I thought he's comparing the law in Iran with a similar law in the US (CAATSA I think?) directed at North Korea.
I'd feel only marginally more safe violating the US's equivalent law. Breaking sanctions means prison and, at least according to Amnesty, US prisons engage in torture pretty routinely.
I happen to know that two popular machine learning libraries (MLPack and Vowpal Wabbit) have merged pull requests from North Korea. I know this because I was teaching a class on open source software development to North Korean students in 2015 (at PUST, a university in North Korea), and this was the final project for two student groups. The pull requests got merged fine, and the country of origin was never an issue.
FWIW, I am an American citizen and former military officer with a top secret clearance. I never broke US law, and I never feared any retaliation from the US government.
I was going by this which states that "importing technology" is covered by sanctions.
If encryption can get classified as munitions export (which, pre 1992 it was) I could imagine a PR from NK can fairly easily be classified as "importing technology".
IANAL but if I was taking a risk averse approach like this Iranian dude then I'd err on the side of caution and not merge.
I certainly wouldn't want to try and establish case law that a PR is not importing technology, either, even if, say, the lack of a financial transaction meant it technically didn't count. It's playing with fire.
I'd have to look it up to be sure, but I believe US law only restricts dealings with North Korea that are political or commercial in nature. Merging a PR shouldn't qualify.
More importantly, in the US, there is at least some semblance of fairness in the judiciary. To be clear, I'm not saying "fairness always wins". Not even close. A criminal charge would entitle the defendant to a trial by jury, though, and I find it hard to believe that a jury would convict a teacher for merely collaborating with a student in an academic setting, regardless of the letter of the law.
I'd feel only marginally more safe violating the US's equivalent law. Breaking sanctions means prison and, at least according to Amnesty, US prisons engage in torture pretty routinely.
So, I probably wouldn't merge a North Korean PR.
Would you?