Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub blocks entire company because one employee was in Iran

twitter.com

Post reply on HN
Print view View original

431–440 of 515 posts

Re: GitHub blocks entire company because one employee was in Iran

#431

Post by grumple »

jokethrowaway wrote: post #193
grumple wrote: post #135

Earlier quoted context omitted.

It is. We established this quite clearly in Nuremberg.

You're comparing state sanctioned killing and torturing with sanctioning people trading with each other. The first one is a violent crime against individuals, the second one is basically a tax. I'm against both but they carry a different weight.

Sure, the impact is different. But on the other hand, I try to follow this rule as much as possible:

“One has not only a legal, but a moral responsibility to obey just laws. Conversely, one has a moral responsibility to disobey unjust laws.” – Martin Luther King, Jr.

Microsoft is no stranger to breaking laws and certainly has the resources to fight this one, or at least to argue that it shouldn't apply in this case.

Re: GitHub blocks entire company because one employee was in Iran

#432

Post by camdenlock »

factorialboy wrote: post #396
umarniz wrote: post #382

The US sanctions on Iran has such a massive impact on Iranians that most of us don't realise. All US companies have to comply and majority of the tech companies are unfortunately in the US. I know you can use a VPN and configure it on a router level to make sure that you are always connected via a VPN but just the fact that 1 slip-up can result in account level blocks (which google is notoriously good at and can esse…

(Controversial comment) I am not condoning the actions of the United States government, but arguably the Iranian Islamic theocratic regime has unleashed more horrors on the Iranian people in the last 50 years than any other foreign government.

Imagine having to preface such a benign statement of fact with a disclaimer like that. What kind of bizarre culture have we created?

Re: GitHub blocks entire company because one employee was in Iran

#433

Post by michaeltimo »

What I don't understand is why not blocking access to those regions which are affected by US sactions (in this case Iran). The current situation in which you can access the website, but if you do, your account will be banned immediately is more like a detective scenario than respecting the laws. You can simply block all Iranian IPs.

Re: GitHub blocks entire company because one employee was in Iran

#434

Post by diebeforei485 »

astura wrote: post #295
dustinmoris wrote: post #57

Is GitHub going to take itself down when one of their employees goes to Iran for holiday and logs into their GitHub account? If not, then why are they treating others with such contempt?

I'd imagine Github/Microsoft has extremely strict rules about not taking company resources to, or performing any work at, or accessing any company resources from countries that are embargoed. This simply wouldn't happen at my company because special permission is needed to take any company assets out of the country. If anyone at my company casually took a company laptop to Iran that would be instant termination. It a…

This is not the case at most large companies (FAANG) - no special permission is required to take a laptop with you across borders. They'd generally rather you have your laptop with you so you can get work done.

Regardless, this person logged into GitHub, which could have been from any device including a phone.

Re: GitHub blocks entire company because one employee was in Iran

#436

Post by harperlee »

A4ET8a8uTh0 wrote: post #422
harperlee wrote: post #385

Earlier quoted context omitted.

Banks typically would react overnight to OFAC list updates, through a sanctions list service. If no DOB or similar is also provided, though, scoring should not be too high - and if a match with Mohammad is enough to trigger an alert, the overnight alert delta would be either manually processed by Compliance, or bulk closed as false positives, depending on how much time you need to unblock the clients and similar risk…

I am not sure if you realize it, but you are proving my point. Banks found a way to address the issue without adversely affecting the customers. Github appears to have only recently started to do the same, but they opted for a blanket approach as opposed to a more targeted one.

Sure, I’m just not trying to disprove you, I argued similarly in other threads.

Re: GitHub blocks entire company because one employee was in Iran

#437

Post by qayxc »

londons_explore wrote: post #222
qayxc wrote: post #132

Earlier quoted context omitted.

> 2FA should be bypassable after some longish lockout period. Nope. No backups, no sympathy, simple as that. 2FA is worthless if you start to put holes in it like that. So if you value your data, make backups - preferably locally the old-fashioned way, e.g. HDDs stored in at least two different locations or at least using several different cloud providers (which have their own infrastructure and aren't just relying o…

> Nope. No backups, no sympathy, simple as that. For your personal stuff, sure. But when engineering a service, you should care about everyones stuff, not just those who are careful. You should design your service to try to help those users who use the same password they did on myspace in 2004 and write it on a sticky note on their desk. Engineer for those who shared their password with their now-hated ex. Even if th…

> You should design your service to try to help those users who use the same password they did on myspace in 2004 and write it on a sticky note on their desk. Engineer for those who shared their password with their now-hated ex.

