Be careful where you log into GitHub: Dev visits Iran, opens laptop, gets startup's entire account shut down

On Tuesday, startup service firm Pure Labs regained access to its GitHub account, which had been shut down since December 30 for an apparent breach of Iranian sanctions. The reason that the biz, based in Germany, lost access, according to co-founder Sebastian Slomski, was "one employee opened his laptop while visiting his …

[Yet Another Anonymous coward]

relying on third-party services

Remember OFAC bans any sort of dealings with you, the bank, phone company, domain registrar etc all have to block you if you fall foul of OFAC

It's difficult to not rely on ANY 3rd party - unless you are a self sufficient yak farmer

[Anonymous Coward]

Re: relying on third-party services

Just don't rely on services provided by American companies. It's easier than you think.

[ragnar]

Re: relying on third-party services

You can't avoid US influence with banking services, which is why the EU has been unable to provide an effective shield for companies to trade with Iran in the face of US sanctions.

[Roo]

Re: relying on third-party services

In practice it appears that you don't really need to avoid the US authorities. Certainly doesn't seem to present much of a problem for the oligarchs that funnel huge amounts of money through the London property market, multiple UK shell companies and tax havens.

For extra cover you can insinuate yourself into the circles of the ruling classes, scratch a few backs, buy a newspaper, buy football clubs etc, you could probably buy the entire Tory party for less than the price of a second hand yacht. :)

[Alan Brown]

Re: relying on third-party services

"You can't avoid US influence with banking services"

SWIFT has been losing ground to Instex recently for this reason

[S4qFBxkFFg]

Re: relying on third-party services

"the EU has been unable to provide an effective shield for companies to trade with Iran in the face of US sanctions"

I'd say more "unwilling" than "unable". If the EU was prepared to bear the consequences, it could prohibit complying with the relevant US rules.

They're obviously unwilling because there would be severe disruption (assuming the US didn't give in to avoid losing the business) until/unless EU equivalents replaced the US institutions - imagine Mastercard, Visa, and every bank that can't do without the USA simultaneously withdrawing from the EU.

[Anonymous Coward]

Re: relying on third-party services

It's really more difficult than you appear to think. Try, for example, to find a EU bank that has zero dealing with the US. How many banks are there in the EU that do not have a Visa, Mastercard or even Amex brand on their card?

Now, try to find a service provider that only use one of those banks that has zero link with the US. Or one that only accepts cash and some form of cryptocrapcoins as payment methods.

The list becomes small real quick.

[The Man Who Fell To Earth]

Re: relying on third-party services

No sympathy for the dev. WTF did he think was going to happen? I have a number of Iranian expats working for me who (pre-COVID) would go back to Iran annually and they all say this guy should have known better.

[W.S.Gosset]

Re: relying on third-party services

> unless you are a self sufficient yak farmer

But, then you're relying on yaks.

[Anonymous Coward]

Artificial problem generators

What would have worked just fine was borked, as a combined result of purposeful sabotage, bugs ,and systemic prejudice in the bureaucratic process . Together they form an engine that actively generate unnecessary errors, barriers, labor and expense

As if there were not enough problems in life here's the government artificially creating problems as if our lives are so perfect we needed this just to be entertained.

I'd much rather deal with the natural consequences of a freedom , then all these petty artificial problems born of over control and oppression

At least when it's a natural consequence it can be respected without encouraging delusion

[Anonymous Coward]

Re: Artificial problem generators

"I'd much rather deal with the natural consequences of a freedom"

Strange that you would say that still, unqualified, after 10+ months of demonstration of what happens when selfish unmasked "freedom!!" people proudly strut over the dead bodies of their neighbors. Could you be just a bit more nuanced?

I've been wrestling for a few years now, trying to figure out how to begin to engage in the discussion:

"Freedom to" vs. "Freedom from" - where is the balance?

[Anonymous Coward]

Re: Artificial problem generators

Freedom to transact without permission of third parties. freedom to exchange information without external governance. The freedom to just do it and see what happens versus settling for a predicted norm.

The freedom to maximize entropy to farm incidental discovery.

The freedom to experiment.

The freedom to learn from your own experiences rather than be governed by the insecurities and fears of others.

Humans exist to independently diverge and recreate the world in their own image as far as physics will allow them to.

Without ability to indulge that purpose human life is worthless. Stable avoidance of change is better suited to an inanimate object or artificial tools such as robots.

