GitHub blocks entire company because one employee was in Iran • Hacker News Board

Re: GitHub blocks entire company because one employee was in Iran

#381

Post by hoppla » Tue, Jan 05, 2021, 4:51 PM UTC

raziel2p wrote: post #292

x3c wrote: post #153

Earlier quoted context omitted.

This particular case was overreach by Github and not the US Lawmakers. https://home.treasury.gov/policy-issues/financial-sanctions/... 118. I have a client that is in Iran to visit a relative. Do I need to restrict the account? A: No. As long as you are satisfied that the client is not ordinarily resident in Iran, then the account does not need to be restricted. See FAQ 37. Source: https://twitter.com/Hamed/status/13…

If you read this literally, you could get away with leaking state secrets as long as you're visiting a relative while doing it. Github cannot be expected to reliably differentiate between the coworker who just checked the status of a PR on a webapp versus the employee who opened a crucial piece of encryption code to leak it to the Iranian military or whatever.

I do not see why a geoip filter do not suffice. GitHub should not be the one to interpret the whole complex picture.

Re: GitHub blocks entire company because one employee was in Iran

#382

Post by umarniz » Tue, Jan 05, 2021, 4:51 PM UTC

The US sanctions on Iran has such a massive impact on Iranians that most of us don't realise.

All US companies have to comply and majority of the tech companies are unfortunately in the US.

I know you can use a VPN and configure it on a router level to make sure that you are always connected via a VPN but just the fact that 1 slip-up can result in account level blocks (which google is notoriously good at and can essentially shut down your business) means no company would want to work with someone working from Iran.

Coming from a 3rd world country, I know the problems of internet censorship which Iranians also face but being too toxic to touch for everyone outside Iran because the US leadership thinks so is just infuriating and heart breaking.

Imagine being a programmer in Iran. Not only do you have less resources to learn and grow, you have a massive handicap to find good work as most work is outside of the country.

Only bet is to leave the country but even there you have a very low probability as you basically can't have a trial period for your job as most companies don't want to risk having their accounts blocked.

Most of us here know how degrading and infuriating the tech recruiting processes can be and now add to it the horrors of working from Iran.

Wars are not supposed to have civilian casualties but this one has a generation of civilians being starved of information and experience critical for them to grow.

Re: GitHub blocks entire company because one employee was in Iran

#383

Post by slaymaker1907 » Tue, Jan 05, 2021, 4:51 PM UTC

A4ET8a8uTh0 wrote: post #317

fennecfoxen wrote: post #306

Earlier quoted context omitted.

So look at (one one hand) a customer worth... well, PureLabs is "10 incredible FTEs," let's give them the $21/user/mo Enterprise plan at $210/month in revenue. On the other hand, a sanctions violation could be a $65,000 fine (Trading with the Enemy Act) or $250,000 (International Emergency Economic Powers Act) for each offense. (I leave aside the million-dollar narcotics-kingpin act). On top of this we also see the r…

It is hard to discuss hypothetical violations so I won't do that. It absolutely is a safe course of action to do a blanket ban. That said, is it reasonable to assume violation based on IP address ( and that is what seems to have happened here )? Banks don't automatically (typically ) block MUHAMMAD JIHAD even if they may end up questioning it.

They do actually flag payments if you put the word Isis or something in the memo.

Re: GitHub blocks entire company because one employee was in Iran

#384

Post by londons_explore » Tue, Jan 05, 2021, 4:53 PM UTC

necovek wrote: post #268

londons_explore wrote: post #222

Earlier quoted context omitted.

> Nope. No backups, no sympathy, simple as that. For your personal stuff, sure. But when engineering a service, you should care about everyones stuff, not just those who are careful. You should design your service to try to help those users who use the same password they did on myspace in 2004 and write it on a sticky note on their desk. Engineer for those who shared their password with their now-hated ex. Even if th…

Other than requiring some form of government issued identification (including prior to the incident), or a well built reputation using GPG (but those are not going to be users you mention), how would achieve that today? And as the GP says, what role would 2fa play in that scenario?

2fa simply means the user has more ways to potentially identify themselves... That means as a service you should try harder to stop someone else getting in, but also try harder to maintain access for the real owner. The 2fa code should help you do that, because now there are more things that the real account owner can do to identify themselves that an attacker cannot.

Re: GitHub blocks entire company because one employee was in Iran

#385

Post by harperlee » Tue, Jan 05, 2021, 4:53 PM UTC

A4ET8a8uTh0 wrote: post #360

harperlee wrote: post #339

Earlier quoted context omitted.

