GitHub shuts off access to Aurelia repository, citing trade sanctions • Hacker News Board

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#301

Post by dylz » Fri, Mar 20, 2020, 7:31 PM UTC

duckmysick wrote: post #231

natfriedman wrote: post #113

Hi HN, I'm the CEO of GitHub. Flagging this account was obviously a terrible mistake, and I apologize to anyone who was affected by it. We're investigating why it occurred and will make changes to make sure it doesn't happen again. I am glad that we restored access to the account in less than an hour after Aurelia filed their appeal. For context on why any account flagging is ever necessary, unfortunately, every comp…

> unfortunately, every company in the world is required to comply with US sanctions if they do any business at all in the United States, e.g. serving US-based customers. This includes even interacting with US banking infrastructure. So being headquartered somewhere else doesn't help; you have to comply. And US sanctions as written do not allow us to provide commercial services or services which could be used commerci…

Wikipedia article says this:

> DHL offers worldwide services, including deliveries to countries such as Iraq, Afghanistan and Myanmar (formerly Burma). As it is German-owned, DHL is not affected by U.S. embargoes or sanctions and will ship to Cuba and North Korea. However, there are strict codes for delivering to North Korea, as the country has shaky relations with the West. As DHL is no longer a United States company, it is not allowed to make domestic flights between U.S. airports. DHL contracts these services to other providers.

> DHL ended domestic pickup and delivery service in the United States in 2009

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#302

Post by neotek » Sat, Mar 21, 2020, 2:21 AM UTC

piokoch wrote: post #284

rezonant wrote: post #172

Earlier quoted context omitted.

You need to do a post-mortem on this. What exactly did Aurelia do to trigger this to start with? A contribution from a sanctioned country? A github issue posted by someone from a sanctioned country? How exactly are open source projects supposed to avoid this possibility if they don't happen to literally be Rob Eisenberg? How many other project repositories have been disabled because of this problem? Is Github doing a…

Fun fact. My friend works in a bank. In this bank its account has a factory that produces curtains. Now, curtain in Polish is "firana", and any time those guys are doing a bank transfer it is thrown into some kind of lengthy manual processing mode because company name contains dreaded word "iran".

We had to remove products containing any and all references to Cuba and Egypt from our Shopify store to avoid PayPal suspending our account. All of the products are American made, produced in the US with local ingredients. For example, a raw flavour compound called “Cubano Style” or an eliquid brand called “The Great Pyramids” (fictional examples but in line with the real products.)

Only the thing was that PayPal wouldn’t actually confirm exactly what was triggering their automated system, we had to infer that ourselves by looking for commonalities between the flagged payments. Even when we identified the problem they refused to give any confirmation at all other than to re-enable our account.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#303

Post by neop1x » Sat, Mar 21, 2020, 10:53 AM UTC

fartcannon wrote: post #54

coliveira wrote: post #46

Earlier quoted context omitted.

Nobody should depend on GitHub, especially after it was taken over by Microsoft. If you have any repository on GH, create similar accounts on competing sites such as bitbucket. Also consider services hosted in other countries, since it seems that local political prejudices and propaganda are starting to creep out on the science and technology arena.

Better yet, self host. Post RSS feeds.

Pull requests and collaboration would be a bit more complicated, I guess. But as long as "Log in with ..." works to quickly create an account, it may be ok.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#304

Post by tedmiston » Sat, Mar 21, 2020, 7:21 PM UTC

Sephr wrote: post #300

tedmiston wrote: post #260

Earlier quoted context omitted.

ITAR undeniably applies to software. Whether it's open source or not is irrelevant. ITAR software cannot legally live on GitHub.com in any case -- it doesn't matter if the repos are public or private. [But a GitHub Enterprise install (self-hosted version only) can be compliant.] I'm confused by your request for the company's stance, since it's not something up for debate... there is no room for them to take a stance…

Are you sure about that? Publicly-available open source software can be exempt from ITAR according to this page: https://www.unr.edu/sponsored-projects/compliance/export-con...

If it's publicly available open source, it can't contain ITAR.

If there is existing open source that doesn't contain ITAR, then that's fine because it's beyond the scope of ITAR, so ITAR doesn't apply to that scenario. [Maybe this is the case you're mentioning?]

If it is ITAR, it can't possibly be publicly available open source. [How could it be possible to have publicly-available open source software that is also restricted to being only shared with U.S. citizens?]

Of course an ITAR project could pull in publicly available open source (e.g., dependencies), but that doesn't sounds like what's being discussed here.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#305

Post by SahAssar » Sat, Mar 21, 2020, 8:24 PM UTC

shadowgovt wrote: post #138

miracle2k wrote: post #51

Earlier quoted context omitted.

Note that Gitlab hosts on Google Cloud, which blocks all traffic from sanctioned countries on a network level. No IP packages from US sanctioned countries reach any service hosted on Google Cloud, including OpenSource gitlab repos.

Yep. Sum it all up, and the easiest way to not be disadvantaged on the Internet is to not be in a sanctioned country. Which is, well, rather the point of the sanctions.

No, the point of sanctions is to hurt the leaders of a country, not their citizens. That's why sanctions are applied to specific goods and not across the board.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#306

Post by ncmncm » Sat, Mar 21, 2020, 10:12 PM UTC

tedmiston wrote: post #304

Sephr wrote: post #300

Earlier quoted context omitted.

Are you sure about that? Publicly-available open source software can be exempt from ITAR according to this page: https://www.unr.edu/sponsored-projects/compliance/export-con...

