Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub shuts off access to Aurelia repository, citing trade sanctions

twitter.com

Post reply on HN
Print view View original

221–230 of 312 posts

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#221

Post by mirimir »

ljm wrote: post #153
natfriedman wrote: post #113

Hi HN, I'm the CEO of GitHub. Flagging this account was obviously a terrible mistake, and I apologize to anyone who was affected by it. We're investigating why it occurred and will make changes to make sure it doesn't happen again. I am glad that we restored access to the account in less than an hour after Aurelia filed their appeal. For context on why any account flagging is ever necessary, unfortunately, every comp…

How would this have been resolved if the post on Twitter/other social media didn't get enough traction? Is this just a terrible mistake because it has much more visibility than all of the other terrible mistakes?

I'm sure that there have also been takedowns that weren't terrible mistakes, but merely procedural. And given the disclosure that GitHub implements sanctions loosely, far more repos are likely at risk.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#222

Post by antoncohen »

bdcravens wrote: post #188
antoncohen wrote: post #109

Earlier quoted context omitted.

Does the law actually require a fully automated means of detection? For example to "nuke first" means you need to know that sanctions apply. If the law doesn't require it to be fully automated, "know that sanctions apply" could involve a human doing verification.

With over 100M repos, manually reviewing (even if the flagging for review is automated) is likely just not practical. I suspect that once they are aware (the automated flagging) they are then legally on the hook for as long as it takes to perform the review.

That still comes down to when they are considered "aware". If I emailed GitHub and told them the "microsoft" org was run by people in Iran, would they then be "aware" and need to shutdown the "microsoft" org? If you consider automated flagging to be a tip-off that needs to be investigated, then you aren't "aware" until it is investigated.

I don't think 100 million repos matters. What matters is how many automated tip-offs they need to investigate. It would have taken two minutes of investigation to find out this repo wasn't from a sanctioned country. If it takes two minutes to review a case, a team of five people could review over a thousand cases in an eight hour day. I work for a tech company that has a team of people that reviews uploaded content for copyright violations, it can be done.

Remember that the sanctions are for commercial use, primarily paid accounts. These sanction violation aren't happening at the rate of something like YouTube copyright violations. I wouldn't be surprised if it was less than ten a day.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#223

Post by slavik81 »

shadowgovt wrote: post #170
freeone3000 wrote: post #166

Earlier quoted context omitted.

It's local to the US and it's prejudice and propaganda, so...?

I think I'd need a citation on why "prejudice and propaganda" applies here. The US doesn't turn to sanctions flippantly (it's not in the US's economic interests, in general, to take a trading partner off the table).

I probably wouldn't use language quite that strong, but the view from outside the US is definitely quite different.

The US withdrawl from the Iran nuclear agreement was more a result of changes in the US than of changes in Iran. Barack Obama brokered the deal and he stated his clear opposition to Donald Trump's decision to end it. (https://facebook.com/barackobama/posts/10155854913976749)

The European Union was also a party to the Iran nuclear deal, and they thought so poorly of the resumption of US sanctions on Iran that they passed a law making it illegal for European companies to comply. (https://dw.com/en/eu-to-reactivate-blocking-statute-against-...)

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#224

Post by bdcravens »

antoncohen wrote: post #222
bdcravens wrote: post #188

Earlier quoted context omitted.

With over 100M repos, manually reviewing (even if the flagging for review is automated) is likely just not practical. I suspect that once they are aware (the automated flagging) they are then legally on the hook for as long as it takes to perform the review.

That still comes down to when they are considered "aware". If I emailed GitHub and told them the "microsoft" org was run by people in Iran, would they then be "aware" and need to shutdown the "microsoft" org? If you consider automated flagging to be a tip-off that needs to be investigated, then you aren't "aware" until it is investigated. I don't think 100 million repos matters. What matters is how many automated tip…

Ignoring the financial decision (manual vs automation) this suggests they are more concerned about false negatives than false positives.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#225

Post by luckylion »

dsl wrote: post #214
alireza94 wrote: post #200

Earlier quoted context omitted.