To be human is to be naturally driven to invalidate concepts of authority and test every limit to destruction.

when everything is happening under government control with an expected norms, the world grows stagnant and individuals become irrelevant unto themselves, encouraging depression ,suicide or primaly motivated compulsions to clear space so there might have a chance to create their own order that result in apathy and hatred towards their neighbors.

[Anonymous Coward]

Re: Artificial problem generators

Things are never as black and white as you are implying. I would love to see a true anarchy that actually worked (it would probably be indistinguishable from "true democracy"). But every freedom has some bad side effects that lead to failure ...

> Freedom to transact without permission of third parties.

... is used to trade in slavery, child prostitutes, weapons of mass destruction, biological attack agents, and more...

> Freedom to exchange information without external governance.

... about how to make weapons of mass destruction, ways to get away with murder or mass genocide, ...

> The freedom to just do it and see what happens versus settling for a predicted norm.

... is enjoyed by dictators, megalomaniacs, terrorists, and internet trolls everywhere. There are a dozen or more wars of genocide going on now because some enjoy this very freedom.

> The freedom to maximize entropy to farm incidental discovery.

... WTF? maximum entropy is heat - freedom demolish the world by fire?

> The freedom to experiment.

... on captive populations of slaves, prisoners.

The term "mad scientist" is not a fictional concept. Medical and Psychiatry history is littered with people who enjoyed this freedom in ways that would make your skin crawl. Literally in one case of beetle experiments.

> The freedom to learn from your own experiences rather than be governed by the insecurities and fears of others.

... what the worlds deadliest poison tastes like, or what an atomic blast feels like from up close, or what it is like to be flayed alive.

Fear is a communication of perceived danger. It signals that caution should be used when learning and experimenting with the subject matter.

> Humans exist to ...

[Elided several statements of personal belief about "meaning of life" without any factual basis.]

> When everything is happening under government control with an expected norms, the world grows stagnant and individuals become irrelevant unto themselves, encouraging depression ,suicide or primaly motivated compulsions to clear space so there might have a chance to create their own order that result in apathy and hatred towards their neighbors.

This statement is somewhat disingenuous. The truth is there has never been a government system which truly met the "everything is happening under government control" basis. The closest humanity has come to that is Authoritarian Dictatorships and Communes. Even there dissidents are routinely found acting against the rules.

In such situations the outcome is quite the opposite to what your statement concludes. As shown by the dissidence - human inclination towards hatred focuses towards the authority rather than towards neighbors.

[Terry 6]

Re: Artificial problem generators

Just two further small comments re;

The freedom to learn from your own experiences rather than be governed by the insecurities and fears of others.

1) Someone has to go out and rescue the idiot who climbs a mountain with the wrong kit, at the wrong time. Or goes out in a tiny boat to sail round the world without decent maps

And so on.

2) "Insecurities and fears of others" ==common sense in the above case and many others.

[JWLong]

Re: Artificial problem generators

1) Someone has to go out and rescue the idiot.......

No they don't.

[Terry 6]

Re: Artificial problem generators

Unfortunately, they do, because the rescuers don't know the circumstances.

And in the context of unregulated freedom, you can't demand that the suicidal idiots sign a "Do not rescue me" waiver before they set off up a mountain in trainers and Gucci sunglasses. Because you can't make them sign/stop them going, because of that self-same "freedom".

[Loyal Commenter]

Re: Artificial problem generators

I'll just add:

Freedom to transact without permission of third parties.

...is what leads to a tiny minority of the population hoarding all the wealth. It is what was the downfall of 19th century "liberal economics" (this is liberal in the financial sense, not the political sense, important distinction). It is playing out again with "neoliberal economics" and is why markets need regulation to prevent monopolies.

Freedom to exchange information without external governance.

...is exactly what is abused in price-fixing, again, another reason economic regulation is required, this time to prevent cartels.

As I said, failure to regulate markets leads to all the wealth ending up in very few hands, and a derogation of freedom for everyone else. Throughout history this has not ended well - think Madame Guillotine.

A quick aside about entropy: entropy is the measure of disorder in a system (not heat, in this context, that is known as enthalpy). Entropy always increases because more disordered states exist than ordered ones. A good illustration here is the number of disordered arrangements of gas molecules in a room where they are spread around randomly, as opposed to a single arrangement where they are all lined up in one corner. If you start with the latter state, you will, in practice, never end up back in that state, you will always have one of the higher entropy disordered states because there are vastly more of them.

[Tomato Krill]

Re: Artificial problem generators

There’s a lot of opinion stated as fact there...

