Like I wrote somewhere else, the Gitlab case is both worse and better. Gitlab did not make a specific decision to block Iranian users, it merely made a technical decision to move to Google Cloud, and Google Cloud is blocking sanctioned countries on a network level (which is abhorrent).

But I don't see Gitlab making an active decision that they have to do this for sanctions compliance reasons, it was just a side-effect and they didn't care enough for it to change their minds about the move.

Specifically, if I sign up to Gitlab, set my country of residence to Iran, and Gitlab lets me create private repositories, then they are not enforcing the sanctions the way Github does.

See comments in this previous thread from 31 days ago [1]...

Google Safety & Security Blog: An update on state-sponsored activity (2018) ...

Detecting and terminating activity on Google properties

"Actors engaged in this type of influence operation violate our policies, and we swiftly remove such content from our services and terminate these actors’ accounts. Additionally, we use a number of robust methods, including IP blocking, to prevent individuals or entities in Iran from opening advertising accounts."

---//---

[1] "An Open Letter to Google and Apple: Stop Hindering Iranian Entrepreneurs"

https://news.ycombinator.com/item?id=20302547

Can we start calling this "The Great Reverse Firewall"?

Not all of it is US sanctions [1]. The US will protect its networks and will not allow a foreign adversary to use US platforms to target US citizens, but the US has no incentive to restrict the Iranian people's access to information or communications or ability to speak. Most of Iran's cyberspace restrictions are coming from within...

https://en.wikipedia.org/wiki/Internet_censorship_in_Iran

[1] "Iran's Rulers Speak Of More Cyberspace Restrictions As Conditions Worsen" https://en.radiofarda.com/a/iran-s-rulers-speak-of-more-cybe...

It looks like the free services provided by GitHub are still available:

"A selection of GitHub services such as access to public repositories will remain available to everyone, the company said in a statement on its website. “This includes limited access to GitHub public repository services (such as access to GitHub Pages and public repositories used for open source projects), for personal communications only, and not for commercial purposes.”

So what can't restricted foreign-nationals do? Private, paid-for repositories? Is there something else particularly important?

If I recall right from previous thread they can still create and commit to public repo but can't delete them. They also can't touch even their own private repo anymore.

They added the option to make private repos public so you can back it up. But again, you can’t delete the now public repo.

>They added the option to make private repos public so you can back it up.

And allow all to see their contents, likes business and trade secrets. Top tier.

Yep. If you want to access your blocked private repo, you literally have to let everyone access it. And you can’t even delete it afterwards.

> Yep. If you want to access your blocked private repo, you literally have to let everyone access it. And you can’t even delete it afterwards.

One must wonder just how many companies with juicy trade secrets situated in a nation with adversarial relations to the US are hosting that juicy data in the US, with a US corporation.

Given that the public, open-source situation is not changed this is starting to sound like a tempest in a teacup.

Couldn't one temporarily travel outside of the affected regions to access their private repos normally?

Github does have an appeal process if the algorithm mistakenly tagged you. I’m not sure what proof they ask for.

This is interesting, I didn’t see that.

In which case they are actually providing -more- than gitlab does.

It's google that's blocking gitlab users/servers. Gitlab's mistake is using Google.

There was already the privacy concerns and complete lack of ethical oversight. Now we have some more ethical reasons not to use them.

The amount of harassment that citizens of any state that the US claims to hate at any given time endure on a daily basis is disgusting. Exiled iranians living outside of Iran for 20 years have got their bank accounts closed solely for being Iranian. I can't help but think that these internet services will be going that way in the future.

The fact that the "free software" community is not putting their foot down for this is disgusting. Especially when there's so much back-patting when it comes to "the value of the community". Where's the community for crimean or iranian developers?

How do you come to this conclusion, and what exactly do you mean by "free software community"? Github/Microsoft?

There are quite some free software projects that use their own code hosting (e.g. https://salsa.debian.org). But if you don't have time for that and use github for your OSS project you are now disgusting because of the iranian sanctions?

How about gender equality? CO2 neutral servers? Why are the ones that put effort into building and improving things blamed for not being at least perfect?

