GitHub confirms it has blocked developers in Iran, Syria and Crimea | Hacker News Reader

GitHub confirms it has blocked developers in Iran, Syria and Crimea

techcrunch.com

284 pointsjmsflknr300 comments

Same as Gitlab then[0].

US Sanctions should not affect internet services (so long as they are provided for free)[1], but political pressure appears to be very strong.

Personally I find it quite abhorrent, and would cite this as a reason not to use US based companies in future.

[0]: https://about.gitlab.com/2018/07/19/gcp-move-update/

[1]: https://www.treasury.gov/resource-center/sanctions/Programs/...

Well thanks for the extra info :). Sad news imho :S.

There was already the privacy concerns and complete lack of ethical oversight. Now we have some more ethical reasons not to use them.

The thing I am woried is that harfbuzz is developed by Iranian developer. It is an integral part of Linux font stack.

Well, for a well-known project, they won't miss GitHub visibility benefits.

They can host the git repository anywhere. Self-host an issue tracking system or find a non-US company that does that (and is not required to follow US sanctions due to trade agreements, that'll be hard).

It's an annoyance, for sure.

The problem is that they'd require a payment method to rent the server somewhere else or to use a non-US company that doesn't offer a generous free plan. The most prominent payment providers (Visa, MasterCard, PayPal) are all US-based.

> (and is not required to follow US sanctions due to trade agreements, that'll be hard).

I really don't know much about sanctions against Syria and Crimea, but Iranian developers could use every country that hasn't withdrawn from the Iran deal: EU, UK (separate signature, regardless of Brexit), Russia, China.

Enter... crypto

Between the speculative get-rich-quick rollercoaster of Bitcoin and the fraud of other crypto currencies it feels like the promise of decentralization has been forgotten.

That's just shifting the problem one inconvenience further. How do you purchase cryptocurrencies without Visa/MasterCard/PayPal?

I'm not sure what options they have, but ideally, for convenience some kind of local country bank transfer, which could be to a local crypto dealer. That might take days but you might "stock up" on crypto to compensate.

Or peer to peer cash/crypto swap might be required.

Or businesses themselves sell some of their services with crypto.

It's unfortunately not that easy. Iranian students studying in the UK for example, currently have a lot of trouble to pay their tuition fees. Because the U.S. insists that any bank (from the EU or wherever in the world) that wants to do business in the U.S. must comply to U.S. sanctions, which means an U.K. bank has to choose if it wants to block Iran or get blocked itself in/by the U.S. for doing business with Iran. More about this can be found on Wikipedia: https://en.wikipedia.org/wiki/United_States_sanctions_agains....

Even before the US withdrew a lot of financial institutions wouldn't allow doing any kind of transactions with iran.

It's not like the sanctions were actually dropped even though they were supposed to. That was the whole point of the critiques of the JCPOA.

These are very good points. Especially the one about the major payment providers.

Re: countries that have withdrawn from the Iran deal. Even those who haven't (AFAIK, Brazil) are still in grey waters because local companies with business in the US are afraid to do business with Iranian companies. For example, two ships weren't allowed to be refilled in Brazil for 50 days while a legal battle at the supreme court was ongoing to decide if the Brazilian oil company could even refill them, because it was afraid to be sanctioned by the US govt (while doing business in the US or with US companies in the future).

Behdad Esfahbod lives in Canada though, also most of his FOSS contribution (pango, fontconfig etc) are on the freedesktop.org and GNOME git repo servers, not GitHub.

I know this is just nitpicking, but US Sanctions apply to sanctioned state nationals; regardless of location.

Are you sure ?

Quoted from GitHub CEO Nat Friedman on Twitter:

> The restrictions are based on place of residence and location, not on nationality or heritage. If someone was flagged in error, they can fill out a form to get the restrictions lifted on their account within hours.

> Any company or national of Cuba, Iran, North Korea, Sudan, Syria, and the Crimea region. Export licensing of commodities or services intended for these countries is presumed denied;

Wording like this appears on the treasury documents, Google cloud and Oracles official documentation on sanctions.

I'll just link the Oracle one because ironically the one that google uses is really difficult to find:

http://www.oracle.com/us/products/export/export-regulations-...

By that wording, who is a national of the Crimea region? Did they mean residents?

No they don't! The sanction is against the country, not nationals. So if you are a developer from the U.S. with U.S. nationality and move to Cuba the sanctions would also apply to you.

Actually there is a very good wikipedia page "United States sanctions against Iran" https://en.wikipedia.org/wiki/United_States_sanctions_agains... about this, if you want more info.

I don't mean to be flippant, but it will sound this way.

I trust Oracles lawyers to know the law better than a wikipedia page.

http://www.oracle.com/us/products/export/export-regulations-...

Oracles lawyers and Githubs lawyers then disagree cause Githubs CEO stated the same thing as the GP: They block people based on location, not on nationality. If you are banned but not in one of the banned locations you can fill out a form to get unblocked:

https://twitter.com/natfriedman/status/1155311123467399168

Of course this is one of the intended consequences of any capricious military-state outrage. Uncertainty allows them to oppress more people while simultaneously claiming that wasn't their intent. The firms who are applying a broad brush are doing exactly what the armaments lobbyists desire.

IANAL but it seems to me like Oracle's lawyers have taken a stronger position than required by law.

Nationality of individuals is primarily relevant for deemed-export under ITAR/EAR; not the OFAC sanctions on Iran.

Hey. Behdad here. I live in the States but one of our core developers is in Iran. This whole incident was a huge miscommunication on github. Fortunately they have addressed some of it. In short: Open Source and public repos are not affected at all. HarfBuzz has been on github. We will consider moving to fdo or GNOME gitlab if github becomes a problem. Cheers

I would have said "move to git.kernel.org" but that's also hosted by a US based provider:

    organisation:   ORG-PHI3-RIPE
    org-name:       Packet Host Inc
    org-type:       OTHER
    address:        30 Vesey Street, Suite 900, New York, NY 10007 US

And, obviously GNOME git servers are US based, since they're owned by RedHat/IBM.

Use a self hosted gogs installation (https://gogs.io/) under your own domain and root server outside US jurisdiction.

Or just use ssh. That’s what I’ve always done with my friends when we didn’t want to use GitHub.

There’s no need to over complicate things.

GitLab is self-hostable as well, although I imagine Gogs is easier.

Gitlab is actually super easy if you keep to the omnibus installation methods or docker image.

The only problem regarding gitlab is resource consumption.

If your company operates in the US and uses a provider, who does not implement sanctions, does it have to enforce them on its own?

I mean, something like selling a product, maybe based on open source tech in the US and cooperating with devs in sanctioned countries via a workaround provider..

