I would have said "move to git.kernel.org" but that's also hosted by a US based provider:

    organisation:   ORG-PHI3-RIPE
    org-name:       Packet Host Inc
    org-type:       OTHER
    address:        30 Vesey Street, Suite 900, New York, NY 10007 US

And, obviously GNOME git servers are US based, since they're owned by RedHat/IBM.

Use a self hosted gogs installation (https://gogs.io/) under your own domain and root server outside US jurisdiction.

Or just use ssh. That’s what I’ve always done with my friends when we didn’t want to use GitHub.

There’s no need to over complicate things.

GitLab is self-hostable as well, although I imagine Gogs is easier.

Gitlab is actually super easy if you keep to the omnibus installation methods or docker image.

The only problem regarding gitlab is resource consumption.

If your company operates in the US and uses a provider, who does not implement sanctions, does it have to enforce them on its own?

I mean, something like selling a product, maybe based on open source tech in the US and cooperating with devs in sanctioned countries via a workaround provider..

Behdad Esfahbod lives in Canada though, also most of his FOSS contribution (pango, fontconfig etc) are on the freedesktop.org and GNOME git repo servers, not GitHub.

Hey. Behdad here. I live in the States but one of our core developers is in Iran. This whole incident was a huge miscommunication on github. Fortunately they have addressed some of it. In short: Open Source and public repos are not affected at all. HarfBuzz has been on github. We will consider moving to fdo or GNOME gitlab if github becomes a problem. Cheers

I know this is just nitpicking, but US Sanctions apply to sanctioned state nationals; regardless of location.

No they don't! The sanction is against the country, not nationals. So if you are a developer from the U.S. with U.S. nationality and move to Cuba the sanctions would also apply to you.

Actually there is a very good wikipedia page "United States sanctions against Iran" https://en.wikipedia.org/wiki/United_States_sanctions_agains... about this, if you want more info.

I don't mean to be flippant, but it will sound this way.

I trust Oracles lawyers to know the law better than a wikipedia page.

http://www.oracle.com/us/products/export/export-regulations-...

Oracles lawyers and Githubs lawyers then disagree cause Githubs CEO stated the same thing as the GP: They block people based on location, not on nationality. If you are banned but not in one of the banned locations you can fill out a form to get unblocked:

https://twitter.com/natfriedman/status/1155311123467399168

Of course this is one of the intended consequences of any capricious military-state outrage. Uncertainty allows them to oppress more people while simultaneously claiming that wasn't their intent. The firms who are applying a broad brush are doing exactly what the armaments lobbyists desire.

IANAL but it seems to me like Oracle's lawyers have taken a stronger position than required by law.

Nationality of individuals is primarily relevant for deemed-export under ITAR/EAR; not the OFAC sanctions on Iran.

Are you sure ?

Quoted from GitHub CEO Nat Friedman on Twitter:

> The restrictions are based on place of residence and location, not on nationality or heritage. If someone was flagged in error, they can fill out a form to get the restrictions lifted on their account within hours.

> Any company or national of Cuba, Iran, North Korea, Sudan, Syria, and the Crimea region. Export licensing of commodities or services intended for these countries is presumed denied;

Wording like this appears on the treasury documents, Google cloud and Oracles official documentation on sanctions.

I'll just link the Oracle one because ironically the one that google uses is really difficult to find:

http://www.oracle.com/us/products/export/export-regulations-...

By that wording, who is a national of the Crimea region? Did they mean residents?

If we end up with a project like [1] actually taking off, then with Secure Scuttlebutt you wouldn't need to care about server hosting and the pub servers could be distributed globally.

[1]: https://people.kernel.org/monsieuricon/patches-carved-into-d...

Hey. HarfBuzz maintainer here. I live in the States but one of our core developers is in Iran. This whole incident was a huge miscommunication on github. Fortunately they have addressed some of it. In short: Open Source and public repos are not affected at all. Cheers

Well, for a well-known project, they won't miss GitHub visibility benefits.

They can host the git repository anywhere. Self-host an issue tracking system or find a non-US company that does that (and is not required to follow US sanctions due to trade agreements, that'll be hard).

It's an annoyance, for sure.

The problem is that they'd require a payment method to rent the server somewhere else or to use a non-US company that doesn't offer a generous free plan. The most prominent payment providers (Visa, MasterCard, PayPal) are all US-based.

> (and is not required to follow US sanctions due to trade agreements, that'll be hard).

I really don't know much about sanctions against Syria and Crimea, but Iranian developers could use every country that hasn't withdrawn from the Iran deal: EU, UK (separate signature, regardless of Brexit), Russia, China.

It's unfortunately not that easy. Iranian students studying in the UK for example, currently have a lot of trouble to pay their tuition fees. Because the U.S. insists that any bank (from the EU or wherever in the world) that wants to do business in the U.S. must comply to U.S. sanctions, which means an U.K. bank has to choose if it wants to block Iran or get blocked itself in/by the U.S. for doing business with Iran. More about this can be found on Wikipedia: https://en.wikipedia.org/wiki/United_States_sanctions_agains....

These are very good points. Especially the one about the major payment providers.

Re: countries that have withdrawn from the Iran deal. Even those who haven't (AFAIK, Brazil) are still in grey waters because local companies with business in the US are afraid to do business with Iranian companies. For example, two ships weren't allowed to be refilled in Brazil for 50 days while a legal battle at the supreme court was ongoing to decide if the Brazilian oil company could even refill them, because it was afraid to be sanctioned by the US govt (while doing business in the US or with US companies in the future).

Even before the US withdrew a lot of financial institutions wouldn't allow doing any kind of transactions with iran.

It's not like the sanctions were actually dropped even though they were supposed to. That was the whole point of the critiques of the JCPOA.

Enter... crypto

Between the speculative get-rich-quick rollercoaster of Bitcoin and the fraud of other crypto currencies it feels like the promise of decentralization has been forgotten.

That's just shifting the problem one inconvenience further. How do you purchase cryptocurrencies without Visa/MasterCard/PayPal?

I'm not sure what options they have, but ideally, for convenience some kind of local country bank transfer, which could be to a local crypto dealer. That might take days but you might "stock up" on crypto to compensate.

Or peer to peer cash/crypto swap might be required.

Or businesses themselves sell some of their services with crypto.