https://github.blog/2021-01-05-advancing-developer-freedom-g...

This sort of union between tech and politics is not going to take us anywhere.

Also GitHub: "sorry you're from a wrong country"

Can most internet operations not run through companies who are registered and have servers in a country where most of those laws don't apply to customers who are not US citizen?

Here comes a new employee onboarding document to sign: no Iranian VPN nor travel to Iran.

While it's certainly very convenient and economically reasonable to use cloud services for development and production, every company should have a plan B.

In this case, it's an absolute must to have daily backups of all repositories / all branches which are stored on premise. If your company is not doing that, you play the lottery of losing access to your own source code.

Then watch as bunches of companies are blocked from GitHub.

If the Iranian government wanted to have fun with US laws, they could totally set this up. And it wouldn't even be illegal.

* Is this a US Company?

* What was the employee doing in Iran?

* Is the employee an Iranian national?

* Was the company aware of this?

Headlines like this make me really scratch my head.

They are way too big to actually be penalized in a meaningful way and doing the right thing once in a while feels great.

The technology to realize a peer-to-peer alternative to GH is here. We just need to make it happen. IMO radicle.xyz is the most promising one right now.

> Hi Sebastian, sorry to hear about this. I will check into it right away and get your org unblocked.

https://twitter.com/natfriedman/status/1346452935924846593?s...

Pretty messed up that they built this kill switch in the first place though, if you ask me.

All devices are subject to search, seizure, and duplication when crossing international borders and border agents may tamper with devices as well. If assets cross borders there has to be a good reason, it has to be documented, and phones/computers may have to be scrubbed before and after depending on circumstances.

It does not condone that it took an HN frontpage to react to a massive issue from a client blocked due to either a badly configured sanctions system, or a badly defined false positive determination workflow, that could not be expedited otherwise by the client, but... it’s something I guess.

Good luck having a 7-day response by your bank, who have the legal obligation to not share with you why did they block you, or having Google’s CEO looking into your issue aired in twitter.

And then they would say "I had 30 minutes of waiting time in transit and I just wanted to add a comment on my Pull Request".

You're right. You should frame it correctly and take ownership over the complete and utter regulatory failures of European countries to support and nurture local businesses.

When I went to London for the first time I meet a ridiculously attractive Swedish Arab girl. She had mentioned she really wanted to visit America, but with the recent election of Donald Trump she was a bit scared.

Not all of us like Eastern European women, Trump blocked my game right there.

The point of this story is anyone can meet anyone from anywhere and the nasty racist system the US has for blocking certain people because they have the wrong last names or whatever doesn't do anyone any service.

I also don't think embargo serve anything aside from radicalizing other people's. Take Vietnam, now you have Coca-Cola, and McDonald's succeeding to do what 20 to 30 years of Western imposition couldn't, they've made Vietnam capitalist. That was accomplished once the embargoes were removed in the nineties. Even with Cuba ,I'd imagine if the embargo didn't exist you'd see much more reform as individuals would eventually be able to succeed on their own merits.

At a previous job we self hosted Git and it worked fairly well. At my current job we use GitHub and while we could migrate away, it would hurt.

Personally, I think GitHub's value is more about the fact that it integrates so well with so many other services. Without GitHub we would lose:

- Most of our PR/ Code Review flow

- Integration with Pivotal (our ticketing/ story system)

- Integration with our Travis server for CI

- Integration with our hosting service for automated deployment.

All of this stuff can be done independent of GitHub, but most of it takes a lot of time and effort you could be spent delivering the product you are trying to ship. You also lose a lot of flexibility.

2) I can assure you there's policies at Microsoft that include performing work abroad and accessing any company resources from abroad. Obviously nobody will be approved to access any company resources from Iran, especially not source code.

3) I can say there is policies at MS this with a very high degree of confidence because I personally have done work with Microsoft involving code and data that is export restricted.

4) Companies should have policies in place in order to avoid situations like this. Taking your company laptop to, say, Germany probably isn't a big deal for most companies, but any "exporting" company assets should at least be pre-approved/documented.

