Hacker News new | past | comments | ask | show | jobs | submit login
Okta and Auth0 Blocking Cuba, Iran, N Korea, Syria, Crimea, Luhansk, Donetsk (okta.com)
122 points by joelittlejohn on Sept 15, 2022 | hide | past | favorite | 162 comments



I run a USA based SaaS and was mistakenly caught up in Auth0's 'sanctions'.

0. Production servers deleted

1. No logs, notifications or any indications of the issues

2. Can't get ahold of support on the free plan

3. Spend 1-2 weeks frantically trying to restore access to our customers

4. Find a random Auth0 support thread of someone who had the same issues

5. Auth0s response was to submit an affadavit to their legal team indicating I'm not sanctionable

6. Access restored after ~3ish weeks of downtime

Why was my SaaS caught up in sanctions?

I had a Russian developer deploy Auth0 two years ago (and hadn't logged in for 18+ months)

That was enough to get my production servers deleted with no warning.


Automated enforcement is evil and must be banned (except in situations when the violations themselves mostly are automated and come in unbearably huge quantities).


>Automated enforcement is evil and must be banned

Aren't the only people able to enforce the banning of automated enforcement, politicians, the very people that want the blocking done in the first place?


All you have to do is get them automatically screwed over by some unaccountable systems and we will quickly have laws that require automated systems be accountable.


Banning automated enforcement is also the end of free and maybe even cheap services on the Internet.


Nah, it would be the end of politicians demanding ever increasing shitty automation affecting a huge percentage of valid use cases. We didn't have any regulations demanding automated enforcement before it was possible, certain media lobby industries just wouldn't be able to abuse the state to enforce their profits via spurious, entirely untried copyright claims.


Okay, I don't mind.

I am not rich but I would agree to double and triple on my internet subscription if the Internet would be made significantly better (scarce and exclusively curated non-intrusive ads, no tracking, no DRMs, no forced/nudged "engagement", no automated enforcement, no paywalls, everything easy to download and or syndicate, etc.).

In fact I would already pay Google and Facebook if they would seriously stop treating me as a product and would consider me a client whom they would act in best interest of. Yet they don't even offer, even those who actually pay them get blackholed routinely.

I understand there are poor countries where people really can't pay so I don't insist the business model has to change for everybody everywhere.


> In fact I would already pay Google and Facebook if they would seriously stop treating me as a product and would consider me a client whom they would act in best interest of.

They do. But their customers are their advertisers, not their users. Their users are literally the product. Their public services are bait for eyeballs.

If you were a fish, on a hook, would you offer to pay the fisherman for better tasting bait? The fisherman isn’t concerned about the bait as long as it’s good enough to catch you and send you to market.


You should probably ask for a refund then.


Insance.... what's next, I ate a Cuban sandwhich last year and posted it on instagram so GAFA will arbitrarily deplatform me ?


It's enough to post a comment on YouTube which doesn't entirely agree with the mainstream. I got a ban when I suggested on 20th Feb that Russia might attack Ukraine, and it took down the one (fortunately non-production) thing I had in GCP. Don't use them at all - especially not GCP - problem solved.


Oh, nice, my company is just integrating Okta.

Is Cuba still being punished for daring to host Soviet missiles?

I think the way we've treated them is really terrible.


At this point, Cuba is stuck being a chip in presidential politics to win Florida’s electoral votes.


Meaning if commerce with Cuba was not ban it would be a threat to Florida’s economy?


Meaning there are many Cuban refugees living in Florida who hate the Communist regime and will not support a President who does not continue the sanctions. No political party wants to lose Florida, therefor politicians have a good reason to continue US policy.


Florida's days of being a swing state will likely be over by the next presidential election. Desantis won by tight margins, but he seems to have done a great job attracting exactly the sort of people who'd vote for him to the state and has consistently worked to gerrymander and restrict voting rights for those who'd vote against him.

Crist couldn't even beat Rick Scott for the Senate, and Scott was one of the least popular governors in the country at the time of the election.

Edit: It was actually Bill Nelson who lost to Scott in 2018, my bad. Crist has been hiding out as a US Rep in Saint Pete since losing the governor's race to Scott.


Bill nelson ran against Rick scott not charlie christ.


Oh, right, sorry - Crist lost to Scott as governor years before that. I'll edit my post.


How has Desantis restricted voting rights?


Refused to implement the felon voting rights that voters approved in any manner that might actually by equitable. Proposed an extremely gerrymandered district map that was thrown out by a court, but then worked with the state congress to drag his feet on a replacement to ensure it gets used anyway.


So that is your definition of "restricting" -- not expanding?


The voting rights of those individuals were restricted, as gp said.

You're rephrasing it to make it sound like its something materially different, yet it's the same thing that goes against the spirit - and likely the letter - of the law.


No, the statement was that Desantis restricted voting rights. Here is the literal quote:

"Desantis won by tight margins [..] and has consistently worked to gerrymander and restrict voting rights for those who'd vote against him."

When pressed for details on this bizarre claim, it was pointed out that voting rights for felons was not expanded and that the status quo remained under Desantis. Thus he only refused to expand voting rights.

Now you are trying to rephrase the original claim to make it appear to be less false than it is, when all you need to do is scroll up to see the original claim.



Cuba exports terrorism and misery across the region. The dictatorships in Cuba, Venezuela, and Nicaragua fly under the radar these days, but are no less noxious to humanity than the regimes in Russia, Iran, NK, etc.

