GitHub blocks entire company because one employee was in Iran • Hacker News Board

Re: GitHub blocks entire company because one employee was in Iran

#491

Post by jamesmishra » Wed, Jan 06, 2021, 4:20 AM UTC

jamesmishra wrote: post #108

I'm on GitHub/Microsoft's side here. They are not responsible for the content of US export control laws, and they have an incredible amount to lose if they are found to be in violation of US export control laws. Presumably GitHub needs some automated tool to prevent inbound traffic from sanctioned countries, and it's hard to be certain that they are complying with US law if such automated tools have some wiggle room…

Perhaps I spoke too soon. It looks like GitHub is able to do something about the issue.

https://github.blog/2021-01-05-advancing-developer-freedom-g...

Re: GitHub blocks entire company because one employee was in Iran

#492

Post by necovek » Wed, Jan 06, 2021, 4:58 AM UTC

londons_explore wrote: post #384

necovek wrote: post #268

Earlier quoted context omitted.

Other than requiring some form of government issued identification (including prior to the incident), or a well built reputation using GPG (but those are not going to be users you mention), how would achieve that today? And as the GP says, what role would 2fa play in that scenario?

2fa simply means the user has more ways to potentially identify themselves... That means as a service you should try harder to stop someone else getting in, but also try harder to maintain access for the real owner. The 2fa code should help you do that, because now there are more things that the real account owner can do to identify themselves that an attacker cannot.

The increased security from 2FA comes from using both factors to authenticate to a service.

If you are not using both, then it's a single factor authentication.

You still haven't answered the core question: how do you do what you propose (keep strong security and allow easier restoration of an account to the real owner) today?

Re: GitHub blocks entire company because one employee was in Iran

#493

Post by necovek » Wed, Jan 06, 2021, 5:10 AM UTC

londons_explore wrote: post #388

necovek wrote: post #307

Earlier quoted context omitted.

Most countries require SIM registration using a government issued ID document (including prepaid ones). Some providers offer ID registration even for prepaid SIMs. If you want privacy from your government too, don't use SIM-based (sms or call) 2fa. That's generally a suitable backup in my view.

Yet most countries allow foreign sims to roam into the country. That effectively defeats the benefits of requesting government id's, since the real criminals will just use foreign sims.

Sure, if you are using a SIM from a country that does not require ID registration.

But we are talking about restoring access to your phone number. I don't really care about "a criminal" getting their account back on my service (well, unless I am SilkRoad or something).

My point is that I am able to get a new SIM for the same phone number as long as I've registered my ID with the provider. I have even kept my phone number even though I had my phone stolen 3 times for the last 20 years or so. Thus, if any of my accounts rely on that phone number for 2fa, I am good.

Re: GitHub blocks entire company because one employee was in Iran

#494

Post by diebeforei485 » Wed, Jan 06, 2021, 6:42 AM UTC

astura wrote: post #475

diebeforei485 wrote: post #434

Earlier quoted context omitted.

This is not the case at most large companies (FAANG) - no special permission is required to take a laptop with you across borders. They'd generally rather you have your laptop with you so you can get work done. Regardless, this person logged into GitHub, which could have been from any device including a phone.

1) In this case the laptop was taken to Iran, so that's what we are talking about here. 2) I can assure you there's policies at Microsoft that include performing work abroad and accessing any company resources from abroad. Obviously nobody will be approved to access any company resources from Iran, especially not source code. 3) I can say there is policies at MS this with a very high degree of confidence because I pe…

I checked with my old classmates who currently work at Microsoft and LinkedIn, and they do not require permission for accessing company resources from abroad. One of them has been working from Israel and Turkey for many months in 2020. Another has been in Mexico since the pandemic began.

I'm not sure what team you worked in, it's possible some teams have stricter policies. If you were doing business with Microsoft, the export control language is boilerplate contract language.

Re: GitHub blocks entire company because one employee was in Iran

#495

Post by waihtis » Wed, Jan 06, 2021, 7:57 AM UTC

f6v wrote: post #171

waihtis wrote: post #161

Earlier quoted context omitted.

Problem is that EU is not comparable in any manner to the US. For one, where do you suggest the Silicon Valley of EU is? London would've been a decent bet except that they just bailed. As someone else mentioned, capital is way harder to raise (meaning slower to market) - and then an underrated factor which is equally important is how easy or difficult is it to sell as a nascent startup. At least in my industry (cyber…

Well, we shouldn’t just assume that Silicon Valley has to be a place. The lockdown showed that numerous companies can operate 100% remotely. And I got the impression that there’s always more money than startups.

Silicon Valley absolutely has to be a place and people will return to face-to-face social contact the minute that is possible. It is impossible to build long-term meaningful relationships on a 100% remote basis.

Re: GitHub blocks entire company because one employee was in Iran

#496

Post by oytis » Wed, Jan 06, 2021, 10:25 AM UTC

ogre_codes wrote: post #379

oytis wrote: post #259

Earlier quoted context omitted.