If we end up with a project like [1] actually taking off, then with Secure Scuttlebutt you wouldn't need to care about server hosting and the pub servers could be distributed globally.

[1]: https://people.kernel.org/monsieuricon/patches-carved-into-d...

Hey. HarfBuzz maintainer here. I live in the States but one of our core developers is in Iran. This whole incident was a huge miscommunication on github. Fortunately they have addressed some of it. In short: Open Source and public repos are not affected at all. Cheers

they took the easy way out...ban them all, just in case. Not worth the trouble or lawyer fees explaining it to DOJ

I don't think it is about political pressure in the sense that, I doubt the USG fundamentally cares about whether or not Iranians can use GitHub or not. For companies like Google or Microsoft, this is about minimising the attack surface because they do other (legal) things that the USG does care about. You can't punish a tech giant just for doing a tech giant, but you could try to make other things stick.

The amount of harassment that citizens of any state that the US claims to hate at any given time endure on a daily basis is disgusting. Exiled iranians living outside of Iran for 20 years have got their bank accounts closed solely for being Iranian. I can't help but think that these internet services will be going that way in the future.

The fact that the "free software" community is not putting their foot down for this is disgusting. Especially when there's so much back-patting when it comes to "the value of the community". Where's the community for crimean or iranian developers?

Ya know what was actually disgusting? The war in Iraq, or any other recent regime change the US executed. If economic warfare is the way it’s done now, then that’s great. Let the casualties be inconvenienced github users, rather than ya know, actual casualties...

You realize that sanctions also kill people through lack of supplies like medicine being available, people being unable to economically support themselves, and, if the sanctions cause the government to collapse, all the death that results from that.

So let’s not pretend sanctions are somehow nonviolent.

and yet, that will be less than the war in iraq.

It's github. I would personally be inconvenienced, but not terribly so. I cannot imagine their life is going to crash in some meaningful way for not having access to github.

> it's github.

Are you naive enough to think the sanction is explicitly targeted exactly at github, and not any number of services, or part of a wider economic attack?

yes, tehbeard. The takeaway from my comment should have been that I'm naive and have no idea how sanctions work, or why they're used.

That is absolutely, 100%, unequivocally, the most fair interpretation of my comment that you could have made.

I should thank you for this, really. I cannot imagine someone on the internet assuming that maybe my opinion is based upon more than ignorance and naivete.

These countries are run by some of the most violent and oppressive regimes in the world. Let’s not pretend that the US is responsible for the quality of life of the people living there.

These sanctions are entirely non-violent. The actual word you’re looking for is harmful. They’re designed to be harmful, economically. Responding to regimes like this with economic pressure is most certainly preferable to actual violent conflict. Which would be guaranteed to kill thousands of innocent civilians.

Given recent history, if you think electing to use non-violent methods to sanction these governments is disgusting, then I really don’t think there’s anything I could say to you.

If the regime in Iran falls. It won’t be because of US sanctions. It will be because that country has been operated by a brutal dictator for decades, and the Iranian people grew tired of being the enemy of their own government.

In all fairness, the Iranian government is more popular in Iran than the US govenment in the US. The US sanctions wasn't enacted to help the Iranian people, but to weaken a country that the US perceives as an adversary.

This is important. This kind of actions have to be taken as what they are: unilateral actions of a country against another. It is just the US defending what it sees as they interests. But for the rest of the world it is just a maneuver.

For some people in the USA it is difficult to see it. Given their (expected) skew towards their country. But people outside that country can see it with a more objective perspective.

Similar thing is happening with the concentration camps in the south.

You’ve just described the foreign policy of every country in the world.

Are they? Or are the Iranian people too afraid of the Revolutionary Guard to say different? If you want to go that route, North Korea has the most popular government and leader on Earth. I don't think you can make claims about popularity of a government that can and does make people disappear who say otherwise.

Two very different cultures. there has been several protests in Tehran in the last decade with no execution.

NK has their own culture too where it's just wrong to critise their rules (or their parents). we need to stop looking at the world from a globalised western lens.

This comment seems borderline satire. But I guess you’re right. There’s the western way of approving of your government, where you’re free to make up your mind about whether you do or not, and the way that they do it in North Korea and Iran, where you have to constantly fear the consequences of not approving of your government in the appropriate government prescribed manner.

> the Iranian government is more popular in Iran than the US govenment in the US

It really would be sad if you controlled the media, religious doctrines as interpreted by the gov't (which you can't criticize), had censors, and couldn't pull that off.

https://en.wikipedia.org/wiki/Media_of_Iran

"These sanctions are entirely non-violent." Their effect on the rich in these countries mostly is. What about children dying because of a lack of medication?

One could avoid a lot of collateral damage by targeting sanctions at specific powerful individuals. Think of the way some Russian oligarchs from Putin's inner circle got restricted by western sanctions.

> If the regime in Iran falls. It won’t be because of US sanctions. It will be because that country has been operated by a brutal dictator for decades, and the Iranian people grew tired of being the enemy of their own government.

If so (that Iran falls not because of US sanctions), surely it follows that there is no point to the sanctions?

They would only serve to embitter the targeted population.

> surely it follows that there is no point to the sanctions?

Not at all. Either the sanctions pressure Iran into changing their policies, or the sanctions restrict their ability or enact those policies.

Of course the US is pressuring Iran to act according to the Interests of the US. But if you want to criticize that, you’d have to look at what they are in this situation.

* Protecting allies in the region (which Iran openly and repeatedly vows to wipe of the map)

* Preventing nuclear proliferation

* Doing so while avoiding war

You have to try quite hard to apply the USA-is-just-a-bully trope to this situation.

It's relatively easy to avoid sanctions in the first place or have them removed: comply with US demands.

Most of the world does this just fine. There's a few bad actors out there screwing their countries and their people.

I'm hoping you're being sarcastic - if so, you're right, the US is becoming more and more transparent in its use of power to simply force countries to do whatever it wants.

Everything that reduces quality of life kills people in some way. Heck, I commute through a town that back in the day was rich enough to prevent the highway from being expanded. I bet a couple people have died in ambulances in gridlock there.

Sanctions are a heck of a lot less violent than bombs, or some tit for tat response (which would probably eventually escalate to bombs). They're basically one step up from taxes/tariffs.

The perfect is the enemy of the good.

But how many lives were saved from not having a fast moving road running alongside the town.

Everything is good and bad.

Normally I'd agree but this highway was built as a highway in the '50s a new route where there formerly was no road. It's not like a main street that slowly grew into a major road. The only points where pedestrians cyclists cross the road (it's limited access, nobody is walking or biking on it) are at the aforementioned traffic lights. Based on my experience as a pedestrian I suspect the lights are about the same safety as walking biking past on/off ramps.