You can argue whether or not sanctions are an effective way to promote regime change, or if they just hurt the regular citizens of rogue governments. I think they are often quite ineffective.

But there's no defending the Cuban regime.


Yeah... They fought against apartheid in South Africa while US fought to keep apartheid... They fought for Africa independence while the west wanted to keep their colonies... It's Cuba exporting terrorism and misery... Not forgetting how US recently destroyed the country with highest HDI in Africa, how CIA is a terrorist organization that blows up people with impunity around the world...


The US supported and harbored an anti Castro terrorist who among other things blew up a civilian airliner:

https://en.m.wikipedia.org/wiki/Luis_Posada_Carriles


Imagine discussing South America only to come to the conclusion that Cuba is to blame LMAO

r/ShitAmericansSay


“Cuba exports terrorism and misery across the region.”

::walks away whistling hoping you don’t notice Iraq and Afghanistan’s blown up weddings::


https://en.wikipedia.org/wiki/And_you_are_lynching_Negroes

Feel free to start a discussion on US aggression, if you honestly feel strongly about it.

Otherwise you're blatantly trying to whitewash decades of systematic oppression from totalitarian bloodthirsty regimes, and in the process support all the human rights violations they're continuously subjecting their population to.


> systematic oppression from totalitarian bloodthirsty regimes

How do sanctions help an average Joe stuck living under such a regime?

Now they are even poorer, have worse nutrition and medicine.


That's a very nice link. It took around 40 years for the USA to even get to that level of self-awareness to have BLM.

Think about it, Soviet Union was not just knowing what you did last summer; it knew what you would be doing a summer 40 years from back then.


Curious... Soviet union were completely right when criticizing US for lynching black people... But it is interesting how propaganda works... It's like nowadays when you point hypocrisy in the Internet, but people just yell "whataboutism" as a way to always ignore criticism and do not accept responsibility for double standards and hypocrisy in the propaganda that they spread. Of course, this happens only for criticism against US and the west, never against non-aligned countries. Nobody creates a wikipedia post about "And what about Stalin/Tiananmen Square/Whatever" trying to take away importance from criticism against communist countries calling it a "demagogical trick" like described in the above wikipedia page.


> Curious... Soviet union were completely right when criticizing US for lynching black people...

...except they weren't criticizing. Much like in this case, their intention was to divert the attention on their cruel and inhumane practices by picking any distraction they could find out, with the goal of perpetuating their abuse without being subjected to criticism.

It's the same reason why nowadays you have Putin's regime posting bullshit about how the people of the UK and Germany are somehow suffering from hardship to deflect the attention from the impact that international sanctions is having in it's economy. The target and substance of their attacks is immaterial, and their goal is to divert attention.


This wasn't the impression I got from op. It's perfectly valid to point out that the u.s. is also guilty of the things it imposes sanctions on other countries for - I don't believe that the argument is being made that Cuba is blameless, just that if you're going to hold someone to a standard of behavior, you should first hold yourself to that standard.

As a u.s. citizen, this resonates. I'm deeply troubled by the fact that we've been led by war criminals in my lifetime who got off scot-free.

Mind you, I'm not defending Cuba's human rights violations - I agree that things should be done to mitigate those. However, we should clean our own house first.

It's also been posted elsewhere in this thread, that sanctions haven't appeared to be effective. I think it's hard to argue otherwise, especially if you believe that the awful-dictator situation still persists, as we've had Cuba under sanctions for a while now.


Yes this is an incorrect use of “whataboutism”.

It is supposed to mean the rhetorical trick of using other’s faults to distract from and normalize one’s own wrongdoing.

It is not a general defense against accusations of hypocrisy leveled by a third party.


So Okta and the US in general should also enforce similar sanctions on pretty much half of the planet, starting with Saudi Arabia. :o)


Since this post has blown up. Let me clarify my point.

The US has zero moral authority to impose sanctions based on violations of human rights while simultaneously violating human rights on a global scale.

Additionally, we have seen the effects of sanctions, the average people suffer even more, and the regime stays the same.

Arguably the people of Cuba are worse off after sanctions than before.


Cuba's biggest export is effectively doctors. But, sure, buy into decades old anti-communist propaganda!


> Cuba's biggest export is effectively doctors.

I find it highly amusing how "exporting people" is suddenly portrayed as being an achievement, as if being exploited as an indentured servant is something praiseworthy in the 21st century.

In other contexts this is referred to as human trafficking and exploitation, but being Cuba this is suddenly something to brag about?

I lived in a country where the national health service resorted to hiring cuban "doctors" to fill in vacancies in deserted areas. The Cuban regime ripped them off out of a big chunk of their pay, they had no right to work beyond the job program, the national certification board had to bend over backwards to allow cuban doctors to practice as all they had was a mere 4 year degree whose scientific basis was questionable, and their role in the healthcare service was basically triaging patients to hand over cases to other doctors.

The "Cuba exports doctors" myth doesn't hold to scrutiny. I guess that even Dr Nick Riviera is a godsend in third world countries where people have to walk for hours to get basic medical care, but let's not pretend that Cuba does not coherce undereducated professionals to play a role whose value-added is highly dependent on the development status of the country that pays for this service.


> is suddenly portrayed as being an achievement

It's not an achievement.

It's a sign of how hard the USA-based bullying had come so that a country cannot export goods or services so it has to export people.


> (...) so it has to export people.

It's indentured servitude. It's exploitation that treats the fellow man as nothing more than an exportable good whose role in life is to be abused to cater to the whims of despots.