Those can't be helped. We're not talking about Geocities or MySpace here - we're talking about a service that hosts a distributed version control system aimed at experienced users with a technical background.

The target audience is strictly not your average consumer and even then you shouldn't insult the intelligence of your users.

2FA is intended to protect all users of the service and users do have a choice when it comes to selecting their 2nd factor. Doesn't have to be an e-mail or phone. It can be an app-generated token as well.

And loosing everything at once is tragic (hence: keep backups!), but suggesting that the locksmith should be allowed to just open the door if you ask nicely and the owners don't show up within an hour would be just as ridiculous as allowing to circumvent 2FA.

Re: GitHub blocks entire company because one employee was in Iran

#438

Post by rabite »

will4274 wrote: post #430
umarniz wrote: post #382

The US sanctions on Iran has such a massive impact on Iranians that most of us don't realise. All US companies have to comply and majority of the tech companies are unfortunately in the US. I know you can use a VPN and configure it on a router level to make sure that you are always connected via a VPN but just the fact that 1 slip-up can result in account level blocks (which google is notoriously good at and can esse…

Imagine being a programmer in Israel and hearing that the leader of a neighboring country wants to kill you and everybody you know. We're not unaware of the impact of sanctions. Fundamentally, starving a generation of Iranians of information and experience is worth it if leads to civil unrest and regime change, therefore preventing Iran's current leaders from committing the genocide they've said they want to commit s…

Imagine being almost any other religion in the Middle East and learning that Israelis on a day to day basis are lobbying to carve your countries apart by imperialist wars via their American proxies, bulldozing the homes of your coethnics in Palestine, raping their children, forcibly hijacking their TVs and exposing their kids to pornographic broadcasts, organizing a famine in Syria by their Kurdish proxies, and occupying their homelands. It was only in 2006 that Shiites and the SSNP finally kicked them out of South Lebanon, where they regularly committed war atrocities. Add to this the historical genocides that the nation of Israel completed and rejoice in within their scriptures -- the Ammonites, the Moabites, the Jebusites, the Canaanites (the assault on which happened the day after the Israelites convinced them to get circumcized, then went door to door killing them while their dicks hurt) are all tribes that were completely physically wiped out by the Israelites.

This argument should apply to Israel, which is the biggest per capita committer of genocide, land theft, rape, and fraud in the entire world. The entire history of Israel is one of genocide, from the ancient world to today. We need BDS now and a just society would absolutely shun your nation until they respect human rights.

Re: GitHub blocks entire company because one employee was in Iran

#440

Post by elmo2you »

A4ET8a8uTh0 wrote: post #297
elmo2you wrote: post #199

Earlier quoted context omitted.

I would go quite a step further than that. If this was not an unfortunate incident/mistake, then GitHub/Microsoft has become quite the active enforcer of US (legal) foreign policy. If they do that within the US market, that might be justifiable. But in this particular case, GitHub appears to enforce US foreign policy on what appears to be a company on the EU market. Also in what to me appears to be a rather ruthless,…

"I would go quite a step further than that. If this was not an unfortunate incident/mistake, then GitHub/Microsoft has become quite the active enforcer of US (legal) foreign policy." I am not sure if most people realize this, but OFAC compliance is rather rigid with no room for error ('strict liability'). And US treasury enforces it hard. Recently, Amazon got caught in its cross-hairs ( though it managed to get away…

There is no doubt about US companies having to follow US law. But this is an internationally operating company, which means it has to also follow whatever law might apply to whatever market they operate on.

GitHub, as any other US company, has a choice/freedom to stop offering services to customers outside the US market, if the particulars of providing those services causes them to violate laws in at least one of the jurisdictions.

Of course, US companies should be rightfully pissed, if the US government puts them in a situation where they can not (legally) operate abroad. But that's something they should take up with US lawmakers.

At the end of they day, they are still (most likely) operating illegally on a foreign market, even if they are unlikely ever to be substantially punished for that. The thing is, the US has a rather questionable track record of coming to the rescue, whenever a US companies get into trouble for (illegally) doing business abroad. Ironically, whenever another country does that (e.g. China) the US immediately have a long list of choice words an allegations at the ready. Long story short: pure hypocrisy.

Post reply on HN