Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub blocks entire company because one employee was in Iran

twitter.com

Post reply on HN
Print view View original

131–140 of 515 posts

Re: GitHub blocks entire company because one employee was in Iran

#131

Post by astura »

mola wrote: post #76
kiallmacinnes wrote: post #14

Earlier quoted context omitted.

> EDIT: concerning hypothetical worlds, I pretty much not want to live in a world were companies blindly follow the law regardless of how harmful it is. We have tried these worlds in the past and they were not pretty. Personally, I think a distinction is necessary. Companies IMO should absolutely obey the laws regardless of if they like them or not. It's entirely unfair to blame them for obeying the law. They (as wel…

One way to fight a law is civil disobedience.

You won't get that from Microsoft, they do a lot of business with the US government.

Re: GitHub blocks entire company because one employee was in Iran

#132

Post by qayxc »

londons_explore wrote: post #87
jeroenhd wrote: post #29

Earlier quoted context omitted.

To be fair to GH, I wouldn't trust them if their customer service could be convinced to unlock an account with neither email nor 2FA access. Passwords leak all the time (because people are bad at using unique passwords) and social engineering efforts are quite effective at hijacking high-value accounts in a great deal of companies, so while I sympathise with the loss of your account, your experience actually improves…

2FA should be bypassable after some longish lockout period. For example, someone has lost their password, email access, phone number, and 2FA app. Make them wait a month to regain account access. If any time during that month, the account is used or logged into, cancel the takeover request. During the month, every day send an email to all points of contact on the account letting them know what will happen. It's a tra…

> 2FA should be bypassable after some longish lockout period.

Nope. No backups, no sympathy, simple as that.

2FA is worthless if you start to put holes in it like that.

So if you value your data, make backups - preferably locally the old-fashioned way, e.g. HDDs stored in at least two different locations or at least using several different cloud providers (which have their own infrastructure and aren't just relying on AWS/GCP/Azure/etc.).

There's no such thing as a "trade-off" when it comes to cyber security - either commit to it fully or just don't use 2FA at all.

Personally, I think 2FA that doesn't rely on physical devices (phones, keys, smart cards, etc.) is unreliable and sketchy anyways.

If you can't spare a few hundred bucks on a NAS that you can just put in a storage unit or bank vault if need be, you data can't be that valuable anyway.

Re: GitHub blocks entire company because one employee was in Iran

#133

Post by tpoacher »

icelancer wrote: post #116
EdwinLarkin wrote: post #74

Entrusting your business to an american entity is the stupidest idea you could have thought about. Especially us europeans should not rely on American services at all.It's not worth it. American corporations are just as much a liability as their counterparts in China.

The top 33 "software and programming" companies by revenue in the world can be found below [0]. 28 of them are American. Two are in the EU. One is in the UK. One is in Australia. The last is Russian. One of the companies in the EU produces enterprise software almost no one on this website uses (SAP). The other is Dassault. In the US the top five companies are Microsoft, Oracle, ADP, Adobe, and Salesforce. If you incl…

Both you and the person you replied to are right. They are not mutually exclusive points.

Famous example: MS Windows having a marketshare of 96% should not necessarily stop you from designing your business around linux.

Re: GitHub blocks entire company because one employee was in Iran

#134

Post by kitd »

rad_gruchalski wrote: post #94
kitd wrote: post #53

Earlier quoted context omitted.

The real question is why GH blocks an Indian company and all its Indian employees (all legal and outside the US sanctions list) when an employee logs on in Iran. Does US law require application to such an extreme degree? If not, then why is GH doing it?

Because github is a company based in the USA and must comply with the law of USA. It does not matter where the customer of github is based. It would be the same with gitlab because they are based and hosted in the USA. If you are German and USA decides to apply sancations on Germany because of NordStream2 tomorrow, well, good luck setting up your own gitlab ce...

Ofc GH has to comply with US law, but you missed the question: does US law require blocking access to cover those who are not on the sanctions list?

Or look at it another way: this is an Indian company. Does one employee opening their laptop in Iran make it an Iranian company under US law?

