Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub blocks entire company because one employee was in Iran

twitter.com

Post reply on HN
Print view View original

331–340 of 515 posts

Re: GitHub blocks entire company because one employee was in Iran

#331

Post by 10000truths »

numlock86 wrote: post #42
zed88 wrote: post #11

What's the difference between a Chinese company and a US company? None. Both work for the state, although US ones operate under the guise of democracy. This sort of union between tech and politics is not going to take us anywhere.

Nice phrasing. A bit edgy and exaggerated, though. But since they are the same, I bet you can show us where the USA holds a few (at least 5 digit range) people in abduction camps, just to name one difference. Now that would be interesting.

Surely you’ve heard of ICE and the sorry state of their “detention facilities” by now?

Re: GitHub blocks entire company because one employee was in Iran

#332

Post by harperlee »

jimmydorry wrote: post #300
darkwater wrote: post #220

Earlier quoted context omitted.

And now is when GP should reply saying "oh gee, you are right and I was wrong. thanks for pointing that out."

Github shoulders all the responsibility if they get it wrong. They appear to be doing the reasonable thing, up until this could not be resolved through customer support (as the company bears the burden of satisfying github that they are not violating the embargo).

Yes, the core problem here is that unblocking the preventive block in 7 days is both unacceptable for the client and a big OPEX ask for github.

What I’m not sure at all is that github had the obligation to preventively block cases instead of the alternative to investigate high risk cases prior to block. As long as they had a sound Compliance process for determining sanction enforcement needs in a reasonable time it should be enough - though for sure more expensive than autoblock followed by non-specialized, non-time sensitive (for github!) customer service followup.

Re: GitHub blocks entire company because one employee was in Iran

#333

Post by Pet_Ant »

throwaway4good wrote: post #231
owlmirror wrote: post #200

Earlier quoted context omitted.

Github sure contributed to the popularity, but I remeber distinctly as Git came out and how it took off like rocket. Git was a "killer app" from it's day of inception and everyone I knew switched their source control to it in late 2005 early 2006. It was a game changer to say the least. Github jumped on a already rolling bandwagon and left me ans many people I knew wondering why the hell you would need to host your p…

Github fixes the problem that most users have with git (but are ashamed / too ignorant to admit): That it is de-centralized.

> Github fixes the problem that most users have with git (but are ashamed / too ignorant to admit): That it is de-centralized.

Git is designed for an environment where there are multiple canonical trunks. RedHats kernel is equally a master as SuSe's. So you are maintaining various tips in a semi-synchronized manner. In most projects there is a single repository branch that is the true branch (with perhaps a few tags for LTR) that represents the project. For that reason a lot of Git's mechanisms are unneeded complexity.

The killer features of Git is GitHub, and to a lesser degree local commits (after all, Mercurial has that too).

Re: GitHub blocks entire company because one employee was in Iran

#334

Post by 2OEH8eoCRo0 »

factorialboy wrote: post #34

So many dimensions come to play here. 1. There's the obvious legal aspect i.e. how these laws are framed and interpreted. 2. Then there's the geopolitical aspect. Is it fair to impose sanctions on Iran. 3. There's another aspect around GitHub policy that asks if an entire organization be banned for the location of one team member. 4. Finally, there's the aspect of relinquishing control. Your app development is on the…

5. Github is bound to obey US law and international trade agreements.

I think github is the last one at fault for this.

Re: GitHub blocks entire company because one employee was in Iran

#335

Post by elwell »

otagekki wrote: post #24
benjaminwootton wrote: post #15

Github refused to help me regain access to an 11 year old account when I changed jobs so lost access to 2FA and email account at the same time. We lost access to tens of thousands of dollars worth of project code which we had to rewrite. The customer service support was Google style brick wall. I wish this guy luck in getting access.

Rewrite? Wow. Hopefully for them it is just code so all they'd have to do is push their branches to a new self-hosted server.

Code is (almost) always better when it's re-written. So, maybe it was a blessing in disguise...

Re: GitHub blocks entire company because one employee was in Iran

#336

Post by BowBun »

astura wrote: post #295
dustinmoris wrote: post #57

Is GitHub going to take itself down when one of their employees goes to Iran for holiday and logs into their GitHub account? If not, then why are they treating others with such contempt?

