GitHub blocks entire company because one employee was in Iran • Hacker News Board

Re: GitHub blocks entire company because one employee was in Iran

#291

Post by draw_down » Tue, Jan 05, 2021, 2:58 PM UTC

Merman_Mike wrote: post #285

nanna wrote: post #280

To be fair Nat Friedman replied: > Hi Sebastian, sorry to hear about this. I will check into it right away and get your org unblocked. https://twitter.com/natfriedman/status/1346452935924846593?s... Pretty messed up that they built this kill switch in the first place though, if you ask me.

This behavior shouldn't be praised. Having to go on twitter, get on the front page of HN, and make Github look bad seems like the only way to get help these days.

You guys can keep making this point, and I guess you probably will. But that ship has sailed folks.

Doing it this way works, whether we like it or not.

Re: GitHub blocks entire company because one employee was in Iran

#292

Post by raziel2p » Tue, Jan 05, 2021, 2:59 PM UTC

x3c wrote: post #153

cies wrote: post #71

Earlier quoted context omitted.

> Ironically, Git is a decentralized version control system. And Git is open source. Github is a US-registered company under MS. The US has a history of weaponizing its economic power. Stallman (RMS) was right once again.

This particular case was overreach by Github and not the US Lawmakers. https://home.treasury.gov/policy-issues/financial-sanctions/... 118. I have a client that is in Iran to visit a relative. Do I need to restrict the account? A: No. As long as you are satisfied that the client is not ordinarily resident in Iran, then the account does not need to be restricted. See FAQ 37. Source: https://twitter.com/Hamed/status/13…

If you read this literally, you could get away with leaking state secrets as long as you're visiting a relative while doing it.

Github cannot be expected to reliably differentiate between the coworker who just checked the status of a PR on a webapp versus the employee who opened a crucial piece of encryption code to leak it to the Iranian military or whatever.

Re: GitHub blocks entire company because one employee was in Iran

#293

Post by smarx007 » Tue, Jan 05, 2021, 3:00 PM UTC

zuzun wrote: post #119

jeroenhd wrote: post #29

Earlier quoted context omitted.

To be fair to GH, I wouldn't trust them if their customer service could be convinced to unlock an account with neither email nor 2FA access. Passwords leak all the time (because people are bad at using unique passwords) and social engineering efforts are quite effective at hijacking high-value accounts in a great deal of companies, so while I sympathise with the loss of your account, your experience actually improves…

They just turned 2FA on for all accounts and that was the moment I found out that mine was pointing to the wrong email address. I wish they would allow you to sign something with your private SSH key to get an inactive account back.

I think this is where I think having a scan of a passport and requiring a letter certified by a public notary would be a better approach.

Re: GitHub blocks entire company because one employee was in Iran

#294

Post by risyachka » Tue, Jan 05, 2021, 3:01 PM UTC

kavalg wrote: post #245

turbinerneiter wrote: post #235

Earlier quoted context omitted.

GitLab, Gitea or others provide most, if not all, and in some cases even more features than GitHub. Theiy are fully or partially Open Source and they are easy to host. You need to compare the cost of self-hosting to the cost of SaaS - INCLUDING the risk of getting locked out. One downside of the SaaS model is that you are just a very small customer in the bigger scheme and they can't really justify spending money on…

WRT self hosting, GitLab could be painful, but Gitea is really easy to host and keep up to date.

I've been self-hosting gitlab for few years now in my company and never had a problem.

Re: GitHub blocks entire company because one employee was in Iran

#295

Post by astura » Tue, Jan 05, 2021, 3:02 PM UTC

dustinmoris wrote: post #57

Is GitHub going to take itself down when one of their employees goes to Iran for holiday and logs into their GitHub account? If not, then why are they treating others with such contempt?

I'd imagine Github/Microsoft has extremely strict rules about not taking company resources to, or performing any work at, or accessing any company resources from countries that are embargoed.

This simply wouldn't happen at my company because special permission is needed to take any company assets out of the country. If anyone at my company casually took a company laptop to Iran that would be instant termination. It absolutely astonishes me that a company wouldn't have a policy about taking company resources to foreign countries.

Re: GitHub blocks entire company because one employee was in Iran

#296

Post by koheripbal » Tue, Jan 05, 2021, 3:03 PM UTC

raziel2p wrote: post #292

x3c wrote: post #153

Earlier quoted context omitted.

This particular case was overreach by Github and not the US Lawmakers. https://home.treasury.gov/policy-issues/financial-sanctions/... 118. I have a client that is in Iran to visit a relative. Do I need to restrict the account? A: No. As long as you are satisfied that the client is not ordinarily resident in Iran, then the account does not need to be restricted. See FAQ 37. Source: https://twitter.com/Hamed/status/13…

If you read this literally, you could get away with leaking state secrets as long as you're visiting a relative while doing it. Github cannot be expected to reliably differentiate between the coworker who just checked the status of a PR on a webapp versus the employee who opened a crucial piece of encryption code to leak it to the Iranian military or whatever.

