Gitlab Blocked Iranians’ Access
ahmadhaghighi.com
ahmadhaghighi.com
It was a sticking point for us when deploying the sequel to a game I was working on. Ultimately we determined that the benefits of using the provider outweighed the benefit to users since we weren’t shipping the game there officially anyway. (With one notable exception)
It still leaves a sour taste in my mouth.
It should be noted that it’s also Cuba and Crimea that are blocked. I was principally annoyed at the lack of usability in Crimea, as any way you slice it it’s part of a country that is not being sanctioned in the same way and the citizenry did nothing wrong.
Huh, I thought it was GitLab B.V. and that still exists[1], but Wikipedia says they're headquartered in the USA as of 2018[2] and the official "About" page[3] mentions Amsterdam, the Netherlands nor B.V., but does mention a "GitLab Inc.". The history on Wikipedia doesn't mention them having moved and still has the "Tech companies from the Netherlands" category (not sure if that's because they're still originally from there, or because the category was never removed).
Not sure blocking Iran would have happened if they hadn't opened a corp overseas.
[1] https://www.kvk.nl/orderstraat/product-kiezen/?kvknummer=600...
[2] https://en.wikipedia.org/w/index.php?title=GitLab&diff=82685...
[3] https://about.gitlab.com/company/
Edit: slightly older, 2017 reference of USA headquarters https://www.ycombinator.com/library/6J-gitlab-s-secret-to-ma...
Editv2: the TOS still says that the intellectual property is with GitLab B.V. but the branding page says the trademark is held by GitLab Inc. The privacy policy is not GDPR-complaint (on multiple counts and I haven't even read it, just spotted some things like implicit+non-opt-outable consent while looking for who is the data controller) and doesn't mention who the data controller is. It does make clear that all data goes to the USA and you better suck it up. Looks like they fully embraced all of the USA's freedoms including censorship and privacy violations under their home country's law. I'm giving up searching for more info about the move at this point: there is no news article in HN search, the blog search requires me to accept more tracking which (after seeing the illegal-in-the-EU privacy policy) I'm not sure I'm willing to engage in, and the website seems to have had mixed mentions of B.V. and Inc. as of 2016.
Also, if that were the case, literally have the internet would cease to function w/o VPN, which should give pause to those who would shrug off such a policy.
Your knowledge is blatantly wrong, despite multiple people telling you otherwise:
https://reclaimthenet.org/amazon-aws-iran-proxies-vpn-sancti...
Unless someone is fronting them with a transparent reverse proxy inside Iran, those services will be unavailable. Blocked on AWS’s side as part of their compliance with US sanctions.
Most interesting to me: apparently when they first went public and became subject to US regulation they had to close quite a large number of customer accounts in Iran.
That's a charitable way to put it.
You would probably have to be in an OFAC exception category, of course. Routing to sanctioned countries from a provider that mostly blocks them probably isn't the best either.
It doesn't seem to be blocked at the moment, but it's also something I can't find any official documentation on.
I'm not sure Azure has been available for Iranian IPs for the past few years or ever, feel free to Google "Azure Blocked Iran" though - plenty of petitions.
I mean, yeah, I think that kind of is the theory behind US sanctions sometimes honestly. It's pretty messed up. (And the US, which is a "democracy", would want to avoid looking in the mirror too).
I was not saying that the citizens of Crimea did something wrong: I was saying the opposite.
If "doing wrong things" is a criterion for being blocked on GitLab, then there are _so_ many organizations and states which should be blocked, and arguably hundreds of Millions of people who serve in military forces which do wrong things etc.
So, there is really no justification for this regardless of slicing. IMHO.
This happened because of US sanctions[0].
[0] https://about.gitlab.com/handbook/people-group/code-of-condu...
At the very least, enforceable sanctions give us options other than war. Giving that up could carry an immense human cost. An understanding of distributed software architecture does not come with the ability to understand and weigh that cost, nor does it make you a legitimate authority on which tradeoffs to choose. It’s probably inevitable, but I’ll be disappointed in our community if it happens.
If there is a real need to put sanctions in place to avoid a war, they can go through the UN and a vote on the UNSC.
Otherwise, it's just great power games, and I don't want to have to deal with that.
But you make a valid point. Perhaps we should put the "master reop" on something that's decentralized and not subject to US censorship, and only place a copy on GitHub/GitLab/etc.
Is there a requirement to actively monitor the service for possible Iranians? What kind of actions are required specifically to be safe from jail? Is it a requirement to actively block IPs? Spoiler: These things are not specified.
Maybe we should be angry with the US government for the lack of legal certainty provided to its citizens.
However, given that no one in a situation like Gitlab has been prosecuted, maybe their hands are bound after all.
Unfortunately it seems they’ve somehow transformed it into a US company with all attendant benefits and penalties.
I’m assuming the benefits are in the form of cold hard cash, and the penalties are in the form of freedom.
Yeah, no kidding. It's not even "knowing non-compliance", though -- although that's almost certainly worse.