This is king of going off on a tangent though.

Sounds like something you could say about anything.

In this case it seems Microsoft at least is striking the right balance by leaving open the free version. They are not profiting from sanctions yet they are leaving open an information service that could be used to organize dissent within the sanctioned regime. Not that github would be the first place you’d try but at least it’s an option if all the others are blocked.

False dichotomy! Economic sanctions are not the only alternative to actual wars. In fact, they are a form of collective punishment that harm average citizens of these countries more than their governments. And this is not just about some inconvenienced github users; this has been a contentious issue in every natural disaster [1].

[1] https://www.reuters.com/article/us-iran-floods-redcrescent/f...

In any situation, the people will be harmed by any form of action taken against its government. By this logic, it would never be considered reasonable to take any action at all against any government.

When one country vows to wipe another country off the map, it’s reasonable for other countries to take some action against that. When a dictator spends the better part of a decade bombing its civilians, it’s reasonable for other countries to take some action against that.

Your options really are to retaliate with force, or sanctions. Economic sanctions are far less harmful, and far more productive. I’d bet that all those Syrians you see on the news digging their dead family members out of the rubble of their bombed houses would be more than willing to trade that life for one with economic sanctions.

I’m really struggling to believe that an anti-war stance is now considered controversial on HN.

> I’m really struggling to believe that an anti-war stance is now considered controversial on HN

I Don't know about HN, but I don't think an anti-war stance is controversial. Having said that, I believe, presenting economic sanctions as a humane alternative to war is deeply misleading. Of course you are entitled to your opinion.

Economic sanctions are quite obviously an alternative to war (though perhaps not the only alternative), and if you look at recent administrations proclivity for intervention and regime change, it’s also quite obviously a change of tack.

Whether the sanctions are warranted is much more open to debate. But in Syria you have a regime that created the greatest humanitarian crisis of a generation, and in Iran you have a regime that repeatedly vows to wipe another country off the map, and an enormous proliferation risk. So I know what side of that debate I’d fall on, and I know what my preferences are when it comes to starting new wars.

http://cepr.net/press-center/press-releases/report-finds-us-...

While I believe in the GNU definition of free software, how are we to maintain a community that's truly open-source when the parties you speak of don't believe in free software themselves? Are we really to give them the best our world has to offer so they can use it to suppress people and act against their interests? Do we let them use our libraries and tools to make their world smaller for their citizens? Do we let them steal our code to change it to hurt others and then not reciprocate it back in? Do we let them take the best we have to offer with such obvious mal-intent?

If it were a difference of culture or opinion that's fine. But you're allowing rogue authoritarian states to use our technology while taking an adversarial stance to our primary purpose; the free transfer of knowledge and information. We don't need to accommodate that. They need to accommodate the freedom their people are entitled to.

Think about it. Which developers in North Korea or Iran are using Github? Answer: The ones the government lets use Github.

This is a pretty gross generalisation of the people and issues at stake. "We" the individual freedom loving, contributors. "They", the rogue nations using open source software to oppress and enslave.

Honestly it boggles my mind how easily you slipped into that mentality in response to the comment you replied to - a comment describing people caught in the crossfire, affected by the choices of nations at war, individual liberties crushed by sanctions and foreign policy.

If an individual feels wrongly and disproportionately impacted by US sanctions they can apply to the SEC for a waiver. A small, lonely dev will probably be ok.

But the issue isn't with one dev who gets caught in the crossfire. You want to stop fighting a blazing inferno to mount a rescue operation because there's one kitten in the burning apartment building.

Individual liberties cannot be realized without sanctions and foreign policy. Do you think if Github were located in Tehran that Americans would be able to post a commit right now?

> If an individual feels wrongly and disproportionately impacted by US sanctions they can apply to the SEC for a waiver. A small, lonely dev will probably be ok.

And github & Co will then invest money to not blanket-ban, but make exceptions for this individual? I have some doubts.

Do you believe that Iran's cyber warriors or their critical infrastructure people host their code on github? Because if not, you're not "fighting" the government, you're fighting individual developers.

> Do you think if Github were located in Tehran that Americans would be able to post a commit right now?

I find that a very problematic worldview, as it gives you permission to do anything. There are no limits, because "what if the table were turned? I'm doing it to them, so clearly they'd do it to me, right? So you see, I must do it to them first".

> And github & Co will then invest money to not blanket-ban, but make exceptions for this individual? I have some doubts.

I don't see why not. It's probably a simple boolean value in their database somewhere. If they can blanket ban, they can probably be selective for a minimal cost.

> Do you believe that Iran's cyber warriors or their critical infrastructure people host their code on github?

It wouldn't surprise me one bit if they did. People put weird stuff on GH for all kinds of weird reasons. Every week we hear about an unsecured AWS bucket from some huge mega-corp or state actor who should know better. But they are all run by humans who are free to make mistakes and break rules.

> I find that a very problematic worldview, as it gives you permission to do anything.

Being the most powerful and influential player in technology gives us permission to do anything. Having (one of) the largest tech markets and the (nearly) unlimited resources to spend makes us able to do whatever we want. And if we want to keep it that way we will ensure that we don't let unfriendly nations take advantage of our technology. We developed encryption to protect our banking sector. Just because we're nice enough to open-source it doesn't give Tehran officials the freedom to use it to suppress their entire nation. If authoritarianism worked so well they would be on top of the world with all their proprietary technology and censored information. But they're not. So either you're going to play nice with our toys in the sandbox or we're taking our ball and going home.

Large services are banning IP ranges (https://gist.github.com/alibo/dfd7c258bcc44a0e8c9f7c5bfd3bd2...), so they'll have to invest and provide alternatives to those individuals.

> Being the most powerful and influential player in technology gives us permission to do anything.

Read this again, slowly. You're advocating for the law of the jungle where the actor with the biggest club has the right (and, I presume, duty?) to do whatever they please to whomever they please whenever they please.

> Individual liberties cannot be realized without sanctions and foreign policy.

What kind of jingo non-sense is that?

We now have over a century of data on how effective US foreign policy is at promoting democracy around the world and if you read the history even badly, you can't help but notice that it's much better at killing people in monstrous numbers than at promoting individual liberty.

American foreign policy isn't designed to promote "democracy around the world."

It's designed to promote democracy in the free world that the people who control the world live in.

> Individual liberties cannot be realized without sanctions and foreign policy.

[Citation needed]. It is not as if sanctions have a stellar record when it comes to promoting individual liberties. Rather the opposite - they entrench the powers that be and give them an opponent that are not themselves that they can blame the hardship of the people on.

How do you come to this conclusion, and what exactly do you mean by "free software community"? Github/Microsoft?

