But you make a valid point. Perhaps we should put the "master reop" on something that's decentralized and not subject to US censorship, and only place a copy on GitHub/GitLab/etc.
At the very least, enforceable sanctions give us options other than war. Giving that up could carry an immense human cost. An understanding of distributed software architecture does not come with the ability to understand and weigh that cost, nor does it make you a legitimate authority on which tradeoffs to choose. It’s probably inevitable, but I’ll be disappointed in our community if it happens.
If there is a real need to put sanctions in place to avoid a war, they can go through the UN and a vote on the UNSC.
Otherwise, it's just great power games, and I don't want to have to deal with that.
That is not to say that there if it fails to go through the process it is necessarily just a game of great powers, but hey, that's the world we live in.
Is there a requirement to actively monitor the service for possible Iranians? What kind of actions are required specifically to be safe from jail? Is it a requirement to actively block IPs? Spoiler: These things are not specified.
Maybe we should be angry with the US government for the lack of legal certainty provided to its citizens.
However, given that no one in a situation like Gitlab has been prosecuted, maybe their hands are bound after all.
Unfortunately it seems they’ve somehow transformed it into a US company with all attendant benefits and penalties.
I’m assuming the benefits are in the form of cold hard cash, and the penalties are in the form of freedom.
Yeah, no kidding. It's not even "knowing non-compliance", though -- although that's almost certainly worse.
To illustrate this with an example that most HN readers will easily understand (and which some might even be affected by):
The Office of Foreign Assets Control (OFAC) of the Department of the Treasury recently issued an advisory [0,1] to "alert" U.S. companies of the potential risks of "facilitating" ransomware payments.
The TL;DR is that "U.S. persons, wherever located" are subject to heavy civil penalties -- under "strict liability" -- if you "facilitate" a payment from a ransomware victim that ultimately ends up going to an "entity" that's in one of the embargoed/sanctioned countries (Iran, North Korea, Syria, Crimea, Cuba, ...) or on OFAC's "Specially Designated Nationals and Blocked Persons List".
"Strict Liability", by the way, means that you're still liable and subject to penalties even if you "did not know or have reason to know".
"Oh, really? Oh, well, that's too bad. You're still liable, pay up!"
Finally, think about how broadly the vague term "facilitate" might possibly be interpreted (especially by the U.S. Government!) There's belief in some infosec circles that this even means that, for example, a consultant who told a ransomware victim, "yeah, you should probably pay if you want your data back" might be considered liable.
--
[0]: https://home.treasury.gov/policy-issues/financial-sanctions/...
[1]: https://home.treasury.gov/system/files/126/ofac_ransomware_a... (PDF)
Anyone on earth with access to the internet in non-sanctioned and non-sanctioning IP ranges could set up a mirror to help Iranians and other sanction victims. Private repos might be a little more difficult to handle, but still possible. Like the "Great Firewall", USA's petty totalitarianism can be routed around if people care to do so.