You cannot deflect the blame of these subhuman practices onto foreign regimes just because you feel a specific oppressive regime that you support could use some extra cash.


I'm not defending Cuban regime, merely saying that USA had no problems dealing with other repressive regimes, and that Cuban regime would likely improve if it wasn't pressed in the corner by the USA.


> I'm not defending Cuban regime (...)

Well, except you are. You're trying to shift the attention away from Cuba's track record on human rights abuses by arbitrarily picking distractions that frankly you care nothing about, as if pointing out these distractions justified Cuba's long history of oppression and abuse.


> You're trying to shift the attention away from Cuba's track record on human rights abuses

The irony of complaining about human right abuses in Cuba and at the same time operating Guantanamo on Cuban land...


I just don't see how any amount of human right abuses excuses trying to exclude a sub-population of Earth from world economy.

That's trying to answer abuses with more and harsher abuses.


These doctors need to be taught a lot and don't even care about proper hygiene (or as one of them told me "we care about hygiene, it just means something totally different in Cuba"), and don't know the first thing about modern medical procedures using modern technologies and tooling. It's nothing like US or European medical schools - it's like they went to a medical-oriented high school at best. In Europe we just send them to the school again, they can't even skip years or subjects.


Cuban life expectancy is almost exactly equal to American life expectancy; likely better over the last two years, actually (https://www.cdc.gov/nchs/pressroom/nchs_press_releases/2022/...). They don't seem to be doing that badly at keeping folks alive.


American life expectancy is absurdly bad. I live in the places in Europe/EU where it's much higher, so to me it really is very bad (and yes we are making fun of US because of it too).


The life expectancy for an American man is only 73 years old? That's distressingly low for such a rich country!


Most of that is self-inflicted though. Lifestyle-related.

It's not a bad thing either, you can live your life like a saint and still die young of cancer. I think we're focused on physical instead of mental health too much sometimes.

If people like to live a certain lifestyle and know the risks, just let them.


Yes lets just swallow the Cuban propaganda that their medicine is somehow magical and more advanced that every other, and ignore the fact that their government have been surviving as a parasite from other countries, helping the dictators stay in power


Indeed, Cuba had more that 167000 covid deaths because they refuse to give its citizens foreign and proven vaccines. Trying to develop its own to profit selling it to another countries. of course they've failed. They refuse to provide scientific results that it's vaccines works. On top of that hospitals are empty of everything needed: no hygiene, no medicines, no even doctors because the government "exports" them for cash to other countries neglecting its own necessities and Doctors gladly agree to earn a bit more of the 50 USD dollars a moth they would earn working in cuba a MONTH


The US is pretty evil and sanctions on Cuba just affect regular people on the island and keep Florida politicians alive, but Cuba is way eviler. They don't export doctors, they do human trafficking for the enrichment of the communists and their families. Many of my friends were sent to Brazil and Venezuela as doctors, of the 3000 a month dollars the governments of these countries paid them, they only got $200 a month and the gov kept the rest while they were risking their life's in bad neighborhoods and very isolated places in the Amazonas. Does this money go back to help the regular citizen? Nope, it goes to Castro's families and the other new commies that are in power now, there is more poverty, and there are very few hours of electricity in a day right now, there is hunger compared to or worse than Africa and Haiti, there is repression and incarceration of young people who are protesting regularly, including 16-year-old kids and young women. It's that the embargo fault, nope completely, there is no production of anything, communists steal everything for their own enrichment from the government companies. Their media brags about the doctor exports and being a medical potency, yet my mom spent 4 months in pain to see a doctor because all of them have been exported or young ones left the country. There are zero medicines and one person in my family almost died of COVID if they didn't move fast and bribe the hospital director with dollars and suddenly there was medicine. Did they help fight apartheid in Africa? Yep and that was nice but they sent people against their will there, people who were kids and were in the mandatory military service, if you refused to go they did acts of repudiation (https://en.wikipedia.org/wiki/Acts_of_repudiation) with your neighbors and got a job was hard or impossible after you said no. I still know people traumatized from that war.

Source: I was born and raised there my entire life, and just came from there last weekend.


It's vitally important that America defends Batista, the Czar, and the Shah.


It's called nation-building!!! The thing the CIA is best at, but still fail every single time ;)


I think if we're going to root-cause this, what really got the ire of the Americans was good old fashioned land reform after the revolution. They hate land reform, happened in Guatemala too.


C'mon, it's only been 60 years! /s


Okta just asked me to add a third authentication factor to my account. Now in addition to entering a password and authenticating via push notification I am also required to enter a code sent via SMS to the same phone that just answered a push notification. Sheer madness.


No, I think the sanctions came from expropriating US property without restitution.


Can the Hawaiians place similar sanctions on the US for doing the same thing?

https://en.wikipedia.org/wiki/Colonial_history_of_the_United... looks like it could get... expensive.


Absolutely they can try. But who will come to their rescue when the federal government comes to impose it's opinion?

Anyone can say anyone else is bad and "take action" against it. What matters is whether the rest of the world agrees with you or not.


Note: the "US property" in question here was basically all of the agricultural land in Cuba


oh, so when are they getting back the illegally occupied Guantanamo Bay?


So it turns out that when you outsource auth, you also outsource some of the governance on who can access your platform.

Isn't access control a set of patterns rather than a service? When did it stop being a core competency of web applications?


I think you're missing the point of okta. It's not for access control to your specific application. It's for companies to deal with many groups of users and on/off boarding easily.

