appearances matter move to switzerland [LWN.net]

appearances matter move to switzerland

Posted Feb 6, 2025 11:39 UTC (Thu) by lunaryorn (guest, #111088)
In reply to: appearances matter move to switzerland by linuxrocks123
Parent article: The Linux Foundation on global regulations and sanctions

Github itself implements sanctions, see https://docs.github.com/en/site-policy/other-site-policie...

Specifically, it explicitly states to restrict availability to sanctioned entities and to use various sources to determine whether a user or organisation could possibly be subject to sanctions. Github generally knows a lot more than just the user name (such as mail addresses, payment history, commit, push, and interaction history, remote IP addresses, etc), and it does not need to come to a definite conclusion; it can already limit accounts on mere suspicion and require proof of identification (such as a valid credit card). Github also summarily blocks entire geographic regions. It used to block all of Iran, until it obtained a special license from the US government to restore services to Iran.

As such, Github exists as some kind of a walled garden where sanctioned entities are not present, and within with users can reasonably assume that other users legitimate or they'd not be on the platform in the first place. But the Linux Foundation runs its own infrastructure, and thus needs to care for this itself.

All of what you're describing in your comment literally exists in the more or less the very form; you were just lucky enough not to notice so far, because frankly, reddit discussions are not usually not a place where serious business is done, and neither are LWN comments.

But organisations doing serious business, especially in sensitive fields, will likely do their own checks for significant Github contributions or prolonged collaboration with external Github users. I know that my organisation would. It has a whole policy document about doing open source which includes regulations for accepting significant contributions which include concerns of export control and sanctions, and it's not even a US-based organisation.

And I'd like to remind you that under many jurisdiction export control and sanctions laws come with specific personal liability. Contrary to, say, financial regulations or product liability or customer safety you cannot routinely disclaim personal responsibility for violations done on behalf of your employer. Breaching sanctions or export control regulations is routinely a personal criminal offence, for which you're immediately liable, even if you did so on behalf of your employer, which is why no one is particularly keen to test the limits of these regulations in court.

to post comments

appearances matter move to switzerland

Posted Feb 6, 2025 12:06 UTC (Thu) by intelfx (subscriber, #130118) [Link] (2 responses)

> [...] and it does not need to come to a definite conclusion; it can already limit accounts on mere suspicion and require proof of identification (such as a valid credit card). Github also summarily blocks entire geographic regions.

Is that supposed to be a good thing?

> As such, Github exists as some kind of a walled garden where sanctioned entities are not present, and within with users can reasonably assume that other users legitimate or they'd not be on the platform in the first place.

GitHub does this to protect its own ass, not the one of other users. If what you (and others in this thread) say about strict personal liability for breach of sanctions is true, then it's very obvious that you cannot rely on GitHub's "walled gardenness" to make any decisions in this space, so you didn't really refute what GP was saying.

GitHub and sanctions

Posted Feb 6, 2025 12:52 UTC (Thu) by farnz (subscriber, #17727) [Link]

Using GitHub provides you with a degree of protection, AIUI. You're safe if you genuinely believed that you weren't breaching sanctions - and you could argue that you believed that GitHub would be applying sanctions, therefore you assumed that you were not breaching sanctions by using GitHub.

Now, once the authorities have notified you, you'd have to stop working with sanctioned entities - but as a practical matter, the authorities get much more bang for their buck if they get the sanctioned entities blocked from all of GitHub than if they simply get your project to stop interacting with them.

appearances matter move to switzerland

Posted Feb 6, 2025 14:44 UTC (Thu) by lunaryorn (guest, #111088) [Link]

I didn't say anything about whether this was good or bad. I do have an opinion about the whole export control and sanctions thing, which - reading between the lines - probably isn't that far from yours, but I don't think my opinion is relevant. It is what it is, whether I like it or not.

Github certainly protects itself first and foremost, but in doing so, also provides reasonable protection to most individuals who casually contribute to open source projects. I for my part am quite sure that my personal activity on Github does not bear much of a risk, simply because none of my projects have any particular impact or reach, so I'm effectively off the grid: In the exceedingly unlikely case a sanctioned top terrorist used Github to contribute to one of my repositories there's a long long chain of people to be in trouble before anyone would come after me.

However, that's not the case for my employer, which would be held to a much much higher standard. If said top terrorist contributed to one of my employer's repositories my employer would definitely be in trouble, and if the repository was under my responsibility, so would I, unless I could meticulously prove that I followed my employer's regulations for export control and open source work to the very letter, and thus did all I could possibly to do avoid this situation. And as said in my previous comment, my employer does maintain quite extensive regulations around all this.