Well, this sounds bad. A few months ago GitHub banned access of Iranian developers (and devs who live in a few other countries) to private repositories and gists and now, with actions like this, even if it's by accident, they are threatening our chance of collaboration to public open-source repos because maintainers would be afraid that if they accept our contribution they may face consequences.

> maintainers would be afraid that if they accept our contribution they may face consequences But that isn't a result of GitHub's actions, if anything they are trying to protect maintainers by blocking Iranian contributions. Sanctions are 1) implemented at a federal government level and 2) intended to make it almost impossible for the sanctioned country to get anything done. It's like not letting your kid take their…

> But that isn't a result of GitHub's actions, if anything they are trying to protect maintainers by blocking Iranian contributions.

By blocking the repository of the maintainers? Is that like "I'm just trying to keep you safe. I'm going to kill you so nobody can murder you"?

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#226

Post by cortesoft »

mirimir wrote: post #211
cortesoft wrote: post #194

Earlier quoted context omitted.

Yes, they do. If you are suggesting they should do what those employees did and quit in protest (which for a company would be to shut itself down), then I guess you are right they don't HAVE to comply with US law... but they do if they want to continue to exist.

They could move everything to Tor onion services, and offer clearnet access via disposable VPS as reverse proxies. Paying staff anonymously would be problematic, I know.

Pay them with what money? How are they going to earn anything?

Meanwhile, they would also face arrest for ignoring US law.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#227

Post by hn23 »

woofcat wrote: post #57
vasco wrote: post #44

Sanctions for online services are one of the worst things about working in this industry. Being forced to implement and maintain technical solutions to block access to every day citizens of certain regions because some guys in suits decided these are second tier humans is demoralizing as hell. How are people supposed to rise up and depose or vote for less tyranical governments if they cannot access information, or us…

>What exactly is the plan? Are we expecting that individuals who disagree with their regimes would leave their country and their families? It just feels like cold blooded retribution with no care for the regular every day population. That it will impact the country economically and hopefully result in the Government changing coarse or for the People of the country to not want to live in a shitty place with a poor eco…

Sanctions are part of a war or often a preparation. You could also call it blackmailing. If people die from not having access to medical goods etc because of sanctions it just cheaper than sending troops.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#228

Post by rossmohax »

djsumdog wrote: post #184
rezonant wrote: post #172

Earlier quoted context omitted.

You need to do a post-mortem on this. What exactly did Aurelia do to trigger this to start with? A contribution from a sanctioned country? A github issue posted by someone from a sanctioned country? How exactly are open source projects supposed to avoid this possibility if they don't happen to literally be Rob Eisenberg? How many other project repositories have been disabled because of this problem? Is Github doing a…

Yea, there's a real lack of information in Github's response. I hope we get something more complete. But really, if your project is mature enough and you have the bandwidth, just host it yourself. Gogs, Gitlab, cgit .. lots of FOSS implementations to choose from.

Some projects enjoy increase in contributions once they move to Github. I think it was either CPython or Erlang which mentioned this effect.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#229

Post by jacquesm »

jiggawatts wrote: post #210
xxpor wrote: post #181

Earlier quoted context omitted.

The difference is companies actually get in a LOT of trouble for sanctions violations. When was the last time someone was prosecuted for an illegal GPS implementation?

The minute someone uses an open-source GPS radio to build a cruise missile in their garage, and uses it for assassinations. Given the current tech level available to hobbyists, this isn't that far fetched.

You don't need an open source GPS radio for that, just fly a bit slower. The upper limit is plenty fast for weapons, 1900 km/h isn't much of a limitation, neither is 59,000 ft of altitude.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#230

Post by mirimir »

cortesoft wrote: post #226
mirimir wrote: post #211

Earlier quoted context omitted.

They could move everything to Tor onion services, and offer clearnet access via disposable VPS as reverse proxies. Paying staff anonymously would be problematic, I know.

Pay them with what money? How are they going to earn anything? Meanwhile, they would also face arrest for ignoring US law.

Doesn't GitHub pay staff?

I'm saying to take the whole operation into anonymous space. Or replace it with one that is. It could be Tor, or perhaps Loki, based on what little I know about it so far. And pay with cryptocurrencies.

People who work anonymously enough can't be arrested.

For example, see http://cryptohippie.net/AnonAdmin.html

Post reply on HN