It transforms "Andy is andy@foo on service A, AndyA on service B, aaaandy on service C, maybe has two factor enabled on some of them and hopefully hasn't joined other groups to give them access" into "Andy is andy@company in Okta and we can turn services on/off and set policies as needed".


> When did it stop being a core competency of web applications?

Turns out, login is surprisingly hard. It will be the first and most important focus point for attackers - SQL injections, DDoS attacks, captchas, griefers intentionally using wrong passwords to lock someone else out... with Okta and other products of its kind, all an application developer needs to do is to check some token.

Another huge part is that in the "old" world there was only one player for any kind of centralized authentication: LDAP. While there were and are multiple LDAP server implementations (OpenLDAP, MS AD, Samba and a bunch of smaller ones), only Microsoft's AD has a somewhat comfortable and usable management application - but even that is using old-school Windows UI and you need a MS desktop to manage it. Everyone else? Either use Apache Directory Studio, some barely working web management UI (phpldapadmin, GOsa) or heaven forbid plain LDIF files.

In contrast, working with anything of the "modern authentication" solutions is a breeze.


I’m curious to know if there are any oss alternatives for similar services.


Ory, Keycloak, Authelia and bunch of others come to mind if that's exactly what you're looking for.


If you just need oauth2 + openid connect, you can install a library from your Open Source package repository of choice.


keycloak


- "The Office of Foreign Assets Control ("OFAC") of the U.S. Department of the Treasury administers and enforces economic and trade sanctions based on U.S. foreign policy and national security goals against targeted foreign countries and regimes, terrorists, international narcotics traffickers, those engaged in activities related to the proliferation of weapons of mass destruction, and other threats to the national security, foreign policy or economy of the United States."

That last clause has also encompassed things like Hague prosecutors [0]. If your interpretation of these regulations depends on your assessment of the trustworthiness of the regulator, this is a very relevant datapoint.

Imagine major tech companies geoblocking United Nations offices. Is that far-fetched fantasy?

[0] https://www.hrw.org/news/2020/12/14/us-sanctions-internation... ("US Sanctions on the International Criminal Court")


E.g. United States have withdrawn their signature from International Criminal Court and will refuse (and actively oppose) being bound by ICC sanctions.


good. America answers to no one save herself.


Absolute hubris corrupts absolutely.


I am generally pro-regulation in my politics (police for the rich and powerful) but I agree that the power can be and is often abused. Just like regular police, firewalls should be built to prevent politicians from abusing regulations for political purposes.


My view on this from the United Kingdom: I have no vested interest in any of the territories listed nor do I support them in any way, but my business should not be subject to the whims of overseas powers and foreign policy.

In response to this announcement I've closed down my Auth0 experiments. I refuse to be held to US enforcement when I operate outside US jurisdiction. I know other SaaS will follow suit, but we have to oppose this somehow.

As far as I'm aware, the UK does not have any sanctions imposed against Cuba for example, so Auth0's active stance on this is inappropriate for those outside US border.


But isn't Auth0 a US-based company? In that case, they are obliged to implement US sanctions, regardless where their customers are located.

That applies of course to any US-based company, so in that case you would need to avoid touching anything that is based in the US. That may be possible in some cases, but if you rely on the third parties, it's almost inevitable to completely avoid US.


The USA has a recent history of imposing extraterritorial legislation. USAians are apparently unwelcome at UK banks; transferring money from the UK to the USA risks unwelcome attention from the IRS, even if you've done nothing wrong.

This damages US businesses more than it does overseas businesses. Sure, UK banks lose some US customers. But actually they didn't have to lose those customers; all they were required to do was exercise enhanced diligence over the sources of funds transferred to USA. The UK banks chose to eject those US customers, because it was cheaper.

I don't know what to do about this. I think US legislators like extraterritorial legislation because it looks strong, and because it has a certain flavour of "fixing the world". Most USAians don't have overseas financial interests, so aren't impacted. But, for example, my US half-sister declined her share of my late father's legacy, because importing it to the USA would have been too costly as well as too much hassle.


> so in that case you would need to avoid touching anything that is based in the US

This does not change much: a, say, French company is bound to follow US regulations anywhere (including in France, not to mention abroad) because the US would punish any interests of this company in the US.

This was the case with Iran, and with others.

If you are mid-to-small compared to the US/China, you are bullied.

If you are very small (like a blog or local newspaper) you may not give a fuck.


I don't think the French government care much because the EU gives them more bargaining power. If they were bound beyond political pressure then we'd have French or EU embargos against Cuba for the last 60 years. France doesn't stand alone nor does the UK despite leaving the EU, which is why I object to US foreign policy spilling over political borders via internet-based tech companies.


We (France) had contracts in Iran. The US decided that Iran is bad.

So far so good.

Then the US said that everyone must leave Iran, and if they do not, their presence in the US will be harmed and they will not be allowed to trade in USD.

We asked the EU for help. The EU said that this is really [bad|unfriendly|unethical|immoral|whatever] of the US to behave that way and that we are, collectively, definitely offended. But that they cannot help.

So we left Iran, together with the rest of EU companies.

---

This is just one example of the extraterritoriality that the US does, without any special concerns for international law or relations. One could say "[US|China]are big and strong so they rule", which is true. Not the kind of relationship I would like to have on a personal level.

We frown at bullies in everyday life, but accept this on a national scale.


The US only has this power because everyone relies on the USA to do everything. Stop relying on the US and we can stop caring about how the US treats the rest of the world.