There are quite some free software projects that use their own code hosting (e.g. https://salsa.debian.org). But if you don't have time for that and use github for your OSS project you are now disgusting because of the iranian sanctions?

How about gender equality? CO2 neutral servers? Why are the ones that put effort into building and improving things blamed for not being at least perfect?

It's unfortunately hard to separate good and honest foreigners from those that would prefer to destroy other nation states.

Yeah but I would argue that the US is actually destroying other nation-states

s/foreigners/people/ .

It is however quite easy for good and honest foreigners to determine if the US wishes to destroy other nation states.

> Personally I find it quite abhorrent, and would cite this as a reason not to use US based companies in future.

Then I’d highly recommend that you try doing that. I consulted for a company once that tried this, and it was an absolute nightmare. Every single piece of technology they used was worse than second rate. Making comments on HN is really easy, backing them up with action, in this case, is not.

Any company that does business in the US, or with another company that does business in the US. Not just US based companies are subject to these restrictions (if they want to sell into the US)

Don’t make it too hard on yourself. If you want to use your own economic clout to take a swing at the US, then just stick to boycotting US companies. See if it’s even possible to operate your project like that. You’ll be taking a step back in time by at least 10 years.

I am not sure I could do it at all. The Linux Foundation is a US corporation, and that rules out nearly all my options for the work I personally do. (and, well working for one doesn't help it either)

Then make it even easier. Only apply the principle to services or products you pay for.

The sensibility you have expressed is chiefly why we should fight US dominance of the tech sector. Not why we should lean in to it.

this is true for a lot things.

They're called keyboard warriors for a reason.

It looks like the free services provided by GitHub are still available:

"A selection of GitHub services such as access to public repositories will remain available to everyone, the company said in a statement on its website. “This includes limited access to GitHub public repository services (such as access to GitHub Pages and public repositories used for open source projects), for personal communications only, and not for commercial purposes.”

So what can't restricted foreign-nationals do? Private, paid-for repositories? Is there something else particularly important?

If I recall right from previous thread they can still create and commit to public repo but can't delete them. They also can't touch even their own private repo anymore.

They added the option to make private repos public so you can back it up. But again, you can’t delete the now public repo.

>They added the option to make private repos public so you can back it up.

And allow all to see their contents, likes business and trade secrets. Top tier.

Yep. If you want to access your blocked private repo, you literally have to let everyone access it. And you can’t even delete it afterwards.

> Yep. If you want to access your blocked private repo, you literally have to let everyone access it. And you can’t even delete it afterwards.

One must wonder just how many companies with juicy trade secrets situated in a nation with adversarial relations to the US are hosting that juicy data in the US, with a US corporation.

Given that the public, open-source situation is not changed this is starting to sound like a tempest in a teacup.

Couldn't one temporarily travel outside of the affected regions to access their private repos normally?

Github does have an appeal process if the algorithm mistakenly tagged you. I’m not sure what proof they ask for.

This is interesting, I didn’t see that.

In which case they are actually providing -more- than gitlab does.

It's google that's blocking gitlab users/servers. Gitlab's mistake is using Google.

This affects companies that have US users too. Your only option is to move out of the US and not use products with any users in the US. That means your only option is China, which is far worse for online rights than the US.

Like I wrote somewhere else, the Gitlab case is both worse and better. Gitlab did not make a specific decision to block Iranian users, it merely made a technical decision to move to Google Cloud, and Google Cloud is blocking sanctioned countries on a network level (which is abhorrent).

But I don't see Gitlab making an active decision that they have to do this for sanctions compliance reasons, it was just a side-effect and they didn't care enough for it to change their minds about the move.

Specifically, if I sign up to Gitlab, set my country of residence to Iran, and Gitlab lets me create private repositories, then they are not enforcing the sanctions the way Github does.

See comments in this previous thread from 31 days ago [1]...

Google Safety & Security Blog: An update on state-sponsored activity (2018) ...

Detecting and terminating activity on Google properties

"Actors engaged in this type of influence operation violate our policies, and we swiftly remove such content from our services and terminate these actors’ accounts. Additionally, we use a number of robust methods, including IP blocking, to prevent individuals or entities in Iran from opening advertising accounts."

---//---

[1] "An Open Letter to Google and Apple: Stop Hindering Iranian Entrepreneurs"

https://news.ycombinator.com/item?id=20302547

Can we start calling this "The Great Reverse Firewall"?

Not all of it is US sanctions [1]. The US will protect its networks and will not allow a foreign adversary to use US platforms to target US citizens, but the US has no incentive to restrict the Iranian people's access to information or communications or ability to speak. Most of Iran's cyberspace restrictions are coming from within...

https://en.wikipedia.org/wiki/Internet_censorship_in_Iran

[1] "Iran's Rulers Speak Of More Cyberspace Restrictions As Conditions Worsen" https://en.radiofarda.com/a/iran-s-rulers-speak-of-more-cybe...

Yeah, it's totally abhorrent that the US blocks people that would prefer they get wiped off the face of the earth. How dare they!!!

Your sentence uses "they" ambiguously, FYI. Two very different interpretations possible.

Have you considered that regular people that live under an oppressive totalitarian government have no control over said government and are actually just victims?

Have you ever lived in the US?

I think non-US companies have to comply with the sanctions too. Your alternative will be the pool of sanctioned countries and friends. Which don’t have the infrastructure most people need.

There is no real difference between sanctions on internet service and any other thing, except things directly involved in the reasons for the sanctions (notably military material)

If Crimea was unwillingly annexed by Russia, then the sanction is punishing the victim instead of the criminal. If Crimea people genuinely supported the unification with Russia and received sanction for that, then it is a blatant attack on Crimean people's freedom.

pff, ridiculous comment. a region doesn't have the right to attach itself to another state.

think about it. a bunch of russians move to somewhere near grand canion, do a referendum and then proclaim it russian territory.

There aren't many examples of Unification, but there are examples, maybe this wouldn't be considered one of them.

My home country for instance is the "United Kingdom" which is made of up of countries/territories that unified many hundreds of years ago.

There's other examples such as the formation of Italy: https://en.wikipedia.org/wiki/Italian_unification

However, if it's not annexation it's probably better described as "ceding"; an American example: France ceded Louisiana to the United States by the treaty of Paris, of April 30, 1803. Spain made a cession of East and West Florida by the treaty of February 22, 1819.

Cessions have been severally made of a part of their territory by New York, Virginia, Massachusetts, Connecticut, South Carolina, North Carolina, and Georgia.

unified is a proper term perhaps but at the time the gaelic speaking peoples would have probably used conquered or maybe colonized.

This is not an appreciable understanding of history. If talking about the UK specifically.

But that's _literally_ how a bunch of countries split from other countries. In a different context, we might celebrate it and call it "gaining independence" or "reuniting with their motherland".

