GitHub blocks entire company because one employee was in Iran • Hacker News Board

Re: GitHub blocks entire company because one employee was in Iran

#411

Post by 8note » Tue, Jan 05, 2021, 5:28 PM UTC

elmo2you wrote: post #288

michaelt wrote: post #255

Earlier quoted context omitted.

> But in this particular case, GitHub appears to enforce US foreign policy on what appears to be a company on the EU market. Surely enforcing your politics outside of your jurisdiction is the whole point of an embargo?

As a government, yes. As a commercial company, operating on a market outside of US jurisdiction, please explain me the legal basis for that (if you can).

The legal basis is that the US has a big stick, and so all countries must follow us laws, or they'll nuke your capital, rape your children, destroy all your infrastructure, etc.

In this case, it's just leaving you to starve, so you're pretty well off on the whole vs other things Americans will do

Re: GitHub blocks entire company because one employee was in Iran

#412

Post by sailingparrot » Tue, Jan 05, 2021, 5:30 PM UTC

jitbit wrote: post #310

GitHub: "Lets rename master to main because Inclusion & Equality" Also GitHub: "sorry you're from a wrong country"

> Also GitHub: "sorry you're from a wrong country"

GitHub has no choice into the matter short of moving all it's infra in another country.

This is a political issue, pressure need to be put on political leaders to change that stupid law.

Re: GitHub blocks entire company because one employee was in Iran

#413

Post by mcguire » Tue, Jan 05, 2021, 5:31 PM UTC

Xylakant wrote: post #299

fibers wrote: post #204

Earlier quoted context omitted.

I'm not a pro dev by any means but what is stopping orgs from simply self hosting such a thing? Git is merely version control which supposedly does not take a lot of resources so you can go ahead and buy a dedicated server and host it in your office. Is the question more so about expanded services like CI/CD that may take up more computational resources to continuously build binaries and other deliverables?

The compute part is the least of your worries, even installing the software is usually not your primary concern - everything is fine as long as you're on the happy path. Software needs to maintained, patched, backed up, verified etc. It has bugs, security issues, hardware breaks in weird ways. This takes time and skill - ideally you'd need two or three people that are capable of fixing problems with the install. (one…

The bottom line is that it is cheaper to use GitHub and live with the external risks than to maintain internal services or live without them.

I note that the Linux kernel lived with bare Git for many years.

Re: GitHub blocks entire company because one employee was in Iran

#414

Post by jey » Tue, Jan 05, 2021, 5:34 PM UTC

apta_ wrote: post #389

jpxw wrote: post #354

Earlier quoted context omitted.

Github’s help text when opening a new repo irks me. It contains the following: git branch -m master main With absolutely no explanation of what they are doing, or why. I can imagine this being confusing to beginners, and it requires mental effort for me to ignore it each time.

They seriously think "master" is a bad word? That's crazy.

To be fair, our industry brought this on itself -- we did use "master" and "slave" together as technical terms in various contexts. Now even the innocent uses of "master" that don't involve any reference to slavery are tainted too, at least from the perspective of a non-technical outsider. I'm sure their eyes will glaze over well before one can finish explaining what a version control system is, why you would want one, why it has branches and what they are used for, and that all this involves no references to slavery.

Re: GitHub blocks entire company because one employee was in Iran

#415

Post by scott_s » Tue, Jan 05, 2021, 5:36 PM UTC

delfinom wrote: post #378

scott_s wrote: post #350

Earlier quoted context omitted.

The government where the commercial company is based expects the company to do so, and will hold that company accountable if they do not. You may not agree with this situation, but it is how it works. The US government will investigate and penalize companies that violate US sanctions, even if the parts of those companies involved did so entirely outside of the US.

Yep, the current US administration is somewhat to blame on the shift. It has always been a requirement, it's just that the government up until this admin mostly didn't care to enforce it. It's pretty obvious a number of companies got threatening letters to comply or face jail time.

When I did some googling, I found an article from 2012 about sanctions enforcement (https://www.itproportal.com/2012/10/26/ibm-questioned-over-a...). I am unaware of new behavior regarding sanctions enforcement, although I know that the current administration imposed additional sanctions. But my understanding is that with existing sanctions, this is what the US government has always done.

Re: GitHub blocks entire company because one employee was in Iran

#416

Post by gnopgnip » Tue, Jan 05, 2021, 5:37 PM UTC

jeroenhd wrote: post #21

If the Iranian employee logged into the Github account, isn't blocking the account exactly what the law says they should do? If all they did was apply a merge request in one of the repos then would reverting the merge and blocking the account would be enough to comply? Is there some alternative way to comply with US export restrictions? The real question here is why people even consider using US cloud companies when…

https://home.treasury.gov/policy-issues/financial-sanctions/...

118. I have a client that is in Iran to visit a relative. Do I need to restrict the account?

Answer

No. As long as you are satisfied that the client is not ordinarily resident in Iran, then the account does not need to be restricted. See FAQ 37.

Re: GitHub blocks entire company because one employee was in Iran

#417

Post by mcguire » Tue, Jan 05, 2021, 5:39 PM UTC

literallycancer wrote: post #290

coredog64 wrote: post #267

Earlier quoted context omitted.

Iran is a signatory to the Nuclear Nonproliferation Treaty. According to the treaty, they agreed to not pursue nuclear weapons and to allow IAEA oversight. Making it difficult for the IAEA to provide oversight is enough of a treaty violation, and that goes double when there is credible evidence that unauthorized enrichment was occurring.

Why do non-US companies care about US foreign policy goals? EU companies can benefit from doing business with Iran, on the other hand using US based SaaS only makes them hostages of the US government and provides zero additional benefit. It would seem that using US based SaaS is simply bad risk management on the buyer's part.

The EU (and the UN) has had on-and-off sanctions against Iran for decades as well.

Are any EU countries still dependant on Iranian oil supplies?

Re: GitHub blocks entire company because one employee was in Iran

#418

Post by prepperdev » Tue, Jan 05, 2021, 5:42 PM UTC

From the company perspective, it's an arbitrary disruption. It could happen to any company.

While it's certainly very convenient and economically reasonable to use cloud services for development and production, every company should have a plan B.

In this case, it's an absolute must to have daily backups of all repositories / all branches which are stored on premise. If your company is not doing that, you play the lottery of losing access to your own source code.

Re: GitHub blocks entire company because one employee was in Iran

#419

Post by [deleted] » Tue, Jan 05, 2021, 5:42 PM UTC

richardwhiuk wrote: post #158

jhasse wrote: post #154

Earlier quoted context omitted.

I doubt it.

There's definitely an argument that GitHub is one of the primary reasons that Git beat Mercurial.

[deleted]

Re: GitHub blocks entire company because one employee was in Iran

#420

Post by Xylakant » Tue, Jan 05, 2021, 5:43 PM UTC

mcguire wrote: post #413

Xylakant wrote: post #299

Earlier quoted context omitted.

The compute part is the least of your worries, even installing the software is usually not your primary concern - everything is fine as long as you're on the happy path. Software needs to maintained, patched, backed up, verified etc. It has bugs, security issues, hardware breaks in weird ways. This takes time and skill - ideally you'd need two or three people that are capable of fixing problems with the install. (one…

The bottom line is that it is cheaper to use GitHub and live with the external risks than to maintain internal services or live without them. I note that the Linux kernel lived with bare Git for many years.

At least for small to medium organizations without specific reasons for self-hosting. Once you have a team that manages internal infrastructure, this calculus can change.

The Linux kernel is a very specific case with a very specific development model that likely doesn’t apply to most other projects.