Being gay is illegal in some parts of the world but my gay friends don't care because they don't do business with those countries, don't participate in any commerce that does business in those countries, etc. Your country will cease being bound by US law when you cease to rely on the US for whatever.


It's easier said than done. It would be good if USA would stop to push that reliance using its military power, economic power, media and soft power, open and covert intelligence operations with the only purpose to extend its power and influence around the world.

If USA starts treating other countries in a biblical "don't do to others what you don't like to be done to you" sense, the world would be a much better and safer place for everyone.


Possibly until they grow to a point where they have divisions in UK or EU, which I think is how Facebook/Google/Microsoft are set up but I could be wrong.

There's some choices in the market, and beyond the behemoths it is still possible to avoid the US. The challenge is finding one that isn't owned by a US company and will end up with the same restrictions (like Gigya is now owned by SAP) - but any company serious about security will do the due diligence and know who own who.


>I refuse to be held to US enforcement when I operate outside US jurisdiction. I know other SaaS will follow suit, but we have to oppose this somehow.

I'm in the US, and I'm not so sure I want to be held to US enforcement. Our government has always been a little wacky, but it's really stepped up the jiggery-pokery during the past, well, 20 years.

At this point it feels an awful lot like a past-their-prime pop star getting screechy and demanding about the brown M&Ms in the dressing room.


One thing I've always been curious about is why the opportunity created by this sort of thing doesn't seem to be taken advantage of.

To take Iran as an example: when US sanctions prevent Boeing or Airbus from selling to them, I can understand why Embraer doesn't step in and offer to supply planes, because they are afraid of secondary sanctions affecting their business with the rest of the world.

But tech isn't like aircraft production — building a GitHub, Okta or Auth0 clone is a chunk of work but hardly infeasible — hell, most companies routinely built a partial Auth0 clone in-house until not that long ago. Many still do.

So why don't we see alternatives pop up that don't block Iran? It's a niche, but you get the whole niche to yourself, and Iran is not a small market.

From a legal perspective you would set up somewhere like UAE where they have a good climate for business but regularly do business with Iran, so that part shouldn't be an issue.

Network effects are a factor, but when you're blocked from the popular platform, you have a bigger incentive than usual to consider the less-popular one.


In Iran there are alternatives to many services. There are domestic cloud providers, a domestic android marketplace, there was a domestic Apple marketplace (and will show up again when Apple opens the platform to alternative stores), alternative video sharing platform, etc.

Working in/with Iran has other difficulties in addition to sanctions. Iranian government has total control over what services from outside Iran are accessible to Iranians. They also use this control elaborately, in some fields whitelisting services rather than blacklisting them. So if you want to work with Iran from outside, you are always at the mercy of the government to block you.

If working from inside, you are under pressure to share people's private information with the government en masse. You have no way to resist that. The courts are puppets, price of resistance can be anywhere from takeover of your business, to prison, to death.

Oh and from outside, you have the problem of exchange rate: due to 40+years of 40+% inflation, what you earn from there cannot even cover your costs outside the country, unless you do the entire business from another country with similar economy.


You don't even need to jump through this many hoops - somebody from Iran can just do it. And maybe they do, but overall I don't think the market is that big. All of these companies operate globally because it's otherwise difficult to make a profit.

In other news, setting up businesses that go around US sanctions is not something the US will just wave off. Bullies don't accept their authority questioned.


> And maybe they do, but overall I don't think the market is that big.

Before Trump nixed the JCPoA, Iran had a firm order with Boeing for $16.6 billion worth of aircraft, and a firm order with Airbus for $25 billion worth of aircraft. Taken together, that's one of the largest aircraft orders of all time. Iran is not a small market.

> In other news, setting up businesses that go around US sanctions is not something the US will just wave off. Bullies don't accept their authority questioned.

Businesses in the UAE regularly trade with Iran (and Russia, for that matter) in the normal course of business.


Once Russia resolves their supply chain issues and market substitution on sanctioned inputs, Iran will be a big aircraft market for them. It's not widely known, but Russia has several new commercial jet designs in production.


SSJ-100 and MC-21, both obviously made mostly from imported parts. SSJ-100 is operational with limited success, MC-21 is closer to vaporware.


> building a GitHub, Okta or Auth0 clone

Because it is is not necessary. Setting up something like Github onsite takes 1 hour. Network effect really is overrated.

Where it hurts are payment systems, credit cards etc.. And there are alternatives.


Most of the time these sanctions are global in nature and various treaties that US has with different countries prevent companies in those countries also doing business with sanctioned nations.


Sanctions are absolutely not global in nature. Iran trades extensively with countries in the region.


Theoretically, anyone can do that. Why would people in Iran spend money on such a bespoke solution? Anyone who does that has to pay off other people too.


There are alternatives.

Problem is, that people think they are a grift.


Don’t offload authentication to third parties…

People didn’t learn their lesson from Facebook etc etc.


I’ll take SSO over manually logging into 8-10 company apps I use. If the team implementing an onprem SSS/IDP solution has deep domain knowledge and sys admin skills go for it. Had issues before and cloud based providers like Okta were much better, IMHO.


If Windows didn't turn into a shit-show post-Windows 7 I would prefer Active Directory over all of this mess. Log in once with your password or smartcard and that auth magically works across all applications without ever seeing a login screen or dozens of redirects to do the SAML flow, at least for internal tools. For external stuff, SAML/OIDC is kind of a necessary evil I think (I'm not sure if there's anything preventing external tools from interoperating with Kerberos).