Ya know what was actually disgusting? The war in Iraq, or any other recent regime change the US executed. If economic warfare is the way it’s done now, then that’s great. Let the casualties be inconvenienced github users, rather than ya know, actual casualties...

You realize that sanctions also kill people through lack of supplies like medicine being available, people being unable to economically support themselves, and, if the sanctions cause the government to collapse, all the death that results from that.

So let’s not pretend sanctions are somehow nonviolent.

In this case it seems Microsoft at least is striking the right balance by leaving open the free version. They are not profiting from sanctions yet they are leaving open an information service that could be used to organize dissent within the sanctioned regime. Not that github would be the first place you’d try but at least it’s an option if all the others are blocked.

Everything that reduces quality of life kills people in some way. Heck, I commute through a town that back in the day was rich enough to prevent the highway from being expanded. I bet a couple people have died in ambulances in gridlock there.

Sanctions are a heck of a lot less violent than bombs, or some tit for tat response (which would probably eventually escalate to bombs). They're basically one step up from taxes/tariffs.

The perfect is the enemy of the good.

But how many lives were saved from not having a fast moving road running alongside the town.

Everything is good and bad.

Normally I'd agree but this highway was built as a highway in the '50s a new route where there formerly was no road. It's not like a main street that slowly grew into a major road. The only points where pedestrians cyclists cross the road (it's limited access, nobody is walking or biking on it) are at the aforementioned traffic lights. Based on my experience as a pedestrian I suspect the lights are about the same safety as walking biking past on/off ramps.

This is king of going off on a tangent though.

Sounds like something you could say about anything.

and yet, that will be less than the war in iraq.

It's github. I would personally be inconvenienced, but not terribly so. I cannot imagine their life is going to crash in some meaningful way for not having access to github.

> it's github.

Are you naive enough to think the sanction is explicitly targeted exactly at github, and not any number of services, or part of a wider economic attack?

yes, tehbeard. The takeaway from my comment should have been that I'm naive and have no idea how sanctions work, or why they're used.

That is absolutely, 100%, unequivocally, the most fair interpretation of my comment that you could have made.

I should thank you for this, really. I cannot imagine someone on the internet assuming that maybe my opinion is based upon more than ignorance and naivete.

These countries are run by some of the most violent and oppressive regimes in the world. Let’s not pretend that the US is responsible for the quality of life of the people living there.

These sanctions are entirely non-violent. The actual word you’re looking for is harmful. They’re designed to be harmful, economically. Responding to regimes like this with economic pressure is most certainly preferable to actual violent conflict. Which would be guaranteed to kill thousands of innocent civilians.

Given recent history, if you think electing to use non-violent methods to sanction these governments is disgusting, then I really don’t think there’s anything I could say to you.

If the regime in Iran falls. It won’t be because of US sanctions. It will be because that country has been operated by a brutal dictator for decades, and the Iranian people grew tired of being the enemy of their own government.

In all fairness, the Iranian government is more popular in Iran than the US govenment in the US. The US sanctions wasn't enacted to help the Iranian people, but to weaken a country that the US perceives as an adversary.

This is important. This kind of actions have to be taken as what they are: unilateral actions of a country against another. It is just the US defending what it sees as they interests. But for the rest of the world it is just a maneuver.

For some people in the USA it is difficult to see it. Given their (expected) skew towards their country. But people outside that country can see it with a more objective perspective.

Similar thing is happening with the concentration camps in the south.

You’ve just described the foreign policy of every country in the world.

Are they? Or are the Iranian people too afraid of the Revolutionary Guard to say different? If you want to go that route, North Korea has the most popular government and leader on Earth. I don't think you can make claims about popularity of a government that can and does make people disappear who say otherwise.

Two very different cultures. there has been several protests in Tehran in the last decade with no execution.

NK has their own culture too where it's just wrong to critise their rules (or their parents). we need to stop looking at the world from a globalised western lens.

This comment seems borderline satire. But I guess you’re right. There’s the western way of approving of your government, where you’re free to make up your mind about whether you do or not, and the way that they do it in North Korea and Iran, where you have to constantly fear the consequences of not approving of your government in the appropriate government prescribed manner.