I'd imagine Github/Microsoft has extremely strict rules about not taking company resources to, or performing any work at, or accessing any company resources from countries that are embargoed. This simply wouldn't happen at my company because special permission is needed to take any company assets out of the country. If anyone at my company casually took a company laptop to Iran that would be instant termination. It a…

My startup had similar rules when we were only 10 people.

Beyond just the Iran issue, it's known that trade secrets on employee laptops are at risk when crossing some international borders, particularly in airports. Border agents can confiscate electronic devices on vague suspicions, compel you to unlock them (or hack them open in some cases), and then leave them in unsupervised settings with yet more border agents who have the barest electronic security training. These risks terrified me during my travels!

Re: GitHub blocks entire company because one employee was in Iran

#337

Post by u801e »

pmontra wrote: post #195
whack wrote: post #110

Earlier quoted context omitted.

> You have relinquished so much control, why be surprised if that stares you back in the face? We live in a market-based economy with highly specialized division of labor. The idea of "keeping control" of all our necessities and dependencies, is an archaic one. The system generally works, because we create sensible laws that foster trust, vet for partners who are trustworthy, and name-and-shame entities that violate…

A customer of mine use GitHub, Travis and Slack. If GitHub is offline we can still setup a git server somewhere. I could offer my own for a quick startup. Mailing patches to each other, Linux kernel style, is not a viable backup plan. The cultural gap is too wide. If Travis is down we can run tests locally. We build the deployment artifact on one of our servers. If that one is down probably our production server is d…

When we ran services like this in-house, I don't really recall a time where any of them failed. Now that we have a 3rd party run those services, it's easy to recall multiple instances where one or more of them were down for some reason.

Re: GitHub blocks entire company because one employee was in Iran

#338

Post by madsbuch »

MattGaiser wrote: post #324
madsbuch wrote: post #223

Earlier quoted context omitted.

I think you are conflating marked share with quality of offering. Indeed there are viable local options for many of these things. Heck, the reason why European companies have so little relative marked share, is because they serve smaller, domestic, markets. A Danish webshop provider probably has a better offering for a webshop for servicing the Danish market. It probably has better support for Danish accounting, bett…

Do Danes have unique server needs compared to the rest of the world?

That's an issue for the webshop service provider ;)

Re: GitHub blocks entire company because one employee was in Iran

#339

Post by harperlee »

A4ET8a8uTh0 wrote: post #317
fennecfoxen wrote: post #306

Earlier quoted context omitted.

So look at (one one hand) a customer worth... well, PureLabs is "10 incredible FTEs," let's give them the $21/user/mo Enterprise plan at $210/month in revenue. On the other hand, a sanctions violation could be a $65,000 fine (Trading with the Enemy Act) or $250,000 (International Emergency Economic Powers Act) for each offense. (I leave aside the million-dollar narcotics-kingpin act). On top of this we also see the r…

It is hard to discuss hypothetical violations so I won't do that. It absolutely is a safe course of action to do a blanket ban. That said, is it reasonable to assume violation based on IP address ( and that is what seems to have happened here )? Banks don't automatically (typically ) block MUHAMMAD JIHAD even if they may end up questioning it.

That’s because the combined business of all Muhammads and their employers is way more than 210$/month AND it would be illegal, and Bad PR™, to ban them from your business based just on their culture/name. Otherwise they would have been “derisked” out of service.

Re: GitHub blocks entire company because one employee was in Iran

#340

Post by x3c »

justin66 wrote: post #309
x3c wrote: post #176

Earlier quoted context omitted.

Not as per the letter of the law. https://home.treasury.gov/policy-issues/financial-sanctions/...

It's so peculiar that you - and some guy on twitter, apparently - are quoting a footnote to a FAQ on Treasury's OFAC information page as if that captures the entirety of an American company's obligations under the law. This is really obviously crazy, right? In any other, less political, context involving business law and liability the advice would be "talk to a lawyer."

I doubt GitHub or any org is changing their SOP based on my comment. But the mere existence of a scenario equivalent to the one in question in the operating guidelines suggest there is room fur sanity to prevail in the interpretation of the law.
Post reply on HN