[Doctor Syntax]

Re: Artificial problem generators

Any given freedom depends on having others respect it. It's only a pre-existing bargain that we restrict one set of rights in favour of another. My freedom to extend my fist stops short of your face & vice versa.

[A.P. Veening]

Re: Artificial problem generators

My freedom to extend my fist stops short of your face & vice versa.

True, but with exceptions, e.g. a boxing match freely entered by both sides.

[Unicornpiss]

Re: Artificial problem generators

I understand the spirit in which you made your post. And on paper (or electrons), it almost looks like a 'Bill of Rights' of sorts. The problem is that not everyone is ethical, many are stupid, prejudiced, mentally unstable, violent by nature or molded that way by life experiences, or just plain misinformed. And very few are altruistic. And quite a few are way too lazy to do the right thing if it inconveniences them even slightly. So despite being somewhere between liberal and moderate, I unfortunately have to say that we do need controls in place to keep the less well behaved people from impinging on the freedoms and lives of others, and/or from hurting people and destroying things that others care about.

You may have just misspoke (or I may be misinterpreting) when you said: "The freedom to just do it and see what happens versus settling for a predicted norm." But to take a page from current events, all the idiots that won't wear a mask or distance themselves because their 'freedom' is being threatened are certainly a headache (or possibly even a death sentence) to those of us that are just trying to get through this mess and realize that common sense and good judgement must always be applied, even when so many seem to have been born lacking any. There might be a time and place to heckle your brother about his affair with a stripper, but it probably isn't while making the toast at his wedding.

[Anonymous Coward]

Re: Artificial problem generators

You ever look at All their animals and our ancestors in wish that you were also worthy to do at least what they could. It's hard not to feel like you're being in treated inferior to an animal, when The governing structure as restricted you to a subset of behaviors rather than expanding you to a super set.

[Pascal Monett]

Re: where is the balance?

Theoretically it's simple : your freedom stops where mine starts.

The problem is that you need to be intelligent enough to realize that, and that's why we need laws : to educate the morons who are incapable of thinking of anyone but themselves.

It's not a perfect system, I know.

[Francis Boyle]

That's the easy part

The difficult part is: to what extent am I entitled to restrict your freedom in order to protect someone who might not be even be aware that they are in any danger from you. The trick the libertarians try to pull is to suggest that somehow, deep down, we all really believe that any such restriction is illegitimate. Of course, it's projection but it's been a maddeningly effective technique

[Anonymous Coward]

Re: That's the easy part

Authorityis a artificial mechanism of control the operates through campaigns of gas lighting. People why too through both words and artificial target consequence to create a break with reality and which they believe the others have a right to rule them when in fact is only their cooperationand belief that completes the illusion.

Authority is granted by the follower.

Until it has been granted it is not authority. It is a campaign of dominance that is putting you under siege.

It's the same dynamic as a domestic abuse victim has with your abuser simply on a larger scale. The same old vicious cycle of psychological abuse and purposeful manipulation

[Terry 6]

Re: That's the easy part

Clearly one of the forms of authority you dislike is SPaG* (Spelling, Punctuation and Grammar).

*SPaG is now a specific bit of the English National Curriculum from 5 up and marks are allocated in GCSE exams.

[W.S.Gosset]

Re: That's the easy part

You've just described the Woke brigade(rs).

In fact, virtually all Virtue-Display Memes.

[TheMeerkat]

Re: Artificial problem generators

“when selfish unmasked "freedom!!" people proudly strut over the dead bodies of their neighbors”

People with your attitude to freedom are exactly the people who brought National Socialist government to power in Germany.

All it needs is a bit of scare and you wet your trousers and call for a dictator to rule over you.

[MiguelC]

Re: "People with your attitude to freedom are exactly the people who brought National Socialist government to power in Germany."

You win the Godwin, you lose the argument.

[Loyal Commenter]

Re: Artificial problem generators

A little time spent actually studying history, rather than imagining what happened would illustrate that the rise of German fascism in the early 20th century was due to the exact opposite; Hitler gained power by promising freedom to people who were being economically constrained as a result of losing the Great War. It was used to justify the annexation of Sudetenland (Lebensraum).

If you're going to go around using the "slippery slope" argument and accuse people of saying the same things as the Nazis, it's probably best to check you're not doing it yourself first.

[Sykowasp]

Taking your main work laptop with you when you visit certain countries is always a dodgy proposition. Best to leave it at home, and take a cheaper 'disposable' system or tablet - you shouldn't be on it much anyway because there should be a reason for that visit that stops you needing to go on it.

[Daedalus]

My thoughts exactly. By rights this guy should be in serious trouble with his employer just for taking a work laptop out of the country without proper reason. On the other hand, if he does use a personal laptop to log into GitHub, which is perfectly doable, then he's stupid for risking his own property like that.

[Anonymous Coward]

By rights this guy should be in serious trouble with his employer just for taking a work laptop out of the country without proper reason.

There speaks a man untouched by BYOD. But even if it was a laptop provided by his employer, you don't know what its policy on taking laptops out of the country is. Many companies - particularly small ones - just want the work done and are glad for their staff have the resources to do just that with them at all times.

The three things I took away from this are VPN, VPN and VPN.

[bombastic bob]

or at least use a VPN, especially when overseas. If the VPN disallows connections from "there", the Tor network might also be helpful...

pirate icon because, hacker. heh. white hat with a touch of grey...

[Danny Boyd]

The problem wasn't he logged in from his working laptop. The problem was, he logged in to the company's account from Iranian territory. If he did that using "disposable" machine, it wouldn't change a thing - the company's account would be blocked because the company seemingly works with Iranians, which is a no-no.

[teknopaul]

off microsoft hosting

It's easy to set up multiple remotes with git. If your code is in Microsoft land only now is a good time to fire up a vm somewhere and cohost your important repos yourself. Github is more than just git, but being locked out of your own code is plain scary.

[mark l 2]

So Github were banning any accounts that logged in from IP's located in Iran? These kind of sanctions are kinda pointless in the real world as it would be trivial for anyone in Iran to jump onto a VPN with an endpoint in a none sanctioned country to get around it and login from their.

[Yet Another Anonymous coward]

VPN? You sound like a terroist boy, you sure you ain't one of them commie Linux users?

[Danny Boyd]

Yeah. Next you'll mention Tor, you villain!

[Anonymous Coward]

"the enduring US foreign policy of promoting free speech and the free flow of information." That's right Mr Assange...don't you forget it!

[Anonymous Coward]

"But that goes beyond what the US rules require. The US Treasury FAQs on Iran sanctions cover a similar scenario and note that it's not necessary to restrict the bank account of a client visiting a relative in Iran."

I am a sanctions lawyer. The bank account scenario is not analogous because it doesn't involve transactions inside Iran; the bank is still not permitted to transact with Iranian institutions or send money to/from Iran. The bank doesn't have to close the account merely because the account holder goes to Iran temporarily.

An analogous situation would be if the dev/company had a github account, but didn't use it while they were in Iran. Github wouldn't have had to restrict the account - but that's not what happened here.

[Potemkine!]

Right to disconnection

Conclusion: don't work when you are in vacation. Never ever.

[John Sturdy]

A handy thing about distributed version control

SInce git is peer-to-peer, it's easy enough to recover from the loss of what you have been treating as the master copy (provided that people keep their local repos up to date). Something which I hope that git-based service providers remain sharply aware of.

[tin 2]

I'm a little confused as to why Github has a system whereby they check if anyone's access is from Iran, investigate (albeit crappily automated or no) and then block your (company's) account, rather than just blocking any access at all from Iran? Seems.... odd.

[Jon 37]

Because if they block access from Iranian IP addresses, then people in Iran discover they can't access the site, then just hop on a VPN to get around it. Then GitHub get in serious trouble because you were in Iran accessing their service.

So once you access GitHub from an Iranian IP address, they go "aha, you're obviously trying to access the site from Iran in violation of US law and the GitHub ToS, so we will block your account".

You may think this is crazy, but it's just GitHub applying US law as best they can.

[PeeKay]

Ban these guys then this happens

https://github.blog/2021-01-05-advancing-developer-freedom-github-is-fully-available-in-iran/

[Roo]

Re: Ban these guys then this happens

Classic, good spot.

[Anonymous Coward]

Vpn people

Surely they enforce vpn usage among their staff.. opening your GitHub account in a cafe in Main Street Berlin is probably just as dangerous as opening it in Iran..

[Anonymous Coward]

Re: Vpn people

Just as much chance of being killed by a middle-eastern terrorist, you mean?

[Anonymous Coward]

I'm a bit confused...

Article quotes Slomski as saying "one employee opened his laptop while visiting his parents in Iran."

So did the employee actively attempt to use GitHub (typing in his login credentials, pulling some files, etc) or did he simply open the laptop, which performed a background sync or something similar without him realizing it?

Regardless, word to the wise - never take work-related tech with you on vacation. (And, if you're traveling outside the country, double-check any restrictions with your employer if you have to take your laptop with you.)