Sheesh the redirects. My HSA bank has the most I’ve ever seen, even Safari screams sometimes about too many redirects.

Can you use AD on Chrome in Windows to login to a web app? Would it be for internal apps only?


Windows 11 is so much superior to 7 in every way.


Modern Windows has great improvements at the kernel level and OS internals but both the UI and general direction of the product (more focused on media consumption, services and the “attention economy”) is a massive downgrade.


This is very different than Facebook. This isn't a company that also happens to provide auth to get more tracking for their main product. The auth is the main service for okta and it's used by people making decision about whether they want to build this in-house or outsource it.


Sure it's their current offering. But they want to be an "Identity Platform". They have just proven they're a political platform too.

> Why are we blocking Users from access to Okta Service? > In support of our customers’ and Okta’s existing contractual obligations with respect to U.S. export control laws, Okta customers are not permitted to access the Okta Service (including the Auth0 Platform) from Cuba, Iran, North Korea, Syria, the regions of Crimea, Luhansk or Donetsk without prior approval from the U.S. Government. This restriction applies even if a User is temporarily visiting any of the aforementioned regions.

Total utter bs. Next they will start filtering your business, customers etc.. Then just stop all together, because there's always something not right within larger orgs.

> Can Okta handle these OFAC controls for me? > As a Customer, you are responsible for ensuring your own compliance with applicable laws. As outlined in the Okta Master Subscription Agreement, you must use the Okta Service in compliance with applicable laws.

How can you be responsible if you don't have the power to make decisions anymore? If they think they know better, they should face the consequences when something goes wrong (some north Korean login for example)

US export controls don't apply to other countries. Why don't they have foreign entities for this? Because even if they have, they don't want to, because they became a political vehicle. A political vehicle for the CEO who thinks he's smarter than anybody who has a different opinion or who wants more power/influence, or maybe some bribes, I mean lobbyists at the door.

These days everybody seems to be a politician, pro athlete, doctor, scientist, code, entrepreneur, etc.


Todd KcKinnon (CEO) :

> https://twitter.com/toddmckinnon/status/1544046909307752448 Things about abortion, inclusive blabla, political stuff

> https://twitter.com/toddmckinnon/status/1539642789864312834 gov identity, political stuff

He seems to have been corrupted right after his gov talk.

W E A K


There are two problems here

1) let a third party handle authentication (Code)

2) let a third party handle authentication (SSO)

Number 1: don't do that Number 2: Only do that if you are in control of SSO, or if you are very certain you won't have problems contacting the provider. (so not google in this case)


> Only do that if you are in control of SSO

In reality: you do this if TCO of doing it internally < TCO of doing it externally + risk. There's quite a few people who estimate the risk is worth it.


Wow, and here I thought Okta had split up their service into US and non-US, like many other big companies, but seems they have not, so now just because the US has some arbitrary list of who can be a user, everyone using Okta needs to follow that... Seems like the laws are a bit outdated and haven't really been updated for a global internet, hope we see some changes in that direction.


There’s nothing “outdated” here. The OFAC Controls being applicable to business done over the internet is not an unintended effect.


I think the reason he calls it outdated is the definition of "business" becomes murky when it comes to online services and SaaS companies. Does servicing an HTTP request that appears to come from a sanctioned country (based on unreliable GeoIP data) actually count as "business" for sanctions purposes?


The specific prohibitions vary by sanctions program, but there are some that prohibit companies from providing “services” and the answer as to whether that includes SaaS is right there in the name.

Companies are required to do due diligence to determine that they aren’t engaged in activities that are sanctioned. GeoIP is less than 100% accurate… but so is comparing first and last names. Unreliable data is not something inherently unique to the internet.


Multi-nationals have to exist in the Venn diagram of laws.

Which is problematic in a bunch of scenarios:

  - US foreign policy (note: I don't really want to stick up for a bunch of the countries/regions on that list).
 
  - Chinese (and other countries) with censored internet. 

  - GDPR reaching far further than the EU borders.

  - Badly written cryptography laws[0]

I don't really see a solution to this problem though. It's more of a problem when there is no transparency or ability to provide feedback and move democratic mechanisms toward "correct" solutions.

In the case of Okta/Auth0, however they've segmented their business (I use their EU region) they're still at the end of the day a US company with US board and directors. They can make a "service region" that respects EU laws because they don't contradict US laws (mostly), but there is nothing in EU laws mandating offering services to these regions. ¯\_(ツ)_/¯

[0]: https://www.eff.org/deeplinks/2018/09/australian-government-...


It does not matter. If there is business presence ini the US of a company (direct or indirect), this business will be used to punish unwanted operations outside the US.

If you have a US-Okta and a non-US Okta and both ultimately are "Okta", then if the non-US Okta does not follow US regulations, the US-Okta will take the whip.


I don't get it. If we're insisting that Crimea, Lugansk and Donetsk are Ukraine and the people are Ukranian, then why block/sanction people there who have no control over the situation?


Two reasons:

- To inconvenience the institutions of the occupier just in that area (Why just there? To avoid removing their incentives to change and to avoid crippling your own companies who provide a service there. If you sanction the occupier fully, they'll double down, perceive it as an escalation, and your own companies will be significantly hurt. They'll find an alternative, and once they do, they won't need your service any longer, so you lose leverage.)

- To frustrate the local populace so that even the milder ones have additional incentives to oppose the occupying regime.


Imagine if Russia occupies Ukraine by force. Following this logic, Ukrainians should now be persuaded (punished) so that they they find the will (as if they don’t already have it) to throw Russia out. The same people that we are helping and sending money and weapons to right now.


