist.

They could move everything to Tor onion services, and offer clearnet access via disposable VPS as reverse proxies.

Paying staff anonymously would be problematic, I know.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#212

Post by dsl »

tlrobinson wrote: post #197
dsl wrote: post #160

Earlier quoted context omitted.

All North Korean internet traffic originates from 175.45.176.0/22. They have no reason to hide (except for the massive amount of cyber crime they originate, where VPNs are used)

> They have no reason to hide (except for the massive amount of cyber crime they originate, where VPNs are used) And, well, trade sanctions, which is why the parent comment wondered if they used VPNs.

I used to use an Iranian based VPN. Sanctions are almost always implemented by billing address, not by IP address. Geolocation services are crap when you start getting in to third world countries.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#213

Post by itronitron »

stickfigure wrote: post #4
firloop wrote: post #2

This is pure speculation, but it seems that GitHub's ownership by Microsoft causes them to be significantly more strict with the types of content that they are comfortable hosting. Expect this to continue as they expand up and down the stack; once their npm acquisition closes you'll see this there too. I think this should be a wake-up call to anyone staking their open source project on GitHub — if I let someone from…

This seems peculiar since Rob Eisenberg (author of that tweet and lead of Aurelia) works for Microsoft .

well, that helps explain the CEO's responsiveness in sorting it out

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#214

Post by dsl »

alireza94 wrote: post #200
EisenbergEffect wrote: post #141

GitHub has corrected the issue, restoring our organization access and web site. They have reported that the org was flagged as part of an automated process. The flagging occurred because we have two external contributors from Iran (non GH org members). They told me that there should have been a warning and they are investigating why that didn't happen. The CEO of GitHub also reached out personally to try to speedily…

Well, this sounds bad. A few months ago GitHub banned access of Iranian developers (and devs who live in a few other countries) to private repositories and gists and now, with actions like this, even if it's by accident, they are threatening our chance of collaboration to public open-source repos because maintainers would be afraid that if they accept our contribution they may face consequences.

> maintainers would be afraid that if they accept our contribution they may face consequences

But that isn't a result of GitHub's actions, if anything they are trying to protect maintainers by blocking Iranian contributions.

Sanctions are 1) implemented at a federal government level and 2) intended to make it almost impossible for the sanctioned country to get anything done. It's like not letting your kid take their Switch or iPhone with them to timeout. Yeah it sucks and makes everything awful, but that is exactly the point.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#215

Post by JyB »

EisenbergEffect wrote: post #141

GitHub has corrected the issue, restoring our organization access and web site. They have reported that the org was flagged as part of an automated process. The flagging occurred because we have two external contributors from Iran (non GH org members). They told me that there should have been a warning and they are investigating why that didn't happen. The CEO of GitHub also reached out personally to try to speedily…

Looks quite easy to trigger that automatic process to cause trouble to any open source repo on github.

Sounds insane.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#216

Post by relaunched »

bdcravens wrote: post #206
relaunched wrote: post #198

Earlier quoted context omitted.

Glad you asked. Since Sid respects the broadest interpretation, take a look at https://www.export.pitt.edu/sites/default/files/6.%20Anti-bo... It seems like, if a VP wants to discriminate hiring within certain countries, based on a pending customer contract, as stated by Mr. Johnson - it's reasonable to assume that GitLab should report, as per the EAR requirement, that: Any person under U.S. Jurisdiction who is asked…

That's not an interpretation of sanctions, you're pulling in a second set of laws. Additionally, I'm pretty sure a country being on a boycotted list doesn't prohibit a company from making hiring decisions for reasons outside of the boycott.

At best, it's a matter of law to determine what doing business in a country means. In the broadest interpretation, employing seems like doing business. Merely being asked, by a customer, is reportable and the government gets to make the determination.

How to act seems like a determination / recommendation made by the head of compliance.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#217

Post by brodock »

mroche wrote: post #126
enriquto wrote: post #15

Earlier quoted context omitted.

You can use any old git repo as your main source, and "dump" every commit into github for visibility. Any issues and pull request into the github site are replied by an automatic answer to use some other site.

For my GitLab repos (where I maintain source/workflow) I use the mirror functionality to automatically push any and all all commits to GitHub. I configure the GitHub mirror with a link to the official repo and disable issues. Unfortunately, you can’t outright disable GitHub’s pull requests. I’ve seen plenty of orphaned PRs on repos that do tracking/review elsewhere and people just don’t read (or actively ignore) the…

looks like you can use Actions for that:

https://github.com/marketplace/actions/close-pull-request

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#218

Post by mirimir »

dsl wrote: post #212
tlrobinson wrote: post #197

Earlier quoted context omitted.

> They have no reason to hide (except for the massive amount of cyber crime they originate, where VPNs are used) And, well, trade sanctions, which is why the parent comment wondered if they used VPNs.

I used to use an Iranian based VPN. Sanctions are almost always implemented by billing address, not by IP address. Geolocation services are crap when you start getting in to third world countries.

Billing addresses are easy to fake.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#219

Post by Twirrim »

firloop wrote: post #2

This is pure speculation, but it seems that GitHub's ownership by Microsoft causes them to be significantly more strict with the types of content that they are comfortable hosting. Expect this to continue as they expand up and down the stack; once their npm acquisition closes you'll see this there too. I think this should be a wake-up call to anyone staking their open source project on GitHub — if I let someone from…

Note: This is the company that is acquiring NPM. Which now also is going to have to deal with the messy reality of us sanctions, if they'd been dodging them before. Prior to this it wouldn't have been entirely beyond the pale for NPM to move ownership to another country if it proved to onerous. The threshold for "too onerous" is likely to be significantly higher at Microsoft / Github.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#220

Post by mappu »

shadowgovt wrote: post #111
vetinari wrote: post #45

Earlier quoted context omitted.

Is it really a thing, to have to learn another site? If you know the basic functionality of Github, do you really have to learn to use similar functionality of Gitlab, Gitea, etc? Is it not enough to be familiar with the concepts?

Having to set up a new account, complete with a new username and password, is by itself sufficient to drive away a staggering amount of adoption / conversions according to several UX studies.

Gitea supports "log in with GitHub" if the site-owner has enabled it; and the UI is immediately familiar.
Post reply on HN