Isn't that how Texas became part of the US?

Indeed, tell King George about it, and at the very least return Texas to Mexico and Mexico to Spain.

You're totally right. Think about it, British/French/Spanish/... move to somewhere near grand canyon, do a referendum and they proclaim it United States? Ridiculous!

Hey, it happened before

https://en.wikipedia.org/wiki/Texas#Statehood

Crimea is a special case: it used to be Russian but was reassigned to the Ukraine at the time when they both were part of the USSR. It wasn't a big deal until the USSR dissolved and suddenly Crimean residents turned out to be in a foreign country.

It had been Turkish before it was Russian. Should we go on? Besides, the indigenous population (Crimean Tatars) and the Ukrainians in Crimea never thought of Ukraine as a foreign country.

Let's not confuse events of the 18th century and the modern history.

Crimea was called Crimean Khanate at that time and the backbone of its economy was the slave trade. As a major slave trade hub it has seen many hundreds of thousands of Russians and Ukrainians captured by Crimean Tatars and sold to Turkey until Catherine the Great's counter-terrorist operation finally put an end to it in 1783 :)

This dramatic history rooted in inability of the Crimean Khanate peacefully coexist with Russia can hardly be compared with a single action of a Soviet bureaucrat in Moscow in 1954.

And you are misinformed, Crimeans Tatars are not the indigenous population, they are a remnant of the Golden Horde.

> Let's not confuse events of 18th century and the modern history.

https://en.wikipedia.org/wiki/Deportation_of_the_Crimean_Tat...

Are you and 'tomohawk' the same person? Otherwise I don't see a reason why you have brought up 'ethnic cleansing' in this thread.

Nonetheless, the deportation of Crimean Tatars by Stalin in 1944 is a crime and has been repeatedly recognized as such by the modern Russia.

"Most of the Russian population in Crimea are second/third generation settlers"

Even the biased Wikipedia article you linked to doesn't support that.

Edit: please don't edit your comments after they have a reply. Thank you.

Yes, I was off with the numbers, so I had deleted my comment just before you replied to it. But the point is still valid: the current ethnic composition of Crimea was greatly affected by the deportation.

According to your own link Crimean Tatars constituted 20% of the population in 1939, nowadays the number 12-15%.

I wouldn't call it 'greatly affected'.

> According to your own link Crimean Tatars constituted 20% of the population in 1939, nowadays the number 12-15%. I wouldn't call it 'greatly affected'.

Lots of people died as a result of the deportation. The uprooting inhibited the natural population growth over the years. Lots of Crimean Tatars now live outside of Crimea.

I don't see your point, honestly.

https://en.wikipedia.org/wiki/Texas_Revolution

This was basically Kosovo, Transnistria and probably a few more.

The idea is to try and make it unsustainable for Russia to hold. --They have to pour money into the region to keep control of it due to people in the region being unhappy, out of work, etc.

I'm not saying it's necessarily a good strategy, mind you.

That’s horrible. I was unaware of this until now and I’m deeply upset by it. :(

What do you then suggest? Going to war about it, or just letting territorial annexations continue?

If you have no better alternative, what reason is there to be upset?

> They have to pour money into the region to keep control of it due to people in the region being unhappy, out of work, etc.

From what I've heard Russia is doing exactly that. And the people there seem happy, atleast according to a reddit AMA by a Crimean.

Save for the indigenous Crimean Tatars and some Ukrainians who are, although a minority, being harassed like there's no tomorrow.

https://www.hrw.org/news/2017/11/14/crimea-persecution-crime...

> And the people there seem happy, atleast according to a reddit AMA by a Crimean.

It's amazing to me that anyone would put any faith in a random AMA in an occupied territory.

For an alternative random redditor, this guy had to get divorced, all his friends left, and he's leaving for Kiev: https://www.reddit.com/r/AskReddit/comments/9p6d9r/serious_r...

Well, seeing we already talk anecdotes… I was there myself this year in May on a week-long hike and a few days at the sea, and they're doing alright. The year of 2014 was quite rough (especially with the electricity shortages when Ukraine cut off their supplies), but now, with the two new power plants, they're energetically self-sustainable. After the bridge link to the mainland opened last year and with a newly-rebuilt airport in Simferopol, they also no longer feel so isolated.

> The idea is to try and make it unsustainable for Russia to hold

Why, then, blocking does not apply to all Russia, but to its victims only?

The only situation when economics sanctions isn't an attack against the victims is if a fully democratic country decided to start a war.

Some dictators are popular and their actions are supported by the people.

Yeah, tell that to all my friends who had to leave the Crimea. "Voting" after the Russian armed forces had been brought is not significant.

You mean eastern Ukraine? Russians came in and installed an illegal regime. Add in some ethnic cleansing, and the situation is not remotely what you claim. Add in downing of MH17 airliner, and its obvious they pose a danger to all of us.

There's a lot of whataboutism going on in this thread, but it is clear that these sanctions exist for reasons, and for Crimea, those are pretty solid reasons.

The whataboutisms about what other countries may or may not have done is immaterial. If you want to put some people who happen to live in the crimean region who cannot access and internet service in the same category as downing an airliner and ethnic cleansing, good luck.

The victim in Crimea annexation is Budapest Memorandum (1994) that protected Ukrainian territorial integrity in exchange for Ukraine giving up nuclear weapons.

The United States (and other western countries) are concerned that Crimea annexation encourages nuclear weapons proliferation.

Sanctions against Crimea discourage potential annexations and lower chances of nuclear weapons proliferation in the future.

https://en.wikipedia.org/wiki/Budapest_Memorandum_on_Securit...

Posting Nat Friedman's tweets here so they're easier to read - they're doing more than most companies about the whole thing, not sure where the vitriol in these comments is coming from:

It is painful for me to hear how trade restrictions have hurt people. We have gone to great lengths to do no more than what is required by the law, but of course people are still affected. GitHub is subject to US trade law, just like any company that does business in the US.

To comply with US sanctions, we unfortunately had to implement new restrictions on private repos and paid accounts in Iran, Syria, and Crimea.

Public repos remain available to developers everywhere – open source repos are NOT affected.

The restrictions are based on place of residence and location, not on nationality or heritage. If someone was flagged in error, they can fill out a form to get the restrictions lifted on their account within hours.

Users with restricted private repos can also choose to make them public. Our understanding of the law does not give us the option to give anyone advance notice of restrictions.

We're not doing this because we want to; we're doing it because we have to. GitHub will continue to advocate vigorously with governments around the world for policies that protect software developers and the global open source community.

It's crazy how Trump imposed these restrictions against innocent people and got away with it.

It's the nature of economic sanctions that there are real people's livelihoods which are directly affected. That happens with all economic sanctions... nothing unique about this one

I don’t think that it would have been different if someone else was the president. Pre-Trump I had a vacation in Cuba and since I knew that the internet is a luxury there I made Spanish available offline on Google Translate. Works great, then I made the mistake to launch the app when I hade one hour access to the internet in Havana and puff translate is gone. I’m not allowed to use it there. That surely destroyed the communists.

When it comes to Iran, it definitely would have been different, considering that it was Obama that made the deal that Trump decided to break.

Oh definitely, my comment was intended to highlight how blunt these tools are.

The US trade restrictions are pretty far reaching. They block companies trading with countries and companies on entity list . It also bans US companies from dealing with companies that deal with countries and companies on the list.

So let us look at this:

1. GitHub becomes a Maltese company. 2. GitHub allows Iranian users to use all features 3. No US company could buy a GitHub Enterprise licence, or a private org.

The export restrictions don't let them notify people that the ban is coming - once they identify the users that are under the Export Restrictions, allowing them to download (aka export) their repos is a breach. They did as much as they could to allow them to keep their accounts at all (and this is only due to export restrictions having exclusions that cover "publicly available source").

GitHub did what they had to do to avoid being censured by the US Gov, and did it better than a lot of other tech companies recently, by leaving some level of access.

If you don't like the ban, and you are in the US, contact your elected representatives, and let them know - it is the only way it changes.

That's not true. There are already many non-US companies who are providing services to Iran in the same sense that Github is providing services, and those companies are also having US clients, proving that it can be done.

Now, if a Maltese-Github were specifically designated by OFAC, then sure. But that's fairly unlikely.

> and those companies are also having US clients, proving that it can be done.

Proving they haven't been caught, or may not even know about the US Dept of Commerce entity list.

Yes, in a way they haven't been caught. However, I want to point out that only US companies and persons are obligated to follow the sanctions. The reason why foreign companies might also follow them is because they don't want to end up being designated themselves.

And this is not realistically going to happen unless you are a large multinational, bank, or doing business in sensitive sectors.

Not actively blocking accounts identified as Iranian is not even the same as specifically trading with Iran. Like many smaller US-based web-services who also do not actively block, Github might well have gotten away with it as well, like the did the last couple of years.

A Maltese-based company not blocking Iranian users might be designated, but unless they are, and it is pretty unlikely that they would be, they are doing nothing wrong under US law.

Like a certain sized company, Microsoft? And that's why we're in this situation, because frankly Microsoft is big enough to get slapped hard if they didn't comply.

The real risk is to their US end users - if a US company is found to have commercial dealings with a company that has commercial dealings with Iran / N. Korea etc, the US company is in breach of the regulations.

So in this case, if Bank of America had a company subscription with this hypothetical Maltese GitHub, BoA would be in breach, and could face sanctions (and this would probably cause the Maltese GH to get on the entity list as well)

So is it just a question of risk tolerance? Are the laws clear or are companies like GitHub in a grey area with out precedence?

The law is pretty clear, apart from what "commercial activity" is - GitHub has decided that it is accounts, but allows public repos, as they are explicitly exempted from some of the regulations.

We made it point now to avoid all US-based services. While we're not affected by the sanctions yet, it seems like it is a possibility in the future. There's really not a lot of reasons to use Gitlab or Github or Slack or a number of other services. They're not exceptional in any way and can be replaced by other open-source or commercial projects.

Yep, and this is a sign of the ecosystem working well.

In the same line, if there's any forum I take with a spoonful of salt it's Hacker News.

Convenience and speed aren't reasons?

You're handicapping yourself against your competitors, and no one who does that lasts very long.

Don't see it that way. If I set up a process once, using software that's been tested and been around for a while, it's extremely convenient. And free. And there's no risk of deplatforming.

You're completely ignoring feature parity, among many, many other things in your oversimplification...

Ask any founder here: people don't generally randomly throw money without getting value; ergo these multibillion dollar services you're pretending are entirely replaceable with free tools offer some additional value .

I'm a founder. I'm extremely careful not throwing money. And I'm especially am aware of the changing environment. The internet is no longer free. You depend on a third party, you lose. The only true way is to gradually build your own infrastructure as you grow.

That's fine, but pretending like this is an objectively superior solution and the value prop of these companies doesn't exist is flat wrong.

What if someone applied your own logic to buying your product (why pay when I can get the exact same thing from free tools)? It'd be annoying and generally wrong, wouldn't it?

I'm happy to pay. To me, however, the value lies in predictability, sustainability and avoiding the risk of deplatforming. Tech companies come and go and are subject to political issues (as proven by Github). Thus, sometimes, it's wiser to pay engineers to set things up than buy a product/service.

You're shifting the conversation though, this wasn't about what your priorities are it was about whether or not the products provide value. You claimed they don't, you are now saying they do provide value?

I never said those products don't provide value, I only said they're not exceptional in providing that value and that value can be obtained by carefully considering alternative solutions.

> There's really not a lot of reasons to use Gitlab or Github or Slack or a number of other services.

That is completely different from what you are saying now...

Also, "that value can be found elsewhere" is a devious little shift in the meaning of the word "value" in "value prop". Nice try but no, that isn't the same thing.

Even further. Wondered why there are no single Stallman reference here and in the previous discussion at https://news.ycombinator.com/item?id=20531039

How do you get payments from your customers? Most payments are processed by US companies.

Bitcoin.

Keep in mind the sanctions affect all companies that do business in the US.

I know lots of Iranian people and they are universally kind generous lovely people.

I hate the way Iran is demonized so politicians can point out an enemy.

We were flat out lied to about Iraq. Demonization of Iran is no different.

It's more like the Iranian government.

Not like the US government is any better right now

Trump just needs a war to be in by election time...

At no point in the last 40 years has the US government held a higher moral ground than the Iranian government. The USA has killed far more innocent people under far worse pretext than any other nation on Earth.

As long as the government just calls people names instead of invading them, I am completely fine with that. Progress, I guess.

Because the US government hasn't invaded other countries...?

Of course they call it something different, but they do tend to start wars periodically. For flimsy reasons.

Not lately at least. While I think Lybia was a big mistake, I tend to blame France more than the US. Iraq, Uganda, Somalia and Yemen are the wars the US is involved in to my knowledge, some of them not actively anymore. Say what you will about Trump. Him not starting wars seem to be an exception, although I don't think Obama is responsible for the Lybia situation. Politically perhaps as he omitted congress, but I still wouldn't call it a war that he started.

Hell, Gaddafi was air-striking civilians. The African Union was against foreign intervention and today civilians probably suffer more than under the regime of Gaddafi. Hard so say what would have been the right thing to do. We still feel the repercussions of that...

The US government is executing people for being homosexual and imprisoning women for being individuals? Really??

Of course they don't do that. However, that is certainly not the reason why the relations are so bad. The US government has absolutely no problem in having very good relations with government/regimes that do those things and worse (Saudi Arabia?). The thing is that whenever a country decides to do something that the USA don't like, they begin hostilities in different levels until they a) get what they want (almost never happens) or b) completely destabilize the country.

Irans government is pretty backwards. The Iranian society is and was much more open a few decades ago. Truly a sad story of development in the completely wrong direction.

Have you seen the US lately? We're en route to undoing Roe v Wade, the Civil Rights Act, years of progress on other matters, etc, and we've already basically given up on functional democracy by allowing corporations to spend as much as they want on candidates. What do they say about those in glass houses...?

The female lawyer who defended a woman who refused to wear a hijab was sentenced to 38 years in prison and 148 lashes. [1]

Homosexuality is punishable by death. [2]

Please don't act like the problems you see in the U.S are the same problems they have in Iran.

[1] https://www.washingtonpost.com/opinions/global-opinions/she-... [2] https://www.usatoday.com/story/money/2019/06/14/countries-wh...

Don't forget it was the US that destroyed Iran's democracy in 1953, installed a puppet dictator, leading to the islamic revolution we see today.

In the US the backlash is unfortunate but explainable. While conservatives could probably have been convinced with data that liberation did in fact not increase abortion cases and showing that prohibition doesn't stop them either while just increasing suffering, a lot of liberal proponents put some twitter nut jobs at the forefront of the discussion. Or maybe conservative media just put them in the spotlight. That is my impression at least. The result is predictably bad. I don't know how that abortion topic came up in the first place, but here we are.

Money in politics is a serious problem. Obama was very honest about that. While basically being bankrolled by citybank, he made that fact clear multiple times and basically asked for people holding their representatives accountable. Obviously that doesn't seem so easy.

But all that doesn't really compare to the theocratic rules the Iranian regime implemented. That is on a whole other level.

It was the CIA backed coup of 1953 that led to this "wrong direction" in the first place.

There's a repository that has made many aware of such problem https://github.com/1995parham/github-do-not-ban-us

As an alternative for Iranian developers and any other who was affected by such problem, I've setup https://gitfoo.com/

It's a hosted version of gitea. I have enough resources and interest to maintain and keep it going.

To me, this is another example of the "splinternet" phenomenon where the Internet is, in some ways, moving to become less of a universal resource and more regional in nature.

It's a shame, as a lot of benefit has been derived from having globally available information exchange, but it seems the trend is for regions or nation states to want more control over Internet based resources, as they become more important to the operation of those countries.

There's a lot of misinformation in this thread, from GitHub CEO [1]:

"It is painful for me to hear how trade restrictions have hurt people. We have gone to great lengths to do no more than what is required by the law, but of course people are still affected. GitHub is subject to US trade law, just like any company that does business in the US."

"To comply with US sanctions, we unfortunately had to implement new restrictions on private repos and paid accounts in Iran, Syria, and Crimea.

Public repos remain available to developers everywhere – open source repos are NOT affected."

"The restrictions are based on place of residence and location, not on nationality or heritage. If someone was flagged in error, they can fill out a form to get the restrictions lifted on their account within hours.

More info is on our policy page: https://help.github.com/en/articles/github-and-trade-control... "

GitHub is just complying with US trade law, it's not just because they're a US company, any company doing business in the US also has to comply.

[1] https://twitter.com/natfriedman/status/1155311121038864384

I'm curious.. why is this very suddenly an issue? Haven't countries like Iran and Syria been under embargo for years? Have more restrictive laws around sanctions been passed in recent weeks?

I’m not sure but I suspect the change is due to GitHub having been bought by MS which has more competent (or more paranoid.... or maybe just more) lawyers.

MS with their lawyers caring about things that GitHub on its own didn't?

How about someone build a platform that is freely available that pushes to github from a not banned Location. Or just stop using github and create or find a truly free platform.

This really is reason to start thinking about alternatives to github.

Now the vast majority of open source projects are controlled by Microsoft corporation which must obey the US goverent and this is the outcome.

Downvoted.

Github was subject to US law before MS took it over; gitlab is not MS-owned but had to do the same (not sure about bitbucket but I imagine it's similar).

Whether the #1 place to host open-source projects should be owned by a company that makes a closed-source OS is a good debate question but it's completely orthogonal to whether they have to comply with US law.

I'm not saying I agree either with the sanctions or with Microsoft running github, but I'm saying you can't blame Microsoft for the current administration's sanctions on Iran.

So why haven't all websites cut off these countries?

Why haven't the ISPs cut off these countries?

Github has acted because github is under the control of a giant corporation, Microsoft or otherwise.

So there's a line that runs precisely from Microsoft acquisition to cutting off countries from the world's largest open source repository. It's a direct outcome of the Microsoft acquisition.

A lot of pages have. Or at least they don't take payments from them. Larger CDN providers will maintain "US sanctions" blacklists which you can enable with one click. A lot of companies just don't care.

I doubt it - I would suggest the rapidly escalating tensions in the Gulf, combined with a much more activist / impulsive administration has caused this.

I don't think people actively contributing to open source ever cared about in which nation their code was hosted. Because it didn't really matter.

Now it is like an old grumpy grandpa you wanted to get rid off some time ago suddenly caught up with you and enforced some of the shittiest laws you could imagine.

But did they really need to enforce that block? I would imagine nobody would have noticed it and if github wouldn't be owned by a giant that enforces compliance to the letter, Iranian devs wouldn't be banned.

Not the fault of MS, sure, just saying that this is one of the disadvantages about the takeover.

Don't build a system to circumvent sanctions if you're within the reach of the US Government, AKA much of the world.

https://en.wikipedia.org/wiki/List_of_United_States_extradit...

Just build it in Switzerland:

"3. The Requested State may deny extradition for acts which: (a) violate provisions of law relating exclusively to currency policy, trade policy, or economic policy; " [1]

[1] http://www.mcnabbassociates.com/Switzerland%20International%...

There's room for building instruments like this at a state-sponsored level in, say, the EU. The EU has already been working on a special clearing house that would help European businesses circumvent the US-imposed sanctions.

https://www.aljazeera.com/news/2019/06/system-circumvent-san...

You are not wrong on facts. The problem for Iran is that EU does not really seem to want to actually do anything other than words and vague promises. Instex was a promise of sorts, but UE chickened out ( for a good reason after most govn. representatives including Lindsay said something along the lines u either wiff us or against us ). One of the reasons Iran grabbed a ship was to pressure EU to make it an actual option and not a talking point.