Re: GitHub blocks entire company because one employee was in Iran

#135

Post by grumple »

jokethrowaway wrote: post #121
enriquto wrote: post #3

Earlier quoted context omitted.

It's alright to blame people for lawfully following harmful laws.

It's not. You have a literal state actor backed with an army demanding money if you don't comply. I'll pick the legal way unless the profits I can make somehow outweigh the sanctions (legislators can make mistakes too) and there are no penal repercussions.

It is. We established this quite clearly in Nuremberg.

Re: GitHub blocks entire company because one employee was in Iran

#136

Post by icelancer »

tpoacher wrote: post #133
icelancer wrote: post #116

Earlier quoted context omitted.

The top 33 "software and programming" companies by revenue in the world can be found below [0]. 28 of them are American. Two are in the EU. One is in the UK. One is in Australia. The last is Russian. One of the companies in the EU produces enterprise software almost no one on this website uses (SAP). The other is Dassault. In the US the top five companies are Microsoft, Oracle, ADP, Adobe, and Salesforce. If you incl…

Both you and the person you replied to are right. They are not mutually exclusive points. Famous example: MS Windows having a marketshare of 96% should not necessarily stop you from designing your business around linux.

Sure they are. Propose an EU or non-Chinese Asian alternative to AWS that is, say, 80% as efficient/effective. If that's not possible, then choosing AWS for your startup/scaling business is not the stupidest move you can make, assuming AWS fits your use case.

"MS Windows having a marketshare of 96% should not necessarily stop you from designing your business around linux"

But Windows doesn't have this kind of marketshare in most areas going forward? The #1 OS used worldwide is AndroidOS and no one is clamoring to write for it as far as I can tell.

Re: GitHub blocks entire company because one employee was in Iran

#138

Post by jojobas »

icelancer wrote: post #116
EdwinLarkin wrote: post #74

Entrusting your business to an american entity is the stupidest idea you could have thought about. Especially us europeans should not rely on American services at all.It's not worth it. American corporations are just as much a liability as their counterparts in China.

The top 33 "software and programming" companies by revenue in the world can be found below [0]. 28 of them are American. Two are in the EU. One is in the UK. One is in Australia. The last is Russian. One of the companies in the EU produces enterprise software almost no one on this website uses (SAP). The other is Dassault. In the US the top five companies are Microsoft, Oracle, ADP, Adobe, and Salesforce. If you incl…

You can use many of the products from the companies in the list (i.e. SAP, Adobe or Oracle) without risking all your data in a Kafkaesque ploy of sorts.

If you keep everything your business is at Amazon you better be prepared to Amazon booting you.

Re: GitHub blocks entire company because one employee was in Iran

#139

Post by afroboy »

wccrawford wrote: post #84
kkapelon wrote: post #61

This means that as a disgruntled employee I can simply visit Iran, log in my company Github account and boom! I have now taken revenge on my whole company with minimal effort.

Only if you're okay with the legal consequences of sabotaging the company. They absolutely can sue you for it, and you might even face criminal prosecution for such a thing.

On what basis they are going to sue him? he visited a specific country and than boom. how in the hell are going to prove that he did it in purpose.?

Re: GitHub blocks entire company because one employee was in Iran

#140

Post by dj_mc_merlin »

Erlich_Bachman wrote: post #123
whack wrote: post #110

Earlier quoted context omitted.

> You have relinquished so much control, why be surprised if that stares you back in the face? We live in a market-based economy with highly specialized division of labor. The idea of "keeping control" of all our necessities and dependencies, is an archaic one. The system generally works, because we create sensible laws that foster trust, vet for partners who are trustworthy, and name-and-shame entities that violate…

There is plenty of solutions that are keeping the data in-house. Or allow for easy exporting/importing (github is not too bad in this regard though). None of these solutions go against the "highly specialized division of labor". This is a question about what kind of solutions we build, not how labor is divided or not.

None of those solutions are as plug-and-play as hosted GitHub/GitLab, nor without maintenance costs. Those add up to quite a bit of money too, usually making hosted the more cost effective option. Although this can happen, the truth is 99% of the time it doesn't, so most companies continue to use hosted solutions as it is far more likely they go bankrupt due to poor business rather than US embargos.
Post reply on HN