That’s because the combined business of all Muhammads and their employers is way more than 210$/month AND it would be illegal, and Bad PR™, to ban them from your business based just on their culture/name. Otherwise they would have been “derisked” out of service.

You have a point ( and Mnuchin to his credit ,based on reports, does care about regulatory burden and its impact ). So you are right, one is not like the other. To address your point directly, if OFAC tomorrow added MOHAMMAD JIHAD with no other information ( no DOB, no address, and so on ), you would be surprised how quickly the banks would respond. Now note that that we are discussing a name, a commmon, but somewhat…

Banks typically would react overnight to OFAC list updates, through a sanctions list service.

If no DOB or similar is also provided, though, scoring should not be too high - and if a match with Mohammad is enough to trigger an alert, the overnight alert delta would be either manually processed by Compliance, or bulk closed as false positives, depending on how much time you need to unblock the clients and similar risk considerations.

Re: GitHub blocks entire company because one employee was in Iran

#386

Post by jankotek » Tue, Jan 05, 2021, 4:54 PM UTC

factorialboy wrote: post #34

So many dimensions come to play here. 1. There's the obvious legal aspect i.e. how these laws are framed and interpreted. 2. Then there's the geopolitical aspect. Is it fair to impose sanctions on Iran. 3. There's another aspect around GitHub policy that asks if an entire organization be banned for the location of one team member. 4. Finally, there's the aspect of relinquishing control. Your app development is on the…

Hell no!

In this case Github is just unreliable piece of infrastructure. My phone provider bans me for receiving phone call from wrong country? Nice joke.

Re: GitHub blocks entire company because one employee was in Iran

#387

Post by lawnchair_larry » Tue, Jan 05, 2021, 4:54 PM UTC

slaymaker1907 wrote: post #383

A4ET8a8uTh0 wrote: post #317

Earlier quoted context omitted.

It is hard to discuss hypothetical violations so I won't do that. It absolutely is a safe course of action to do a blanket ban. That said, is it reasonable to assume violation based on IP address ( and that is what seems to have happened here )? Banks don't automatically (typically ) block MUHAMMAD JIHAD even if they may end up questioning it.

They do actually flag payments if you put the word Isis or something in the memo.

Do you have a story about this?

Re: GitHub blocks entire company because one employee was in Iran

#388

Post by londons_explore » Tue, Jan 05, 2021, 4:55 PM UTC

necovek wrote: post #307

fsflover wrote: post #178

Earlier quoted context omitted.

>> 2FA should be bypassable after some longish lockout period. > Nope. No backups, no sympathy, simple as that. My two sim-cards were lost at the same time. Impossible, right? Now I cannot access my Github account anymore. Perfect security. Nothing important is lost and backups are there. But what about the account itself?

Most countries require SIM registration using a government issued ID document (including prepaid ones). Some providers offer ID registration even for prepaid SIMs. If you want privacy from your government too, don't use SIM-based (sms or call) 2fa. That's generally a suitable backup in my view.

Yet most countries allow foreign sims to roam into the country. That effectively defeats the benefits of requesting government id's, since the real criminals will just use foreign sims.

Re: GitHub blocks entire company because one employee was in Iran

#389

Post by apta_ » Tue, Jan 05, 2021, 4:55 PM UTC

jpxw wrote: post #354

jitbit wrote: post #310

GitHub: "Lets rename master to main because Inclusion & Equality" Also GitHub: "sorry you're from a wrong country"

Github’s help text when opening a new repo irks me. It contains the following: git branch -m master main With absolutely no explanation of what they are doing, or why. I can imagine this being confusing to beginners, and it requires mental effort for me to ignore it each time.

They seriously think "master" is a bad word? That's crazy.

Re: GitHub blocks entire company because one employee was in Iran

#390

Post by mcguire » Tue, Jan 05, 2021, 4:57 PM UTC

antihero wrote: post #250

x3c wrote: post #153

Earlier quoted context omitted.

This particular case was overreach by Github and not the US Lawmakers. https://home.treasury.gov/policy-issues/financial-sanctions/... 118. I have a client that is in Iran to visit a relative. Do I need to restrict the account? A: No. As long as you are satisfied that the client is not ordinarily resident in Iran, then the account does not need to be restricted. See FAQ 37. Source: https://twitter.com/Hamed/status/13…

Thing is, GitHub is a tool that facilitates distribution of IP. So if someone is logging into GitHub in Iran, whether they live there or not, they can use it to "export" code.

Which is kind of irrelevant---preventing the export of code is not the issue. This is an economic sanction against Iran by preventing companies from doing business there.