To illustrate this with an example that most HN readers will easily understand (and which some might even be affected by):
The Office of Foreign Assets Control (OFAC) of the Department of the Treasury recently issued an advisory [0,1] to "alert" U.S. companies of the potential risks of "facilitating" ransomware payments.
The TL;DR is that "U.S. persons, wherever located" are subject to heavy civil penalties -- under "strict liability" -- if you "facilitate" a payment from a ransomware victim that ultimately ends up going to an "entity" that's in one of the embargoed/sanctioned countries (Iran, North Korea, Syria, Crimea, Cuba, ...) or on OFAC's "Specially Designated Nationals and Blocked Persons List".
"Strict Liability", by the way, means that you're still liable and subject to penalties even if you "did not know or have reason to know".
"Oh, really? Oh, well, that's too bad. You're still liable, pay up!"
Finally, think about how broadly the vague term "facilitate" might possibly be interpreted (especially by the U.S. Government!) There's belief in some infosec circles that this even means that, for example, a consultant who told a ransomware victim, "yeah, you should probably pay if you want your data back" might be considered liable.
--
[0]: https://home.treasury.gov/policy-issues/financial-sanctions/...
[1]: https://home.treasury.gov/system/files/126/ofac_ransomware_a... (PDF)
Anyone on earth with access to the internet in non-sanctioned and non-sanctioning IP ranges could set up a mirror to help Iranians and other sanction victims. Private repos might be a little more difficult to handle, but still possible. Like the "Great Firewall", USA's petty totalitarianism can be routed around if people care to do so.
I would be mad at the US if this happened to me
I once had a different story — some openstack Q&A website wasn't unavailable from Russia. Turned out it wasn't the website who was blocking russian ips — it was roskomnadzor carpet-blocking whole IP ranges of cloud providers.
Oh yeah, forgot about it. RKN block is usually an SSL error, a timeout, or a page from your ISP saying "this is blocked by the government, sorry". Never a 403.
Thankfully, smaller ISPs are terrifically terrible at complying with this.
However, it's a difference whether a company does not want to serve you or whether a country that says it brings freedom to the world stops information flow for some. China is criticized for the big firewall. When the US does it to others, it's in the name of freedom.
https://en.wikipedia.org/wiki/Convention_on_the_Rights_of_th...
What about cloudflare? They are responsible for more and more of the internet‘s traffic. And even if you are a non-us company and have servers not in the US many people use cloudflare because of its ddos protection. Does cloudflare block these countries too as they are an american company despite you not being a us company.
I'd have to look at the exact text of the sanctions to see if providing service like cloudflare is a violation, but it's not really the same thing as having an account.
You assume it's about open source in particular. It isn't. US sanctions are very sweeping in scope.
[Excluded are...] Technology, technical data and software that is publicly available, meaning published in periodicals, books, print, or electronic media that is available to the public at a price that does not exceed the cost of reproduction or distribution; (...)
[0] https://about.gitlab.com/handbook/people-group/code-of-condu...
What the US really wants is not respect of human rights or better living conditions for the people (see Libya, see Iraq, see Palestine, see the bloody civil war in Syria). What they want is to reduce every non-aligned country to either vassal or rubble.
This is a great phrase, I'm going to borrow that and use it.
I'm curious if:
1) you still live in Iran and/or have immediate family who do?
2) is your opinion common amongst Iranians (and/or Persians)?
3) do/would you still feel the same way if the sanctions brought extreme economic hardship on the people of Iran?
(Considering your remark about North Korea, I'm assuming the answer to the latter is "yes".)
2) I don’t know. I know there is a minority (again no idea how big) that really likes Trump because they really hate the Islamic regime, but these people tend to be poor (? Again not that sure) and have little grasp of economics or international politics.
3) The current sanctions have brought extreme hardships on us Iranians. From my own selfish viewpoint, I am hoping for much lighter sanctions from the potential Biden presidency. I would, however, prefer the harsh sanctions to the IR ever having nuclear bombs. (Not that I can see them being effective at preventing the bombs.) I am also not poor; I think a high-pressure strategy that results in a mass revolution by the poor can be to their medium term advantage (such a revolution would, of course, hurt the middle/upper classes a lot). But such a revolution might very well be impossible by the modern technology and the centralization of power. So to summarize, I think effective sanctions will be worth the hardships they cause, but ineffective sanctions not. The current hard sanctions seem ineffective to me unless they are made much more stringent (which might not be possible) or are paired with military interventions.
NATO is not going to trade and help technologically a country that's trying to develop nuclear weapons in order to threaten to NATO and their main officially stated enemy – United States.
Why would you buy oil from a country or give access to your tech to them when they are using these resources to ramp up their military against you?
Does the US sanction China like it does Iran? The only difference is that China is a larger market than Iran and is close to power parity with the US.
These sanctions are ineffective and disproportionately punish your average Iranian citizen, while we ignore the elephant that is China, which is far more dangerous as an adversary [1] [2].