‘[…] services such as access to public repositories will remain available to everyone, […] “This includes limited access to GitHub public repository services (such as access to GitHub Pages and public repositories used for open source projects), for personal communications only, and not for commercial purposes.”’

Assuming that this is a Cuba, Iran or Syria problem is misleading, even though it renders most of things that I've made in my free time useless.

Having free access to open source code is important. As a developer I'd try to self-host more and try decentralized solutions instead of relying on corporate entites to protect my interests.

Saw some other debate in here about whether the law applies only to countries or also to individuals... Here's two federal govt lists of banned individuals:

https://www.bis.doc.gov/index.php/the-denied-persons-list

https://www.treasury.gov/resource-center/sanctions/SDN-List/...

That's a great opportunity to build similar code-hosting platforms (and other software/services) outside of the US. Just for political reasons many people might like to switch...

Good time to advocate ipfs!

https://docs.ipfs.io/guides/examples/git/

Thankfully github is not a walled garden and repo can be moved to any other public or self-hosted git (well, at least the code itself). Or, as someone already suggested, use an external service/server that pushes the commits into git(hub|lab) repo. Git also seems to be relatively easy to work in a federated ecosystem - the only problem to be solved is read/write access in such environment.

I'm curious to hear what Gitlab has to say about this, or if they will have some kind of official communication specifically on that matter.

See https://about.gitlab.com/2018/07/19/gcp-move-update/

Yes, thanks!

Note that this is not quite the same. Gitlab made a technical decision to move to Google Cloud, and Google Cloud has its own, much more outrageous block on a network level.

Gitlab not being accessible from Iran is a by-product of that move, not a conscious decision Gitlab made.

Arguably, if I create a Gitlab Account using a VPN but put country of residence "Iran", and Gitlab lets me do that, then Gitlab does not have the same policy has Github.

Ha, good additional info indeed. I took the Github post as in "if I'm in Iran but use a VPN, and set Iran as country of residence I'm fine".

How are private repos handled in this situation? From what I remember private repos go public if you fail to pay for them after a month.

Are there currently any serious competitors to Github/Gitlab (or instances of the latter) outside the reach of US politics?

I think that's a fair answer and is totally understandable from Github's standing point.

Wish they could give a heads up earlier.

I think it is interesting and a shame that we accept centralized issue tracking at all. Git is wonderfully distributed, probably in more than most of the github users realize. Unless they've gone out of their way to learn about it.

When things like this (github's ban) happen, I think it is too bad that we don't have a widely accepted issue tracker built into git. To be a little more clear, you'd get all of the source and all the issues when you clone or pull. Updating would work just like updating files when you push.

Microsoft has appeared to start loving open source. I'm sure there are people there that do, but Microsoft itself I wouldn't be so sure. The are certainly embracing it. https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguis...

I mean, you could just make a folder with a text file in it for each issues. People can write comments in it. Move them into a "complete" folder when done. Write down who it's assigned to at the top. You wouldn't get some of the more complex features of course, but I'm not sure a git built in issue tracker could do most of that anyway. Not clear how it could send email notifications?

It's not Microsoft choice. They have to listen to US laws.

You could also switch from Git to Fossil which supports issues and wikis as part of its decentralized nature, in addition to unversioned artifacts (e.g., for release artifacts)

I wonder is those could be related to cyber security measures, not political measures.

It's unlikely. GitHub hasn't banned Iranian IPs or completely closed Iranian users, but just blocked those users' access to their private repositories and Gists.

Very unlikely in my opinion - if the Iranian Revolutionary Guard did want to attack something, I doubt they would do it from an IP address in their own country. I'm sure they have a decent botnet or two somewhere else, that's like opsec 101.

Similarly, although Crimea specifically is now IP-banned, the rest of the Russian Federation is not.

This is exactly what it looks like: a political sanction.

Yes, some of it is. See previous thread...

https://news.ycombinator.com/item?id=20302844

This is what happens when mega companies take over, they helped to make github what it is today just like every body else, and banning them without any notice just to see them suffer, that's low

"GitHub confirms it has blocked developers in Iran, Syria and Crimea" - you mean Microsoft, right? Because last I checked Microsoft bought GitHub, fully!

As far as I know, SourceHut[1] is still available everywhere.

[1] https://sourcehut.org/

EDIT: I stand corrected.

Sourcehut is US operated and I cannot accept users from sanctioned countries. You can run your own instance if your legal circumstances differ, but you cannot use the official hosted version.

As other users have pointed out, the sanctions don't apply to internet services as long as they are provided for free[1]. So this is political pressure, not legal requirement.

I'm disappointed that you've chosen to give in to the political pressure. I posted about SourceHut to promote your service because I thought you were doing something better than the big guys.

[1] https://www.treasury.gov/resource-center/sanctions/Programs/...

SourceHut accepts payments and will eventually become paid-only. I am a one-man operation and I don't have the legal wherewithal to stand up to the government. You can tell me how this legal fight fits into our budget, the finances are public:

https://lists.sr.ht/~sircmpwn/sr.ht-discuss/%3CBVRVZEWYB30Q....

I have to prioritize the health of the service for everyone above the needs of a few people.

Wait, Crimea's on the sh*tlist now too? Is this new?

No; this goes back to 2014.

https://www.treasury.gov/resource-center/sanctions/Programs/...

The timing is interesting, but same action could have been taken say 4 years ago and it would technically still be true. Whatever the reason is, it is not the recent SDN update.

Is there an easy to understand guide for SaaS businesses to be compliant with these specific sanctions?

Yes: don't provide any products or services to Iran, Syria, North Korea, or Crimea.

Uhh. I am sure you know that there exception to every rule. Hell, even current set of Iranian sanctions have them.

Looks like it's time to switch to decentralized git repositories

Will they start blocking VPN access ;(

I despise all 3 regimes, but these sanctions harm the people more than they harm the regimes. Sanctioning Crimea specifically makes no sense whatsoever. Why not instead sanction Putin who, you know, is the one who occupied Crimea?

This thread is a useful reminder to US citizens that if you haven’t registered to vote, its a great idea to do so. The margins of victory in 2016 were small enough (in swing states) that a mobilized hackernews community could have made the difference.

This move has little to do with the current political climate and is more so associated with risk reduction from Microsoft as technology and regulations regarding technology (see Facebook) are coming into focus.

All companies that do business with the US are required to abide by the Export Administration Regulations (EAR)[1] which prohibits exports (unless explicitly exempt) to sanctioned countries. The US has had sanctions on Iran since 1987[2].

This move would have likely happened regardless of who is in the White House.

[1]: https://en.wikipedia.org/wiki/Export_Administration_Regulati...

[2]: https://en.wikipedia.org/wiki/United_States_sanctions

Reply on news.ycombinator.com