> the Iranian government is more popular in Iran than the US govenment in the US

It really would be sad if you controlled the media, religious doctrines as interpreted by the gov't (which you can't criticize), had censors, and couldn't pull that off.

https://en.wikipedia.org/wiki/Media_of_Iran

> If the regime in Iran falls. It won’t be because of US sanctions. It will be because that country has been operated by a brutal dictator for decades, and the Iranian people grew tired of being the enemy of their own government.

If so (that Iran falls not because of US sanctions), surely it follows that there is no point to the sanctions?

They would only serve to embitter the targeted population.

> surely it follows that there is no point to the sanctions?

Not at all. Either the sanctions pressure Iran into changing their policies, or the sanctions restrict their ability or enact those policies.

Of course the US is pressuring Iran to act according to the Interests of the US. But if you want to criticize that, you’d have to look at what they are in this situation.

* Protecting allies in the region (which Iran openly and repeatedly vows to wipe of the map)

* Preventing nuclear proliferation

* Doing so while avoiding war

You have to try quite hard to apply the USA-is-just-a-bully trope to this situation.

"These sanctions are entirely non-violent." Their effect on the rich in these countries mostly is. What about children dying because of a lack of medication?

One could avoid a lot of collateral damage by targeting sanctions at specific powerful individuals. Think of the way some Russian oligarchs from Putin's inner circle got restricted by western sanctions.

It's relatively easy to avoid sanctions in the first place or have them removed: comply with US demands.

Most of the world does this just fine. There's a few bad actors out there screwing their countries and their people.

I'm hoping you're being sarcastic - if so, you're right, the US is becoming more and more transparent in its use of power to simply force countries to do whatever it wants.

False dichotomy! Economic sanctions are not the only alternative to actual wars. In fact, they are a form of collective punishment that harm average citizens of these countries more than their governments. And this is not just about some inconvenienced github users; this has been a contentious issue in every natural disaster [1].

[1] https://www.reuters.com/article/us-iran-floods-redcrescent/f...

In any situation, the people will be harmed by any form of action taken against its government. By this logic, it would never be considered reasonable to take any action at all against any government.

When one country vows to wipe another country off the map, it’s reasonable for other countries to take some action against that. When a dictator spends the better part of a decade bombing its civilians, it’s reasonable for other countries to take some action against that.

Your options really are to retaliate with force, or sanctions. Economic sanctions are far less harmful, and far more productive. I’d bet that all those Syrians you see on the news digging their dead family members out of the rubble of their bombed houses would be more than willing to trade that life for one with economic sanctions.

I’m really struggling to believe that an anti-war stance is now considered controversial on HN.

> I’m really struggling to believe that an anti-war stance is now considered controversial on HN

I Don't know about HN, but I don't think an anti-war stance is controversial. Having said that, I believe, presenting economic sanctions as a humane alternative to war is deeply misleading. Of course you are entitled to your opinion.

Economic sanctions are quite obviously an alternative to war (though perhaps not the only alternative), and if you look at recent administrations proclivity for intervention and regime change, it’s also quite obviously a change of tack.

Whether the sanctions are warranted is much more open to debate. But in Syria you have a regime that created the greatest humanitarian crisis of a generation, and in Iran you have a regime that repeatedly vows to wipe another country off the map, and an enormous proliferation risk. So I know what side of that debate I’d fall on, and I know what my preferences are when it comes to starting new wars.

It's unfortunately hard to separate good and honest foreigners from those that would prefer to destroy other nation states.

Yeah but I would argue that the US is actually destroying other nation-states

s/foreigners/people/ .

It is however quite easy for good and honest foreigners to determine if the US wishes to destroy other nation states.

While I believe in the GNU definition of free software, how are we to maintain a community that's truly open-source when the parties you speak of don't believe in free software themselves? Are we really to give them the best our world has to offer so they can use it to suppress people and act against their interests? Do we let them use our libraries and tools to make their world smaller for their citizens? Do we let them steal our code to change it to hurt others and then not reciprocate it back in? Do we let them take the best we have to offer with such obvious mal-intent?

If it were a difference of culture or opinion that's fine. But you're allowing rogue authoritarian states to use our technology while taking an adversarial stance to our primary purpose; the free transfer of knowledge and information. We don't need to accommodate that. They need to accommodate the freedom their people are entitled to.

Think about it. Which developers in North Korea or Iran are using Github? Answer: The ones the government lets use Github.

This is a pretty gross generalisation of the people and issues at stake. "We" the individual freedom loving, contributors. "They", the rogue nations using open source software to oppress and enslave.

Honestly it boggles my mind how easily you slipped into that mentality in response to the comment you replied to - a comment describing people caught in the crossfire, affected by the choices of nations at war, individual liberties crushed by sanctions and foreign policy.

If an individual feels wrongly and disproportionately impacted by US sanctions they can apply to the SEC for a waiver. A small, lonely dev will probably be ok.

But the issue isn't with one dev who gets caught in the crossfire. You want to stop fighting a blazing inferno to mount a rescue operation because there's one kitten in the burning apartment building.

Individual liberties cannot be realized without sanctions and foreign policy. Do you think if Github were located in Tehran that Americans would be able to post a commit right now?

> If an individual feels wrongly and disproportionately impacted by US sanctions they can apply to the SEC for a waiver. A small, lonely dev will probably be ok.

And github & Co will then invest money to not blanket-ban, but make exceptions for this individual? I have some doubts.

Do you believe that Iran's cyber warriors or their critical infrastructure people host their code on github? Because if not, you're not "fighting" the government, you're fighting individual developers.

> Do you think if Github were located in Tehran that Americans would be able to post a commit right now?

I find that a very problematic worldview, as it gives you permission to do anything. There are no limits, because "what if the table were turned? I'm doing it to them, so clearly they'd do it to me, right? So you see, I must do it to them first".

> And github & Co will then invest money to not blanket-ban, but make exceptions for this individual? I have some doubts.

I don't see why not. It's probably a simple boolean value in their database somewhere. If they can blanket ban, they can probably be selective for a minimal cost.

> Do you believe that Iran's cyber warriors or their critical infrastructure people host their code on github?

It wouldn't surprise me one bit if they did. People put weird stuff on GH for all kinds of weird reasons. Every week we hear about an unsecured AWS bucket from some huge mega-corp or state actor who should know better. But they are all run by humans who are free to make mistakes and break rules.

> I find that a very problematic worldview, as it gives you permission to do anything.

Being the most powerful and influential player in technology gives us permission to do anything. Having (one of) the largest tech markets and the (nearly) unlimited resources to spend makes us able to do whatever we want. And if we want to keep it that way we will ensure that we don't let unfriendly nations take advantage of our technology. We developed encryption to protect our banking sector. Just because we're nice enough to open-source it doesn't give Tehran officials the freedom to use it to suppress their entire nation. If authoritarianism worked so well they would be on top of the world with all their proprietary technology and censored information. But they're not. So either you're going to play nice with our toys in the sandbox or we're taking our ball and going home.

Large services are banning IP ranges (https://gist.github.com/alibo/dfd7c258bcc44a0e8c9f7c5bfd3bd2...), so they'll have to invest and provide alternatives to those individuals.

> Being the most powerful and influential player in technology gives us permission to do anything.

Read this again, slowly. You're advocating for the law of the jungle where the actor with the biggest club has the right (and, I presume, duty?) to do whatever they please to whomever they please whenever they please.

> Individual liberties cannot be realized without sanctions and foreign policy.

What kind of jingo non-sense is that?

We now have over a century of data on how effective US foreign policy is at promoting democracy around the world and if you read the history even badly, you can't help but notice that it's much better at killing people in monstrous numbers than at promoting individual liberty.

American foreign policy isn't designed to promote "democracy around the world."

It's designed to promote democracy in the free world that the people who control the world live in.

> Individual liberties cannot be realized without sanctions and foreign policy.

[Citation needed]. It is not as if sanctions have a stellar record when it comes to promoting individual liberties. Rather the opposite - they entrench the powers that be and give them an opponent that are not themselves that they can blame the hardship of the people on.

The thing I am woried is that harfbuzz is developed by Iranian developer. It is an integral part of Linux font stack.

I would have said "move to git.kernel.org" but that's also hosted by a US based provider:

    organisation:   ORG-PHI3-RIPE
    org-name:       Packet Host Inc
    org-type:       OTHER
    address:        30 Vesey Street, Suite 900, New York, NY 10007 US

And, obviously GNOME git servers are US based, since they're owned by RedHat/IBM.