[1] https://www.amazon.com/Hundred-Year-Marathon-Strategy-Replac...
[2] https://www.brookings.edu/blog/order-from-chaos/2020/09/04/w...
So while I share the skepticism expressed upthread that blocking websites is effective diplomacy, it's hard for me to look at the situation and see a one-sided problem.
Secondly, this is not a question of they block our services, so we block their services. In both cases, it is Iranians who lose access to services.
If anything, it highlights the hypocrisy of pretending to care about Iranian freedom.
However, I'm also in favor of blanket sanctions against any nation whose parliament takes up a literal "Marg bar Āmrikā" collective chant.
https://en.wikipedia.org/wiki/Iran%E2%80%93United_States_rel...
https://en.wikipedia.org/wiki/Iran%E2%80%93United_States_rel...
[0] https://www.wto.org/english/res_e/reser_e/ersd201803_e.pdf
The literature isn't conclusive either way, there's evidence in both directions. But sanctions definitely tend to hurt everyday citizens more than they hurt the targeted governments. Dictators and cronies aren't going to have to worry about increased prices of goods - they get whatever they want - that's sort of the point of being dictator
Respect the deal that was reached between Iran, US, and EU members.
The US unilaterally broke that, my guess is probably because the deal was reached in a pre-Trump era. Now they are deciding to further sabre rattle with sanctions.
All other parties in the deal have pretty much politely decided to ignore Trump's administration and carry on the terms of the deal.
This is more about the US administration desperately trying to look strong for their internal voters more so than actually having a plan or a coherent external policy.
Sanctions are not punishments. They are just a way to say – you're an asshole, and neither us nor our allies are going to play with you anymore.
Look. I love the US (being a Mexican, I consider Mex/US relationship like a bug brother / little brother one) . But darn, it seems the pax-anericana epoch is getting weaker and weaker, and the US is just trying to cling at the last straws of influence that its left.
But the sanctions against Iran are mainly based on old grudges. Pretty much nobody even knows why they exist beyond “they’re bad.”
So tell me why are the American sanctions directed at the people of Crimea? [0]
[0] https://en.wikipedia.org/wiki/International_sanctions_during...
If the US had chosen to respect Russian security interests, nothing would've happened. Finland understands that and lives just fine despite being outside of NATO and bordering Russia.
https://en.wikipedia.org/wiki/International_sanctions_during...
Regardless, I was talking about sanctions in general. Dismissing them as a valid instrument of politics is, in my opinion, misguided.
Antagonizing and radicalizing people? Yes, war is more effective in that.
1. Blocking Iranian IPs, as opposed to accounts, is almost certainly over-compliance. Note that the vast majority of websites do not do this. Even big ones, such as Gmail, do not do this.
2. It does not speak well of the United States justice system if someone could be prosecuted for failure to block Iranian IPs. If this were required, the law should be clear. Otherwise, the US citizens deserve not to be in fear of prosecution.
3. Beyond IP-blocking, if the US government wants to require companies to go actively fishing for possible Iranian accounts, it should clearly codify this. Otherwise, companies should not have to fear prosecution.
Summary: Gitlab should grow a pair, and Americans should ask themselves if this kind of legal uncertainty is desirable.
Finally, legal effort to make websites inaccessible in Iran is entirely incompatible with being taken seriously when complaining about internet freedom in Iran.
Note that this goes so far that the entire Google Cloud network blocks Iranian IPs, including any and all services and websites hosted there, including say resources that might provide valuable information to regime opponents.
With that said, most companies do not start blocking these IPs until they are either contacted by US authorities and asked to comply or via the recommendations of an audit by an outside private company.
Please do not trust what this person is saying. Remember, violating sanctions can get you a prison sentence, not just a fine.
Is there any government guidance or legal precedent that says IP blocking is required? There is not.
Any evidence that the government warned companies privately? And is this the way things are done in the US? Private threats while the citizenry at large is left on the dark about what the law requires?
A Gitlab executive facing prison time over failure to block Iranian IPs would be unjust even with clear guidance, on the import of the offense alone. But given the lack of legal clarity, this would be banana republic stuff. One of my main points here is, Americans should not accept such a state of affairs.
It's bad enough that there is so much over compliance, it's disappointing to see people running to normalize the idea that fear of jail time in the face of legal uncertainty is a way to run a country.
Both Google and Github block accounts by Iranian IPs, and this is easily verifiable if you know anyone who lives in Iran and can access a website - attempting to use Github functionality for anything other than viewing repositories right now is currently blocked, and enterprise accounts are entirely blocked.
Personal Gmail accounts are the exception to Google services available in Iran, and some functionality is also blocked by IP - if you live in Iran currently you might know that almost all other Google services and enterprise accounts are outright blocked by IP too:
https://support.google.com/a/thread/4870330?hl=en
https://docs.github.com/en/free-pro-team@latest/github/site-...