Those are not problems, those are trade-offs. OP is right, you could be in a position in which those trade-offs dont apply to you (i.e. by buying a "expensive" but great solution, this happens all the time in all the industries) or you could sacrifice one item (say speed) in your solution if this is not a problem for your workflow ("so what if a open source tool runs 2x as slow as the best proprietary option, our daily batch processing take 2 hours and it is used in weekly buckets")

Saying that Israel could resolve the issue by de-escalating is nonsense, as much as saying the same thing about North and South Korea. One side has leaders intent on acquiring nuclear weapons and publicly claims it will use them against its neighbors.

As someone else mentioned, capital is way harder to raise (meaning slower to market) - and then an underrated factor which is equally important is how easy or difficult is it to sell as a nascent startup. At least in my industry (cybersecurity) it has been very hard in the EU vs US in the earlier stages of product maturity.

Much like the parent comment, I don't see this changing anytime soon and I'm fully betting on the fact US will keep their dominance in tech.

"MS Windows having a marketshare of 96% should not necessarily stop you from designing your business around linux"

But Windows doesn't have this kind of marketshare in most areas going forward? The #1 OS used worldwide is AndroidOS and no one is clamoring to write for it as far as I can tell.

Accenture is American-Irish and listed on the NYSE. Subject to US jurisdiction from a national, not global level.

The argument is that the US sanctions are wrong. It's totally against what America and the West at large stands for. Those sanctions, as always punish innocent citizens the most. The strategy of course is to make those citizens revolt. But it ain't even working. See with Iraq and Libya, they litterally ended up bombing these countries and ensured the death penatly to those leaders, and now see how worse it has become over there (interestingly the news outlet don't report much of the situation now).

I have been clearly and firmly reminded by my employer about sanctions on Iran and to not engage in any business with Iranian as clients. The US government, like said in another comment is using its country's private economical powers for the service of its (absurd) geopolitics, not far from what China has been doing, but with far more hypocrisy and somehow less success.

[1] https://www.worldatlas.com/articles/how-many-countries-are-i...

Or look at it another way: this is an Indian company. Does one employee opening their laptop in Iran make it an Iranian company under US law?

Private entities chartered and regulated by the government, of course.

1. Bomb them back into the stone age. That would kill a whole bunch of people, who as you point out are basically held hostage by their government and don't get much choice in the matter. It'd also permanently wreck their economy and infrastructure, cost lives on both sides, and usually has follow on effects.

2. Do nothing and allow things like funding terrorism, selling arms, committing atrocities, etc. You would know these things are going on, and therefore be allowing them to happen, and these things would probably be happening to your own people and allies.

Which one would you rather take?

Sorry what??? I have family in India, but not because I'm Indian, I just have family there. I have family in Poland, not because I am Polish (well I am kind of, but not on paper). I have family in the UK, but I'm not British.

This is 2021, not Christopher Columbus times.

"The United States has imposed an arms ban and an almost total economic embargo on Iran, which includes sanctions on companies doing business with Iran, a ban on all Iranian-origin imports, sanctions on Iranian financial institutions, ..."

A private visit is not doing business, so the org cannot be blocked. And most other companies are ignoring the US sanctions, that's why we have the current propaganda push.

The law is ok, because economical sanctions are the only way to get rogue nation states to comply. That's why we have sanctions on Iran, Russia, Crimes, North Korea. Unfortunately not against the US yet.

- the Arab nations don't consider themselves kin (or "coethnics" whatever that means) with the Palestinians. When Jordan and Egypt controlled the Palestinian territory, they treated the Palestinians worse then Israeli does today.

- the groups that commit the vast majority of rape (per capita or otherwise) in the middle east are not Israeli. In most of the Muslim countries, it's legal to rape your wife. In some of them (such as Iran), men execute their daughters for being raped by their neighbors. One well known group (ISIS) was really into rape - and so Iran gave them money so they could rape more.

If what you care about is rape, murder, and genocide, you're against Iran 100x as much as you're against Israel.

