Hacker News Reader

Comment by dijit | Hacker News Reader

Quick note that anyone using a US based cloud provider will likely be blocking all sanctioned countries. It’s not configurable at all.

It was a sticking point for us when deploying the sequel to a game I was working on. Ultimately we determined that the benefits of using the provider outweighed the benefit to users since we weren’t shipping the game there officially anyway. (With one notable exception)

It still leaves a sour taste in my mouth.

It should be noted that it’s also Cuba and Crimea that are blocked. I was principally annoyed at the lack of usability in Crimea, as any way you slice it it’s part of a country that is not being sanctioned in the same way and the citizenry did nothing wrong.

View on HN

> US based cloud provider

Huh, I thought it was GitLab B.V. and that still exists[1], but Wikipedia says they're headquartered in the USA as of 2018[2] and the official "About" page[3] mentions Amsterdam, the Netherlands nor B.V., but does mention a "GitLab Inc.". The history on Wikipedia doesn't mention them having moved and still has the "Tech companies from the Netherlands" category (not sure if that's because they're still originally from there, or because the category was never removed).

Not sure blocking Iran would have happened if they hadn't opened a corp overseas.

[1] https://www.kvk.nl/orderstraat/product-kiezen/?kvknummer=600...

[2] https://en.wikipedia.org/w/index.php?title=GitLab&diff=82685...

[3] https://about.gitlab.com/company/

Edit: slightly older, 2017 reference of USA headquarters https://www.ycombinator.com/library/6J-gitlab-s-secret-to-ma...

Editv2: the TOS still says that the intellectual property is with GitLab B.V. but the branding page says the trademark is held by GitLab Inc. The privacy policy is not GDPR-complaint (on multiple counts and I haven't even read it, just spotted some things like implicit+non-opt-outable consent while looking for who is the data controller) and doesn't mention who the data controller is. It does make clear that all data goes to the USA and you better suck it up. Looks like they fully embraced all of the USA's freedoms including censorship and privacy violations under their home country's law. I'm giving up searching for more info about the move at this point: there is no news article in HN search, the blog search requires me to accept more tracking which (after seeing the illegal-in-the-EU privacy policy) I'm not sure I'm willing to engage in, and the website seems to have had mixed mentions of B.V. and Inc. as of 2016.

Gitlab is hosted on google cloud, and fronted by cloudflare... those IP restrictions apply to google cloud, AWS, Azure and Oracle Cloud. (and Cloudflare since that's a US company also)

To my knowledge, services hosted on AWS are not blocked in Iran.

Also, if that were the case, literally have the internet would cease to function w/o VPN, which should give pause to those who would shrug off such a policy.

I just checked and they are.

Unless someone is fronting them with a transparent reverse proxy inside Iran, those services will be unavailable. Blocked on AWS’s side as part of their compliance with US sanctions.

>To my knowledge, services hosted on AWS are not blocked in Iran.

Your knowledge is blatantly wrong, despite multiple people telling you otherwise:

https://reclaimthenet.org/amazon-aws-iran-proxies-vpn-sancti...

This article is talking about Iranians being able to use AWS to host services. We are talking about services I host on AWS being accessible in Iran without a VPN.

Those are also blocked, but I genuinely implore you to make an Iranian friend (somehow) and ask them what works.

For myself, I saw my users go to zero when I migrated to AWS+GCP over my European based co-location provider.

I was hosting services that had 30,000~ monthly active users from Iran at the time.

https://en.wikipedia.org/wiki/Internet_censorship_in_Iran#Un...

Admittedly, it's been a couple of months since I've been to Iran, so I just asked a friend in Mashad. He confirmed to me that my websites, running on a Kubernetes cluster on EC2 in the eu-west-1 are accessible without a VPN.

Maybe your issue was due to use of GCP?

I moved all my stuff to AWS specifically because Google Cloud does have this kind of block. I care about this a lot, so if your friends in Iran have different things to report, let's look into it to figure out what is going on.

The minute they took money from US VCs they agreed to play by US rules.

In the past I worked for an Israeli company listed on a US stock exchange. They were proud that they had customers in virtually every corner of the world, and had just six countries they couldn't do business in. One (Lebanon) because of the Israeli government, and five (including Iran) because of the US.

Most interesting to me: apparently when they first went public and became subject to US regulation they had to close quite a large number of customer accounts in Iran.

It’s interesting to me that the US views Iran more harshly than Israel does.

Iran, Israel, Kingdom of Saudi Arabia... There is so much going on there. Are they all at conflict with one another? Who are allies? How does this work?

On a long enough time scale, everyone is the bad guy.

Israel is an ally of the KSA against Iran, though they both pretend not to be for domestic consumption. They are indeed both in conflict with one another, because in truth Iran is really the only country in the Middle East that could threaten to become an independent power, on the level of say, Turkey.

It doesn't, the US is just Israel's proxy warrior in this fight. (cf. the Clean Break memo, etc)

> just Israel's proxy warrior in this fight

That's a charitable way to put it.

At least on some clouds, it's configurable, but your lawyers need to speak to their lawyers, etc, to get worldwide access enabled, and annual reconfirmation between lawyers.

You would probably have to be in an OFAC exception category, of course. Routing to sanctioned countries from a provider that mostly blocks them probably isn't the best either.

I only use Amazon Route 53. Does anyone know if that's ever been blocked in Iran etc?

It doesn't seem to be blocked at the moment, but it's also something I can't find any official documentation on.

It would only affect you if your doing direct DNS requests to route53- which is almost never the case for clients.

But an Iranian ISP's customers will probably use that ISP's DNS servers, and that DNS resolver does query Route 53 from Iran.

Does that mean Ali Cloud would be a better option here ?

Not really.

Other than GCP, which US based cloud providers do this?

AWS: https://reclaimthenet.org/amazon-aws-iran-proxies-vpn-sancti...

I'm not sure Azure has been available for Iranian IPs for the past few years or ever, feel free to Google "Azure Blocked Iran" though - plenty of petitions.

AWS and Azure prevent Iran-based users from having an account, but if you have an account, you can exchange traffic with Iranian IPs. GCP blocks traffic to/from Iranian IPs for all users. It sounded to me like GP was referring to the latter type of blocking.

You might want to delete the "and the citizenry did nothing wrong" ending to your otherwise reasonable post. I don't think you meant it the way it sounds.

I legit am not sure how it sounded to you in a way that seemed unfortunate.

It implies that, unlike Crimea, the citizenry of countries _other_ than Crimea (Iran/Sudan/Cuba etc) _did_ do something wrong.

Ah, I see.

I mean, yeah, I think that kind of is the theory behind US sanctions sometimes honestly. It's pretty messed up. (And the US, which is a "democracy", would want to avoid looking in the mirror too).

What do you think the citizenry of Crimea did wrong?

they voted wrong way.

I'm under the impression that nobody but Russian state media claims that election was legitimate.

wrong way in wrong elections :) Of course, like any Russian election it was just a formality, a décor. Nobody really needed it as the will of the people was clear - no more threats of more of those "trains of friendships" full of Western Ukrainian nationalists, especially given all the quiet massive arming of those nationalists that had happened under the cover of the Ministry of Internal Affairs in the run up to the 2014.

What massive arming?

Ah yes, the legitimacy. I don't think it means what it's implied to mean. The USA do many illegitimate things and no-one bats an eye.

Nothing; see my reply elsewhere in this thread. I meant the opposite of what you understood me to mean, but I can see why I was misunderstood.

I am being misunderstood because of the wording I used. The reason "and the citizenry did nothing wrong" is problematic is because it implies that, unlike Crimea, the citizenry of countries _other_ than Crimea (Iran/Sudan/Cuba etc) _did_ do something wrong.

I was not saying that the citizens of Crimea did something wrong: I was saying the opposite.

It was obvious and you are dealing with pedants

> I was principally annoyed at the lack of usability in Crimea, as any way you slice it it’s part of a country that is not being sanctioned in the same way and the citizenry did nothing wrong.

If "doing wrong things" is a criterion for being blocked on GitLab, then there are _so_ many organizations and states which should be blocked, and arguably hundreds of Millions of people who serve in military forces which do wrong things etc.

So, there is really no justification for this regardless of slicing. IMHO.

Reply on news.ycombinator.com