To make it unattractive to the current occupier.


Aren't companies just going to ban the entirity of Ukraine, due to it being easier than finding out if your clients are connected to Russia or in a Russia-controlled area, resulting in an outcome undesired by the Ukrainian gov?


My understanding is that the occupied areas of Ukraine generally have Russian telcos come and take over, so it would be as simple as blocking Russia the majority of the time.


It's sad that people in occupied regions of Ukraine are punished twice, by Russian government and by US government too.


I’ve seen videos where captured Russian soldiers are actually conscripts from the contested regions.

I would think they have a lot more to worry about than okta authentication.


Depending on the region, this may not be a problem. I (casually) saw that the Russian approval is big (>50%) in the eastern regions, so these conscripts may still be "the good ones" for the population of this region.


Yes, so these people will be more isolated and in information bubble of RU. They can't get messages from others to stay out of the streets/work where RU army grabs them and sends them as cannon fodder. From the videos I saw they are just pure cannon fodder for UA artillery positions identification.


They had plenty of time to move to whatever they prefer - unoccupied territories of Ukraine or legitimate territories of Russia. As far as I know they traveled both ways routinely but returned voluntarily every time.


People are attached to places they grew up, it's their home. Also poor people don't have much mobility. I remember when the war just started and one of the first shocking videos was of a mother with two sons and a dog shelled basically live stream on CNN. The father went at that time to DNR to help his sick mother. He did it out of his choice but he probably wasn't a separatist.


> As far as I know they traveled both ways routinely but returned voluntarily every time.

That's of course per-24-feb open russian invasion of those regions. There's been some people such as visiting their elder relatives during winter holidays and now stuck there.

I wouldn't say for removing ocuppied regions of Ukraine from the list but instead adding aggressor to it.


Not for long now. Just look at the large military successes Ukraine has achieved in the last few weeks.


Note how Russia is not on the list.


I don't understand the reason for that. Somehow it is OK to do business with Cuba which are not threatening anyone but not with Russia that is killing people en masse?


If killing innocent people is where you draw the line then you should stop doing business with the U.S.

Inb4 cries of whatboutism, no I'm just pointing out the hypocrisy.


Most still hope for return to "business as usual". Which IMO won't happen this decade, and probably next decade as well.

see Roblox, Valve (Steam), Cloudflare, Patreon and many more who didn't leave Russia: https://som.yale.edu/story/2022/over-1000-companies-have-cur...

^ Not on the same level as IBM working with Nazis, but still morally questionable


They probably don’t draw much revenue from those countries anyways. The dollar is pretty expensive there. Well, let’s send a gesture to the relevant customers then (including governments).


The national hate coming from the US is getting out of hand


That just hurts the businesses and people who're trying to find a way out of there. Okta and Auth0 will not be used by rogue state actors.


And so the fractured internet continues apace


So here's a good reminder for devs/startups on their free plans (I am using Auth0 on their free plan):

- Have a copy of all your users e-mail within your own infrastructure (DB)

- Have proper backups in place

- Verify regularly that your backups function correctly (backup AND restore)

In case your account get's deleted, you can rebuild from these.


low market cap out of those , high reward for okta/auth0. the fact that they use this to showcase their power is abhoring.


"In support of our customers’ and Okta’s existing contractual obligations with respect to U.S. export control laws, Okta customers are not permitted to access the Okta Service (including the Auth0 Platform) from Cuba, Iran, North Korea, Syria, the regions of Crimea, Luhansk or Donetsk without prior approval from the U.S. Government. This restriction applies even if a User is temporarily visiting any of the aforementioned regions."


Does anyone know Iranians real cyber attack capacities? There are a lot propaganda on both sides.

Do these sections even slow them down?

(Real question, please don't start a flame wars, I don't want this account to be disabled)


Wouldn’t these export control rules also apply to Microsoft AD?


Microsoft apparently has a whitepaper on this, but I'm not going to read it: https://devblogs.microsoft.com/azuregov/export-control-impli...


A very good question!


Tangentially related, but lately Okta's sales people are cold messaging random engineers on LinkedIn with spammy garbage. Fix your OKRs


"Pharoah Tutmoses III was the Pharaoh of the Exodus and deleted Moses from the Egyptian history"

our new Tutmoses is AUKUS + EU.

But the story repeats itself.


The terrorist state of Russia should be blocked too.


At the start of this year, I was in Cuba. While in Cuba, I opened my bank app to check my balance. Just that, not to make any transactions.

I am a EU citizen. I only have EU bank accounts. The app I used was of a EU bank. There are no EU sanctions against Cuba at this time or at the time I was there. I also have no relation to the USA, I was never there or have business there.

A few days after opening my bank app ( again, read only, no transaction ) I received a threatening email from my EU bank saying I might be in violation of sanctions and it is prohibited to use the bank in a list of jurisdictions ( basically the ones mentioned in the post minus the last thee ) and the bank reserves the right to terminate my account.

As you can imagine, this was very concerning. Fortunately nothing came of it.

But still, I find it ridiculous the bank threatened to close my account just for being in a country that, at least for the jurisdictions that concern me, is a normal country.

I have no doubt this was an automated message. The only thing that prevented my bank account from being terminated was the suspicious activity flag triggered the email handler and not the delete account handler.

I find this to be utterly dystopian.


Do you know that or do you assume that?

There are global trade and sanction contracts between USA and eu fyi and the financial sector is even more strongly regulated.