You do realize that the bulk of "other religions" in the Middle East (namely Islam) - and, for that matter, the US (namely Christianity) - are derived from those same scriptures and rejoice in those same genocides (and have happily added to them over the past couple millennia, of course), right? There's no moral high ground on either side of this mess.

EDIT: concerning hypothetical worlds, I pretty much not want to live in a world were companies blindly follow the law regardless of how harmful it is. We have tried these worlds in the past and they were not pretty.

GitHub could have warned the company before blocking and/or blocked access only from Iran. It did neither.

I consider immoral the USA's warmongering and spying on its own citizens.

Still, if I don't pay my taxes or if I try to stop the army from going to bomb some poor people in the middle east, I'll be put in jail.

If I have a way to sabotage the government which won't ruin my life, I'll do it, but I'll pass on the rest.

We're lucky enough not to live in a country that require us to kill people in concentration camps, because we would surely do that.

At least, I would do it if I didn't have another choice (but I would also try to desert).

Software needs to maintained, patched, backed up, verified etc. It has bugs, security issues, hardware breaks in weird ways. This takes time and skill - ideally you'd need two or three people that are capable of fixing problems with the install. (one ill, one on vacation, one available). This is something that detracts from the actual work you're doing. I'm very much an ops person and I actually like tinkering with a gitlab install - it's just so many moving parts that I prefer not to run this for my company since it would eat a substantial chunk of my time just caring for this.

For example, the source code as well as the tickets around a software tend to be the most critical assets of a company. As such, you need one or better 2 systems to host the source host and ticketing. However, such a system needs backups, so suddenly you need to maintain a backup solution, you need to implement and monitor the backups being created, you need restore tests. You end up needing some kind of monitoring as well. As well as 2-3 dudes at least part-time maintaining all of this capable of replacing each other during sickness and vacation.

That's a lot of stuff as well as a lot of manpower as your base cost. Of course, once you have that, you can self-host a lot of things easily and maintain excellent uptime at minimal risk, because these base services scale very well in complexity. For us it makes sense to do this, because unplanned outages at 100+ developers are seriously expensive and risky.

However, if you have 3 developers and a clock ticking to find product market fit, you don't have that budget - or spending it this way does not make sense. So you buy.

Disobey the law, make a public statement about it, and deal with the consequences. This is not a new problem, it was treated by Kant a few centuries ago.

- Sanctions don't achieve the goal of stopping funding terrorism as evident by it still happening.

- IF the point of sanctions was to _actually_ stop terrorism funding, you'd start at the origin of where these ideas start, which is known to be Wahhabism/Salafism.

- At least, you'd start at the origin of how people holding these ideas were supported and given weapons and training to achieve regime change goals and to fight against Russians in Afghanistan.

From the "Syria Palaestina" of Roman times all through the Rashidun, Umayyad, Abbasid, and Fatimid Caliphates, the Ayyubid dynasty, and the Mamluk Sultanate, the borders of Syria have nearly always encompassed all of what is described as Palestinian territories today, with a special exception made either for the occupation of Jerusalem by the Christian First Crusade or in the 19th century the Jerusalem Mutasarrifate of Jerusalem was split away into a special region given legal autonomy as a city-state, much like Vatican City.

All through this time, for thousands of years up through the Ottoman era, the borders of Syria included what are now described as the Palestinian territories. You can see them on a map here:

https://en.wikipedia.org/wiki/Ottoman_Syria

You can also check maps available on Wikipedia for the historical borders of Syria during the Caliphates, which have always encompassed Palestine.

Palestine was never an independent nation at any point in history. It was always a part of Syria, and Syria today considers it Syrian temporarily-occupied territory stolen by Western-sponsored violence and terrorism.

Nope. No backups, no sympathy, simple as that.

2FA is worthless if you start to put holes in it like that.

So if you value your data, make backups - preferably locally the old-fashioned way, e.g. HDDs stored in at least two different locations or at least using several different cloud providers (which have their own infrastructure and aren't just relying on AWS/GCP/Azure/etc.).