The above is not law. The law is more detailed. This is a FAQ that should be interpreted in a reasonable fashion, not with an extreme use-case.

Re: GitHub blocks entire company because one employee was in Iran

#297

Post by A4ET8a8uTh0 » Tue, Jan 05, 2021, 3:04 PM UTC

elmo2you wrote: post #199

cies wrote: post #71

Earlier quoted context omitted.

> Ironically, Git is a decentralized version control system. And Git is open source. Github is a US-registered company under MS. The US has a history of weaponizing its economic power. Stallman (RMS) was right once again.

I would go quite a step further than that. If this was not an unfortunate incident/mistake, then GitHub/Microsoft has become quite the active enforcer of US (legal) foreign policy. If they do that within the US market, that might be justifiable. But in this particular case, GitHub appears to enforce US foreign policy on what appears to be a company on the EU market. Also in what to me appears to be a rather ruthless,…

"I would go quite a step further than that. If this was not an unfortunate incident/mistake, then GitHub/Microsoft has become quite the active enforcer of US (legal) foreign policy."

I am not sure if most people realize this, but OFAC compliance is rather rigid with no room for error ('strict liability'). And US treasury enforces it hard. Recently, Amazon got caught in its cross-hairs ( though it managed to get away with a low fine relative to its size ).

I guess what I am saying, according to OFAC, everyone is responsible for enforcing US foreign policy.

edit: Everyone as in US person, person on US soil or someone using US dollar. I really should avoid exaggeration.

Re: GitHub blocks entire company because one employee was in Iran

#298

Post by x86_64Ubuntu » Tue, Jan 05, 2021, 3:04 PM UTC

raziel2p wrote: post #292

x3c wrote: post #153

Earlier quoted context omitted.

This particular case was overreach by Github and not the US Lawmakers. https://home.treasury.gov/policy-issues/financial-sanctions/... 118. I have a client that is in Iran to visit a relative. Do I need to restrict the account? A: No. As long as you are satisfied that the client is not ordinarily resident in Iran, then the account does not need to be restricted. See FAQ 37. Source: https://twitter.com/Hamed/status/13…

If you read this literally, you could get away with leaking state secrets as long as you're visiting a relative while doing it. Github cannot be expected to reliably differentiate between the coworker who just checked the status of a PR on a webapp versus the employee who opened a crucial piece of encryption code to leak it to the Iranian military or whatever.

If that's the case, then the problem isn't Github, but of the organization having Iranian intelligence assets on staff. And the whole idea of the government regulating encryption and it being weaponized is overdone.

Re: GitHub blocks entire company because one employee was in Iran

#299

Post by Xylakant » Tue, Jan 05, 2021, 3:05 PM UTC

fibers wrote: post #204

cies wrote: post #71

Earlier quoted context omitted.

> Ironically, Git is a decentralized version control system. And Git is open source. Github is a US-registered company under MS. The US has a history of weaponizing its economic power. Stallman (RMS) was right once again.

I'm not a pro dev by any means but what is stopping orgs from simply self hosting such a thing? Git is merely version control which supposedly does not take a lot of resources so you can go ahead and buy a dedicated server and host it in your office. Is the question more so about expanded services like CI/CD that may take up more computational resources to continuously build binaries and other deliverables?

The compute part is the least of your worries, even installing the software is usually not your primary concern - everything is fine as long as you're on the happy path.

Software needs to maintained, patched, backed up, verified etc. It has bugs, security issues, hardware breaks in weird ways. This takes time and skill - ideally you'd need two or three people that are capable of fixing problems with the install. (one ill, one on vacation, one available). This is something that detracts from the actual work you're doing. I'm very much an ops person and I actually like tinkering with a gitlab install - it's just so many moving parts that I prefer not to run this for my company since it would eat a substantial chunk of my time just caring for this.

Re: GitHub blocks entire company because one employee was in Iran

#300

Post by jimmydorry » Tue, Jan 05, 2021, 3:06 PM UTC

darkwater wrote: post #220

another-dave wrote: post #148

Earlier quoted context omitted.

> Says who? There is a law, the law is unclear and IHMO a bad law. Says the US Department of the Treasury, as mentioned in the Twitter thread further down: > 118. I have a client that is in Iran to visit a relative. Do I need to restrict the account? > No. As long as you are satisfied that the client is not ordinarily resident in Iran, then the account does not need to be restricted. from their "FAQs: Iran sanctions"…

And now is when GP should reply saying "oh gee, you are right and I was wrong. thanks for pointing that out."

Github shoulders all the responsibility if they get it wrong. They appear to be doing the reasonable thing, up until this could not be resolved through customer support (as the company bears the burden of satisfying github that they are not violating the embargo).