Spinning up your own git server is not a huge effort though even for a startup. As to what is archaic - I believe a point can be made that the division of labor thing can suit poorly our brave new cloud software world. You can't just buy things (or software) from others, and completely own them. If you are outsourcing some part of your business to others, you also lose a lot of sovereignty that is crucial to stay fle…

> Spinning up your own git server is not a huge effort though even for a startup. At a previous job we self hosted Git and it worked fairly well. At my current job we use GitHub and while we could migrate away, it would hurt. Personally, I think GitHub's value is more about the fact that it integrates so well with so many other services. Without GitHub we would lose: - Most of our PR/ Code Review flow - Integration w…

Yes, integrations are a real value. I've seen a lot of it working in self-hosted Gerrit, but there was a dedicated maintainer for the project who among other things implemented these.

Re: GitHub blocks entire company because one employee was in Iran

#497

Post by edumucelli » Wed, Jan 06, 2021, 10:47 AM UTC

bogomipz wrote: post #405

edumucelli wrote: post #399

Earlier quoted context omitted.

Imagine the horror US has unleashed "invading" almost every country in the world (except 3) with formal or hidden missions.

You realize that there are between 194 and 197 countries in the world depending on who is doing the recognizing[1]. Could you please provide a citation for the 191+ countries you say the US has invaded? [1] https://www.worldatlas.com/articles/how-many-countries-are-i...

https://www.wearethemighty.com/articles/these-are-the-only-3...

Re: GitHub blocks entire company because one employee was in Iran

#498

Post by denton-scratch » Wed, Jan 06, 2021, 11:30 AM UTC

epc wrote: post #243

elmo2you wrote: post #199

Earlier quoted context omitted.

I would go quite a step further than that. If this was not an unfortunate incident/mistake, then GitHub/Microsoft has become quite the active enforcer of US (legal) foreign policy. If they do that within the US market, that might be justifiable. But in this particular case, GitHub appears to enforce US foreign policy on what appears to be a company on the EU market. Also in what to me appears to be a rather ruthless,…

Given the pressure by the EU and China on US companies to enforce local laws globally (GDPR, RTBF, Taiwan), I don't see how Github, operating in the US, as a US company, has any chance absolving itself of enforcing US laws and regulations (though in this specific case they appear to have overreacted, likely due to regulatory enforcement via algorithm and not common sense). If you expect US companies to respect GDPR a…

"If you expect US companies to respect GDPR and cookie banners and the right to be forgotten, globally; you cannot be surprised that they will respect and enforce US law globally as well."

I don't expect any US entity to "respect" GDPR. Unless they are expecting to trade in the EU. If you trade in the EU, and violate EU law, then you can expect to be fined - wherever you choose to locate your HQ.

Incidentally, GDPR is pretty badly flawed. The intrusive cookie popups are an egregious example of unintended consequences - those popups are actually attacking privacy.

Re: GitHub blocks entire company because one employee was in Iran

#499

Post by denton-scratch » Wed, Jan 06, 2021, 11:38 AM UTC

epc wrote: post #448

watwut wrote: post #263

Earlier quoted context omitted.

EU is not forcing American companies to enforce their laws for third party companies operating on non-EU market. Also, American company does not have to follow GDPR for Iranian customers. EU wants American companies to follow GDPR when acting in EU market.

Keep that in mind the next time you encounter a US based newspaper that puts up a GDPR error page instead of serving the news article you requested. The EU asserts it can penalize a US based company a percentage of its worldwide revenue (not EU derived revenue) for GDPR violations. I'm not saying it's right, I am saying that these are the logical, practical responses to the way different jurisdictions expect their la…

"The EU asserts it can penalize a US based company" ...

Well, of course it can, if the company violates EU law inside the EU. Do you think US law trumps [sic] national law globally? If a US company doesn't want to comply with GDPR, it is free to cease trading in the EU, or cough-up the fines.

Extraterritoriality is an old US habit.

Re: GitHub blocks entire company because one employee was in Iran

#500

Post by denton-scratch » Wed, Jan 06, 2021, 11:53 AM UTC

sjagoe wrote: post #212

fibers wrote: post #204

Earlier quoted context omitted.

I'm not a pro dev by any means but what is stopping orgs from simply self hosting such a thing? Git is merely version control which supposedly does not take a lot of resources so you can go ahead and buy a dedicated server and host it in your office. Is the question more so about expanded services like CI/CD that may take up more computational resources to continuously build binaries and other deliverables?

I would say it's less about the compute resources, and more about possibly needing a team dedicated to maintaining quite a lot of infrastructure to replace the features that GitHub has, which is far more extensive than just git hosting.

It's perfectly possible for a team of 10 devs to run on self-hosted source-code control, run an in-house CI system, and run application hosting, with just one tech (and one backup) working part-time on maintaining the system. You need a VM host for the CI; now you have a VM host, you can build git servers and so on (bring the email inhouse, perhaps?).

As far as maintaining the system is concerned: setups that are hosted by 3rd-parties also need maintenance. Someone has to understand how it all fits together, and how to fix it when it goes wrong. So you still need a team-member working part-time on SCC, CI and deployment.