There's no such thing as a "trade-off" when it comes to cyber security - either commit to it fully or just don't use 2FA at all.

Personally, I think 2FA that doesn't rely on physical devices (phones, keys, smart cards, etc.) is unreliable and sketchy anyways.

If you can't spare a few hundred bucks on a NAS that you can just put in a storage unit or bank vault if need be, you data can't be that valuable anyway.

It's common sense that most people are from the same country their parents are from, given what we know about immigration.

Interning people based on predicting their behavior due to ancestry is a whole different ballgame.

We are quite privileged to just assume that following the law as written (AND interpreted by the judiciary) will mostly work out alright and doesn't cause us moral dilemma. And companies consist of people, too. Is it then all of a sudden morally acceptable to build spying software so your country's leadership can prey on it's political enemies? Or assist in persecuting discriminated groups?

You don't have to cite long abolished laws or an industrialized killing machine for pointing that out ;-) though the post is really begging for it.

  Advancing developer freedom: GitHub is fully available in Iran

Github cannot be expected to reliably differentiate between the coworker who just checked the status of a PR on a webapp versus the employee who opened a crucial piece of encryption code to leak it to the Iranian military or whatever.

No, it was rhetorical question. Reading and making an effort to respond to the entirety of the comment would have made that obvious when I specially ask "Where do you draw the line?".

Do not put words in my mouth. I did not say that, you just did. I said that usability is a real concern, because no matter what you expect people to do, it will never work perfectly 100% of the time.

> I'm not talking about security in general.

You can say that now, but that's not what you said previously. "There's no such thing as a "trade-off" when it comes to cyber security"

> you instead share your entire private life with these companies?

Again, I did not say that. Github is a social coding network. I am not saying that I have all of the answers as to how this should work, but I am saying that if 1 member of a 100 person organization loses access to their account, and the other 99 members all confirm that their account access was lost via some event and assert their identity, you could have the start of a reasonable recovery path.

> the CEO running the show is in an entirely different category

Not sure what you mean by this. Are you saying that a CEO is just automatically more responsible and not going to lose something? Or are you saying that he's clearly just more important so it's okay to bypass the stated procedure for just him/her?

> Do you leave your house key under the doormat? Do you keep a post-it note with all your passwords taped to the back of your phone - you know, just in case you forget one and for convenience?

This is not even a valid comparison, and you're just trying to be condescending. I don't leave a house key under my mat just in case I lose it. But I also don't expect to never be allowed to enter my house again just because my key is lost.

> if you can't afford a data storage solution I seriously wonder why you have a need for a distributed version control system in a (semi-)professional environment.

Because many people use Github for non semi-professional environments? It is full of amateurs. Just because you don't find someone's work valuable, doesn't mean that they don't. Saying "Well it's not professional, so if you lost it then it doesn't matter" is not correct.

> 20 bucks for a protective case for your phone - no problem. 50 bucks for a half decent 1TB portable USB HDD to backup

You're comparing a 1 time action to a recurring action. I'm not saying that you shouldn't have back ups. You obviously should. But people are human beings. Even if 99% of people have perfect back ups, that's still 560k (according to Github home page numbers) that will have failed backups or some other issue.

PS. you keep widely including the term "decentralized", as if just because git is decentralized, that nothing on Github should matter. For better or for worse, Github has become the central git repository provider for millions of people. Claiming that Github services should be magically decentralized just because git is decentralized is an invalid claim. Because Github is not decentralized.

Citizenship is always first determined at birth. This isn't relevant to the discussion.

> The common sense idea deals with the probability of someone (already born) being of a certain citizenship given their parents' location.

That would be "ius soli". As opposed to "ius sanguinis".

It's also not a "probability". These are principles which are formally enshrined in nationality laws and very much determine travel, migration and national security policies in different nations. Including the United States.

These are not "common sense" either.

These are laws which come with a long historical pedigree which includes identity politics, economic policies, moral and ideological values, and so on.

They are also very much subject to change through the dominant politics of the day.

> Not allegiance, citizenship. Different, but similar concept again.