Here is a non-comprehensive list of sites that block Iranian IPs, most outright disallowing access to websites:
https://gist.github.com/alibo/dfd7c258bcc44a0e8c9f7c5bfd3bd2...
Please do not pay attention to this fellow, he is spreading legal misinformation that is dangerous.
> GitHub is committed to continuing to offer free public repository services to developers with individual and organizational accounts in U.S.-sanctioned regions. This includes limited access to free services, such as public repositories for open source projects (and associated public Pages), public gists, and allotted free Action minutes, for personal communications only, and not for commercial purposes.
They do not ban Iranian IPs from accessing their site on a network level, and they do allow Iranians to have accounts to work on open source projects. These are both things that Gitlab is accused of doing here. This leaves us with a couple of options:
1. Github is not in compliance. 2. Gitlab, not allowing any Iranian to access their accounts, and blocking IPs, is over-complying. 3. It is not clear what is required to be in compliance, and Americans think that having to fear prison time in the face of such uncertainty is normal.
Google services in Iran are not blocked by Google or the U.S., they are blocked by Iran. It's the Iranian regime that seeks to block the use of things like Google's search engine, not the U.S.
I don’t trust what you are saying either until you show me the sources of the claims.
I think it’s fair to say that everyone in a position to comply with US sanctions will carefully check what they need to do to comply with them.
https://docs.github.com/en/free-pro-team@latest/github/site-...
https://github.blog/2019-09-12-global-software-collaboration...
Additionally, descriptions of what types of software might be sanctioned:
https://fas.org/sgp/crs/mideast/RS20871.pdf
As you might guess, enterprise accounts are the most targeted aspect of these sanctions.
>With that said, most companies do not start blocking these IPs until they are either contacted by US authorities and asked to comply or via the recommendations of an audit by an outside private company.
Most companies don't block IPs from within Iran, including Github, Google, or Microsoft. Is it your suggestion that GitLab's legal team knows something that Microsoft's and Google's legal team doesn't?
Now I am not an expert myself, so no one should consider my post authoritative, but the evidence that is available suggests that there is not only any requirement by U.S. companies to restrict access to people in Iran for a wide variety of software and Internet services, there actually appears to be a section regarding "Expanding Internet and Communications Freedoms" which in 2010 was used to promote the spread of mass communication technologies and internet services within Iran without the need for a company to apply for a waiver.
Now once again, I am not claiming to be right on this issue, but at the very least I am willing to provide evidence for my claims that come from authoritative sources.
Here is the interpretative guidance by the Treasury Department which authorizes the export to Iran of online services such as, and I quote "instant messaging, chat and email, social networking, sharing of photos and movies, web browsing, and blogging, provided that such services are publicly available at no cost to the user." And there are additional examples of software that may be exported to Iran for personal use, with specific examples provided including Dropbox.
https://www.treasury.gov/press-center/press-releases/Pages/t...
Here is an FAS report prepared for Congress that explains the kinds of software that is legally permissible to export to Iran (page 34):
https://fas.org/sgp/crs/mideast/RS20871.pdf
It appears that companies are permitted to export online services to individuals in Iran so long as, and I quote " is classified by the Department of Commerce as mass market software under export control classification number 5D992, and is publicly available at no cost to the user."
Given that this is the only authoritative evidence anyone has bothered to present in this discussion, it appears a case can be made that GitLab is over-enforcing trade restrictions with Iran.
Now the reason they may have for doing so is that it's not worth serving that part of the world and so be it... but the counter argument is that there are people living in Iran who can use these technologies especially during times of protest to share communications technologies with one another and so if it's not a major burden for Github, or Dropbox, or Slack to keep their services available, then they can be of great benefit to that part of the world. At the very least the Treasury Department's own interpretation of the law agrees with my position as it is documented in the link I provided.
Restrictions actually go further as of recently: https://docs.github.com/en/free-pro-team@latest/github/site-...
Describing the decision to build a partially functional "sanctioned" country website and account degradation as overcompliance is misleading as it is the default behaviour for most complying to US sanctions regarding IP blocking other countries.
The links you mention don't state that Github did any work to comply with U.S. sanctions. The links you state are consistent with the links I posted which is that Github is welcome to provide online services to Iran that are free of charge.
Feel free to counter this by pointing out any particular feature or work that Github has to implement unless your suggestion is that denying access to people in Iran paid services like Github Enterprises is somehow a form of "additional feature work put in place" to support Iranian users.
Do you have a source for this being over-compliance? Gitlab and Github are both actively sharing technology. It's not like Gitlab randomly decided "Hey let's block Iran today", obviously they have in house legal council who advised this course of action.
With regards to your second point, everyone knows there are sanctions on Iran, it's been all over the news, and besides it's not like Gitlab is a random US citizen. They are a big company that is doing business overseas. It stands to reason that they should be aware of all laws and restrictions on international trade.
I think it's the other way around, companies like Google and Facebook should grow some responsibility, it is not unreasonable to ask a company to "fish" for any accounts that conflict with any laws. Google and Facebook might give the impression that it's hard, but it's really not, it's only hard if you expect to make hundreds of dollars for every dollar that you invest acquiring your user base.
From my experience at technology companies, this may indeed be the case, but I would also not underestimate the chance that someone made this decision without being advised to do so by an expensive legal council.
Personal Gmail accounts are the exception to Google services available in Iran, and some functionality is also blocked by IP - if you live in Iran currently you might know that almost all other Google services and enterprise accounts are outright blocked by IPs too:
https://support.google.com/a/thread/4870330?hl=en
https://docs.github.com/en/free-pro-team@latest/github/site-...
I can tell you for certain that at least AWS and Atlassian do that.
I learned that while surfing from an IP address which was mistakenly associated with being located in Iran. I only discovered that, because said websites weren't available. As I got that fixed quite fast afterwards I haven't done more browsing, that's why I can only name these two companies, but I'm pretty sure there are much more big companies doing such blocking based on IP address geolocation.
Tor?
I wish dang would ban users for blatant misinformation such as this. The number of people who end up believing these lies as truth probably outweighs the benefit of any civil discussion it could lead to: in the US, it's now obvious that "alternative facts" has led to a breakdown of civil discussion, after all.
Always verify.
If effort was put into censoring bad information, that might instill a false sense of trust that could never be met by mods. Instead, effort should be put into making sure everyone knows to be skeptical. That, to me, seems more in line with how this site operates.
If people want to be believed, they should cite authoritative sources.
Yes I am saying they block accounts by Iranian IPs, and this is easily verifiable if you know anyone who lives in Iran and can access a website - attempting to use Github functionality for anything other than viewing repositories right now is currently blocked, and enterprise accounts are entirely blocked.
Personal Gmail accounts are the exception to Google services available in Iran, and some functionality is also blocked by IP - if you live in Iran currently you might know that almost all other Google services and enterprise accounts are outright blocked by IPs too:
https://support.google.com/a/thread/4870330?hl=en
https://docs.github.com/en/free-pro-team@latest/github/site-...
Here is a non-comprehensive list of sites that block Iranian IPs, most outright disallowing access to websites:
https://gist.github.com/alibo/dfd7c258bcc44a0e8c9f7c5bfd3bd2...
Please do not spread misinformation.
How do you define an iranian account? It's a complicated rule set there. Iranians not legally resident in Iran are exempt from the sanctions for example.
I feel like IP bans are correct. If you're evading sanctions and internet censorship, you use whatever proxy and many do just this. Companies under these sanctions can write it off as not being the wiser and the users get to where they need to.
Closing accounts with an IP login from Iran does feel like an unnecessary step here.
You yourself are defending these ludicrous sanctions to some extent:
> 1. Blocking Iranian IPs, as opposed to accounts, is almost certainly over-compliance.
So blocking Iranian IPs is fine?
If you tell me "but GitLab is in the US, it has to" - it chose to base itself in the US only after apparently having previously being based elsewhere. With the way things stand, it is unreasonable for an online universal service provider, with individual user accounts, to operate from the US - similarly to how it should not operate out of China or Turkey (where restrictions are even stronger).
Anyway...
> Summary: Gitlab should grow a pair, and Americans should ask themselves if this kind of legal uncertainty is desirable.
Most people in the US are barely aware of international affairs. This comes to mind from a few years back:
https://www.washingtonpost.com/news/monkey-cage/wp/2014/04/0...
> Finally, legal effort to make websites inaccessible in Iran is entirely incompatible with being taken seriously when complaining about internet freedom in Iran.
You're mistaken. The US is not taken seriously on the merit of its arguments (and probably hasn't been for a couple of centuries already); it is taken seriously due to its ability to exert military and economic pressure.
> So blocking Iranian IPs is fine?
The person you responded to, in the very sentence you quoted, said no, as this is "over-compliance".
in my previous message :-(
Very easy to set a geo blocker or conditional access policy and have full compliance. Exempting unique IP addresses becomes annoying, but if needed possible.
It also cuts down on the other side of the house of security related incidents, which, if your company offers a product interested by people in that state, or, has news that can be taken in a dim light, prevents ddos and other annoying things.
Not perfect, but one reason why there's 'over compliance'.
> It does not speak well of the United States justice system if someone could be prosecuted for failure to block Iranian IPs. If this were required, the law should be clear. Otherwise, the US citizens deserve not to be in fear of prosecution.
Cheap insurance, especially if you have no intentions of doing business from there.
US sanctions compliance most likely
Edit: confirmed by Gitlab: https://twitter.com/gitlab/status/1312183287402512384
Having had the opportunity to meet the former in their homeland so so long ago, many Americans do not understand how grueling the sanctions regime system is for average Iranian citizens in their everyday; this is sadly a minor example as I saw based experiences a decade ago. It does not impact government officials as much as we hope, and the citizens are far, far less empowered to force government change to break free of a system sanctions hopes to disincentivize (I will not even waste time here, Google and look, even recent attempts lead to backlash).
As a Westerner, and a lover of HN, I would love to see data-driven examples of sanctions actually working. Was South Africa are only positive example from US sanction strategies? I will go look, but this is one of many examples in Iran of us causing resentment and confusion for citizenry and not really helping. (For Americans, this is a not a red-blue problem if we talk long-term approach, all political parties have sided with sanction strategies in the long-term for a while: Cubans and Iranians we have punished and it has not really seemed to help us _in the long-term_ shifting their governments and policy objectives, but I would love to see evidenced counterpoints.)
The first time I was struck by this perverting are efforts in explaining open society to citizens of countries with indifferent governments was a decade ago, when SourceForge did the same thing. We respect the rule of law, but to spite the faces of democratic cultural principles. Oh well.
EDIT: I see this question has been asked in other threads, but not answered. Whether Iran should be punished is a separate question (one on which I am personally too ignorant to hold an opinion about) from how should one country punish another.
It is not for the US to "punish" other world states, even if "Iran should be punished".
If you, or your state, believe some kind of sanctions are in order, there are international bodies and forums where this can be discussed and decided upon: The UN security council, international courts, and other more specialized bodies, some of which can make decisions which constitute sanctions.
This whole article is about a US company enforcing US rules.
Sanctions should never be part of a punitive system, which at the level of a whole country is inevitably unjust. They should only be part of an incentive system, where you hope to steer the other country to the direction you want. Looked at it this way, we wouldn't ask ourselves whether sanctions are warranted. We'd ask ourselves how effective they are.
Oh, and there's this question of whether a country should have the right to influence another country to begin with. Not gonna answer that one here.
Are sanctions influencing another country, or limiting how companies and people from the sanctioning country interact with foreign entities?
> They should only be part of an incentive system
Has an incentive system between countries ever been implemented and worked? For a specific what-if, is there a way that we could have realistically "incentivized" Cuba to disassociate with the USSR?
I don't think imposing sanctions has worked to our advantage ever, in any country, in the past 50 years we have used them. And in many, they have backfired, e.g. Iraq in the 90s. That isn't even to mention the hundreds of thousands of innocent people who lose their life. [1]
Yet, sanctions are considered to be "soft" and "dovish" by politicos and the general public. It's stupefying.
https://www.nytimes.com/1995/12/01/world/iraq-sanctions-kill...
I'm strongly opposed to these sanctions, and I also think GitLab should've given people notice so they could get their data out. But I'm not sure it's a good place to pull the racism card.
Also worth noting that GitLab has previously banned hiring from China/Russia, so it's no stranger to blanket bans of questionable nature.
1 - https://www.zdnet.com/article/gitlab-considers-ban-on-new-hi...
I wouldn't consider not hiring from countries with aggressive foreign policies and non-democratic governments that use coercion on their own citizens (including employees of said company) as questionable. GitLab's main job is to protect it's company and it's customers not to try to build some sort of utopian post-reality civilization.
If we go by that logic, the U.S. would get on that list.
> non-democratic governments that use coercion on their own citizens
If that was indeed the standard to go by, I'd agree, but the list would then need to be much, much longer and possibly include even some traditionally democratic countries like Australia who have an actual law where they can force employees to secretly install backdoors.
Saudi Arabia infiltrated Twitter and compromised some of its employees to obtain info on regime critics that could endanger their lives, as just another example.
The list would by these metrics include well over half the world.
Economic sanctions against America would not be racism against scots/germans/west africans or whatever.
You can argue against sanctions on all sorts of grounds, but the flimsiest is claiming that they're racist.
I think that singing about how you want to destroy the country, how you want to choke it etc. do prove racist tendencies.
As for armed forces acting outside of borders, you cannot claim that U.S. armed forces are any more 'authorized' to be in these places than Iranian ones, can you?
So in the end, it comes down to nothing more than the U.S. having the ability to implement these sanctions and Iran not, there's no 'principles' in it, just geo-politics.
What is remarkable however is that this pandemic is a uniquely challenging situation even for countries not under sanctions, so placing new sanctions on the country, as was recently done, is plain inhumane.
Oh come on. That is not scraping the barrel but the bare metal underneath for offense. And most people die of hearth attacks anyway.
> 118. I have a client that is in Iran to visit a relative. Do I need to restrict the account?
> No. As long as you are satisfied that the client is not ordinarily resident in Iran, then the account does not need to be restricted.
https://home.treasury.gov/policy-issues/financial-sanctions/...
Depending on the actual sanctions these might not require a blanket ban on paper but in practice there is no effective way of performing sufficient KYC for every individual from Iran to comply with the sanctions even if they only target specific individuals and institutions.
And then you have to read their BS ads that state: "We’re building money without borders"
As reminder, Venezuela is under a heavy economical crisis, where more than 6 millions citizens (9 millions as per unofficial data) out of the 30 million total had to run away, this is more people than syrian refugees numbers (5,6m).
What role transferwise had on venezuela? well, some of those that left, were using transferwise to send money to their families and friends still in venezuela, helping them feed themselves and buy medicines and cover their needs. Note that most of the money sent, wasnt even touching venezuelan banking system, as most venezuelans already have US bank accounts, money was just moving from lets say argentina (common country for a venezuelan to immigrate) to US, not to venezuela
But transferwise decided that is better to block 20millions possible users in need of humanitarian help [4], because they didnt want to check if those users were in the OFAC list that is not even 100 people long.
[1] https://i.imgur.com/26h0u2W.png
[2] https://www.state.gov/venezuela-related-sanctions/
[3] https://en.wikipedia.org/wiki/Venezuelan_refugee_crisis
[4] https://disasterphilanthropy.org/disaster/venezuelan-refugee...
http://ftp.ir.debian.org/ https://www.debian.org/mirror/list
I find this ridiculous, trying to stop flow of intellectual knowledge.
Change your Hosting to a non US Company is what you can do.
Source: I implemented part of the sanctions compliance for a major tech company’s platform (and saw other projects get sunset because they didn’t implement it)
Btw, doesn't blocking by IP address go beyond what is required by law, since only Iranian residents are subject to sanctions? Would preemptively restricting accounts that have logged in from an Iranian IP address and asking for proof of residence break the law?
The penalties for violating sanctions are so severe that it is worth the risk of potentially blocking legitimate customers.
> Would preemptively restricting accounts that have logged in from an Iranian IP address and asking for proof of residence break the law?
It would be extremely expensive and in a literal sense not worth the time.
Also, this may come as a shock to you, but when a law is sufficiently unjust, there can come a time to disobey the law. In this case, disobeying the law would not directly risk anyone's safety, lowering the barrier somewhat.
Businesses don't care. It's easier for them to have a couple of false positives than it is to deal with the possible consequences.
- Not be a US company
- Not comply with US sanctions
- Not do business in the US
There’s options. Just because they don’t want to take them doesn’t mean they’re not there.
https://sr.ht/ might work due to its small size but it hosted in the US AFAIK.
Why doesn't Gitlab simply host their services outside US jurisdiction?
>Why doesn't Gitlab simply host their services outside US jurisdiction?
Because GitLab is a US company. They moved their headquarters to California (incorporated in Delaware) in 2014.
For example, is there an alternative git hosting site where it would be helpful for me to maintain a fork, so that the README is available and people can open issues and PRs?
Similarly, where would be a good place to host the binaries built on each release so that they are accessible?
https://docs.github.com/en/free-pro-team@latest/github/site-...
> GitHub is committed to continuing to offer free public repository services to developers with individual and organizational accounts in U.S.-sanctioned regions. This includes limited access to free services, such as public repositories for open source projects (and associated public Pages), public gists, and allotted free Action minutes, for personal communications only, and not for commercial purposes.
maybe someone can confirm how this works in practice?
If they are under US jurisdiction it is inadvisable to try and circumvent such stuff.
Especially if you maintain something that could be considered dual purpose
I also find the Aaron Swartz case extremely sad and depressing, but what he was doing was very different from using a European website in the way the website owners intend.
> with only downsides.
Of course there are upsides; that is the whole point of this discussion: the upside is that the resources will be available to all people in the world.
If you are US citizen, you are forced to comply with the laws. The fact that you host something in Germany, doesn't mean it is not under sanctions.
If you tomorrow move your repo from github to codeberg and write "moved here so my iranian friends can have access to my work" - well chances are no one will notice. But if the state by bad luck puts their crosshair on you - don't be surprised if the result is the same as the Aaron Swartz case.
I am not claiming that you are even wrong. Just that when you are playing russian roulette - don't act surprised if there is a bullet.
Furthermore, this is as if GitLab is the only service to block Iran. I didn’t say the Persian people, I said Iran.
PS: Imagine if the USA sponsored Telegram MTPROTO proxies (and other anti-censorship tools). That'd deal a huge blow to the IR, and make the people more US-friendly as well. Does anyone know why they don't? It's an obvious LHF ...
- What are the United States' goals with respect to Iran?
- What goals of Iran's are being hindered, objected to, or otherwise meddled with by the United States?
- In the end, dictators know that the Western block is finicky, unstable, and short-termish; This makes it so that high-pressure strategies do not work. Just to be sure I understand this, you're saying that because Western countries (Europe / the US) cannot maintain a consistent foreign policy, their targets (other countries) see the best strategy for dealing with moments of high pressure from the West as being "wait for the pressure to go away"?
- I do not know of a solution, frankly; Most of my peers see immigration as the only viable solution. Solution to what problem? Immigration of who, from where, to where?
Western democracies generally are very bad game-theoretic agents; They play repeated games as if they are oneshots.
I suspect term limits have a lot to do with this.
3) Yes. Even compromising is made more dangerous; E.g., Obama definitely paid a risk premium in his deal. The Iranian side factored in the possibility of the US annulling the agreement when they agreed to it. Inconsistency in foreign policy sucks A LOT.
4) A solution to Iran being a shitty country to live in, and things getting worse almost every single year. I also meant a solution to Iran exporting shittiness to the world, but immigration doesn’t help with this part.
- odd that you're asking an Iranian Qn#1. They don't know either
- Iran wants to play a regional power in the Middle East, far greater than it is now. It is to be noted that many countries in the ME, such as the UAE, Qatar, Syria, Iraq, Lebanon and Bahrain have significant Shia minorities or majorities in some cases. When the Arab Spring happened, Iran actively encouraged protests within the Shia population to overthrow the monarchy in Bahrain, until the UAE and Saudi Arabia reacted. Even now, the UAE regularly arrests Shia folks it suspects of cavorting with Iran (a large part of the Arab population in the Emirates are descended from Persia). Not to mention, Iran invaded and expelled the local Arab population of a tiny island of one of the constituent Emirates of the UAE, before the country's formation and during the time of the Shah. Iran is quite the expansionist.
- basically what Rouhani thinks. Wait until Biden gets into power, and hope that he's going to continue the Obama policy. This is not common among all dictators though - some want Trump to be in power, like the monarchs of the Arab states, since he's an Iran hawk.
- a solution to Iran's repressive regime, duh. Iranians have been immigrating en masse for a long time to the US, Canada, UK and Europe. Anywhere there is a democracy. There are a ton of Americans, British, Europeans and Canadians who graduated from Sharif University of Technology, the equivalent of Iran's MIT.
- not just term limits, but the need to "pander" to their constituencies. One decade, they warred in the Middle East, the next decade they want to leave the mess they created, but then commit more troops (Obama on Iraq)? It's definitely not like Russia or China or India (all of which are/were friendly with Iran) who have had a steady policy in the region of being on talking terms with everyone.
Yep, the Middle East is complicated.
Presumably, the 'oppressive' part of oppressive regime. Guy has my sympathies FWIW.
The use of this phrase belies a cynical, reductionist attitude that I have no respect for whatsoever
Because I've done it myself many times (mostly before I understood the term, but also afterwards on occasion).
International politics with these kind of countries are tricky business; personally I'd love nothing more than see Iran become a better place, but you can't just force things like this. We tried in Afghanistan and Iraq, and that didn't turn out so well. People are still trying in Syria and we can't exactly call this a great success either.
So ... your best bet is to deal with these kind of regimes the best you can, by applying pressure in one area and making a deal in another. I think few people are especially happy with this, but it's the best option out of a bad bunch.
From what I have heard the "high pressure" has only affected ordinary people who can't get things like meds and equipment. Just look how they were affected by corona, so much worse than their neighbors.
I would highly, _highly_, doubt a person actually living there would consider the "high pressure" strategy a good thing.
Only libre software like GNU and public domain works will probably give you the complete freedom to not be wary of this kind of nation-to-nation wraith.
People getting pissed. Seriously, this is macro economics!
John Perry Barlow begs to differ.
As an occupied territory, it doesn't have any legitimate institutions (such as a recognised government, banks, courts, etc.) — only a foreign occupation regime. Same way as Germany's Reichskommissariats and Reichprotektorats during WW2 were never legitimate entities despite being de facto governed by Germany.
This means than no contract (private or public) with a Crimean entity can be internationally recognised and will be easily contested by any court/arbitrage outside of the RF.
In addition to this, there's a moral concern of giving legitimacy to a foreign occupation. There's just no way to justify this unless one supports the mentioned occupation, with following systemic abuse of human rights, change of ethnic composition and militarisation.
This is why I have such mixed feelings about these kind of sanctions: sure, I don't really disagree with what you're saying, but on the other hand in practice it means hurting normal people just building a life for themselves.
I haven't seen anything in the last 35 years that contradicts that.
The worse thing I've seen is the US is now so schizophrenic that countries under sanctions can't trust that making a deal with US to get sanctions lifted won't prevent them from being reimposed because some other fraction gains power.
[0] https://meduza.io/cards/kak-v-rossii-presleduyut-za-prizyvy-...
According to them, that includes downloads.
So no luck there either.
Some of the screenshot show them even trying to get a temporary account with support just to get what they've been locked out of to make a backup.
Also yes, gitlab doesn't really care about them or they would have given some sort of notice. Even 24 hours.
Moreover we have to point our fingers toward Iranian corrupt regime because they are bringing misery to the the people. We have to be asking this question every day: why on earth countries like japan or korea never get sanctioned. I guess the answer is simple
Also if an Iranian developer is unprepared against losing their access to Gitlab, then sadly they are incompetent developers.
Uhm, it was literally the USA that withdrew from the signed deal without any wrongdoings from Iran. You might consider not being so tough on the internet when you are factually wrong.