Be careful where you log into GitHub: Dev visits Iran, opens laptop, gets startup's entire account shut down
- Reference: 1609878322
- News link: https://www.theregister.co.uk/2021/01/05/github_iran_block/
- Source link:
The reason that the biz, based in Germany, lost access, according to co-founder Sebastian Slomski, [1]was "one employee opened his laptop while visiting his parents in Iran."
That network interaction proved enough to convince Microsoft's GitHub that it had to ban Pure Labs' account to comply with [2]US trade sanctions on Iran.
GitHub's [3]disclosures about how it complies with sanctions raise the possibility that visiting a country subject to trade controls may affect account status.
"Travel in these regions may impact your account status, but availability may be reinstated once you are outside of the sanctioned region and upon submitting a successful individual account appeals request or an organizational account appeals request," GitHub explains on its website.
But that goes beyond what the US rules require. The [4]US Treasury FAQs on Iran sanctions cover a similar scenario and note that it's not necessary to restrict the bank account of a client visiting a relative in Iran.
GitHub will no longer present a cookie notification banner – because it's scrapping non-essential cookies [5]READ MORE
After Slomski reiterated his complaint via Twitter over the weekend, GitHub CEO Nat Friedman joined the discussion thread and [6]promised to look into the situation.
Not only did Friedman help restore Pure Labs' GitHub account but he published a blog post on Tuesday [7]announcing that GitHub, after lengthy negotiations with Uncle Sam, has obtained a license to provide service to developers in Iran, for individuals and organizations, public and private, whether the accounts are free or paid.
"We took our case to the Office of Foreign Assets Control (OFAC), part of the US Treasury Department, and began a lengthy and intensive process of advocating for broad and open access to GitHub in sanctioned countries," explained Friedman.
"Over the course of two years, we were able to demonstrate how developer use of GitHub advances human progress, international communication, and the enduring US foreign policy of promoting free speech and the free flow of information."
GitHub, said Friedman, is in the process of rolling back trade rule compliance measures it put in place in 2019 and restoring access to accounts blocked due to trade rules. The Register understands that the timing of the announcement and Pure Labs' predicament were purely coincidental.
This gives GitHub an advantage, for the moment at least, over competitor GitLab, which [8]isn't available in Crimea, Cuba, Iran, North Korea, Sudan and Syria due to trade restrictions. According to Friedman, GitHub is talking to US government officials about securing licenses for developers in Crimea and Syria.
Despite the happy ending, Pure Labs' week of downtime is a reminder that relying on third-party services creates a potential business process vulnerability. The cloud is all light and air until you hit a wall. ®
Get our [9]Tech Resources
[1] https://twitter.com/sebslomski/status/1344219609923276801?s=20
[2] https://www.state.gov/iran-sanctions/
[3] https://docs.github.com/en/free-pro-team@latest/github/site-policy/github-and-trade-controls
[4] https://home.treasury.gov/policy-issues/financial-sanctions/faqs/topic/1551
[5] https://www.theregister.com/2020/12/17/github_will_no_longer_present/
[6] https://twitter.com/natfriedman/status/1346452935924846593?s=20https://twitter.com/natfriedman/status/1346452935924846593?s=20
[7] https://github.blog/2021-01-05-advancing-developer-freedom-github-is-fully-available-in-iran/
[8] https://about.gitlab.com/handbook/business-ops/trade-compliance/
[9] https://whitepapers.theregister.com/
Re: relying on third-party services
Just don't rely on services provided by American companies. It's easier than you think.
Artificial problem generators
What would have worked just fine was borked, as a combined result of purposeful sabotage, bugs ,and systemic prejudice in the bureaucratic process . Together they form an engine that actively generate unnecessary errors, barriers, labor and expense
As if there were not enough problems in life here's the government artificially creating problems as if our lives are so perfect we needed this just to be entertained.
I'd much rather deal with the natural consequences of a freedom , then all these petty artificial problems born of over control and oppression
At least when it's a natural consequence it can be respected without encouraging delusion
Re: Artificial problem generators
"I'd much rather deal with the natural consequences of a freedom"
Strange that you would say that still, unqualified, after 10+ months of demonstration of what happens when selfish unmasked "freedom!!" people proudly strut over the dead bodies of their neighbors. Could you be just a bit more nuanced?
I've been wrestling for a few years now, trying to figure out how to begin to engage in the discussion:
"Freedom to" vs. "Freedom from" - where is the balance?
Re: Artificial problem generators
Freedom to transact without permission of third parties. freedom to exchange information without external governance. The freedom to just do it and see what happens versus settling for a predicted norm.
The freedom to maximize entropy to farm incidental discovery.
The freedom to experiment.
The freedom to learn from your own experiences rather than be governed by the insecurities and fears of others.
Humans exist to independently diverge and recreate the world in their own image as far as physics will allow them to.
Without ability to indulge that purpose human life is worthless. Stable avoidance of change is better suited to an inanimate object or artificial tools such as robots.
To be human is to be naturally driven to invalidate concepts of authority and test every limit to destruction.
when everything is happening under government control with an expected norms, the world grows stagnant and individuals become irrelevant unto themselves, encouraging depression ,suicide or primaly motivated compulsions to clear space so there might have a chance to create their own order that result in apathy and hatred towards their neighbors.
Taking your main work laptop with you when you visit certain countries is always a dodgy proposition. Best to leave it at home, and take a cheaper 'disposable' system or tablet - you shouldn't be on it much anyway because there should be a reason for that visit that stops you needing to go on it.
My thoughts exactly. By rights this guy should be in serious trouble with his employer just for taking a work laptop out of the country without proper reason. On the other hand, if he does use a personal laptop to log into GitHub, which is perfectly doable, then he's stupid for risking his own property like that.
By rights this guy should be in serious trouble with his employer just for taking a work laptop out of the country without proper reason.
There speaks a man untouched by BYOD. But even if it was a laptop provided by his employer, you don't know what its policy on taking laptops out of the country is. Many companies - particularly small ones - just want the work done and are glad for their staff have the resources to do just that with them at all times.
The three things I took away from this are VPN, VPN and VPN.
off microsoft hosting
It's easy to set up multiple remotes with git. If your code is in Microsoft land only now is a good time to fire up a vm somewhere and cohost your important repos yourself. Github is more than just git, but being locked out of your own code is plain scary.
So Github were banning any accounts that logged in from IP's located in Iran? These kind of sanctions are kinda pointless in the real world as it would be trivial for anyone in Iran to jump onto a VPN with an endpoint in a none sanctioned country to get around it and login from their.
relying on third-party services
Remember OFAC bans any sort of dealings with you, the bank, phone company, domain registrar etc all have to block you if you fall foul of OFAC
It's difficult to not rely on ANY 3rd party - unless you are a self sufficient yak farmer