Use a self hosted gogs installation (https://gogs.io/) under your own domain and root server outside US jurisdiction.

Or just use ssh. That’s what I’ve always done with my friends when we didn’t want to use GitHub.

There’s no need to over complicate things.

GitLab is self-hostable as well, although I imagine Gogs is easier.

Gitlab is actually super easy if you keep to the omnibus installation methods or docker image.

The only problem regarding gitlab is resource consumption.

If your company operates in the US and uses a provider, who does not implement sanctions, does it have to enforce them on its own?

I mean, something like selling a product, maybe based on open source tech in the US and cooperating with devs in sanctioned countries via a workaround provider..

Behdad Esfahbod lives in Canada though, also most of his FOSS contribution (pango, fontconfig etc) are on the freedesktop.org and GNOME git repo servers, not GitHub.

Hey. Behdad here. I live in the States but one of our core developers is in Iran. This whole incident was a huge miscommunication on github. Fortunately they have addressed some of it. In short: Open Source and public repos are not affected at all. HarfBuzz has been on github. We will consider moving to fdo or GNOME gitlab if github becomes a problem. Cheers

I know this is just nitpicking, but US Sanctions apply to sanctioned state nationals; regardless of location.

No they don't! The sanction is against the country, not nationals. So if you are a developer from the U.S. with U.S. nationality and move to Cuba the sanctions would also apply to you.

Actually there is a very good wikipedia page "United States sanctions against Iran" https://en.wikipedia.org/wiki/United_States_sanctions_agains... about this, if you want more info.

I don't mean to be flippant, but it will sound this way.

I trust Oracles lawyers to know the law better than a wikipedia page.

http://www.oracle.com/us/products/export/export-regulations-...

Oracles lawyers and Githubs lawyers then disagree cause Githubs CEO stated the same thing as the GP: They block people based on location, not on nationality. If you are banned but not in one of the banned locations you can fill out a form to get unblocked:

https://twitter.com/natfriedman/status/1155311123467399168

Of course this is one of the intended consequences of any capricious military-state outrage. Uncertainty allows them to oppress more people while simultaneously claiming that wasn't their intent. The firms who are applying a broad brush are doing exactly what the armaments lobbyists desire.

IANAL but it seems to me like Oracle's lawyers have taken a stronger position than required by law.

Nationality of individuals is primarily relevant for deemed-export under ITAR/EAR; not the OFAC sanctions on Iran.

Are you sure ?

Quoted from GitHub CEO Nat Friedman on Twitter:

> The restrictions are based on place of residence and location, not on nationality or heritage. If someone was flagged in error, they can fill out a form to get the restrictions lifted on their account within hours.

> Any company or national of Cuba, Iran, North Korea, Sudan, Syria, and the Crimea region. Export licensing of commodities or services intended for these countries is presumed denied;

Wording like this appears on the treasury documents, Google cloud and Oracles official documentation on sanctions.

I'll just link the Oracle one because ironically the one that google uses is really difficult to find:

http://www.oracle.com/us/products/export/export-regulations-...

By that wording, who is a national of the Crimea region? Did they mean residents?

If we end up with a project like [1] actually taking off, then with Secure Scuttlebutt you wouldn't need to care about server hosting and the pub servers could be distributed globally.

[1]: https://people.kernel.org/monsieuricon/patches-carved-into-d...

Hey. HarfBuzz maintainer here. I live in the States but one of our core developers is in Iran. This whole incident was a huge miscommunication on github. Fortunately they have addressed some of it. In short: Open Source and public repos are not affected at all. Cheers

Well, for a well-known project, they won't miss GitHub visibility benefits.

They can host the git repository anywhere. Self-host an issue tracking system or find a non-US company that does that (and is not required to follow US sanctions due to trade agreements, that'll be hard).

It's an annoyance, for sure.

The problem is that they'd require a payment method to rent the server somewhere else or to use a non-US company that doesn't offer a generous free plan. The most prominent payment providers (Visa, MasterCard, PayPal) are all US-based.