I'm not willing to engage in a semantic discussion.

https://home.treasury.gov/policy-issues/financial-sanctions/...

I am not sure if most people realize this, but OFAC compliance is rather rigid with no room for error ('strict liability'). And US treasury enforces it hard. Recently, Amazon got caught in its cross-hairs ( though it managed to get away with a low fine relative to its size ).

I guess what I am saying, according to OFAC, everyone is responsible for enforcing US foreign policy.

edit: Everyone as in US person, person on US soil or someone using US dollar. I really should avoid exaggeration.

Surely enforcing your politics outside of your jurisdiction is the whole point of an embargo?

Isn’t that what YouTube and FaceBook do day in day out when their influencers run afoul of policy?

"constitutes inflicting serious damage on another company without a legal basis" - again, that does not indicate any wrongdoing. Inflicting serious damage on another company is, by default, permitted (matching the core principle of "everything which is not forbidden is allowed") and is regularly done in the course of normal competition, winning over some other company in bids, recruiting key employees by offering them lots of money, targeting their customers with specific discounts, etc, etc.

If you're inflicting serious damage on another company, then both the intent and result is by itself legal, the only question is about the means. If you're inflicting serious damage on another company by legally prohibited means (e.g. theft or arson or illegal access to computer systems) or violating some established legal duty (e.g. "duty of care" as required by law in various service relationships), then the other company would be entitled compensation. But in the absence of that, if there's no specific legal prohibition to your action (for example, laws on anti-competitive actions tend to impose various restrictions), if your action is legally permitted, then if some company suffers because of that, it's not your problem. There are restrictions on what actions are legally permitted (law on tortious interference might apply here, and if there's some fraud, injurious falsehood etc then it matters) but if they do have the right to arbitrarily end the contract, then that's it, they are not responsible for the damages.

If you expect US companies to respect GDPR and cookie banners and the right to be forgotten, globally; you cannot be surprised that they will respect and enforce US law globally as well.

Sure, the US is (rightfully so) subjecting every company within its jurisdiction to US law, no matter on which market they operate. Sometimes they go even further and say non-US companies can be held liable, when they somehow interact with the USA or its citizens. That can sometimes become a bit dicey with jurisdictions, but even that is not the point here.

The point is that a US-based company is operating on a market outside the US and (most likely) is operating in a way that is within the law of that market.

To put bluntly: I don't give a #### about how the US treats companies on their territory, regardless where those operate. I care about US-based companies abiding to law wherever they do business. If they can not do that, they should cease to operate there. Whether it's the US government or something else that is to blame for the situation is irrelevant.

The issue is that a US company should also be held accountable for whatever they violates abroad. Not by the US government, of course. But by the authorities of whatever foreign market they operate on (the only authority with jurisdiction anyways).

While the tide is gradually changing, so far a substantial part of the problem is that the US government has quite a few nasty ways to shield US companies from being seriously held accountable abroad. Still, the longer that reality exists, the more inevitable it will become that at some point US companies will simply be barred altogether from (some) foreign markets. You can only abuse a dominant position for so long, before the receiving end will no longer put up with it. That is, of course, when (or as soon as) they have the luxury of choice in the matter.

Well, of course it can, if the company violates EU law inside the EU. Do you think US law trumps [sic] national law globally? If a US company doesn't want to comply with GDPR, it is free to cease trading in the EU, or cough-up the fines.

Extraterritoriality is an old US habit.

The law itself is not illegal, as the lawmakers have created and enacted that law. It's the opposite, the law is declaring what's illegal.

So, if GitHub doesn't ban users from Iran, they are breaking the law in the US.

Hope this clears up any misunderstanding on how things work.

Start complaining to those companies and stop pointing your finger in the wrong direction.

Also, law do not require it to be shown for all cookies. Only for tracking ones.

If no DOB or similar is also provided, though, scoring should not be too high - and if a match with Mohammad is enough to trigger an alert, the overnight alert delta would be either manually processed by Compliance, or bulk closed as false positives, depending on how much time you need to unblock the clients and similar risk considerations.