If it's publicly available open source, it can't contain ITAR. If there is existing open source that doesn't contain ITAR, then that's fine because it's beyond the scope of ITAR, so ITAR doesn't apply to that scenario. [Maybe this is the case you're mentioning?] If it is ITAR, it can't possibly be publicly available open source. [How could it be possible to have publicly-available open source software that is also re…

This is just word games.

We can sensibly speak of tech that "would be" an ITAR violation to deliver "if it were not" open source. This is exactly the scenario under discussion. It seems very clear from the linked page that, e.g., GPS code that is released as free/open is, in fact, not restricted by ITAR.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#307

Post by hakfoo » Sat, Mar 21, 2020, 11:39 PM UTC

woofcat wrote: post #69

Joker_vD wrote: post #58

Earlier quoted context omitted.

Apparently, the idea is that those "Crimean or Iranian" would get pissed off at their government and revolt. Which, as the practice shows, doesn't quite work taht way. They get pissed off at the sanctioning government as well, and are less likely to believe that that government actually worries about their interests and rights and not, say, as using them as a free battering ram against their current government/regime…

However what's the alternative? Country 'A' would like to build a weapon of mass destruction. Country 'B' asks them nicely to not do that. They ignore the request and continue building the technology. At that point you can either do the following: - Ignore it and hope they don't destabilize the region / world. - Economic and Trade sanctions to slow down their progress, and impact the economy of the country. - Physica…

Economic sanctions might work as a sudden shock action.

Long-term sanctions are likely futile. There's a point at which the domestic economy compensates. They buy from other players, they learn to do without, they grumble and suck it up, but it doesn't evoke a reaction anymore. I also suspect the tendency to roll them out as "we're sanctioning 13 specific people in the cabinet and their companies" in waves until we finally actually impact everyday civilians doesn't help-- it's basically saying "brace for impact" to the population.

I suspect there's an entire generation or more of Cubans and Iranians who just grew up assuming "this is our economic normal" and don't really see it as a direct call to action of "if you'd be so kind as to remove your leadership, we'd buy your products."

Now, if you spend as much time as possible getting nations to build and maintain deep economic ties with each other, THEN pulling the plug suddenly and boldly, can have an impact. There's more disruption and a clear inflection point.

I also suspect that a lot of civilians view sanctions as non-actionable because there are usually limited and absurd requirements for them to be lifted. I can't imagine, for example, any way Cuba or the DPRK gets out of sanctions without explicitly discharging their current leadership. At best, that's intrusive and insulting to a sovereign nation; at worst it's cheering on civil war and strife. The Iran nuclear deal, before it imploded, was a potential breakthrough here-- we gave them tangible, realistic milestones that could be achieved without a coup, and honoured the commitment.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#308

Post by TechnicalVault » Sun, Mar 22, 2020, 1:53 AM UTC

tedmiston wrote: post #304

Sephr wrote: post #300

Earlier quoted context omitted.

Are you sure about that? Publicly-available open source software can be exempt from ITAR according to this page: https://www.unr.edu/sponsored-projects/compliance/export-con...

If it's publicly available open source, it can't contain ITAR. If there is existing open source that doesn't contain ITAR, then that's fine because it's beyond the scope of ITAR, so ITAR doesn't apply to that scenario. [Maybe this is the case you're mentioning?] If it is ITAR, it can't possibly be publicly available open source. [How could it be possible to have publicly-available open source software that is also re…

There is a certain unrealistic arrogance to the US approach to ITAR and software that seems to assume only US Persons could create technology on the list.

GPS receiver systems are the classic there: Russia, China and Europe all have their own GNSS. China runs the semiconductor industry and is quite capable of producing whatever unrestricted GNSS devices they choose. Therefore why restrict US companies?

Same with satellite tech, there may be some US specific tricks but there is a reason ITAR free satellite designs already exist and are multiplying. ITAR tries to protect too much and is killing US market share by being stupidly annoying.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#309

Post by TechnicalVault » Sun, Mar 22, 2020, 2:06 AM UTC

jiggawatts wrote: post #210

xxpor wrote: post #181

Earlier quoted context omitted.

The difference is companies actually get in a LOT of trouble for sanctions violations. When was the last time someone was prosecuted for an illegal GPS implementation?

The minute someone uses an open-source GPS radio to build a cruise missile in their garage, and uses it for assassinations. Given the current tech level available to hobbyists, this isn't that far fetched.

If you can understand the equations and engineering needed to build a cruise missile the GPS equations will not daunt you. Getting the final approach to have a useful Circular Error Probable at anything low enough for an assassination would be more of a technical challenge than the coarse guidance. Unless you had someone shining a designator you’d need real-time machine vision. To say nothing of designing an airframe that can perform precision manoeuvres at speed without breaking up.

Re: GitHub shuts off access to Aurelia repository, citing trade sanctions

#310

Post by kelnos » Sun, Mar 22, 2020, 9:12 PM UTC

GeorgeWBasic wrote: post #251

kelnos wrote: post #148

Earlier quoted context omitted.

That sounds good in theory, but in reality you end up with worse outcomes than doing nothing: a) The target country just allows their citizens to feel the brunt of the sanctions while the ruling class hoards resources for themselves. b) The target country starts a propaganda campaign to blame the sanction-issuer for all their problems, which the citizens mostly believe. So ultimately you end up with regular-Joe citiz…

> The target country starts a propaganda campaign to blame the sanction-issuer for all their problems, which the citizens mostly believe Because it's at least partly true. They are the ones issuing the sanctions.

Heh, an excellent point. Obviously the sanctioner's goal is for the sanctionee's citizens to understand why the sanctions are in place, and ultimately blame their own government, but that can be a hard sell, even without a propaganda campaign.