> (and is not required to follow US sanctions due to trade agreements, that'll be hard).

I really don't know much about sanctions against Syria and Crimea, but Iranian developers could use every country that hasn't withdrawn from the Iran deal: EU, UK (separate signature, regardless of Brexit), Russia, China.

It's unfortunately not that easy. Iranian students studying in the UK for example, currently have a lot of trouble to pay their tuition fees. Because the U.S. insists that any bank (from the EU or wherever in the world) that wants to do business in the U.S. must comply to U.S. sanctions, which means an U.K. bank has to choose if it wants to block Iran or get blocked itself in/by the U.S. for doing business with Iran. More about this can be found on Wikipedia: https://en.wikipedia.org/wiki/United_States_sanctions_agains....

These are very good points. Especially the one about the major payment providers.

Re: countries that have withdrawn from the Iran deal. Even those who haven't (AFAIK, Brazil) are still in grey waters because local companies with business in the US are afraid to do business with Iranian companies. For example, two ships weren't allowed to be refilled in Brazil for 50 days while a legal battle at the supreme court was ongoing to decide if the Brazilian oil company could even refill them, because it was afraid to be sanctioned by the US govt (while doing business in the US or with US companies in the future).

Even before the US withdrew a lot of financial institutions wouldn't allow doing any kind of transactions with iran.

It's not like the sanctions were actually dropped even though they were supposed to. That was the whole point of the critiques of the JCPOA.

Enter... crypto

Between the speculative get-rich-quick rollercoaster of Bitcoin and the fraud of other crypto currencies it feels like the promise of decentralization has been forgotten.

That's just shifting the problem one inconvenience further. How do you purchase cryptocurrencies without Visa/MasterCard/PayPal?

I'm not sure what options they have, but ideally, for convenience some kind of local country bank transfer, which could be to a local crypto dealer. That might take days but you might "stock up" on crypto to compensate.

Or peer to peer cash/crypto swap might be required.

Or businesses themselves sell some of their services with crypto.

> Personally I find it quite abhorrent, and would cite this as a reason not to use US based companies in future.

Then I’d highly recommend that you try doing that. I consulted for a company once that tried this, and it was an absolute nightmare. Every single piece of technology they used was worse than second rate. Making comments on HN is really easy, backing them up with action, in this case, is not.

Any company that does business in the US, or with another company that does business in the US. Not just US based companies are subject to these restrictions (if they want to sell into the US)

Don’t make it too hard on yourself. If you want to use your own economic clout to take a swing at the US, then just stick to boycotting US companies. See if it’s even possible to operate your project like that. You’ll be taking a step back in time by at least 10 years.

I am not sure I could do it at all. The Linux Foundation is a US corporation, and that rules out nearly all my options for the work I personally do. (and, well working for one doesn't help it either)

Then make it even easier. Only apply the principle to services or products you pay for.

The sensibility you have expressed is chiefly why we should fight US dominance of the tech sector. Not why we should lean in to it.

this is true for a lot things.

They're called keyboard warriors for a reason.

This affects companies that have US users too. Your only option is to move out of the US and not use products with any users in the US. That means your only option is China, which is far worse for online rights than the US.

I think non-US companies have to comply with the sanctions too. Your alternative will be the pool of sanctioned countries and friends. Which don’t have the infrastructure most people need.

I don't think it is about political pressure in the sense that, I doubt the USG fundamentally cares about whether or not Iranians can use GitHub or not. For companies like Google or Microsoft, this is about minimising the attack surface because they do other (legal) things that the USG does care about. You can't punish a tech giant just for doing a tech giant, but you could try to make other things stick.

There is no real difference between sanctions on internet service and any other thing, except things directly involved in the reasons for the sanctions (notably military material)

they took the easy way out...ban them all, just in case. Not worth the trouble or lawyer fees explaining it to DOJ

Well thanks for the extra info :). Sad news imho :S.

Yeah, it's totally abhorrent that the US blocks people that would prefer they get wiped off the face of the earth. How dare they!!!

Have you considered that regular people that live under an oppressive totalitarian government have no control over said government and are actually just victims?

Have you ever lived in the US?

Your sentence uses "they" ambiguously, FYI. Two very different interpretations possible.