On the Cuba issue specifically the EU and Canada many years ago basically told the US to "f off." Way back in the 90s in the beginning of the Helms Burton act days. I know the US occasionally makes threatening but unenforceable noises, but I'm pretty sure the EU drew a firm line on US overreach on Cuba. The mechanisms behind the US trade blockade of Cuba are considered to breach the sovereignty of other nations.

(As a Canadian I've been to Cuba many times with no issues; however a friend's father worked for a nickel mining company and spent time there overseeing their operations in Cuba and he can no longer travel to the US among other things.)


There's no "blockade" of US against the dictatorial communist regime of Cuba, just an embargo. which is totally different. Proof of that is the thousand of Canadians that go to Cuba to have cheap sex with poor people including minors, something they cannot do on their country. With a blockade you could not do that. Basically the Cuban government is a mafia, that never pays back what it owes to other countries on top of intentionally impoverishing its own people and violation all sort of human rights there. making paper laws for the world while doing anything they want one on the inside to its slaves citizens. In Cuba you can go to jail for 30 years just for pacifically and silently protesting on the street with a t-shirt saying: "Patria y Vida"


The question isn't "does Cuba do shitty things?", though.

The question is a) "why is Cuba singled out over places like China that do similar (and often worse) shitty things?" b) "why are we ignoring decades of failure of the embargo to induce any meaningful change?"


Exactly. And I would add that the shitty things about regime in Cuba are somewhat contiguous with the previous shitty (Batista) regime. Both repressive. Both awful. The biggest appreciable difference is: American vs not-American (former Soviet) control/domination.

I think Obama at least sensed that the best way to get Cuba into a more functional state and better neighbour was to take the "but we're embargoed!" excuse away from the regime there. Trump undid that.

BTW the only time I came across sex tourism in Cuba, it was indeed a creepy guy with two young (probably minor) girls. In a cafe in Havana. But the guy was not Canadian, he was American. And repulsive.


Know or assume what? That the email was automated? Yeah, I mean I don’t know 100% but I highly doubt a human analysed the situation and typed an email.

What seems more likely to me is, a request came from my app to some bank server. The server detected the request coming from Cuba and flagged the account as having suspicious activity, that in turn triggering an automated message.

Maybe there was indeed a guy somewhere in an office who saw one request to my account coming from Cuba and decided to have some fun and said he’ll turn my account off. I don’t know. Whatever it is, it’s creepy it happened.


This is precisely why I would rather have my data tracked by China rather than the US. Only one of those would get other countries to fuck me over for some arbitrary reason.


Your experience illustrates what Bitcoin folks predict will happen with CBDCs.


[flagged]


I think if you want to take part in discussions like this you should either inform yourself a bit beforehand, or enter them with an open mind. Otherwise you’re going to blunder in with clown shoes on and make yourself look like a conservative talk radio show caller


You win man.

In the Soviet Union the intellectuals supporting communism revolution were the first sent to gulags.


It's very adult of you to concede defeat. And if I was promoting the Soviet Union then it would be a pretty harsh own on me ... if it was true. But the "kulaks" (the land-owning peasants) were the first sent to the gulags - not exactly a nice thing worth celebrating, but hey there we go.

Good news though, I wasn't promoting the Soviet Union! I was simply saying that you don't understand what Cuba was like before, during and after the revolution. And that you don't fully understand either side, where their allegiances lay (note: the Soviet Union had given up on Latin America and the Caribbean by that point... hmm), what their intentions were and how they intended to implement them.

It's actually really easy to learn about it, and basically everyone is in agreement as to how it all went down. It's nuanced, as is all of history, but you can definitely read about it and find out. You just can't be bothered - you've heard that it's a binary situation: that Cuba are the bad guys and the USA are the good guys and that's it.


[flagged]


We've banned this account for posting flamewar comments. That's not allowed here, and you've unfortunately been doing a lot of it.

Please don't create accounts to break HN's rules with.

https://news.ycombinator.com/newsguidelines.html


(you forgot to switch to your alt for the second comment btw)

No you're missing the point. You don't have to choose a side and go to bat for it. You don't have to defend Batista and reject Castro and what he originally wanted for the Cuban people (or vice versa!). You can understand what each side wanted during the conflict, read into what they did and who they were supported by (note: the Cuban population supported Castro). It's not binary - Castro wasn't a universally good person to be worshipped, far from it. That kind of flawless person never exists.

Take George Washington (yes yes, whataboutism I don't care). He stood up to the Brits, and kicked the fuck out of them. That's good! As a Brit I can say that's a fucking good thing to have done. And yet we can acknowledge he was a slaver who likely did a lot of shitty things in his life. That doesn't mean the USA is bad - it just shows you can't draw a nice clean good/bad line, it's messier than that.


It's a pretty easy defense when you look at the alternatives, as in who came before (Batista) and what the alternate-world versions of Cuba look like - it's doing incredibly well compared to other island nations in the Caribbean, despite being isolated from the entire world by the US blockade for the past 70 years. They even made their own coronavirus vaccine!

P.S. Fidel is dead, don't know if you've heard.


I'm a victim of communist Cuban regime and won't name here all my family has to suffer and endure under that system. People, companies and countries should not do business with dictatorial regimes, period. Regardless of any mental justification, is immoral and only support those regimes to continue exploiting and abusing its own people with your aid, greedy businessman. Then you go on with your life hypocritically saying that you care for others and care for the planet and blah blah. You only care for you and your money, you worth nothing.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: