Gitlab considers not hiring SREs and Support Engineers in China and Russia(gitlab.com)
gitlab.com
Gitlab considers not hiring SREs and Support Engineers in China and Russia
https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555
554 comments
Thanks! We try to be transparent by default and even when it is difficult. I think the OP is a good example of something that is hard to be transparent about because the decision isn't obvious and it takes discussion to come to the best conclusion.
Congratulations on taking a step in the right direction, even if it is a very small step. Nobody else seems to take the threat seriously, somewhat excepting defense contractors of course.
I can understand being reluctant to deal with the full extent of the problem. Somebody from China, with a family in China and subject to Chinese law, does not cease to be a security threat by moving to the USA and getting a green card. This gets awkward.
It really is no surprise that valuable secrets of all types (private key, customer data, trade secret, insider info for trading, etc.) end up in other countries.
I can understand being reluctant to deal with the full extent of the problem. Somebody from China, with a family in China and subject to Chinese law, does not cease to be a security threat by moving to the USA and getting a green card. This gets awkward.
It really is no surprise that valuable secrets of all types (private key, customer data, trade secret, insider info for trading, etc.) end up in other countries.
I on the other hand think that splitting countries into allies and enemies is stupid. China is a huge country, and excluding a billion people from your company just because their government does questionable things sounds like a pretty bad idea.
If you are really concerned about the confidentiality of your data, don't store it unencrypted in some SaaS where every customer service rep has full access to all your data. At that point you're already so vulnerable that exluding potenential employees from a whole country is just pointless security theater that some suit with an MBA thought up to justify his position.
If you are really concerned about the confidentiality of your data, don't store it unencrypted in some SaaS where every customer service rep has full access to all your data. At that point you're already so vulnerable that exluding potenential employees from a whole country is just pointless security theater that some suit with an MBA thought up to justify his position.
> China is a huge country, and excluding a billion people from your company just because their government does questionable things sounds like a pretty bad idea.
People have to do what the state they live in and belong to orders them to do. That's part of the point of having a state. So if you can't trust a state you can't trust its people either.
> you are really concerned about the confidentiality of your data, don't store it unencrypted in some SaaS
I don't think dissolving the company is on the table.
People have to do what the state they live in and belong to orders them to do. That's part of the point of having a state. So if you can't trust a state you can't trust its people either.
> you are really concerned about the confidentiality of your data, don't store it unencrypted in some SaaS
I don't think dissolving the company is on the table.
> I don't think dissolving the company is on the table.
Zing! Solid line but it misses the point. As with any other data, you can encrypt source code. It's perfectly easy to envision a setup where Gitlab employees in country X can only see plaintext Gitlab data they could already see over the public internet.
Zing! Solid line but it misses the point. As with any other data, you can encrypt source code. It's perfectly easy to envision a setup where Gitlab employees in country X can only see plaintext Gitlab data they could already see over the public internet.
> People have to do what the state they live in and belong to orders them to do. That's part of the point of having a state. So if you can't trust a state you can't trust its people either.
So, I could say that American is sucks if I think Trump is sucks?
That is ridiculous. The first is that 'state is unauthentic' is a subjective speculation. And the most funny is that the conclusion 'people is unauthentic' is came from your first thought.
I can not say American is terrorist if Hillary wanna burn other country. Am I right?
So, I could say that American is sucks if I think Trump is sucks?
That is ridiculous. The first is that 'state is unauthentic' is a subjective speculation. And the most funny is that the conclusion 'people is unauthentic' is came from your first thought.
I can not say American is terrorist if Hillary wanna burn other country. Am I right?
If your world view is based on separating entities into good and bad, nuanced statements will appear ridiculous.
mschuster91(4)
In china, not from China. The former is easy to justify, and would affect even Americans of non Chinese descent. The latter would be incredibly difficult to justify, and could easily be seen as unwarranted discrimination.
Discriminating someone because of their Chinese ethnicity would be hard to justify but what about Chinese citizenship (especially if it's the only one) or ties to China like family living there? Those would make someone vulnerable to pressure by the Chinese government.
No. As long as someone has a green card or citizenship, who cares where their family lives? The only exception would be for national security clearances, and those affect Americans as well.
The argument made in the thread is that someone could be pressured by the foreign government into leaking sensitive information.
Where an employee's family lives seems like the single most important point to consider...
Where an employee's family lives seems like the single most important point to consider...
Is it legal for a private US company to apply (some of) the same tests used to determine national security clearances in its hiring decisions? Or is the government the only entity allowed to make decisions that way? I'm genuinely asking, I haven't thought about this conflict before.
Well, technically it is discrimination, but not racism. I.e. you can still hire a Japanese developer, and with a Chinese regime change you might be able to hire Chinese developers. However, federal law prohibits discrimination based on national origin. This is a touchy subject, but maybe this no longer makes sense? As burfrog pointed out, a Chinese employee living in America isn't free from Chinese control; the gov't will do bad things to his family if he gets a request for, say, information or access and doesn't comply. I'm hesitant to endorse allowing discrimination by national origin, but on the other hand, it doesn't make sense to allow the Chinese access to any kind of important data.
It doesn’t matter. As long as a security clearance isn’t required, discriminating based on notational origin is a big no no from an ethical perspective, even if it was legal.
I hope we learned our lesson during WW2.
I hope we learned our lesson during WW2.
> discriminating based on notational origin is a big no no from an ethical perspective
However, discriminating based on exposure to coercive pressure from aggressive and hostile foreign powers is probably OK, even if such exposure is heavily correlated with national origin. The key is that the discrimination must be based on an individual analysis of the applicant and his/her life circumstances.
It's not OK to blanket deny any person of Chinese ancestry.
Denying such a person access to sensitive data or positions might be OK, however, if that person is exposed to coercive threats by, e.g. having family located in a jurisdiction known to use its power over expatriates' families as leverage to recruit sources and agents.
So long as the intent is genuinely to serve a compelling interest in protecting against security threats and the vetting policy is as narrowly tailored as possible to minimizing insider risk from applicants with vulnerability to certain threat actors, I think such a policy could pass ethical and (IANAL) maybe legal muster.
However, discriminating based on exposure to coercive pressure from aggressive and hostile foreign powers is probably OK, even if such exposure is heavily correlated with national origin. The key is that the discrimination must be based on an individual analysis of the applicant and his/her life circumstances.
It's not OK to blanket deny any person of Chinese ancestry.
Denying such a person access to sensitive data or positions might be OK, however, if that person is exposed to coercive threats by, e.g. having family located in a jurisdiction known to use its power over expatriates' families as leverage to recruit sources and agents.
So long as the intent is genuinely to serve a compelling interest in protecting against security threats and the vetting policy is as narrowly tailored as possible to minimizing insider risk from applicants with vulnerability to certain threat actors, I think such a policy could pass ethical and (IANAL) maybe legal muster.
I disagree completely. By that reasoning, a presidential candidate of Chinese descent who was a natural born American citizen but had relatives back in china would be disqualified, and that is nowhere justified by the constitution. A private company likewise shouldn’t be able to discriminate on speculative threats alone. What if they had a relative in prison, a hostile coercive environment by any measure?
I accept that I do not qualify for a high security clearance because I’m married to a Chinese national. I don’t think that should have any bearing on any other jobs that don’t require such clearances (nor my wife nor my son should be subject to such restrictions).
I accept that I do not qualify for a high security clearance because I’m married to a Chinese national. I don’t think that should have any bearing on any other jobs that don’t require such clearances (nor my wife nor my son should be subject to such restrictions).
> By that reasoning, a presidential candidate of Chinese descent who was a natural born American citizen but had relatives back in china would be disqualified
Not so. The Constitution is very clear on eligibility requirements for the President. A natural born American citizen of Chinese descent who otherwise satisfies the requirements in Article II, Section 1, Clause 5 is perfectly eligible to run for the office. If there is concern about potential leverage foreign states have over that candidate--as there rightly would be if our natural born American had close family in PRC--voters might vote for someone else. My position is that such a motivation on the part of the voters is ethical.
> I accept that I do not qualify for a high security clearance because I’m married to a Chinese national. I don’t think that should have any bearing on any other jobs that don’t require such clearances (nor my wife nor my son should be subject to such restrictions).
First, I agree that your or your son's relationship to a Chinese national should not be sufficient grounds to deny you or your son any given job. My position is that a narrowly tailored policy to reject candidates with high risk of coercion from sensitive positions, or to limit such employees' access to sensitive data, is probably OK. Having close family residing in PRC unfortunately does raise the risk of coercive pressure being applied. If your wife has no surviving close relatives in PRC and she never goes to visit, you and your son should be assessed to have no greater vulnerability to coercion than any other citizen with otherwise similar circumstances (debts, addictions, etc.).
Second, I am curious why you disagree completely, yet accept that your relationship with your wife may disqualify you from holding a government security clearance. That means you accept that the government has an interest in protecting classified information from foreign powers, and that your relationship raises your risk profile. Do you not accept that private companies have an interest in protecting their IP and customer data from theft or sabotage? Or do you not accept that your relationship also raises your risk profile for these positions? Just because a position may not require a clearance does not mean that position is not highly sensitive to a potential insider threat. And unfortunately the PLA's targets are not restricted to intelligence agencies; they target virtually every sector of our economy.
Not so. The Constitution is very clear on eligibility requirements for the President. A natural born American citizen of Chinese descent who otherwise satisfies the requirements in Article II, Section 1, Clause 5 is perfectly eligible to run for the office. If there is concern about potential leverage foreign states have over that candidate--as there rightly would be if our natural born American had close family in PRC--voters might vote for someone else. My position is that such a motivation on the part of the voters is ethical.
> I accept that I do not qualify for a high security clearance because I’m married to a Chinese national. I don’t think that should have any bearing on any other jobs that don’t require such clearances (nor my wife nor my son should be subject to such restrictions).
First, I agree that your or your son's relationship to a Chinese national should not be sufficient grounds to deny you or your son any given job. My position is that a narrowly tailored policy to reject candidates with high risk of coercion from sensitive positions, or to limit such employees' access to sensitive data, is probably OK. Having close family residing in PRC unfortunately does raise the risk of coercive pressure being applied. If your wife has no surviving close relatives in PRC and she never goes to visit, you and your son should be assessed to have no greater vulnerability to coercion than any other citizen with otherwise similar circumstances (debts, addictions, etc.).
Second, I am curious why you disagree completely, yet accept that your relationship with your wife may disqualify you from holding a government security clearance. That means you accept that the government has an interest in protecting classified information from foreign powers, and that your relationship raises your risk profile. Do you not accept that private companies have an interest in protecting their IP and customer data from theft or sabotage? Or do you not accept that your relationship also raises your risk profile for these positions? Just because a position may not require a clearance does not mean that position is not highly sensitive to a potential insider threat. And unfortunately the PLA's targets are not restricted to intelligence agencies; they target virtually every sector of our economy.
> Second, I am curious why you disagree completely, yet accept that your relationship with your wife may disqualify you from holding a government security clearance.
This has to do with companies making their own rules about what is right or wrong without any checks, balances, or voter feedback. Security clearances are actually defined by law, I’m against corporations becoming their own extra judicial entities.
This has to do with companies making their own rules about what is right or wrong without any checks, balances, or voter feedback. Security clearances are actually defined by law, I’m against corporations becoming their own extra judicial entities.
> This has to do with companies making their own rules about what is right or wrong without any checks, balances, or voter feedback.
As far as I understand, companies are generally free to make their own hiring decisions, so long as they do not amount to discrimination against a protected class. That limitation, by the way, stems from federal legislation--so companies are very much not extra-legal entities operating without any judicial accountability. If a state or federal Congress decide to further regulate companies' hiring decisions, they are free to do so.
I don't understand what exactly you would like companies to do: Simply ignore potential security risks? Do you have a specific process you advocate should be used to evaluate risks? What different kind of restrictions on companies' personnel decisions would you like to see? Do you just have a problem with a focus on risk from family members in PRC as opposed to a broader vetting process where that is only one risk factor?
> Security clearances are actually defined by law
I am not sure that an exact formula for grant/deny decisions exists in statute. These decisions strike me as inherently subjective, although certain facts are obviously pertinent to the decision. I would be very interested to read the relevant laws and regulations, though, if you'd be so kind as to point me to them.
As far as I understand, companies are generally free to make their own hiring decisions, so long as they do not amount to discrimination against a protected class. That limitation, by the way, stems from federal legislation--so companies are very much not extra-legal entities operating without any judicial accountability. If a state or federal Congress decide to further regulate companies' hiring decisions, they are free to do so.
I don't understand what exactly you would like companies to do: Simply ignore potential security risks? Do you have a specific process you advocate should be used to evaluate risks? What different kind of restrictions on companies' personnel decisions would you like to see? Do you just have a problem with a focus on risk from family members in PRC as opposed to a broader vetting process where that is only one risk factor?
> Security clearances are actually defined by law
I am not sure that an exact formula for grant/deny decisions exists in statute. These decisions strike me as inherently subjective, although certain facts are obviously pertinent to the decision. I would be very interested to read the relevant laws and regulations, though, if you'd be so kind as to point me to them.
As long as companies are operating faithfully within the law, they’re free to do that. And you’re free to criticize it and boycott it.
Companies like Apple and others should be allowed to be concerned about theft of sensitive data just as much as the government. Just because it’s not a matter of national security doesn’t mean it’s okay.
Nobody here is trying to discriminate against a race. The problem is having ties to relatives living under a government that is known for making people disappear. The same would apply for a white person with many relatives there, etc.
Your argument of companies not being allowed to take cautionary steps against a foreign government doesn’t hold water.
Companies like Apple and others should be allowed to be concerned about theft of sensitive data just as much as the government. Just because it’s not a matter of national security doesn’t mean it’s okay.
Nobody here is trying to discriminate against a race. The problem is having ties to relatives living under a government that is known for making people disappear. The same would apply for a white person with many relatives there, etc.
Your argument of companies not being allowed to take cautionary steps against a foreign government doesn’t hold water.
> I’m against corporations becoming their own extra judicial entities.
They already are, with most disputes being settled with Binding Arbitration rather than via the court systems.
Others have already pointed out though, that a company needs to act in its own interests and one of the things it would certainly find interesting is whether an individual is capable of being coerced into sabotaging/sharing corporate trade secrets.
They already are, with most disputes being settled with Binding Arbitration rather than via the court systems.
Others have already pointed out though, that a company needs to act in its own interests and one of the things it would certainly find interesting is whether an individual is capable of being coerced into sabotaging/sharing corporate trade secrets.
> By that reasoning, a presidential candidate of Chinese descent who was a natural born American citizen but had relatives back in china would be disqualified
If large numbers of voters felt that, then they would never get elected.
> nowhere justified by the constitution
The voters are entitled to vote however they like; that's implied by the constitution.
> I accept that I do not qualify for a high security clearance because I’m married to a Chinese national
Then you essentially agree with me.
> I don’t think that should have any bearing on any other jobs that don’t require such clearances
I agree. The question is, which jobs should require such clearances?
If large numbers of voters felt that, then they would never get elected.
> nowhere justified by the constitution
The voters are entitled to vote however they like; that's implied by the constitution.
> I accept that I do not qualify for a high security clearance because I’m married to a Chinese national
Then you essentially agree with me.
> I don’t think that should have any bearing on any other jobs that don’t require such clearances
I agree. The question is, which jobs should require such clearances?
The Title of Nobility / Emoluments Clause [1] and the natural born (and age) qualifier are fairly specific as to what the framers thought were overly corrupting influences for the office of president.
They notably did not include "or family".
The expectation presumably being that foreign powers were clearly enough signalled to tread carefully with regards to exerting pressure on government officials.
At high levels, that seems reasonable. At lower levels, where there's less scrutiny and less opportunity for diplomatic redress? "Reasonable" measures seem murkier.
[1] https://www.law.cornell.edu/constitution-conan/article-1/sec...
They notably did not include "or family".
The expectation presumably being that foreign powers were clearly enough signalled to tread carefully with regards to exerting pressure on government officials.
At high levels, that seems reasonable. At lower levels, where there's less scrutiny and less opportunity for diplomatic redress? "Reasonable" measures seem murkier.
[1] https://www.law.cornell.edu/constitution-conan/article-1/sec...
Constitutionally speaking, the President does not require a security clearance; the President ex officio has unlimited access to classified information. If there are concerns the President may be vulnerable to foreign influence, the constitutional processes to address those concerns are election and impeachment not security clearances.
Is it a constitutional principle that no secrets may be kept from the President? Or is it just that the “security clearance” system is currently based on executive orders that the President issues, rather than Congress exercising its power to “make Rules for the Government and Regulation of the land and naval forces"?
According to the Congressional Research Service, "By virtue of his constitutional role as commander-and-in-chief and head of the executive branch, the President has access to all national intelligence collected, analyzed and produced by the Intelligence Community"
Source: https://web.archive.org/web/20110113190609/http://feinstein....
I think if Congress tried to pass a law limiting the President's access to classified information, the Supreme Court would likely find it to be unconstitutional.
Source: https://web.archive.org/web/20110113190609/http://feinstein....
I think if Congress tried to pass a law limiting the President's access to classified information, the Supreme Court would likely find it to be unconstitutional.
True. Trump wouldn’t have qualified for high security access anyways just given his public relationship history, not even considering what an FBI clearances check would dig up.
The situation with presidential qualifications is one-of-a-kind special. Hiring at tech companies isn't spelled out in the constitution.
Constitutional requirements can also be changed, and it is long past time that we do so. The country has been around for 2.5 centuries, and now has hundreds of millions of people. We wouldn't suffer a shortage of presidential candidates if we required that all 4 grandparents (determined all possible ways) and all descendants and spouses have been born in the USA, along with all living ancestors and descendants of all of those. The job is simply too important to allow otherwise. (this would disqualify the most recent two, along with failed candidates like Romney and Cruz)
For tech companies we shouldn't be quite so extreme, but it also isn't good to ignore the problems.
Constitutional requirements can also be changed, and it is long past time that we do so. The country has been around for 2.5 centuries, and now has hundreds of millions of people. We wouldn't suffer a shortage of presidential candidates if we required that all 4 grandparents (determined all possible ways) and all descendants and spouses have been born in the USA, along with all living ancestors and descendants of all of those. The job is simply too important to allow otherwise. (this would disqualify the most recent two, along with failed candidates like Romney and Cruz)
For tech companies we shouldn't be quite so extreme, but it also isn't good to ignore the problems.
Here's a very clear restriction you're faced with: You could never become a Chinese citizen. Why must be pretend that it's ok for this to be entirely one-sided? We should give what we get, imo.
You can't assume what ethical choices a person will make, before they make them. A Chinese citizen in that situation might find a way to get their family out of China, or otherwise find a way to avoid the issue, or just flat out refuse. You can't just take it for granted that you can't trust someone without much more specific evidence. That's a very greasy slippery slope towards justifying highly constructed justifications for discrimination.
> So long as the intent is genuinely to serve a compelling interest
"Your honor, of course my intent was genuine ..."
Therein lies the rub ;)
"Your honor, of course my intent was genuine ..."
Therein lies the rub ;)
> I hope we learned our lesson during WW2.
You can rest assured that we did not, I have zero doubt that if there ever was another war at that scale we'd have internment camps for nationals of the enemy before the end of that war.
You can rest assured that we did not, I have zero doubt that if there ever was another war at that scale we'd have internment camps for nationals of the enemy before the end of that war.
Have you ever been to China? Such discrimination happens left, right and center. If you’re of an “acceptable” origin and have the right skin color, you might be ok...
I lived and worked in China for almost 10 years. I get that the foreigner glass ceiling is much lower there than here, and things like naked officials are actively discriminated against in government. That has nothing to do with the USA, however.
Well, it does. Because they will use your ethical values against you to slowly boil you like a frog in a pot 'til you find yourself in a concentration camp having your organs harvested. Sometimes bad things have to happen to prevent worse things.
Verwoed
and where it's different? look at distribution of people of color among boards of directors, senate etc.
[deleted]
Because there are less people of ethnic minorities than in the majority demographic. That’s why they’re called minorities. The key point is that they have a chance.
If a security clearance requirement suddenly makes it allowable it argues that it maybe isn't unethical, unless the argument is implicitly that it is ok to ask for unethical things when involving a security clearance?
> discriminating based on notational origin is a big no no from an ethical perspective
Yes it is. You know what's also a big no-no from an ethical perspective? Letting China win so they turn the world into a global dictatorship with concentration camps, organ harvesting and ubiquitous surveillance.
Sometimes you have to do a bad thing to prevent a worse thing.
Yes it is. You know what's also a big no-no from an ethical perspective? Letting China win so they turn the world into a global dictatorship with concentration camps, organ harvesting and ubiquitous surveillance.
Sometimes you have to do a bad thing to prevent a worse thing.
Depends "national security" is much more than defence industries back when I worked BT the team leaders on some projects where getting positively vetted for SC clearance - That's top secret in US terms.
Arguably now the FANGS are now CNI - which is going to suck if your on a H1B or Green Card.
Arguably now the FANGS are now CNI - which is going to suck if your on a H1B or Green Card.
Lessons are getting unlearned by concerning enterprise customers.
Yes, this is old school racism wrapped in company policy. Bigoted leadership in this country gives this kind of activity permission.
The wiser among us know historically garbage thinking when we see it.
The wiser among us know historically garbage thinking when we see it.
China seems to have noticed how accusations of racism, xenophobia and "white supremacy" are a very effective button to push to try and get western countries to act against their own interests.
The thing is, coming from a country that is practicing cultural genocide against various ethnic groups, we can probably take those accusations and survive.
The thing is, coming from a country that is practicing cultural genocide against various ethnic groups, we can probably take those accusations and survive.
Better place them all into internment camps. Just in case.
Are we seriously going 9066 here?
[deleted]
I never thought I'd see this level of xenophobia becoming widely acceptable in the United States. For everything educated Americans loathe about Trump, the one thing they've taken on board from him is fear of the Yellow Peril - which is probably the most dangerous aspect of his Presidency.
[deleted]
It’s not xenopohobia, it’s a hard problem. China actively exploits American tolerance for their own gain, and we have no good way to stem corporate espionage other than a blanket ban.
Even then, good old corruption of non-Chinese is still possible.
Even then, good old corruption of non-Chinese is still possible.
I'm sorry, targeting Chinese people on Green Cards is xenophobia. I'm not interested in whatever rationalizations are given for this sort of discriminatory behavior. The US is sadly headed down a path towards socially acceptable racial discrimination, justified by the new bogeyman - China.
The same argument would apply if the person was white and had many relatives in China. Or real estate, or other leverage that can be used against them.
You can’t ignore the fact that the PRC uses those things as leverage against people abroad in order to get information. Until that stops, what are companies and governments supposed to do? Roll over and allow espionage because we’re so tolerant?
You can’t ignore the fact that the PRC uses those things as leverage against people abroad in order to get information. Until that stops, what are companies and governments supposed to do? Roll over and allow espionage because we’re so tolerant?
I could use the exact same argument to propose banning Americans from GitLab. I'd also have much better empirical grounds for doing so, given how much is known about the extent of US espionage.
There's a growing hysteria in the US about China, which is leading to increasing signs of discrimination and harassment of Chinese people in the US. This sort of demonization of an entire country and the politics behind it (preservation of the US as the world's dominant power by containing China) are very dangerous. The thing that makes it most disturbing is the way people across the political spectrum have bought into the idea of the Yellow Peril, and are now okay with discriminatory policies, the trade war, and challenging Chinese territorial sovereignty.
There's a growing hysteria in the US about China, which is leading to increasing signs of discrimination and harassment of Chinese people in the US. This sort of demonization of an entire country and the politics behind it (preservation of the US as the world's dominant power by containing China) are very dangerous. The thing that makes it most disturbing is the way people across the political spectrum have bought into the idea of the Yellow Peril, and are now okay with discriminatory policies, the trade war, and challenging Chinese territorial sovereignty.
The ban applies to people living in China or Russia, not on chinese or russians.
Any american or european living in either country would similarly be affected by the ban. Untwist your knickers please.
Any american or european living in either country would similarly be affected by the ban. Untwist your knickers please.
It very quickly escalates to discrimination against Chinese people in the US, as evidenced by the highly upvoted comment I originally responded to. I'm sorry if I get my knickers twisted about people proposing an entire race of people pose a national security threat, but this sort of xenophobia has rarely gone well in history.
Chinese and Russians living outside of China and Russia will not be affected by the ban.
You keep calling it xenophobia even after you've been proven wrong when you claimed this is targetted at green-card holders. You are absolutely disengenuous and have no intention at good-faith discussion.
You keep calling it xenophobia even after you've been proven wrong when you claimed this is targetted at green-card holders. You are absolutely disengenuous and have no intention at good-faith discussion.
Read the GP comment, which says this is a good first step and then muses about expanding the ban to Green Card holders: https://news.ycombinator.com/item?id=21438366
I then suggest you edit out your erroneous personal attacks.
I then suggest you edit out your erroneous personal attacks.
I think the issue of a week ago was the harder one and I really commend you on walking that one back.
I just read your CEO page section about flaws and how to engage you about your flaws. On the topic of transparency, I'm curious if this has been working. Do people feel comfortable bringing them up? Is it helping you improve?
I'm eager to find ways to be a more transparent person at work. I want to eliminate "politics" and "games" where possible and for work to be Wysiwyg.
I'm eager to find ways to be a more transparent person at work. I want to eliminate "politics" and "games" where possible and for work to be Wysiwyg.
You mentioned https://about.gitlab.com/handbook/ceo/#flaws
I hoped that people would use the sentences I proposed on that page but that never happened.
What is helpful is that when people raise a concern I can recognize it more quickly and show them it is clearly my flaw. This doesn’t happen often but it happened last week.
I hoped that people would use the sentences I proposed on that page but that never happened.
What is helpful is that when people raise a concern I can recognize it more quickly and show them it is clearly my flaw. This doesn’t happen often but it happened last week.
If you don't mind me asking, why is this conversation open to comments from non-employees? Having discussions be publicly viewable seems valuable, but letting anyone at all participate seems disruptive and unhelpful (as an outside party, I was having trouble following the thread of employee discussion interrupted as it was by internet furor).
If an issue is public everyone can comment on it until it is locked. I don't think there is another setting.
[deleted]
Ot: "In an effort to improve our user['s] experience..."
Wait, am I to understand that this law says I cannot boycott doing business with businesses located in Israel?
I am in the US, so can not say, "I disagree with how the Israeli government is treating Palestine and thus don't want to do business with any entity located there."?
I am in the US, so can not say, "I disagree with how the Israeli government is treating Palestine and thus don't want to do business with any entity located there."?
If you're in the US, you can decide to do that. The law restricts your business with foreign entities that might engage in a boycott. The nuances of what might trigger these regulations are not always straightforward (look at https://www.bis.doc.gov/index.php/enforcement/oac/7-enforcem...) but normally you just have to avoid "bad words" in contracts, RFQs, etc.
I would note my understanding is that fines for non-compliance have historically been relatively light and therefore, to my knowledge, these regulations have not been seriously tested in court in recent times. (And the article I read suggested there was a causal link between those two facts.)
I would note my understanding is that fines for non-compliance have historically been relatively light and therefore, to my knowledge, these regulations have not been seriously tested in court in recent times. (And the article I read suggested there was a causal link between those two facts.)
Yeah, I also can't quite reconcile that.
I have a hard time believing that the government could do this but the way I read it says that if I said:
As a business, I disagree with the human rights violations the government of China is engaged in. I am again Saudis Arabia's ban of alcohol on its residents, its treatment of gay people--including death for simply being gay and the way it withholds rights from women. I also deplore Israel's treatment of the Palestinians, including the demolishing of houses.
Therefore, I will not allow my product to be sold in a way which results in any of these governments collecting tax on it, this supporting the government.
The way this reads, it seems the government can say, "Whoa, you can't to that to Israel though." and ignore the other two. Unfair and prejudicial in my opinion.
I have a hard time believing that the government could do this but the way I read it says that if I said:
As a business, I disagree with the human rights violations the government of China is engaged in. I am again Saudis Arabia's ban of alcohol on its residents, its treatment of gay people--including death for simply being gay and the way it withholds rights from women. I also deplore Israel's treatment of the Palestinians, including the demolishing of houses.
Therefore, I will not allow my product to be sold in a way which results in any of these governments collecting tax on it, this supporting the government.
The way this reads, it seems the government can say, "Whoa, you can't to that to Israel though." and ignore the other two. Unfair and prejudicial in my opinion.
> Wait, am I to understand that this law says I cannot boycott doing business with businesses located in Israel?
No.
That link the parent commenter shared is a very good overview: it basically means that your company will not receive special corporate tax consideration if your company:
Enters agreements to refuse or actually refuses to do business with or in Israel or with blacklisted companies.
Enters agreements to discriminate or actually discriminates against other persons based on race, religion, sex, national origin or nationality.
Enters agreements to furnish or actually furnishes information about business relationships with or in Israel or with blacklisted companies.
Enters agreements to furnish or actually furnishes of information about the race, religion, sex, or national origin of another person.
(e.g. “hey [anti-Semitic company], this competing businessperson is a Jew, if you were wondering”)
In any of these cases, there are exceptions and matters of interpretation.
Whether or not you think this is appropriate for the government, it's not as simple as “you can't engage in a boycott as a matter of personal conscience”.
No.
That link the parent commenter shared is a very good overview: it basically means that your company will not receive special corporate tax consideration if your company:
Enters agreements to refuse or actually refuses to do business with or in Israel or with blacklisted companies.
Enters agreements to discriminate or actually discriminates against other persons based on race, religion, sex, national origin or nationality.
Enters agreements to furnish or actually furnishes information about business relationships with or in Israel or with blacklisted companies.
Enters agreements to furnish or actually furnishes of information about the race, religion, sex, or national origin of another person.
(e.g. “hey [anti-Semitic company], this competing businessperson is a Jew, if you were wondering”)
In any of these cases, there are exceptions and matters of interpretation.
Whether or not you think this is appropriate for the government, it's not as simple as “you can't engage in a boycott as a matter of personal conscience”.
>your company will not receive special corporate tax consideration if your company:
>Enters agreements to refuse or actually refuses to do business with or in Israel
The link does actually include the penalties, which are far more than just losing special tax considerations. It includes hefty fines and even imprisonment under the TRA. The "just losing tax consideration" part is only under the EAR. I understand that part.
It's the fact that they say I cannot boycott Israel independently.
I'm still confused at how this can be fully Constitutional. Say I care a lot about the Palestinians and object to their treatment by the government and military of Israel. Say I make widgets wholesale for people to resell retail.
So I say, if you buy my product and resell it you make money and your government takes some of that money, as is normal. Therefore, I will not sell to any company that sells this in Israel as I do not want to my product to be used to make money for a government whose actions I condemn. I don't care if you are a Jew, a Christian, an Arab and/or even a Palestinian, if you want to sell my product in Israel and taxes which go to the Israeli government will be collected on that, I'm not selling it to you. Not just certain companies within Israel, all of them. Anyone who sells my product and thus makes money for the Israel government, nope, I'm not doing it.
That's the part I have a problem with. If I don't actively try to stop Israel from doing anything but want to take an active role in not helping them in any way, I'm breaking the law? I don't see if how I want to act independently the Arab League but what I want to do aligns with part of what they want to do, that is a problem? I should be able to not support what I see as a bad actor.
>Enters agreements to refuse or actually refuses to do business with or in Israel
The link does actually include the penalties, which are far more than just losing special tax considerations. It includes hefty fines and even imprisonment under the TRA. The "just losing tax consideration" part is only under the EAR. I understand that part.
It's the fact that they say I cannot boycott Israel independently.
I'm still confused at how this can be fully Constitutional. Say I care a lot about the Palestinians and object to their treatment by the government and military of Israel. Say I make widgets wholesale for people to resell retail.
So I say, if you buy my product and resell it you make money and your government takes some of that money, as is normal. Therefore, I will not sell to any company that sells this in Israel as I do not want to my product to be used to make money for a government whose actions I condemn. I don't care if you are a Jew, a Christian, an Arab and/or even a Palestinian, if you want to sell my product in Israel and taxes which go to the Israeli government will be collected on that, I'm not selling it to you. Not just certain companies within Israel, all of them. Anyone who sells my product and thus makes money for the Israel government, nope, I'm not doing it.
That's the part I have a problem with. If I don't actively try to stop Israel from doing anything but want to take an active role in not helping them in any way, I'm breaking the law? I don't see if how I want to act independently the Arab League but what I want to do aligns with part of what they want to do, that is a problem? I should be able to not support what I see as a bad actor.
Honestly, I also do not understand their wording on that.
Getting on board with foreign boycott is not ok that much is clear, but exercising your freedom of affiliation as a company is fine as long as it doesn't contradict US foreign policies. So if you don't want to contradict those you shouldn't boycott them if you don't your gov deciding that your decision is not independent. I mean you never know, but stranger things have happened. Just because of that I generally advise foreign entrepreneurs to think hundreds of times over before they go ahead to open their offices in US.
I also learned a lot and some of the employees made great points.
I’m wondering, can the US government legally issue a National Security Letter to an individual employee that forces them to comply and spy for them?
If they can, does this also mean the employee has no legal recourse since NSLs must be kept secret?
I’m wondering, can the US government legally issue a National Security Letter to an individual employee that forces them to comply and spy for them?
If they can, does this also mean the employee has no legal recourse since NSLs must be kept secret?
Arguably all of this has already happened, with the Lavabit case.
> can the US government legally issue a National Security Letter to an individual employee that forces them to comply and spy for them?
I don’t have a link I can share at the moment to prove this (I’ll update this comment if I find one), but at least in the case of an employee with a security clearance, it is my understanding they can be forced to comply with a US Government order without the ability to inform anyone at their employer (including corporate legal staff). I’m not clear if this order would have to come as an NSL or via another channel.
I don’t have a link I can share at the moment to prove this (I’ll update this comment if I find one), but at least in the case of an employee with a security clearance, it is my understanding they can be forced to comply with a US Government order without the ability to inform anyone at their employer (including corporate legal staff). I’m not clear if this order would have to come as an NSL or via another channel.
> If they can, does this also mean the employee has no legal recourse since NSLs must be kept secret?
No, because that would be unconstitutional. But the proceedings of objecting to a NSL similarly must be kept secret. There wouldn't be any point to the secret component of a NSL if the recipient could object and hash out the merits of the request in public court records.
No, because that would be unconstitutional. But the proceedings of objecting to a NSL similarly must be kept secret. There wouldn't be any point to the secret component of a NSL if the recipient could object and hash out the merits of the request in public court records.
So how would anyone ever know that the objection was 1) heard, and 2) upheld?
Welcome to the wonderfully paradoxical task of organizing and controlling secret services and jurisdictions in an otherwise democratic state.
Most countries do it by subordinating secret agencies to a military division of sorts, wherein martial courts and security access is already structural. Others choose a more 'civilian' approach subordinated to a parallel chain of command within the citizen government/legislation/judiciary — closer to police, interior dpt / homeland security, etc. (in such cases, army intelligence is usually quite distinct from civilian surveillance).
Which approach is favored historically by a country typically depends on pre-existing constitutional models and principles — notably how the army features relatively to the ultimate civilian chain of command, and how the latter is accountable to the (sovereign) public in the event of treason.
None of this applies in authoritarian regimes where the ruling caste or figure(s) usually answer to no principle (no courts for them, only 'advisors' for they sit above the law) and secret service is almost always directly answering to them, as part of the active coercion of the people (fear of the "enemy within", etc).
Most countries do it by subordinating secret agencies to a military division of sorts, wherein martial courts and security access is already structural. Others choose a more 'civilian' approach subordinated to a parallel chain of command within the citizen government/legislation/judiciary — closer to police, interior dpt / homeland security, etc. (in such cases, army intelligence is usually quite distinct from civilian surveillance).
Which approach is favored historically by a country typically depends on pre-existing constitutional models and principles — notably how the army features relatively to the ultimate civilian chain of command, and how the latter is accountable to the (sovereign) public in the event of treason.
None of this applies in authoritarian regimes where the ruling caste or figure(s) usually answer to no principle (no courts for them, only 'advisors' for they sit above the law) and secret service is almost always directly answering to them, as part of the active coercion of the people (fear of the "enemy within", etc).
[deleted]
I used to work for a company that had a public Jira bug tracker (security related bugs were hidden). I imagine a lot of customers had the same feeling you had: listing all bugs in a release, their status, the discussion around them, it was all there. Very transparent and very appreciated.
Unfortunately, like most good things in corporate software, it didn't last.
Unfortunately, like most good things in corporate software, it didn't last.
Red Hat has a public Bugzilla with (almost) all the open bugs in their software.
Public for their paying customers. Which is fair enough, but it’s also nothing particularly unusual.
Source: am a former RHEL customer now using Fedora
Source: am a former RHEL customer now using Fedora
It used to be open for most things. Doesn't seem to be that way for at least the last 6 months or so (may more).
Indeed, thanks GitLab for being so open about your bigotry. I wonder what would happen if GitLab started excluding say Israeli nationals, because a large number of companies that sell 0-days for profit are based there, I suspect that accusations of antisemitism would pour in from all corners & rightfully so, but since demonizing China has been cool since the USSR's collapse & Russia rejoined the club it never really left in the eyes of Americans, it's all good.
Disgraceful. GitLab was once an inspiration to me in terms of its openness & culture, but the recent moves around tracking and now this, make it clear that GitLab has been around for too long to stay a hero.
Disgraceful. GitLab was once an inspiration to me in terms of its openness & culture, but the recent moves around tracking and now this, make it clear that GitLab has been around for too long to stay a hero.
> it never really left in the eyes of Americans
Nice bigotry in a post complaining about bigotry.
Nice bigotry in a post complaining about bigotry.
Except when you look at Hollywood production, U.S TV news etc. that's exactly what you get. The Red Scare was a real thing, so was Russiagate. The anti-Chinese sentiment is very much real in the U.S. too, if the campaign rhetoric, current trade policies & the constant stream of accusations from newspapers of record are to be any indication.
Maybe I could have worded it better, but I am referring to American culture and the mindset that when you think 'anti-hero', it's going to be a Russian/Chinese most of the time.
Maybe I could have worded it better, but I am referring to American culture and the mindset that when you think 'anti-hero', it's going to be a Russian/Chinese most of the time.
[deleted]
From the website:
> forbidden from … Agreements to discriminate or actual discrimination against other persons based on race, religion, sex, national origin or nationality.
So, to be clear - GitLab can merrily discriminate against Chinese citizens of the US on national origin by themselves, but are breaking the law if they do the same under a joint venture with a non-US entity.
Bonkers.
> forbidden from … Agreements to discriminate or actual discrimination against other persons based on race, religion, sex, national origin or nationality.
So, to be clear - GitLab can merrily discriminate against Chinese citizens of the US on national origin by themselves, but are breaking the law if they do the same under a joint venture with a non-US entity.
Bonkers.
Check out the concept of "open startup": https://hackernoon.com/what-does-it-mean-to-be-an-open-start...
I'm shocked that they'd extend it to their lawyers. This thread (and the one the other day about telemetry and the GDPR) are a plaintiff and/or prosecutor's dream.
One of the hardest parts of most white collar prosecutions is proving that an action was taken "knowingly and willfully". Unlike other areas of criminal law, most white collar offenses require prosecutors to prove that not only did the person know they were doing the things they were doing, they had to know they were illegal.
Having the party's own lawyer offering legal advice outside the scope of privileged communication is normally windfall enough. Having them do it publicly and in the media's eye is just insane.
One of the hardest parts of most white collar prosecutions is proving that an action was taken "knowingly and willfully". Unlike other areas of criminal law, most white collar offenses require prosecutors to prove that not only did the person know they were doing the things they were doing, they had to know they were illegal.
Having the party's own lawyer offering legal advice outside the scope of privileged communication is normally windfall enough. Having them do it publicly and in the media's eye is just insane.
On the other hand, the discussion threads actually show that they have no idea what they are doing.
It's a good question what one could prosecute out of that and what to gain. There are so many open angles and I don't think there is any precedent with a fully opened company.
It's a good question what one could prosecute out of that and what to gain. There are so many open angles and I don't think there is any precedent with a fully opened company.
If we are so transparent about everything, can we know the name of that customer?
It's immoral to discriminate on the basis of fear, prejudice, and rumor.
One client can demand that Gitlab get rid of Chinese and Russian nationals today. Tomorrow, a different client can make similar demands - aimed at the nationals of different countries. This makes no sense whatsoever, and will blow out of control quickly.
Sanction programs are the established legal frameworks for such things: https://www.treasury.gov/resource-center/sanctions/programs/...
It's disappointing to see the promise of some money making the company go full 180 on its hiring and employment procedures - going as-far as potentially rescinding one employee's offer, and flagging another employee's personal choice to live in a different country as a risk.
The due process here is concerning. Some techbro starts by creating a "we need to block all Russian/Chinese" issue - followed by a bunch of echo-chamber "yessir" comments. When a legal advisor steps in - everyone tries to silence her and convince her it's just an "iterative process".
Finally - it actually looks like Gitlab's security practices are truly lacking. That an employee is Chinese/Russian shouldn't be a consideration - the systems should be tight enough to make sure absolutely no-one has access to customer data without consent - and that any actions taken are logged for auditing. Whenever necessary - pass your employees through a background-check. In sensitive (government) scenarios - restrict to employees with government clearance.
Honest question: Is Gitlab now a company not in a position to say "no"? Investors and potential customers need to know.
One client can demand that Gitlab get rid of Chinese and Russian nationals today. Tomorrow, a different client can make similar demands - aimed at the nationals of different countries. This makes no sense whatsoever, and will blow out of control quickly.
Sanction programs are the established legal frameworks for such things: https://www.treasury.gov/resource-center/sanctions/programs/...
It's disappointing to see the promise of some money making the company go full 180 on its hiring and employment procedures - going as-far as potentially rescinding one employee's offer, and flagging another employee's personal choice to live in a different country as a risk.
The due process here is concerning. Some techbro starts by creating a "we need to block all Russian/Chinese" issue - followed by a bunch of echo-chamber "yessir" comments. When a legal advisor steps in - everyone tries to silence her and convince her it's just an "iterative process".
Finally - it actually looks like Gitlab's security practices are truly lacking. That an employee is Chinese/Russian shouldn't be a consideration - the systems should be tight enough to make sure absolutely no-one has access to customer data without consent - and that any actions taken are logged for auditing. Whenever necessary - pass your employees through a background-check. In sensitive (government) scenarios - restrict to employees with government clearance.
Honest question: Is Gitlab now a company not in a position to say "no"? Investors and potential customers need to know.
Companies don't make decisions based on morality.
This is a question of liability. Gitlab's liability, based on whatever internal metrics being measured, would be significantly higher than the potential economic rewards of having employees in sensitive positions in these two countries--at the moment.
Also, on a side note, morality != legality. They're two different things. What is moral isn't necessarily illegal, and vice versa.
There's no need to beat up the strawman "techbro." It seems to me that this was a difficult decision to make and somebody had to make it.
Damned if you do; damned if you don't.
This is a question of liability. Gitlab's liability, based on whatever internal metrics being measured, would be significantly higher than the potential economic rewards of having employees in sensitive positions in these two countries--at the moment.
Also, on a side note, morality != legality. They're two different things. What is moral isn't necessarily illegal, and vice versa.
There's no need to beat up the strawman "techbro." It seems to me that this was a difficult decision to make and somebody had to make it.
Damned if you do; damned if you don't.
That was roughly the reading of this issue that I assumed initially too, but in fact the liability/reward situation is reversed here, I think.
GitLab are considering making this change in order to satisfy the requirements of a potential customer[0] - i.e. the reward is for adding the restriction.
And in turn, making the change itself could increase liability[1] since it doesn't seem to be based on a legal request or existing defensible GitLab policy.
[0] - https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not...
[1] - https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not...
The thread reads like a case of the compliance arm of the business trying to keep the ship steady and non-discriminatory (which is in-line with GitLab's stated goals, the intent of the law, and likely in-line with their prospects as a long-term global employer), while a sales part of the organization tries to close a deal.
Putting in additional engineering effort to allow the customer to specify their own policy on SRE/support access to data -- which they'd be responsible for defending if there were any questions -- seems like it might be a way forward. Whether the sales team and customer would wait for that is another question.
It's remarkable and very progressive to see this discussion in the open; it's also interesting to note how many side-discussions and different opinions emerge in the comments and in discussion here, while the core communication continues between a small number of participants in the merge request.
GitLab are considering making this change in order to satisfy the requirements of a potential customer[0] - i.e. the reward is for adding the restriction.
And in turn, making the change itself could increase liability[1] since it doesn't seem to be based on a legal request or existing defensible GitLab policy.
[0] - https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not...
[1] - https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not...
The thread reads like a case of the compliance arm of the business trying to keep the ship steady and non-discriminatory (which is in-line with GitLab's stated goals, the intent of the law, and likely in-line with their prospects as a long-term global employer), while a sales part of the organization tries to close a deal.
Putting in additional engineering effort to allow the customer to specify their own policy on SRE/support access to data -- which they'd be responsible for defending if there were any questions -- seems like it might be a way forward. Whether the sales team and customer would wait for that is another question.
It's remarkable and very progressive to see this discussion in the open; it's also interesting to note how many side-discussions and different opinions emerge in the comments and in discussion here, while the core communication continues between a small number of participants in the merge request.
> "Companies don't make decisions based on morality."
So let's just label every employee with a Foreign/Chinese/Russian background as a spy, because a client says so?
So let's just label every employee with a Foreign/Chinese/Russian background as a spy, because a client says so?
Why not? And Australians, they're explicitly (by law) required to be spies.
And your comment suggests as much - why would opsec about consumer / sensitive data be important unless you expect your employees to act in less-than-fair manner (be that for personal gain, a competitor's gain, a national gain, ...)?
And your comment suggests as much - why would opsec about consumer / sensitive data be important unless you expect your employees to act in less-than-fair manner (be that for personal gain, a competitor's gain, a national gain, ...)?
> "Why not? And Australians, they're explicitly (by law) required to be spies."
How come we don't see Gitlab re-considering hiring Australians then?
> "And your comment suggests as much - why would opsec about consumer / sensitive data be important unless you expect your employees to act in less-than-fair manner (be that for personal gain, a competitor's gain, a national gain, ...)?"
The defense industry will put you through background checks, demand a security clearance, and won't hire you unless you're a citizen - whilst simultaneously employing some of the strictest security measures available today. Security will stay there long after you've stopped hiring Chinese and Russian individuals.
How come we don't see Gitlab re-considering hiring Australians then?
> "And your comment suggests as much - why would opsec about consumer / sensitive data be important unless you expect your employees to act in less-than-fair manner (be that for personal gain, a competitor's gain, a national gain, ...)?"
The defense industry will put you through background checks, demand a security clearance, and won't hire you unless you're a citizen - whilst simultaneously employing some of the strictest security measures available today. Security will stay there long after you've stopped hiring Chinese and Russian individuals.
> How come we don't see Gitlab re-considering hiring Australians then?
I can't speak to GitLab specifically, but them restricting Australian hires too has been brought up numerous times in this HN thread. Given the amount of activity on here from their team members and specifically sytse, it would seem likely that they have at least been made aware.
I can't speak to GitLab specifically, but them restricting Australian hires too has been brought up numerous times in this HN thread. Given the amount of activity on here from their team members and specifically sytse, it would seem likely that they have at least been made aware.
> How come we don't see Gitlab re-considering hiring Australians then?
Because no company has asked them to yet. Give it time ;)
Because no company has asked them to yet. Give it time ;)
Dammit.. was hoping Australia could silently slip under the radar on this one.
The thing that I suspect that most people don't understand about Australia is that the laws don't really mean shit all unless the situation gets very serious very fast.
I know people who have received aa requests who have literally responded with "get fucked mate, why on earth would I do that?" and the response has (for every instance I'm aware of) been "yea, true. it was a bit of a stretch"
It's rather like the Australian constitution, I'm fairly sure I've seen a joke around about it, we have one but like... no one actually cares... if shit really hits the fan I'm sure we'll all go find a copy and figure it out, but otherwise we're doing only slightly less than alright just kinda playing it by ear...
The thing that I suspect that most people don't understand about Australia is that the laws don't really mean shit all unless the situation gets very serious very fast.
I know people who have received aa requests who have literally responded with "get fucked mate, why on earth would I do that?" and the response has (for every instance I'm aware of) been "yea, true. it was a bit of a stretch"
It's rather like the Australian constitution, I'm fairly sure I've seen a joke around about it, we have one but like... no one actually cares... if shit really hits the fan I'm sure we'll all go find a copy and figure it out, but otherwise we're doing only slightly less than alright just kinda playing it by ear...
> It's immoral to discriminate on the basis of fear, prejudice, and rumor.
Except for the fact that state-sponsored hacking and IP theft is a real thing. Your comment reads as naive and extremely uninformed. I would invite you to read the Huawei "Tappy" indictment [1] to understand the lengths that certain nations go to steal from US companies. Here we have a company that is literally offering cash bonuses to their employees for stealing IP.
> the systems should be tight enough to make sure absolutely no-one has access to customer data without consent
If you read the indictment, you'll realize that these rogue employees don't care about audit logging or any punishment that follows as a result of getting caught. In many cases, all they have to do is fly back to their country and they'll be rewarded and regarded as heroes for their loyalty to their country.
[1] https://www.justice.gov/opa/press-release/file/1124996/downl...
Except for the fact that state-sponsored hacking and IP theft is a real thing. Your comment reads as naive and extremely uninformed. I would invite you to read the Huawei "Tappy" indictment [1] to understand the lengths that certain nations go to steal from US companies. Here we have a company that is literally offering cash bonuses to their employees for stealing IP.
> the systems should be tight enough to make sure absolutely no-one has access to customer data without consent
If you read the indictment, you'll realize that these rogue employees don't care about audit logging or any punishment that follows as a result of getting caught. In many cases, all they have to do is fly back to their country and they'll be rewarded and regarded as heroes for their loyalty to their country.
[1] https://www.justice.gov/opa/press-release/file/1124996/downl...
> the systems should be tight enough to make sure absolutely no-one has access to customer data without consent - and that any actions taken are logged for auditing.
You haven't really done OpSec have you? There is very little absolutism in defining who gets access to what data. In fact barring nations that have historically shared data with their governments is exactly one step closer to how you would achieve this.
> Investors and potential customers need to know.
Says the guy hiding behind a throwaway (new?) account...
You haven't really done OpSec have you? There is very little absolutism in defining who gets access to what data. In fact barring nations that have historically shared data with their governments is exactly one step closer to how you would achieve this.
> Investors and potential customers need to know.
Says the guy hiding behind a throwaway (new?) account...
> "You haven't really done OpSec have you? There is very little absolutism in defining who gets access to what data. In fact barring nations that have historically shared data with their governments is exactly one step closer to how you would achieve this."
When was the last time you've contracted for a serious client? When it comes to tech - you don't implement "OpSec" by blanket banning hiring Chinese/Russian individuals. Disregarding your bizarre definition of "OpSec" - plenty of individuals with Chinese/Russian background are working for companies such as Google/Microsoft/Facebook/Uber - making significant contributions and getting paid vast sums of money for it. Those companies actually invest into background checks, have dedicated security teams, are investing into locking networks down and improving monitoring. It appears that Gitlab simply wants the easy way out, or, they can't afford to refuse the aforementioned client's offer.
When was the last time you've contracted for a serious client? When it comes to tech - you don't implement "OpSec" by blanket banning hiring Chinese/Russian individuals. Disregarding your bizarre definition of "OpSec" - plenty of individuals with Chinese/Russian background are working for companies such as Google/Microsoft/Facebook/Uber - making significant contributions and getting paid vast sums of money for it. Those companies actually invest into background checks, have dedicated security teams, are investing into locking networks down and improving monitoring. It appears that Gitlab simply wants the easy way out, or, they can't afford to refuse the aforementioned client's offer.
> When was the last time you've contracted for a serious client?
Uhh, today? I have about 20 on-going contracts with "serious clients", which include manufacturers, distributors, software companies, etc. What's your point?
> When it comes to tech - you don't implement "OpSec" by blanket banning hiring Chinese/Russian individuals. Disregarding your bizarre definition of "OpSec"
Banning hiring from countries isn't an exclusively isolated tactic for executing OpSec...I'm not sure why you implied that.
> Those companies actually invest into background checks, have dedicated security teams, are investing into locking networks down and improving monitoring.
Those companies all have physical presences in those countries. Gitlab does not. BIG DIFFERENCE.
Uhh, today? I have about 20 on-going contracts with "serious clients", which include manufacturers, distributors, software companies, etc. What's your point?
> When it comes to tech - you don't implement "OpSec" by blanket banning hiring Chinese/Russian individuals. Disregarding your bizarre definition of "OpSec"
Banning hiring from countries isn't an exclusively isolated tactic for executing OpSec...I'm not sure why you implied that.
> Those companies actually invest into background checks, have dedicated security teams, are investing into locking networks down and improving monitoring.
Those companies all have physical presences in those countries. Gitlab does not. BIG DIFFERENCE.
I believe “serious clients” meaning more towards to military/banking clients. The access to their production env is very strict, and the personnels are always being audited no matter their nationality and/or geolocation
I think you're being a bit disingenuous. It seems you're almost implying Chinese and Russians are being randomly discriminated against for no reason, as if the kind of thing Gitlab is worried about has never happened before. Specifically with people loyal to those two countries. Yes, it is discrimination, whether it is baseless discrimination is much more debatable.
If you look at the vetting processes in the defence sector they have strict nationality and background checks.
Why should the same not be true for something with a damage multiplier the size of github which is basically carrying a big chunk of commercial IP in private repos?
Why should the same not be true for something with a damage multiplier the size of github which is basically carrying a big chunk of commercial IP in private repos?
> "If you look at the vetting processes in the defence sector they have strict nationality and background checks.
Why should the same not be true for something with a damage multiplier the size of github which is basically carrying a big chunk of commercial IP in private repos?"
I'm all for background checks. Those at-least try to give everyone an equal opportunity - and if you fail them, you'll know why and have a chance to challenge the decision. There is a due process - as opposed to having some random techbro creating "need to get rid of {arbitrary nationality} asap" issues and having a bunch of random employees debating it...
If by having "nationality requirements" you mean "being a US citizen" - then Gitlab will lose 50% of its workforce overnight. The same will be true for many other tech companies. You make it sound like the defense sector is enjoying the strict employment regulations...
Why should the same not be true for something with a damage multiplier the size of github which is basically carrying a big chunk of commercial IP in private repos?"
I'm all for background checks. Those at-least try to give everyone an equal opportunity - and if you fail them, you'll know why and have a chance to challenge the decision. There is a due process - as opposed to having some random techbro creating "need to get rid of {arbitrary nationality} asap" issues and having a bunch of random employees debating it...
If by having "nationality requirements" you mean "being a US citizen" - then Gitlab will lose 50% of its workforce overnight. The same will be true for many other tech companies. You make it sound like the defense sector is enjoying the strict employment regulations...
The issue is not necessarily the background checks but the fact that you can be compelled by the state you reside in after the fact. For example the state could target known employees of GitHub after they are employed and checks passed.
I'm not suggesting any national correlation here. I suspect the same is true for Chinese and Russian companies too!
As for the defence sector it is not enjoying it, at least in Europe as the incoming staff into the sector are shrivelling up pretty rapidly.
I'm not suggesting any national correlation here. I suspect the same is true for Chinese and Russian companies too!
As for the defence sector it is not enjoying it, at least in Europe as the incoming staff into the sector are shrivelling up pretty rapidly.
Lol, our employees who have access to sensitive data cannot be citizens of:
- A country the country our company is based in is currently in war with.
- A communist dictatorship known for pressuring its citizens into stealing IP/corporate secrets abroad.
It's not arbitrary banning from foreign countries on your client's request if there's actually good reasons to take precautions with these nation-states.
And why not? They're a private company they can choose to employ whomever they want as long as they're compliant to local labour laws. There's no "due proccess" in business.
"Finally - it actually looks like Gitlab's security practices are truly lacking. That an employee is Chinese/Russian shouldn't be a consideration - the systems should be tight enough to make sure absolutely no-one has access to customer data without consent - and that any actions taken are logged for auditing. Whenever necessary - pass your employees through a background-check. In sensitive (government) scenarios - restrict to employees with government clearance."
Don't improve HR security practices because you're vulnerable in different ways anyways?
If you as a company simply don't trust the government your employees work under, you cannot trust them with sensitive information, even if they're outstanding trustworthy people.
It's not arbitrary banning from foreign countries on your client's request if there's actually good reasons to take precautions with these nation-states.
And why not? They're a private company they can choose to employ whomever they want as long as they're compliant to local labour laws. There's no "due proccess" in business.
"Finally - it actually looks like Gitlab's security practices are truly lacking. That an employee is Chinese/Russian shouldn't be a consideration - the systems should be tight enough to make sure absolutely no-one has access to customer data without consent - and that any actions taken are logged for auditing. Whenever necessary - pass your employees through a background-check. In sensitive (government) scenarios - restrict to employees with government clearance."
Don't improve HR security practices because you're vulnerable in different ways anyways?
If you as a company simply don't trust the government your employees work under, you cannot trust them with sensitive information, even if they're outstanding trustworthy people.
If it makes no sense whatsoever, why do you think it makes sense to some other people?
[deleted]
I am Chinese living in China. Nationalism is on the rise lately in China, not just for domestic reasons, but also as an reaction to nationalistic moves from "the West" like this one. It's a recurring theme, not just in governmental propaganda, but also in daily conversations, that "the West" would talk about fairness and justice then commit blatant discrimination and double standards.
As a founder of a tech company based in China, I benefit from US companies blocking Chinese (and Russian) engineers; still I am saddened by this. I hope they could come up with more intelligent policies to protect their OPSEC.
As a founder of a tech company based in China, I benefit from US companies blocking Chinese (and Russian) engineers; still I am saddened by this. I hope they could come up with more intelligent policies to protect their OPSEC.
Nationalism has always been high in China ever since the CCP took control. Not being a nationalist would be a good way to suddenly disappear off the face of the Earth.
China has always had double standards. They make it hell for U.S companies to do business there. The only thing that has changed is that the U.S has started pushing back somewhat as of late, but things are still currently in favor of China.
When China makes draconian laws like this: https://www.chinalawblog.com/2019/09/chinas-new-cybersecurit...
Is it really a surprise that companies that care about their customer privacy would be hesitant in dealing with China? Is it inconceivable that data breaches and unauthorized access of data/systems could happen through Chinese employees? These are some of the things you have to think about.
Maybe the Chinese government should look at the year (2019) and realize that personal liberties, sovereignty and privacy are important to the "west". If China is going to disrespect our important values, than what you are seeing in this Gitlab discussion is bound to take place for companies that are sensitive about protecting their customers.
China has always had double standards. They make it hell for U.S companies to do business there. The only thing that has changed is that the U.S has started pushing back somewhat as of late, but things are still currently in favor of China.
When China makes draconian laws like this: https://www.chinalawblog.com/2019/09/chinas-new-cybersecurit...
Is it really a surprise that companies that care about their customer privacy would be hesitant in dealing with China? Is it inconceivable that data breaches and unauthorized access of data/systems could happen through Chinese employees? These are some of the things you have to think about.
Maybe the Chinese government should look at the year (2019) and realize that personal liberties, sovereignty and privacy are important to the "west". If China is going to disrespect our important values, than what you are seeing in this Gitlab discussion is bound to take place for companies that are sensitive about protecting their customers.
>realize that personal liberties, sovereignty and privacy are important to the "west"
I think that Snowden showed us that this is not actually true. Things like National Security letters and the PATRIOT act make the US to me, as a European, seem very hypocritical right now.
I think that Snowden showed us that this is not actually true. Things like National Security letters and the PATRIOT act make the US to me, as a European, seem very hypocritical right now.
There was a huge backlash against the government after Snowden. And Snowden was an American who leaked classified government information for the good of the country. Our perception of Snowden is generally very positive. If what you are saying is right, this wouldn't be the case. You don't see many Chinese whistleblowers leaking the most classified information to the vast public, for example.
The patriot act was passed after 9/11 where the people were hurt and scared. There is backlast against the Patriot act too. Besides PRISM was a highly classified program because the people wouldn't be okay with that type of surveillance here in the U.S where the expectation of privacy isn't even a thing in China.
They are two totally different worlds.
The patriot act was passed after 9/11 where the people were hurt and scared. There is backlast against the Patriot act too. Besides PRISM was a highly classified program because the people wouldn't be okay with that type of surveillance here in the U.S where the expectation of privacy isn't even a thing in China.
They are two totally different worlds.
yes but where does Snowden now live?
You can't deny the hypocrisy here. While our citizens might support him they don't to the extent that they can pressure governments enough to allow him to return home.
You can't deny the hypocrisy here. While our citizens might support him they don't to the extent that they can pressure governments enough to allow him to return home.
Pressuring the government into action is hard and requires personal sacrifice. It would be amazing if we had the same vigor and care about our personal liberties as for instance the people of Hong Kong.
exactly. But if we really held civil liberties as a value we felt strongly about we'd do that, so we do a bit but not that much. :(
It’s not really hypocrisy if the people who are pro-Snowden are also anti-China. Citizens with opinions aren’t hypocrites because their current government’s policies have flaws.
[deleted]
Oh no, Snowden. I guess then all other world powers are equally as shitty as the US.
Search "false equivalence". Use Baidu. Or Yandex.
Search "false equivalence". Use Baidu. Or Yandex.
Yes, but I think the difference is that CCP is much further down the abuse road than Western governments.
First, they've had neighbor surveilling (snitching on) neighbor to control the people since Mao: it's part of the culture and fully accepted because they can't envision another way. They have a saying [ref needed] "Such a people deserve such a government." Now of course the whole tech stack supports it. We're just getting used to ubiquitous domestic surveillance in the West.
Second, because they've further along, they've used their control of information to abuse their power. Tibet, Tiananmen, organ harvesting, and more lately the Uighur atrocities against people of dissent or race. The West is not there but you can see we're blasting down that road now.
First, they've had neighbor surveilling (snitching on) neighbor to control the people since Mao: it's part of the culture and fully accepted because they can't envision another way. They have a saying [ref needed] "Such a people deserve such a government." Now of course the whole tech stack supports it. We're just getting used to ubiquitous domestic surveillance in the West.
Second, because they've further along, they've used their control of information to abuse their power. Tibet, Tiananmen, organ harvesting, and more lately the Uighur atrocities against people of dissent or race. The West is not there but you can see we're blasting down that road now.
It seems you can't mention ^ those keywords without the sensitivity brigade downvoting you.
> Things like National Security letters and the PATRIOT act make the US to me, as a European, seem very hypocritical right now.
These are not even remotely comparable. China is an outright police state. Not saying the United States doesn't have a lot of work to do with regards to personal liberty, but the Government here has nothing close to the iron grip control that the CCP has; they may want it, and what Government doesn't, but they don't have it and a ton of our internal legal mechanisms are designed specifically to prevent it.
These are not even remotely comparable. China is an outright police state. Not saying the United States doesn't have a lot of work to do with regards to personal liberty, but the Government here has nothing close to the iron grip control that the CCP has; they may want it, and what Government doesn't, but they don't have it and a ton of our internal legal mechanisms are designed specifically to prevent it.
Indeed. False equivalence is the oxygen of these discussions.
We should be able to discuss America's governance failures and problem areas without conflating them with horribly regressive models of governance.
We should be able to discuss America's governance failures and problem areas without conflating them with horribly regressive models of governance.
> Nationalism has always been high in China ever since the CCP took control.
Or since the Boxer Rebellion.
Or since before the Opium Wars. And probably even much earlier.
Or since the Boxer Rebellion.
Or since before the Opium Wars. And probably even much earlier.
Assuming you aren’t native Chinese or don’t have lots of friends in China, you don’t seem to understand what the parent said about nationalism rises. No China’s nationalism WAS NOT this high before, (the parade etc) you saw before is organized and it’s actually quite small considering the scale of China. Common people were normally cynical and only act patriotic at occasions where they really have to. Things are freaking different now with certified news from the US regarding trade war and the fact Trump can’t win the trade war. Normal people this time really become nationalist
Is there debate about this on the Chinese net? I'm curious because I don't know, but I imagine having a debate where people can genuinely criticize China would be difficult to conduct in the face of censorship and legal risk.
I ask because my experience across the Western net has been seeing lots of debate. This thread is a good example. I only see Chinese netizens appear in huge angry voting brigades, spamming threads with proclamations, denunciations and flimsy claims.
So I genuinely wonder; does vibrant and open debate take place somewhere? How/where could I see what such debates look like?
I ask because my experience across the Western net has been seeing lots of debate. This thread is a good example. I only see Chinese netizens appear in huge angry voting brigades, spamming threads with proclamations, denunciations and flimsy claims.
So I genuinely wonder; does vibrant and open debate take place somewhere? How/where could I see what such debates look like?
> I only see Chinese netizens appear in huge angry voting brigades, spamming threads with proclamations, denunciations and flimsy claims.
You will never see it anywhere on the internet, because from the very beginning your decision has been made. Anything you read will be morphed according to your belief. Anyone pro China on this site is immediately either labeled as brainwashed retards or paid shill. That's why there are no discussions, it's just your echo chamber.
You will never see it anywhere on the internet, because from the very beginning your decision has been made. Anything you read will be morphed according to your belief. Anyone pro China on this site is immediately either labeled as brainwashed retards or paid shill. That's why there are no discussions, it's just your echo chamber.
Nationalism in China is fueled by the Chinese media (i.e. the Chinese government) which control the message. The chinese government control the degree of nationalism in China like they turn the volume knob of a TV. They use it as weapon.
I agree to some extent, but that’s not the only reason. When earlier US sanctioned ZTE that almost stopped all IC tech blocked, instead of rising nationalism, the view of the future was very pessimistic inside China. However now common people realized US just use it as a leverage and it appears US can’t even make it happen. With multiple US retreats from the trade war, Chinese people are never been more confident in history
Complains about double standards in western media,points to double standards in Chinese media.
Whataboutism?
Whataboutism?
> They make it hell for U.S companies to do business there.
That's not evidenced by the massive presence of US companies in China. American companies do vastly more business in China than vice versa. Whenever I see these sorts of claims, I ask what specific restrictions or hurdles are being discussed.
That's not evidenced by the massive presence of US companies in China. American companies do vastly more business in China than vice versa. Whenever I see these sorts of claims, I ask what specific restrictions or hurdles are being discussed.
The U.S is a much bigger economy than China and that's one of the reasons why you see penetration from U.S companies in China. Just because there are U.S companies in China doesn't mean that what I said about the Chinese government making it hell to do business there is false. Your argument is not logically sound.
But as to your point, some of the things that make it difficult for western countries to do business there is the great firewall, draconian privacy laws https://www.chinalawblog.com/2019/09/chinas-new-cybersecurit...
and subsidies (both monetary and policy) from the Chinese government that make it almost impossible for foreign companies to compete against domestic companies.
But as to your point, some of the things that make it difficult for western countries to do business there is the great firewall, draconian privacy laws https://www.chinalawblog.com/2019/09/chinas-new-cybersecurit...
and subsidies (both monetary and policy) from the Chinese government that make it almost impossible for foreign companies to compete against domestic companies.
China’s economy is “much” smaller than the US by what metric? China and the USA are the top two economies by any measure (GDP, exports, imports, etc.) with both countries switching places as 1 or 2 depending on the metric.
For a counter example of GDP using Purchasing Power Parity where China is "much" bigger under this metric: https://en.wikipedia.org/wiki/List_of_countries_by_GDP_(PPP)
The difference between China/US in nominal GDP is much much greater than the difference in PPP. Secondly China is a known currency manipulator so I am inclined to pay less heed to the PPP. Finally the GDP per capita of China is absolutely dismal. Vast majority of the people there are not doing well and it's not a prosperous country. It's a third world country with vast majority of its citizens in poverty.
> subsidies (both monetary and policy) from the Chinese government that make it almost impossible for foreign companies to compete against domestic companies.
You keep saying this sort of thing, but yet, all sorts of foreign companies do booming business in China. The likes of Starbucks, KFC, Volkswagen, Intel, Boeing and Airbus absolutely dominate their respective markets in China. For a long time, Apple was crushing it in China (until Chinese consumers decided the quality/price ratio was too low).
> But as to your point, some of the things that make it difficult for western countries to do business there is the great firewall, draconian privacy laws
The privacy laws you're citing were only just passed about a month ago. They can't have been a hindrance before. The Great Firewall affects every business in China, both foreign and Chinese.
> Just because there are U.S companies in China
It's not just that there are a few US businesses here or there in China. Foreign businesses have an enormous presence in China. It's the most important single market in the world for a very large number of American and European businesses. If that's what business "hell" looks like, I can only imagine how great heaven is.
> The U.S is a much bigger economy than China and that's one of the reasons why you see penetration from U.S companies in China.
It depends on how you measure the size of an economy. In purchasing power parity units, the Chinese economy is larger than the American economy. Going by the exchange rate, it's smaller. The question of which economy is larger is actually ill-defined.
However, the reason why there's greater penetration of American companies in China than vice versa is that the US economy is more developed. There are simply many more leading companies in many sectors in the US. In the late 1970s, China began courting foreign investment, which meant courting foreign companies. Far from making life "hell" for those companies, the Chinese government tried to give them attractive conditions. Many foreign companies invested large sums in China, and made enormous profits out of those investments.
Now, for the first time, Western companies are facing peer competitors from within China, and you suddenly hear cries of how China is taking advantage of everyone. The crazy thing is how all perspective is lost. The massive presence of foreign companies in the Chinese market and the massive exploitation of cheap Chinese labor by foreign corporations are forgotten, and all we hear about are how it's supposedly impossible to do business in China.
You keep saying this sort of thing, but yet, all sorts of foreign companies do booming business in China. The likes of Starbucks, KFC, Volkswagen, Intel, Boeing and Airbus absolutely dominate their respective markets in China. For a long time, Apple was crushing it in China (until Chinese consumers decided the quality/price ratio was too low).
> But as to your point, some of the things that make it difficult for western countries to do business there is the great firewall, draconian privacy laws
The privacy laws you're citing were only just passed about a month ago. They can't have been a hindrance before. The Great Firewall affects every business in China, both foreign and Chinese.
> Just because there are U.S companies in China
It's not just that there are a few US businesses here or there in China. Foreign businesses have an enormous presence in China. It's the most important single market in the world for a very large number of American and European businesses. If that's what business "hell" looks like, I can only imagine how great heaven is.
> The U.S is a much bigger economy than China and that's one of the reasons why you see penetration from U.S companies in China.
It depends on how you measure the size of an economy. In purchasing power parity units, the Chinese economy is larger than the American economy. Going by the exchange rate, it's smaller. The question of which economy is larger is actually ill-defined.
However, the reason why there's greater penetration of American companies in China than vice versa is that the US economy is more developed. There are simply many more leading companies in many sectors in the US. In the late 1970s, China began courting foreign investment, which meant courting foreign companies. Far from making life "hell" for those companies, the Chinese government tried to give them attractive conditions. Many foreign companies invested large sums in China, and made enormous profits out of those investments.
Now, for the first time, Western companies are facing peer competitors from within China, and you suddenly hear cries of how China is taking advantage of everyone. The crazy thing is how all perspective is lost. The massive presence of foreign companies in the Chinese market and the massive exploitation of cheap Chinese labor by foreign corporations are forgotten, and all we hear about are how it's supposedly impossible to do business in China.
I tried to buy my $2.50 Old Spice deodorant in Shanghai. The price tag when translated to dollars was over $8.
If you are ever in China, go into a grocery store and look at the aisles. The main reason why American products are priced at 200%-300% the competition is because of tariffs. Tariffs designed to make ordinary middle class American products only affordable by rich elites. It's a very effective cap on market share.
If you are ever in China, go into a grocery store and look at the aisles. The main reason why American products are priced at 200%-300% the competition is because of tariffs. Tariffs designed to make ordinary middle class American products only affordable by rich elites. It's a very effective cap on market share.
> I tried to buy my $2.50 Old Spice deodorant in Shanghai. The price tag when translated to dollars was over $8.
This particular case is likely because the usage of deodorant is not a thing in China. The majority of East Asia doesn't have the body odor issue. It's a gene thing.
This particular case is likely because the usage of deodorant is not a thing in China. The majority of East Asia doesn't have the body odor issue. It's a gene thing.
I have no idea why Old Spice is expensive in Shanghai, but 200-300% tariffs are not the norm in China. The mean tariff is under 4%, according to the World Bank. I have noticed, however, that many people in China people hold foreign brands in high regard, and are willing to pay a premium for them.
1. https://data.worldbank.org/indicator/TM.TAX.MRCH.WM.AR.ZS?lo...
1. https://data.worldbank.org/indicator/TM.TAX.MRCH.WM.AR.ZS?lo...
> China has always had double standards. They make it hell for U.S companies to do business there
Here we go. "CCP is bad and China is bad, so every Chinese is bad". This kind of logic is not very healthy, it just like saying "Google(Or insert any company here) is bad, let's punish their employees", it will hurt those employees (way) more than it hurt Google.
Put the story into context, if Chinese engineers cannot find a job oversea, they will probably go back to China and contribute to a Chinese company that operate under CCP's rule. Will that be a good thing for you eventually?
I bet CCP is also counting on the rising nationalism in the US as well, to drive Chinese engineers back home with their valuable knowledge.
Here we go. "CCP is bad and China is bad, so every Chinese is bad". This kind of logic is not very healthy, it just like saying "Google(Or insert any company here) is bad, let's punish their employees", it will hurt those employees (way) more than it hurt Google.
Put the story into context, if Chinese engineers cannot find a job oversea, they will probably go back to China and contribute to a Chinese company that operate under CCP's rule. Will that be a good thing for you eventually?
I bet CCP is also counting on the rising nationalism in the US as well, to drive Chinese engineers back home with their valuable knowledge.
> I bet CCP is also counting on the rising nationalism in the US as well, to drive Chinese engineers back home
OP even mentioned that moves restricting hiring in China from US will help their Chinese based company.
> CCP is bad and China is bad, so every Chinese is bad
This is a very unfair summarization of the parent comment. They never implied that conclusion. Yes, the CCP is bad; And they control China and the Chinese people. But that does not say anything about the people themselves other then they are subject to the communist rules. It is a resistance to the CCP privacy practices that brings this change.
OP even mentioned that moves restricting hiring in China from US will help their Chinese based company.
> CCP is bad and China is bad, so every Chinese is bad
This is a very unfair summarization of the parent comment. They never implied that conclusion. Yes, the CCP is bad; And they control China and the Chinese people. But that does not say anything about the people themselves other then they are subject to the communist rules. It is a resistance to the CCP privacy practices that brings this change.
Curious as the way I see it it's very often China who is the 'initiator', eg internment of Muslims, stealing of territory in South China sea, debt-trap diplomacy, and so forth. Presuming that you are aware of these occurrences, do you agree with your government's positions and actions, and - if not - what actions, if any, do you take to make it clear your opposition?
The Chinese government is, IMO, massively over sensitive to any outside commentary or criticism, eg: https://www.abc.net.au/news/2019-10-31/china-warns-australia...
The Chinese government is, IMO, massively over sensitive to any outside commentary or criticism, eg: https://www.abc.net.au/news/2019-10-31/china-warns-australia...
You took this thread way into flamewar. Please don't do that again. We don't want any flamewars here, and certainly not nationalistic ones.
https://news.ycombinator.com/newsguidelines.html
https://news.ycombinator.com/newsguidelines.html
>Presuming that you are aware of these occurrences, do you agree with your government's positions and actions, and - if not - what actions, if any, do you take to make it clear your opposition?
I'm not from China and I disagree with the action of the China's government you listed above. However I wonder why this kind of opinion (aka the Chinese should be responsible for their government) is not commonly held against the USA?
The USA had invaded countries based on false pretext, toppling legitimate governments, and supported dictators all around the world. Why then, this "the Chinese are responsible for their authoritarian government" argument was not commonly held against the citizens of the USA, who supposedly live in democracy and therefore better equipped to actually change the situation?
I'm not from China and I disagree with the action of the China's government you listed above. However I wonder why this kind of opinion (aka the Chinese should be responsible for their government) is not commonly held against the USA?
The USA had invaded countries based on false pretext, toppling legitimate governments, and supported dictators all around the world. Why then, this "the Chinese are responsible for their authoritarian government" argument was not commonly held against the citizens of the USA, who supposedly live in democracy and therefore better equipped to actually change the situation?
Because the USA has an independent media that is very critical of its government while China doesn't (at least not on the scale as the USA's main stream media). I mean maybe if you're a conspiracy theorist you could say it's just controlled opposition or a distraction, but in the context of this argument at least the US media is unafraid to criticize or even just straight up mock the government and it's leaders, that has to count for something compared to China.
Considering the US media completely swallowed the WMD lies and that the most popular news outlet in America is Fox News (WTF) which has all the characteristics of a state run channel... the US media hasn't done a very good job of speaking truth to power.
The current Presidency has put some of these issues in sharper contrast, but the Iraq war was a total failure of the US media to do their job (IMO).
The current Presidency has put some of these issues in sharper contrast, but the Iraq war was a total failure of the US media to do their job (IMO).
I certainly wouldn't call them perfect, but again, being able to criticize the leader (whether that be Trump now with the left-leaning media or Obama previously with the right-leaning media) puts them head and shoulders above what China has. Hell, 50 years ago journalist reporting led to the resignation of the president, can you see anything even remotely close to that happening in China?
> However I wonder why this kind of opinion (aka the Chinese should be responsible for their government) is not commonly held against the USA?
Why do you think it isn't?
Why do you think it isn't?
Well, I at least try to be consistent, and do query my USA friends about the current administration and it's actions. Recent political changes in the USA have made it the norm to have similar populist leaders or parties gain strength all around the world, it's actually quite distressing for me to see.
Really aggressors project and victim blame as standard practice to justify themselves and their travesties. This goes back to Rome's war with Carthage and probably well before then.
Nationalists of all stripes get very angry when you point out their nation's crimes. Poland made outright illegal to point out that there were in fact Polish collaborators in the Holocaust for instance. It is true that the country was overwhelmingly the victim and Nazis were responsible but cutting off this self reflection only looks sinister. When 'face' culture is involved it seems to be further. Numerous sister city relationships were ended unilaterally by Japan for acknowledging the "comfort women" - ironically losing far more face internationally. Add in outright totalitarianism under a dictator and criticism is seen as an outright threat.
Nationalists of all stripes get very angry when you point out their nation's crimes. Poland made outright illegal to point out that there were in fact Polish collaborators in the Holocaust for instance. It is true that the country was overwhelmingly the victim and Nazis were responsible but cutting off this self reflection only looks sinister. When 'face' culture is involved it seems to be further. Numerous sister city relationships were ended unilaterally by Japan for acknowledging the "comfort women" - ironically losing far more face internationally. Add in outright totalitarianism under a dictator and criticism is seen as an outright threat.
Some prequel of the "initiation" https://zh.wikipedia.org/wiki/Template:%E6%96%B0%E7%96%86%E7...
why do you think Trump likes to talk about China?
He's more likely to talk about camps in China than he is about the homeless in Los Angeles. One is a problem completely out of his control, another is one he could easily mitigate. You wonder why that is?
He's more likely to talk about camps in China than he is about the homeless in Los Angeles. One is a problem completely out of his control, another is one he could easily mitigate. You wonder why that is?
I'm not American, and don't follow what Trump says or doesn't say that closely.
Myself, I do criticise my own government, protest on the streets, and also donate money to causes that work in opposition, mostly, to the current government. I've also made business decisions that involve much less interaction with mainland Chinese businesses and customers precisely because I disagree with the mainland Chinese governments way of doing things. Maybe it's cost me some money, but I sleep better at night.
Myself, I do criticise my own government, protest on the streets, and also donate money to causes that work in opposition, mostly, to the current government. I've also made business decisions that involve much less interaction with mainland Chinese businesses and customers precisely because I disagree with the mainland Chinese governments way of doing things. Maybe it's cost me some money, but I sleep better at night.
Trump never brings up human rights issues in China (or elsewhere), so your point is moot.
How do you expect a Chinese to respond to this kind of "Have you stopped beating your wife" questions?
Whether some of the view points are valid in the first place (at least the second or third one) is deeply contested to Chinese. If you're just parroting Western media view points without showing at least some understanding of Chinese view points, you will likely not get any genuine answers.
Whether some of the view points are valid in the first place (at least the second or third one) is deeply contested to Chinese. If you're just parroting Western media view points without showing at least some understanding of Chinese view points, you will likely not get any genuine answers.
I've lived in China for some time, and have sources of information other than just 'Western media'. Are you saying the article I linked in, for one example, is not accurate? Are you saying the UN is wrong with their information? I have no doubt the Chinese have a different point of view; they have much less complete information on the subjects I mentioned, and others.
But, yes, of course the point is that the poster likely isn't doing anything as they are partially funded by the Chinese government, and also are benefiting from all the aggressive actions their government is taking inside and outside of China.
But, yes, of course the point is that the poster likely isn't doing anything as they are partially funded by the Chinese government, and also are benefiting from all the aggressive actions their government is taking inside and outside of China.
It's very disputable whether or not China is "stealing" territory in the South China Sea or engaging in debt-trap diplomacy. The latter accusation is mostly hypothetical at the moment, based on a general fear that Chinese loans for infrastructure investment might in the future be abused to trap poor countries in debt.
More generally, what's the point of raising these accusations? When you speak to an American, do you demand that they apologize for their government's illegal invasion of Iraq (and the ensuing hundreds of thousands of deaths) or support for Sunni radicals in Syria?
More generally, what's the point of raising these accusations? When you speak to an American, do you demand that they apologize for their government's illegal invasion of Iraq (and the ensuing hundreds of thousands of deaths) or support for Sunni radicals in Syria?
To be fair they actually have beaten their wife into the hospital several times metaphorically - so it stops being a leading question so much as one which acknowledges the obvious.
Those who aren't outright dissidents seem to have an exceptionalism complex where Chinese X is different so no criticism can apply - combined with Not Invented Here syndrome. From what I have heard from those through VPN tunnels they are accutely aware that they aren't anything special.
Those who aren't outright dissidents seem to have an exceptionalism complex where Chinese X is different so no criticism can apply - combined with Not Invented Here syndrome. From what I have heard from those through VPN tunnels they are accutely aware that they aren't anything special.
As a chinese, this kind of comment makes me hate the west even more. I have no control over my government. Zero. 0. Do you understand the concept of 0? Thats the amount of influence I have over any government matter. And you people being racist pos because there is nothing I can do about my gov. Wtf do you want?
No one is criticizing the Chinese people who have zero control over their authoritarian government. The Chinese people are humans just like any other person on Earth, whether from America or Canada or Nigeria or India or anywhere.
When people criticize China, they are almost universally criticizing the Chinese government, because of their double standards, shady practices, lack of respect for individual privacy/sovereignty, ethnic cleansing in xinjiang.
I love the Chinese people, whereas I hate the Chinese government.
When people criticize China, they are almost universally criticizing the Chinese government, because of their double standards, shady practices, lack of respect for individual privacy/sovereignty, ethnic cleansing in xinjiang.
I love the Chinese people, whereas I hate the Chinese government.
CCP has succeeded in making the Chinese government an important part of Chinese people's identity. I've noticed even open minded Chinese people who have lived abroad for years tend to feel a little like insults on Chinese government are personal.
I am sorry that you think like that, but the government is nothing without its people. The moment you start saying there is nothing you can do is the moment you lose. Russian dissidents etc. Chinese middle-class is complacently trading freedom for comfort. American and European middle-class too, for that matter.
I feel it is really unfair to blame chinese individuals like this, can we blame American's for all of their terrible influences they have had around the world too then?
There is a difference between blaming someone for the actions of a government over which they have little control, and suggesting that it’s possible to work toward a better system. Nobody blamed the Civil Rights Movement for segregation; though they lived in a time when Jim Crow was law, they did all they could to defeat it.
I’d also suggest there’s a difference between acceptance of bad government action, even if you don’t or can’t actively oppose it, and active defense of such action.
I’d also suggest there’s a difference between acceptance of bad government action, even if you don’t or can’t actively oppose it, and active defense of such action.
It's only zero if you exclude actions that are unlikely to work while requiring great sacrifices and/or likely to get you killed. Of course, no one should blame you for not:
- Joining/founding an underground resistance group
- Distributing anti-government propaganda
- Rising through the ranks of the party until you're influential.
- Emigrating (This won't directly influence your government. But losing skilled workers (I assume you are one) harms the economy, making a revolution more likely.
- If that is not possible, being as unproductive as you can get away with.
- Becoming friends with high-ranking officials, then influence them.
- Protesting. You can technically make sure you won't get punished by setting yourself on fire.
> And you people being racist pos because there is nothing I can do about my gov. Wtf do you want?
No one's being racist here. The entity people don't trust is the Chinese government. Governments act through the people they govern so that distrust extends to your potentially involuntary actions (but not to your character). Note that Gitlab doesn't trust employees living in China independently of their ethnicity.
- Joining/founding an underground resistance group
- Distributing anti-government propaganda
- Rising through the ranks of the party until you're influential.
- Emigrating (This won't directly influence your government. But losing skilled workers (I assume you are one) harms the economy, making a revolution more likely.
- If that is not possible, being as unproductive as you can get away with.
- Becoming friends with high-ranking officials, then influence them.
- Protesting. You can technically make sure you won't get punished by setting yourself on fire.
> And you people being racist pos because there is nothing I can do about my gov. Wtf do you want?
No one's being racist here. The entity people don't trust is the Chinese government. Governments act through the people they govern so that distrust extends to your potentially involuntary actions (but not to your character). Note that Gitlab doesn't trust employees living in China independently of their ethnicity.
Who is being racist here?
Criticizing a government apparatus isn’t racist. I don’t know why every single time a westerner criticizes the PRC, they act like we hate all Chinese people.
Nobody here has a problem with Chinese people in general. Hopefully all of us can separate a nation’s people from their government... The problem is with the PRC’s government.
Criticizing a government apparatus isn’t racist. I don’t know why every single time a westerner criticizes the PRC, they act like we hate all Chinese people.
Nobody here has a problem with Chinese people in general. Hopefully all of us can separate a nation’s people from their government... The problem is with the PRC’s government.
"Nobody here has a problem with Chinese people in general"
The link this whole discussion is about is about banning Chinese people. Not the government, not even people that work for the government, just "Chinese people in general"
The link this whole discussion is about is about banning Chinese people. Not the government, not even people that work for the government, just "Chinese people in general"
...because of the PRC.
This whole discussion is because of the PRC, and having ties to family members living under the PRC.
This whole discussion is because of the PRC, and having ties to family members living under the PRC.
"I'm not against hiring black people, just those who live in areas controlled by gangs or have family members who live in these areas."
This is an apples to oranges comparison.
The ticket raised on gitlab is specifically about Chinese and Russian nationals, but this would also apply to Australians (they can be compelled, legally, to build backdoors upon request of the government). If I were in charge of a non-trivial company I certainly would not hire an australian national.
This same exact argument would apply for a white person from China who has family or other assets in China, and thus has leverage that can be used against them by the current totalitarian regime.
If the US government enacted a law similar to Australia where we could be compelled to build secret backdoors, then foreign companies probably wouldn't hire an American either.
This really has little to do with race, and everything to do with risk and governments. We would still be discussing a ban on hiring Chinese nationals even if China -weren't- almost completely homogeneous in race; it's basically irrelevant.
The ticket raised on gitlab is specifically about Chinese and Russian nationals, but this would also apply to Australians (they can be compelled, legally, to build backdoors upon request of the government). If I were in charge of a non-trivial company I certainly would not hire an australian national.
This same exact argument would apply for a white person from China who has family or other assets in China, and thus has leverage that can be used against them by the current totalitarian regime.
If the US government enacted a law similar to Australia where we could be compelled to build secret backdoors, then foreign companies probably wouldn't hire an American either.
This really has little to do with race, and everything to do with risk and governments. We would still be discussing a ban on hiring Chinese nationals even if China -weren't- almost completely homogeneous in race; it's basically irrelevant.
> As a chinese, this kind of comment makes me hate the west even more. I have no control over my government.
That right there is exactly the response your government would want you to have. You already 'hate the west', and now even more because of what I wrote? That seems unreasonable to me, and there was not one racist mention in my comment either.
If 'my' government (in Australia) were pulling these kind of stunts in 'my' name, damn right I would be doing something about it. In fact, I already do something about my community's shabby treatment of the First Australians (financially and lobbying wise).
I feel we, the people, have a responsibility to ourselves and other humans, irrespective of country of origin, culture or background, to resist and oppose transgressions by the governments who represent us.
That right there is exactly the response your government would want you to have. You already 'hate the west', and now even more because of what I wrote? That seems unreasonable to me, and there was not one racist mention in my comment either.
If 'my' government (in Australia) were pulling these kind of stunts in 'my' name, damn right I would be doing something about it. In fact, I already do something about my community's shabby treatment of the First Australians (financially and lobbying wise).
I feel we, the people, have a responsibility to ourselves and other humans, irrespective of country of origin, culture or background, to resist and oppose transgressions by the governments who represent us.
Please don't take HN threads further into political and nationalistic flamewar. This sort of rhetoric never leads anywhere interesting.
https://news.ycombinator.com/newsguidelines.html
https://news.ycombinator.com/newsguidelines.html
>I have no control over my government. Zero. 0. Do you understand the concept of 0? Thats the amount of influence I have over any government matter.
Then you should be more pissed off at your own government and screwed up system than the people who are pointing how that the system you live under is screwed up.
Then you should be more pissed off at your own government and screwed up system than the people who are pointing how that the system you live under is screwed up.
I think the question is, how much control do you want over your government? Do you want them doing this stuff? I come from a country with a stronger democracy than the US and governments will fall over stuff like human rights violations, if they don't properly punish the perpetrators.
>And you people being racist pos
In what way was the parent comment racist?
In what way was the parent comment racist?
You say that nationalism in China is a reaction to nationalism in the US when it is actually the other way around. After many decades of realizing China has engaged in unfair trade practices, IP theft, and predatory behavior despite maintaining innocence, US finally has to react. If someone keeps punching you and spitting in your face, how do you think they'll react eventually?
I don't expect Chinese natives to understand the full story because they aren't exposed to all the wrongdoings of their government and even if they are, they think it's justified because they selfishly believe in supremacy of their own race/country. Even your comment suggests that you have been led to believe US is the "bully". I have heard all the arguments from the Chinese about 100 years of humiliation, Opium wars, and how US did X, Y, and Z "bad things" without ever pausing and stepping out of their own shoes to look at their actions in an unbiased way or learning the truth of the facts. I guess you can't have a meaningful argument when your only sources are your government textbooks and fire-walled internet. Think about that.
I don't expect Chinese natives to understand the full story because they aren't exposed to all the wrongdoings of their government and even if they are, they think it's justified because they selfishly believe in supremacy of their own race/country. Even your comment suggests that you have been led to believe US is the "bully". I have heard all the arguments from the Chinese about 100 years of humiliation, Opium wars, and how US did X, Y, and Z "bad things" without ever pausing and stepping out of their own shoes to look at their actions in an unbiased way or learning the truth of the facts. I guess you can't have a meaningful argument when your only sources are your government textbooks and fire-walled internet. Think about that.
Do you have any suggestions as to what Western companies can do to prevent intellectual property theft and the Chinese government trying to pressure them into censoring non-Chinese citizens?
Because short of some effective alternatives, the Chinese government isn't really giving the West much of a choice here.
Because short of some effective alternatives, the Chinese government isn't really giving the West much of a choice here.
>It's a recurring theme, not just in governmental propaganda, but also in daily conversations, that "the West" would talk about fairness and justice then commit blatant discrimination and double standards.
Do you believe this move is a double standard? If America and the E.U. mirrored Chinese rules and practices for corporate governance, foreign investment, and political involvement in private enterprise, how would that look?
Do you believe this move is a double standard? If America and the E.U. mirrored Chinese rules and practices for corporate governance, foreign investment, and political involvement in private enterprise, how would that look?
Agreed; it's unfortunate to see companies considering acting this way. In this case it seems like GitLab are doing this for a single customer, so I'd bet it's caused by a desire to meet sales quotas and/or financial goals, rather than fundamental company strategy or policy.
Using that lens, this is a short-term financially-motivated attempt to change company hiring/access policy, which in turn provides justification for the anti-Western sentiment you mention.
In my opinion this is a restriction that should be the customer's responsibility to enact, if they choose to - which means that GitLab should pause and build access controls which allow the customer to configure (and ideally audit) who at GitLab has access.
What is excellent and commendable is that GitLab is able to have much of this discussion in the open; because at many other organizations, this would all have happened behind closed doors.
Using that lens, this is a short-term financially-motivated attempt to change company hiring/access policy, which in turn provides justification for the anti-Western sentiment you mention.
In my opinion this is a restriction that should be the customer's responsibility to enact, if they choose to - which means that GitLab should pause and build access controls which allow the customer to configure (and ideally audit) who at GitLab has access.
What is excellent and commendable is that GitLab is able to have much of this discussion in the open; because at many other organizations, this would all have happened behind closed doors.
Those people are completely brainwashed https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not...
I've noticed nationalism rising in China lately too.
It's easy to pay attention to difference between people and culture, as noticing difference is what we instinctively do, but it is also beneficial to notice our similarities too. We're all people. Besides minor cultural differences, we all respond in similar ways to the situations we are given throughout life.
>As a founder of a tech company based in China, I benefit from US companies blocking Chinese (and Russian) engineers; still I am saddened by this. I hope they could come up with more intelligent policies to protect their OPSEC.
btw, is it legal to read HN in China?
It's easy to pay attention to difference between people and culture, as noticing difference is what we instinctively do, but it is also beneficial to notice our similarities too. We're all people. Besides minor cultural differences, we all respond in similar ways to the situations we are given throughout life.
>As a founder of a tech company based in China, I benefit from US companies blocking Chinese (and Russian) engineers; still I am saddened by this. I hope they could come up with more intelligent policies to protect their OPSEC.
btw, is it legal to read HN in China?
resouer(1)
As a founder of a tech company based in China, you benefit from China blocking US (and the western world's) companies; You should be saddened by this. Can you please write a letter to Chairman Xi telling him he is wrong?
[deleted]
The article/policy isn't about blocking Chinese/Russian people, it's blocking people in China and Russia, or equivalenly blocking gitlab corporate from spreading into China/Russia.
Ok, that discussion made it clearer for me, and I am kind of behind @cciresi at that point:
https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not...
They have a customer that required the personal data they'll give to Gitlab not be handled by people living in Russia and China. Could be a group doing humanitarian or journalistic work.
That's actually an interesting conundrum: you want to hire a company, need to trust it for handling sensitive material, and can't afford it to fall between specific states' hands.
I don't think there is an objective process to do that. I know that USA and France and probably many other countries have laws to authorize seizure of data they consider linked to a variety of vaguely labeled activities (from "trouble to public order" to "terrorism"). You may end up excluding 80% of the world if you use objective criterion there.
https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not...
They have a customer that required the personal data they'll give to Gitlab not be handled by people living in Russia and China. Could be a group doing humanitarian or journalistic work.
That's actually an interesting conundrum: you want to hire a company, need to trust it for handling sensitive material, and can't afford it to fall between specific states' hands.
I don't think there is an objective process to do that. I know that USA and France and probably many other countries have laws to authorize seizure of data they consider linked to a variety of vaguely labeled activities (from "trouble to public order" to "terrorism"). You may end up excluding 80% of the world if you use objective criterion there.
Honestly I don't understand @cciresi's position. As far as a I know anti-boycott regulations have primarily (only?) been used to prevent US companies from not doing business with Isreal. China & Russia are geopolitical rivals to the US and I don't see any sort of risk of anti-boycott regulations being applied in restricting business with residents of those countries. I guess you could say there is a risk that could change, but that seems hypothetical to the extreme and realistically irrelevant to worry about from a risk perspective.
And this isn't discriminating on nationality or national origin, it is on the nation you currently live in. Employers decide not to hire employees living in other countries all the time, it's the most prevalent choice (i.e. US companies only hiring employees living in the US). I don't see why doing this because a customer you've considered critical has asked for it is any more legally risky that having done it for other reasons, assuming we discount the anti-boycott argument.
This is all with the huge caveat of I'm not a lawyer, just giving my perspective based on how I've seen these laws/regulations applied in the past.
And this isn't discriminating on nationality or national origin, it is on the nation you currently live in. Employers decide not to hire employees living in other countries all the time, it's the most prevalent choice (i.e. US companies only hiring employees living in the US). I don't see why doing this because a customer you've considered critical has asked for it is any more legally risky that having done it for other reasons, assuming we discount the anti-boycott argument.
This is all with the huge caveat of I'm not a lawyer, just giving my perspective based on how I've seen these laws/regulations applied in the past.
Anti-boycott regulations are highly hypocritical because indeed, they are designed for Israel but pretend to apply to all countries.
Thing is, even if it is just country of residence, it is still a discrimination on hiring and could very well be illegal unless there are strong legal reasons. E.g. "we have to do things that are illegal under the laws in country X, so we can't hire people there".
I think the main point of her position is that one should have an objective criterion to add countries into a blacklist and that none can realistically been done over privacy issues that would include China and Russia but not USA.
Thing is, even if it is just country of residence, it is still a discrimination on hiring and could very well be illegal unless there are strong legal reasons. E.g. "we have to do things that are illegal under the laws in country X, so we can't hire people there".
I think the main point of her position is that one should have an objective criterion to add countries into a blacklist and that none can realistically been done over privacy issues that would include China and Russia but not USA.
National borders are a strong legal reason. It's silly to have to write that down.
Absent a treaty between nations, national borders are the borders of laws!
The US government is currently in a trade war with China. Is that illegal discrimination?
Regulating internatiinal relations is a core government
responsibility.
No government would make it illegal for a company to choose not to do business in a non-ally foreign country. Millions of business already don't engage in many foreign countries, by default. Including yours, I bet. Why should they be required to do so?
No government would make it illegal for a company to choose not to do business in a non-ally foreign country. Millions of business already don't engage in many foreign countries, by default. Including yours, I bet. Why should they be required to do so?
>Could be a group doing humanitarian or journalistic work
They speak about revenue, so I'm sure that's not the case. I bet it's a commercial company with sensitive data, probably gov/mil contractor with strict obligations to their customer.
And someone at their management doesn't understand Intelligence 101: they don't reach for your data from the country of origin.
They speak about revenue, so I'm sure that's not the case. I bet it's a commercial company with sensitive data, probably gov/mil contractor with strict obligations to their customer.
And someone at their management doesn't understand Intelligence 101: they don't reach for your data from the country of origin.
Journalists and humanitarian organizations do have revenues.
I doubt a mil contractor would add Russia and China but not embargoed places like Iran.
And yes, I think this is a misguided attempt at security. Companies that handled crucial data that need to stay private really should spend the resources on managing these data themselves.
I doubt a mil contractor would add Russia and China but not embargoed places like Iran.
And yes, I think this is a misguided attempt at security. Companies that handled crucial data that need to stay private really should spend the resources on managing these data themselves.
If I understood it correctly, this should be a nationality block, not country-of-residence.
This would be even more ridiculous.
Why is it ridiculous? The espionage laws in question apply to individuals / nationality, and are explicitly aimed at persons living abroad.
True. You have to decide what level of security is necessary for you. In some countries like China privacy from the government is basically nonexistent. In some like Australia backdoors are mandated by the government. In others like the US secret FISA courts exist and can demand data from companies and gag them at the same time. Off the top of my head I don't really know any ideal developed countries to do business in where privacy is concerned.
See QA with Angelo Codevilla:
https://www.tabletmag.com/jewish-arts-and-culture/culture-ne...
Search for "You were directly involved in the drafting of the original FISA law in 1978."
https://www.tabletmag.com/jewish-arts-and-culture/culture-ne...
Search for "You were directly involved in the drafting of the original FISA law in 1978."
The title seems misleading, the article specifically states this does not effect any current employees, presumably as they have none in China and Russia.
> As such we feel a country block is the most humane solution at this time--especially because it affects zero current employees
> As such we feel a country block is the most humane solution at this time--especially because it affects zero current employees
Ok, I've temporarily changed from the submitted title ("Gitlab blocks current employees and stops future hires in China and Russia") to the page title—which I assume is accurate but is uninformative—until we get clarity about what an accurate, neutral title would be. Does anybody want to suggest one?
Edit: I've provisionally gone with "Gitlab blocks hiring SREs and Support Engineers in China and Russia". If that's wrong, or if anyone can suggest a more accurate and neutral title, we can change it again.
Edit: I've provisionally gone with "Gitlab blocks hiring SREs and Support Engineers in China and Russia". If that's wrong, or if anyone can suggest a more accurate and neutral title, we can change it again.
Correct, this block would be for two functions (Site Reliability Engineer and Support) and we currently have no people in that role in China and Russia.
Please note that we're still discussing this change. We work out in the open so you can see us working on it. I hope that people appreciate the difference between that and what you would see in a non-transparent company (probably nothing, they would just not open up a vacancy in the offices in that country).
Please note that we're still discussing this change. We work out in the open so you can see us working on it. I hope that people appreciate the difference between that and what you would see in a non-transparent company (probably nothing, they would just not open up a vacancy in the offices in that country).
[deleted]
Concerns on privacy, data and IP are understandable. However, this ban would be a symbolic move with absolutley zero substance. The world is small and highly interconnected and it would be extremely easy for the Russian and Chinese governments to compromise and co-opt support staff from pretty much any country of their chosing. This will lulll your customers and your infosec teams into a false sense of security. Considering how forthcoming you are with the names, roles and location of your team. They would pick you off in a heart beat and you would not suspect or see it coming. The Chinese are extremely well entrenched across the global - with enough money to grease anybody's wheels. Not to mention it would be trivial for them to get their "agents" passports from anywhere in the world
Would you consider extending this to other roles? If you remember the Juniper VPN backdoor was so well done it would have likely (or did) passed code review, putting most software engineering in to scope.
Additionally would this extend to individuals who are of Chinese or Russian origin? China in particular leans on nationals who are on visas or have family still in country to conduct espionage operations.
Additionally would this extend to individuals who are of Chinese or Russian origin? China in particular leans on nationals who are on visas or have family still in country to conduct espionage operations.
It would be strange to not accept code from certain countries since we are an open core company that gets contributions from around the world. There are other ways to prevent supply chain attacks. A difference with data is that there are always multiple people involved before code is merged while data can be extracted by a single individual who has access.
Discriminating on origin is likely illegal.
Discriminating on origin is likely illegal.
> A difference with data is that there are always multiple people involved before code is merged while data can be extracted by a single individual who has access.
It sounds like you just need to harden your production perimeter. Jump boxes with two-man-rule access and terminal logging. Apply the same practices to data as you do code.
> Discriminating on origin is likely illegal.
You should ask your legal folks about the national security exceptions of Title VII. It sounds like your customer requirements are pushing you in that direction anyway.
It sounds like you just need to harden your production perimeter. Jump boxes with two-man-rule access and terminal logging. Apply the same practices to data as you do code.
> Discriminating on origin is likely illegal.
You should ask your legal folks about the national security exceptions of Title VII. It sounds like your customer requirements are pushing you in that direction anyway.
> open core company that gets contributions from around the world
The irony...
The irony...
It does block them from moving to that country. So if a current employee was planning to move to either country soon they'd be prevented from doing that.
I've danced this dance at a previous company when we had an employee working from a country of interest for an extended period of time. They were air-gapped from our systems and it worked because they submitted everything by pull requests (the original way, sending git patches by email). They didn't have access to our CRM or any customer systems because several of our contracts - not just with governments but also major multinationals - prevented employees in certain countries from having access.
Even when I traveled to the same country I used a burner laptop that was decommissioned when I returned. When we EOL'd laptops in the office they'd go in the burner pile to have one last holiday abroad before they were wiped again and sent to a local charity.
I've danced this dance at a previous company when we had an employee working from a country of interest for an extended period of time. They were air-gapped from our systems and it worked because they submitted everything by pull requests (the original way, sending git patches by email). They didn't have access to our CRM or any customer systems because several of our contracts - not just with governments but also major multinationals - prevented employees in certain countries from having access.
Even when I traveled to the same country I used a burner laptop that was decommissioned when I returned. When we EOL'd laptops in the office they'd go in the burner pile to have one last holiday abroad before they were wiped again and sent to a local charity.
I've done some travelling to risky places before (Kiev and other places) and even though the networks were hostile there, I still don't understand the point of pretending that Russia et al can't get into Gitlab whenever they want to. They can. Air-gapping isn't going to slow them down.
> I still don't understand the point of pretending that Russia et al can't get into Gitlab whenever they want to
Security isn’t absolute, it’s layered. The harder you make it for the adversary, the more it costs the adversary (eg: potentially burning a zero day), and the more chance there is of detection.
Can Russian intelligence get into Gitlab? Probably. Are measures that make it more expensive liable to deter them? I think so.
Security isn’t absolute, it’s layered. The harder you make it for the adversary, the more it costs the adversary (eg: potentially burning a zero day), and the more chance there is of detection.
Can Russian intelligence get into Gitlab? Probably. Are measures that make it more expensive liable to deter them? I think so.
> They can. Air-gapping isn't going to slow them down.
Two points here. First of all, failing to acheive absolute security is not a justification for ignoring best practices.
Second, this isn't air gapping. It is preventing a bugged laptop from sitting in on conference calls and meetings for the next year or two until it gets aged out.
Two points here. First of all, failing to acheive absolute security is not a justification for ignoring best practices.
Second, this isn't air gapping. It is preventing a bugged laptop from sitting in on conference calls and meetings for the next year or two until it gets aged out.
As the subject of this thread also points out, there's an important factor of risk to the individual: to prevent them from getting put in a position where they can be coerced into turning over data access.
Or just bribing people in “allowed” countries.
I think it would probably be costly to bribe someone in the "allowed" countries. I'm not going to risk going to prison for some small sum of money, and a large sum of money is logistically difficult to give me. People will ask questions, the scheme will probably be found out.
Meanwhile, if the government can just arrest you and say "change this repository and you go free", it's essentially free.
Meanwhile, if the government can just arrest you and say "change this repository and you go free", it's essentially free.
All the people who are saying they've never seen a contract with a term like this, I'm just sitting here wondering how my experience is the opposite...
[deleted]
Or into affected roles.
So, someone in, say, QA or documentation, looking to head into SRE or Support, would be unable to if they presently reside in China or Russia.
So, someone in, say, QA or documentation, looking to head into SRE or Support, would be unable to if they presently reside in China or Russia.
> they'd be prevented from doing that.
Their employment being dependent on them residing within specific locales is not the same as "prevention". It's an incentive scheme, afaik.
Their employment being dependent on them residing within specific locales is not the same as "prevention". It's an incentive scheme, afaik.
It affects no employess (per clarification in this thread) presently in affected roles.
It could affect present employees who are in other roles, located in China or Russia, from moving to a covered role, whilst continuing to reside in China or Russia.
It could affect present employees who are in other roles, located in China or Russia, from moving to a covered role, whilst continuing to reside in China or Russia.
The block is on current non-residents of China or Russia from moving to those countries. <strike>Not on any present residents of those countries from having further access.</strike>
<BOLD>See self-reply below, not the case.</BOLD>
Though that is alluded to as a possibility, with complications.
________________________________
Update: My first read was incorrect.
<BOLD>See self-reply below, not the case.</BOLD>
Though that is alluded to as a possibility, with complications.
________________________________
Update: My first read was incorrect.
Hm, upon a re-read I think you are right. Thanks for clarifying.
And on my own re-read: "Current team members are prevented from moving to these countries and remaining in a role that prohibits it."
That would seem to apply to current employees in Russia / China who are in roles covered by the block.
Which is kind of A Big Deal.
That would seem to apply to current employees in Russia / China who are in roles covered by the block.
Which is kind of A Big Deal.
No? It would seem to apply to current employees who move to Russia/China who are in roles covered by the block. i.e. they would have the choice of moving and changing roles/quitting, or staying.
Depends on whether you read that as:
X: "Current team members"
A: "moving to these countries"
B: "remaining in a role that prohibits it"
X are prevented from BOTH A AND B.
(X may do neither A NOR B)
Or:
X are prevented from (A AND B).
Whether or not remaining in one of these countries and MOVING to a role that prohibits it is included in the prohibition is unclear.
Someone's future transfer may hinge on that.
X: "Current team members"
A: "moving to these countries"
B: "remaining in a role that prohibits it"
X are prevented from BOTH A AND B.
(X may do neither A NOR B)
Or:
X are prevented from (A AND B).
Whether or not remaining in one of these countries and MOVING to a role that prohibits it is included in the prohibition is unclear.
Someone's future transfer may hinge on that.
Probably an idea to throw Australia on that list -
https://www.zdnet.com/article/whats-actually-in-australias-e...
https://www.zdnet.com/article/whats-actually-in-australias-e...
I'm surprised we (Australia) aren't already on more of these lists.
After having this discussion with my manager and colleagues (the conversation with my manager was in my interview process where I bluntly stated if I was asked to comply with anything from this law, I'd immediately resign, my manager also agreed). Everyone I've spoken to agreed we'd immediately resign since it was the only potential option to protect our selves as employees and our employers.
Edit: I'll need to spend a little more time looking into the Assistance and Access Laws. The following article attempts to downplay some of these concerns:
https://www.homeaffairs.gov.au/about-us/our-portfolios/natio...
After having this discussion with my manager and colleagues (the conversation with my manager was in my interview process where I bluntly stated if I was asked to comply with anything from this law, I'd immediately resign, my manager also agreed). Everyone I've spoken to agreed we'd immediately resign since it was the only potential option to protect our selves as employees and our employers.
Edit: I'll need to spend a little more time looking into the Assistance and Access Laws. The following article attempts to downplay some of these concerns:
https://www.homeaffairs.gov.au/about-us/our-portfolios/natio...
> I'd immediately resign
You are assuming that is actually an option. There is nothing to suggest the current Australian government would not prevent you from resigning until the task had been completed. This is the same government currently attempting to make it illegal to boycott businesses that are damaging to the environment.
You are assuming that is actually an option. There is nothing to suggest the current Australian government would not prevent you from resigning until the task had been completed. This is the same government currently attempting to make it illegal to boycott businesses that are damaging to the environment.
They don't have legal authority to prevent you from resigning.
Also, the proposed anti-boycott rules have been widely criticized as unconstitutional, unworkable and ludicrously against the conservatives free speech pronouncements. Unlikely they would get support from Senate cross bench.
Also, the proposed anti-boycott rules have been widely criticized as unconstitutional, unworkable and ludicrously against the conservatives free speech pronouncements. Unlikely they would get support from Senate cross bench.
They could compel your employer not to accept the resignation before the correct procedures are done and you have completed the task.
As far as I know, employment in Australia isn't typically under the terms of indentured servitude. We haven't been a penal colony for a while now.
Executive powers in Aus aren't that strong - they'd have to pass a law to give themselves that specific power. I don't think there's one to permit this now, though I'm no expert and there are many obscure laws.
That's the good(ish) news - the bad is that restraints on the passing of bad law are generally pretty weak in the absence of a hostile Senate. This is particularly true with the current feeble opposition, and even more so given the general atmosphere of cowering obeisance that the major parties have allowed (or encouraged) to develop around any legislation involving the word 'security'.
That's the good(ish) news - the bad is that restraints on the passing of bad law are generally pretty weak in the absence of a hostile Senate. This is particularly true with the current feeble opposition, and even more so given the general atmosphere of cowering obeisance that the major parties have allowed (or encouraged) to develop around any legislation involving the word 'security'.
There is a good description of the many shortcomings of the legislation at https://stateofit.com/interception/ and https://stateofit.com/interceptionpart2/ -- TCNs (compelled changes) are not the real problem, its the more than willing compliance from companies with TARs -- voluntary technical assistance requests. It is unclear how much (if any) the company is shielded from civil suits for complying with TARs.
The problem is not really that you couldn't resign -- it is that the company would hire replacements that would get the job done. The company executive would be compelled to.
Albanese (and his forgettable deputy Marles) have so far been a disaster for the ALP.
The problem is not really that you couldn't resign -- it is that the company would hire replacements that would get the job done. The company executive would be compelled to.
Albanese (and his forgettable deputy Marles) have so far been a disaster for the ALP.
Employers can't refuse to accept your resignation in Australia. Or rather they can refuse as much as they like but your resignation still holds.
[deleted]
[deleted]
Since National Security Letters exist, blocking all employees from the US would also be logical. Same for running anything on third-party hardware.
There needs to be a more effective response than Hari Kiri.
There needs to be a more effective response than Hari Kiri.
> Since National Security Letters exist, blocking all employees from the US would also be logical.
Sure, it would be, especially for companies located in neutral countries, but since US influence is so strong everywhere almost all over the world that's also practically impossible. "Every animal is equal but some animals are more equal than others"
Sure, it would be, especially for companies located in neutral countries, but since US influence is so strong everywhere almost all over the world that's also practically impossible. "Every animal is equal but some animals are more equal than others"
We haven't seen the implementation details for Gaia-X, but it would not be unreasonable for it to include that priviledged persons (admins, company management) by EU citizens and resident in the EU, or possibly even FR/DE only. Full document below in Deutch.
https://www.bmwi.de/Navigation/EN/Home/home.html https://www.bmwi.de/Redaktion/DE/Publikationen/Digitale-Welt...
China and Russia obviously have their own systems, but many other countries some some element of national control which is less obvious. Japan certainly has a mature native cloud capability, although it would be highly disruptive to move everything to it.
Its like plans to be 'cloud agile', it doesn't work unless you deploy to both every time, and you probably just double your cost and bugs for deployment ops. So the tendency will be towards cloud balkanization. Which could really suck, or it could force a path away from proprietary APIs towards standards, which will suck in a different way.
https://www.bmwi.de/Navigation/EN/Home/home.html https://www.bmwi.de/Redaktion/DE/Publikationen/Digitale-Welt...
China and Russia obviously have their own systems, but many other countries some some element of national control which is less obvious. Japan certainly has a mature native cloud capability, although it would be highly disruptive to move everything to it.
Its like plans to be 'cloud agile', it doesn't work unless you deploy to both every time, and you probably just double your cost and bugs for deployment ops. So the tendency will be towards cloud balkanization. Which could really suck, or it could force a path away from proprietary APIs towards standards, which will suck in a different way.
NSLs apply to companies, not employees. The NSL would have to go to your companies legal office.
NSLs can be issued to any person, natural or juridical.
NSLs only bring back non-content information (eg, a call record, but not a recording of a call) and are issued under the Stored Communications Act. Unless you happen to be the owner of a sole proprietorship that falls under the act, you can't be directly issued an NSL - it's issued to the entity which holds the records (eg AT&T).
That's Hara kiri. If you're going to appropriate an antiquated foreign word out of context I wish you'd at least spell it properly.
(1) it's a non-antiquated English word, etymologically linked to the antiquated foreign word (it entered English a long time ago.)
(2) In English, both hari kari and hara kiri are accepted spellings (the word came into English before modern, maybe even standardized, transliteration, and the source language doesn't natively use the Latin alphabet.)
(3) But, in any case, you are right that it is misspelled.
(2) In English, both hari kari and hara kiri are accepted spellings (the word came into English before modern, maybe even standardized, transliteration, and the source language doesn't natively use the Latin alphabet.)
(3) But, in any case, you are right that it is misspelled.
That's the spelling in my phone's dictionary. If I were writing about ancient Japanese cultural traditions I might have checked. I think Japanese people, being inveterate word-stealers, would understand.
It's the same in France, and many other western countries.
I think it's just the usual "Australians not realizing they live in a bubble", and kindly warning the rest of the world about laws or practices that have already been in place in our countries for twenty years.
I think it's just the usual "Australians not realizing they live in a bubble", and kindly warning the rest of the world about laws or practices that have already been in place in our countries for twenty years.
That is not true. There is no such law in Germany, and the public backlash against it would be enormous. In the east we had a government that would pressure citizens to spy on each other -- any hint of that would be political suicide on all levels...
AFAIK there is no law in France where the government can force you to do something you don’t want to do related to your employment. They can however seize your devices.
As an Aussie living & working overseas I'm still not sure if it applies to me and makes me a liability? I know they can't enforce it unless I go home but I will someday
It does make you a liability. Australians can be shanghai'ed into working for the Australian intelligence agencies wherever they are on Earth.
I'm also an Australian living overseas, have worked on many sensitive projects that would be of interest to the Australian government and its masters, and I'm quite prepared to give up my nationality over this issue.
I'm also an Australian living overseas, have worked on many sensitive projects that would be of interest to the Australian government and its masters, and I'm quite prepared to give up my nationality over this issue.
Ah okay, yeah I think I'll get citizenship somewhere else
At this point I think its the only thing Australians can do about their country.
Australians will never be afforded an opportunity to overthrow their government, nor will we get the revolutions our demonstrations hope for.
Australians will never be afforded an opportunity to overthrow their government, nor will we get the revolutions our demonstrations hope for.
[deleted]
Sucks to have such a retarded Gov.
In the case of Chinese-based employees the assumption is that anything they did would go through Chinese Government controlled networks (there's VPN ban even for foreign businesses) and likely result in your intellectual property being shared with your Chinese-based competitors. Not to mention their access being potentially compromised and used.
If an Australian-based employee complied with a letter, they could destroy your business reputation when it got out, even if you threw them under the bus. Probably the main reason Australian employees are still given latitude is that committing compromised code into the codebase would require involving everyone who could possibly see that code change.
In the case of Chinese-based employees the assumption is that anything they did would go through Chinese Government controlled networks (there's VPN ban even for foreign businesses) and likely result in your intellectual property being shared with your Chinese-based competitors. Not to mention their access being potentially compromised and used.
If an Australian-based employee complied with a letter, they could destroy your business reputation when it got out, even if you threw them under the bus. Probably the main reason Australian employees are still given latitude is that committing compromised code into the codebase would require involving everyone who could possibly see that code change.
Yeah I would assume most only don't have them on the list because they weren't actually dealing with them in the first place and had no expectation to have a use for them.
Personally for me, coming into a company that was so transparent was very difficult at first, especially as an attorney. However, over time I realized how much I developed and grew from it. I became much more open and accepting of criticism and feedback. Instead of becoming defensive, I listened to it and learned from it. I also welcomed all of the extra eyes on my work, it helped me create much better work product, just as the open source community does with open source code. When you are transparent, people know what you are doing and that you are genuinely putting the efforts in to do your best. You never know what is going on with others behind closed doors.
If I was a Chinese or a Russian engineer working for Gitlab, I'd consider quitting right now regardless of how this discussion ends. I am surprised that this initiative is not just considered by them, but basically approved by some of the senior staff:
> In e-group on Monday October 15, 2019 we took the decision to enable a "job family country-of-residence block" for team members who have access to customer data.
I don't think there's a need to explain what's wrong with this idea, there are a lot of sane comments on this thread explaining this just okay.
On a side note, I really like how company transparency saves them from making wrong decisions final. I think that this initiative will be dropped just like the recent third-party tracking issue, and I wish more companies were as transparent as this one.
> In e-group on Monday October 15, 2019 we took the decision to enable a "job family country-of-residence block" for team members who have access to customer data.
I don't think there's a need to explain what's wrong with this idea, there are a lot of sane comments on this thread explaining this just okay.
On a side note, I really like how company transparency saves them from making wrong decisions final. I think that this initiative will be dropped just like the recent third-party tracking issue, and I wish more companies were as transparent as this one.
>> If I was a Chinese or a Russian engineer working for Gitlab, I'd consider quitting right now regardless of how this discussion ends.
This is partially the goal of such moves and will accelerate the rise of discrimination. Thus, one should not quit despite the situation.
This is partially the goal of such moves and will accelerate the rise of discrimination. Thus, one should not quit despite the situation.
So you'd suggest staying and fighting against this inside the company? If they truly love the company and it deserves this, you might be right.
edit: what bothers me is that at least by some senior staff members these employees are already considered second-class citizens as otherwise this initiative wouldn't even be discussed, and I wonder how comfortable it will be to continue working with these people now.
edit: what bothers me is that at least by some senior staff members these employees are already considered second-class citizens as otherwise this initiative wouldn't even be discussed, and I wonder how comfortable it will be to continue working with these people now.
by staying you fight it already, better be passive - not being insane is already a lot
I have to disagree. Passively staying does not change anything; the fact that they work for this company has not prevented this initiative.
When a wast majority thinks in a way against you, fighting them you will inevitably make mistakes and be triggered to do dumb stuff. Crowd think can make people believe that Chinese and Russians are some sort of zombies. If you stay around and show that you are not a zombie to be eliminated, this is already a lot. I know how it sounds, but don't underestimate crowd dynamics.
[deleted]
I wrote another comment arguing that this proposal was both racist and discriminatory, which got flagged and deleted without explanation, presumably because I worded it in such a way as to give an example that might resonate more with Americans by using examples of specific groups of people that have experienced oppression in the US. In the interests of quality discussion on HN, I'm going to make another attempt but in a way which is hopefully less likely to be misinterpreted.
There are employment laws which prevent companies from discriminating against people based on factors such as race, sexual orientation, religion, physical appearance, age, marital status, and other things over which they either have no control or which are not relevant to their job. These laws are in place for good reason and most people (myself included) support them.
It is my belief that a company policy prohibiting the hiring of people based on any of the above attributes would be wrong, and probably illegal (depending on the jurisdiction).
The question then comes down to whether refusing to hire someone based on either their nationality or the country in which they live (in the case of a remote company) is wrong in the same sense as the above factors. My argument is yes. The fact that someone lives in China or Russia does not, by itself, make them an untrustworthy person, any more than someone living in the United States, Germany, Japan, or the UK.
At the request of several customers, GitLab is proposing a policy which discriminates against people based on their naionality/country of residence, which I would argue is almost (if not equally) as bad as discrimination based on the other factors I've mentioned, and should be opposed for the same reasons as a policy which prohibited hires who were of a particular race or sexual orientation.
If anyone wants to flag this comment, you are of course free to do so. But I would much prefer, and I think we could all benefit from, a coherent discussion of the flaws in my argument.
There are employment laws which prevent companies from discriminating against people based on factors such as race, sexual orientation, religion, physical appearance, age, marital status, and other things over which they either have no control or which are not relevant to their job. These laws are in place for good reason and most people (myself included) support them.
It is my belief that a company policy prohibiting the hiring of people based on any of the above attributes would be wrong, and probably illegal (depending on the jurisdiction).
The question then comes down to whether refusing to hire someone based on either their nationality or the country in which they live (in the case of a remote company) is wrong in the same sense as the above factors. My argument is yes. The fact that someone lives in China or Russia does not, by itself, make them an untrustworthy person, any more than someone living in the United States, Germany, Japan, or the UK.
At the request of several customers, GitLab is proposing a policy which discriminates against people based on their naionality/country of residence, which I would argue is almost (if not equally) as bad as discrimination based on the other factors I've mentioned, and should be opposed for the same reasons as a policy which prohibited hires who were of a particular race or sexual orientation.
If anyone wants to flag this comment, you are of course free to do so. But I would much prefer, and I think we could all benefit from, a coherent discussion of the flaws in my argument.
In america it is my understanding you can be legally forced by intelligence agencies to provide confidential info about your company and legally forced to not disclose it to your company.
There's no reason to believe it's different in any other countries, in particular countries that have a an obvious confrontational stance against "the west" and are at least semi authoritarian.
So a person maybe a "nice/trustworthy person" but because of such laws, working with a person from a country equal granting access to your internal infos to the whole country this person is a citizen of.
There's no reason to believe it's different in any other countries, in particular countries that have a an obvious confrontational stance against "the west" and are at least semi authoritarian.
So a person maybe a "nice/trustworthy person" but because of such laws, working with a person from a country equal granting access to your internal infos to the whole country this person is a citizen of.
there is no reason to believe any other country does this to it's citizen. my understanding is this kind of imperial reach has been abandoned by all other countries since the invention of the nation-state (in favor of positive law)
> The fact that someone lives in China or Russia does not, by itself, make them an untrustworthy person, any more than someone living in the United States, Germany, Japan, or the UK.
It has nothing to do with "untrustworthy" and everything to do with "will be coerced without anyone even breaking the law".
I don't know if that will change your mind, but it's an important difference, it's not a judgement of the people but of the state they are living in.
It has nothing to do with "untrustworthy" and everything to do with "will be coerced without anyone even breaking the law".
I don't know if that will change your mind, but it's an important difference, it's not a judgement of the people but of the state they are living in.
The fact that you’re in one of these countries makes you easy to access by enemies on the global scale. Assuming the individuals are good, that doesn’t mean they’re not a security risk. The reality is, countries like Russia and China do not respect intellectual property, and are know to perform cyber espionage and attacks. This seems very reasonable to me.
Furthermore, the whole point of anti-discrimination laws are to prevent judgement based off traits that cannot be changed. Where you live is not the same thing as your skin color. Imagine if someone refused to change their password and only used 6 characters for it. It’s a security protocol to force a change there. I’m viewing thing more similar to that than similar to racial discrimination, given that gitlab is not saying they won’t hire Russians widely.
Furthermore, the whole point of anti-discrimination laws are to prevent judgement based off traits that cannot be changed. Where you live is not the same thing as your skin color. Imagine if someone refused to change their password and only used 6 characters for it. It’s a security protocol to force a change there. I’m viewing thing more similar to that than similar to racial discrimination, given that gitlab is not saying they won’t hire Russians widely.
>Furthermore, the whole point of anti-discrimination laws are to prevent judgement based off traits that cannot be changed. Where you live is not the same thing as your skin color.
This is very true. People are getting very caught up on discrimination without taking into account all of the "acceptable" forms that happen all the time. If you're a violent felon, you are likely going to be discriminated against when looking for a job in child-care. Yeah, this is an extreme example, but it's a form of job discrimination most people see as reasonable. Like-wise, people are discriminated against all the time in jobs for things like lack of qualification or lack of relevant degrees, etc., and again most see this kind of discrimination as reasonable. The kinds of discrimination that aren't reasonable are things like no hiring somebody because of their race because there isn't any reasonable connection between that fact and their ability to do job.
The question here isn't whether it is discrimination to not hire those who live in Russia or China, the question is if the underlying premise that those people are more of a data liability than other people. I haven't read the entire thread, but so far I haven't really seen much discussion on this point, just lots of people saying the policy is outright racist (even though I believe the policy only affects people who currently live in those countries regardless of race rather than not hiring people of Chinese/Russian descent who live elsewhere).
This is very true. People are getting very caught up on discrimination without taking into account all of the "acceptable" forms that happen all the time. If you're a violent felon, you are likely going to be discriminated against when looking for a job in child-care. Yeah, this is an extreme example, but it's a form of job discrimination most people see as reasonable. Like-wise, people are discriminated against all the time in jobs for things like lack of qualification or lack of relevant degrees, etc., and again most see this kind of discrimination as reasonable. The kinds of discrimination that aren't reasonable are things like no hiring somebody because of their race because there isn't any reasonable connection between that fact and their ability to do job.
The question here isn't whether it is discrimination to not hire those who live in Russia or China, the question is if the underlying premise that those people are more of a data liability than other people. I haven't read the entire thread, but so far I haven't really seen much discussion on this point, just lots of people saying the policy is outright racist (even though I believe the policy only affects people who currently live in those countries regardless of race rather than not hiring people of Chinese/Russian descent who live elsewhere).
The factor I'd consider is the legal system of those countries: if you hire someone who lives in China, you're adding another country which can compel your employee to against against your company or customers’ interests (as an American company they're already exposed to the U.S. government's powers). Similarly, you're taking on the risk that something like, say, a future iteration of the current trade war would lead to you suddenly being forced to discontinue their employment on potentially very short notice (remember Adobe's need to comply with the Venezuelan sanctions?).
FWIW I have seen government contracts that specifically request only US citizens have access to certain parts of systems.
to elaborate: defence.
They don't want people to have potential leverage (e.g. family members) within the grasp of other national powers who may not be allies.
I might be understanding this differently (perhaps incorrectly). I lived in Russia, and I left with a very strong model in my mind that Russian_people != Russian_government. I don't think this is related to trusting foreign nationals, I believe it's strictly about trusting foreign states.
The threat model isn't "Russian developer who wants to support their family." The threat model is "Russian government." I agree with and support the laws prohibiting discrimination against people for race, religion, etc., but I don't think this is related to any of the criteria you cited. As far as I can tell, GitLab is enthusiastic about promoting diversity [0]. It's based on country of residence; Americans living in Russia would be blocked and Russians living in America would not. Frankly, I think they should consider putting Australia on the list too [1].
It's not an issue of discrimination based on race, sexual orientation, religion, physical appearance, age, marital status, or ethnicity.
[0] https://about.gitlab.com/company/culture/inclusion/ [1] https://www.bbc.com/news/world-australia-46463029
The threat model isn't "Russian developer who wants to support their family." The threat model is "Russian government." I agree with and support the laws prohibiting discrimination against people for race, religion, etc., but I don't think this is related to any of the criteria you cited. As far as I can tell, GitLab is enthusiastic about promoting diversity [0]. It's based on country of residence; Americans living in Russia would be blocked and Russians living in America would not. Frankly, I think they should consider putting Australia on the list too [1].
It's not an issue of discrimination based on race, sexual orientation, religion, physical appearance, age, marital status, or ethnicity.
[0] https://about.gitlab.com/company/culture/inclusion/ [1] https://www.bbc.com/news/world-australia-46463029
I think you're really missing the point of this entire discussion in the first place.
This came up because of a client request.
Your question about whether people from other countries can be considered trustworthy is completely irrelevant.
The fact is, organizations exist that are at polar odds with governments that exist today. It is not unreasonable to, for example, have a 'Uyghur Oppression Awareness Group' require that all of their data be handled by NOT-CHINA. It has nothing to do with Chinese people, or their ethnicity. It has to do with the fact that if an employee is able to access their data, and the government has an incentive to take that data, the government can easily force that person to hand over that data.
This exists in many countries, Russia, China, USA, Australia, UK, the list is very long.
Your argument is flawed because you're arguing the wrong point. The trustworthiness of an individual is not relevant in any capacity.
This came up because of a client request.
Your question about whether people from other countries can be considered trustworthy is completely irrelevant.
The fact is, organizations exist that are at polar odds with governments that exist today. It is not unreasonable to, for example, have a 'Uyghur Oppression Awareness Group' require that all of their data be handled by NOT-CHINA. It has nothing to do with Chinese people, or their ethnicity. It has to do with the fact that if an employee is able to access their data, and the government has an incentive to take that data, the government can easily force that person to hand over that data.
This exists in many countries, Russia, China, USA, Australia, UK, the list is very long.
Your argument is flawed because you're arguing the wrong point. The trustworthiness of an individual is not relevant in any capacity.
It's called Ukrainization of US politics, in short "cut off one's nose to spite one's face" principe of life
The title here really should say "considers" - the discussion seems to be ongoing - and it looks like legal is advising strongly against it.
It’s hard when you have people in your circle of trust who are subject to coercive law enforcement. My heart goes out to victims of such apparatus.
It isn’t even as simple as worrying that foreign national employees can be coerced by their home nation police or state security services — anyone subject to policies like Gitlab’s who is local to your business but who has family or assets abroad that can be used to effect duress, or who can be blackmailed in some way elsewhere, would need to be vetted.
It isn’t even as simple as worrying that foreign national employees can be coerced by their home nation police or state security services — anyone subject to policies like Gitlab’s who is local to your business but who has family or assets abroad that can be used to effect duress, or who can be blackmailed in some way elsewhere, would need to be vetted.
Do they already block Australia, because of the backdoor laws passed a while back?
I suspect this is driven more by surveillance or sabotage risks posed by employee access rather than jurisdictional risks.
Australian law is likely to have little impact on what an SRE or support engineer might be able to do. Australia having an established practice of recruiting and placing enterprise surveillance moles would.
China and Russia have some history with this latter. Though one might say similarly of the US and Israel, as two examples.
Australian law is likely to have little impact on what an SRE or support engineer might be able to do. Australia having an established practice of recruiting and placing enterprise surveillance moles would.
China and Russia have some history with this latter. Though one might say similarly of the US and Israel, as two examples.
Alright, I also thought about Israel and AU at first but this thing is so political
that no way can they include US allies in there because gov wouldn't approve this sort of thing.
To my eye, american companies are becoming more and more like chinese companies in the amount of control governments can extort on them and that is highly troublesome.
To my eye, american companies are becoming more and more like chinese companies in the amount of control governments can extort on them and that is highly troublesome.
I know of a couple major us companies that do include Israel along with other usual suspects but they don’t spray about it on the internet. There’s also growing concern regarding what corporate equipment you can take across us border so there’s that.
[deleted]
They can't. It seems that the only way to do this would be if AU and US wasn't close allies and the US gov sanctioned it.
While I acknowledge the pragmatic approach taken by the company to protect their user's data, I am curious as to how this will play out over time. Factors such as longer term travel or working vacations to these countries by their employees?
Or, What about if one of their employees is married (or wants to get married) to a legal resident of one of these countries? How far removed does the employee have to be from this risk? And how much of an impact on their (and their family's) civil liberties could this have?
Or, What about if one of their employees is married (or wants to get married) to a legal resident of one of these countries? How far removed does the employee have to be from this risk? And how much of an impact on their (and their family's) civil liberties could this have?
I've been told (at a different company based in a different country) "don't bring your work laptop to China, don't bring materials to China without authorization, we'll provide what is effectively a burner device for whatever you are bringing to China (I believe they re-used them as different employees went to China)".
I imagine Gitlab would have a similar but less restrictive policy, "don't bring a work laptop <with credentials that gives you access to one of these roles> to China, ...".
I don't see why a policy against residing/working in China would care about who you are married to or where they live.
I imagine Gitlab would have a similar but less restrictive policy, "don't bring a work laptop <with credentials that gives you access to one of these roles> to China, ...".
I don't see why a policy against residing/working in China would care about who you are married to or where they live.
Consider this scenario: Loyal and long time high performing Gitlab employee Bob, is happily married to Su, who originally hails from China. They live and work in the US. All good.
Until Su's ageing parents back home succumb to ill health and she decides that the family need to move back to China to care for them for maybe one or two years - perhaps longer.
Bob then has to make the choice between (a) resigning his job or (b) being forced into a long distance relationship with lots of travel between China and the US, or (c) divorcing his wife.
When company policy gets in the way of important life decisions, I think it is a dangerous line to walk.
Until Su's ageing parents back home succumb to ill health and she decides that the family need to move back to China to care for them for maybe one or two years - perhaps longer.
Bob then has to make the choice between (a) resigning his job or (b) being forced into a long distance relationship with lots of travel between China and the US, or (c) divorcing his wife.
When company policy gets in the way of important life decisions, I think it is a dangerous line to walk.
Consider the exact same scenario at any non-remote company.
If Bob wants to move to China, where the company doesn't have an office, he's going to have to resign or take a leave of absence.
This decision on Gitlab's part would be moving their incredibly generous "you can work from anywhere you want except places where we legally can't let you like Crimea and Iran" to a nearly as generous "you can work from anywhere you want except places where we legally can't let you like Crimea and Iran, and places that are known to coerce people into spying for them like China and Russia".
Most companies operate on a whitelist of places where you can work (where they have offices), not a blacklist. Even many remote companies operate on a whitelist (e.g. "Remote, US only"). Really, I'm amazed they feel that they can operate on a black list approach at all and not accidentally violate tons of local laws.
If Bob wants to move to China, where the company doesn't have an office, he's going to have to resign or take a leave of absence.
This decision on Gitlab's part would be moving their incredibly generous "you can work from anywhere you want except places where we legally can't let you like Crimea and Iran" to a nearly as generous "you can work from anywhere you want except places where we legally can't let you like Crimea and Iran, and places that are known to coerce people into spying for them like China and Russia".
Most companies operate on a whitelist of places where you can work (where they have offices), not a blacklist. Even many remote companies operate on a whitelist (e.g. "Remote, US only"). Really, I'm amazed they feel that they can operate on a black list approach at all and not accidentally violate tons of local laws.
I may be reading into things here but it sounds a lot like the reason for this is to gain business from the US Government. Limiting reach from governments such as China and Russia is already standard practice for most security/defense related functions of the government.
Yes, and didn’t they also just have a fairly abrupt about-face in terms of doing business with ethically-questionable customers?
MSFT just recently won a 10B cloud deal from the DoD, perhaps the purse is still open there?
MSFT just recently won a 10B cloud deal from the DoD, perhaps the purse is still open there?
there aren't that many countries. turning the black-list into a white-list is not hard, so it really wouldn't make any practical difference.
There are a lot of countries.
there are about 250 or so. it's not hard to make a complete list and drop the few undesired ones.
The point is that those 250 countries all have different legislation and cultures. The only concern is not "we don't want the Chinese government to have access to user data". That's the only concern for Gitlab (well that and not violating US laws in regards to who they can do business with), but it is not as simple for many other companies.
Going from a whitelist to a blacklist is hard because you need to either individually vet every country and decide if they're ok, or you need to just assume a lot of countries are ok.
Going from a blacklist to a whitelist is obviously trivial.
Going from a whitelist to a blacklist is hard because you need to either individually vet every country and decide if they're ok, or you need to just assume a lot of countries are ok.
Going from a blacklist to a whitelist is obviously trivial.
i am not sure we are getting anywhere with this argument. i don't really see the point. when a list has a fixed number of possible entries, then the difference between whitelist and blacklist is purely academic. the result is exactly the same.
You seem to be talking about reciprocal lists (blacklist of 3 -> whitelist of 247, whitelist of 10 -> blacklist of 240, etc), which is not what OC was talking about. OC was specifically talking about going from a "small whitelist" to a "small blacklist". Not a "large whitelist to a small blacklist" and certainly not anything the other way around.
Whitelist with 3 countries: I have vetted three countries, and know my employees can operate in those countries legally without issues.
Blacklist with 3 countries: I either need to vet 247 countries to ensure my employees can operate there legally, or I am just assuming that those 247 countries are fine without actually doing the due diligence.
Again, going from a blacklist of 3 countries to a whitelist of 247 countries is obviously not an issue. You're operating on the same data. The issue is going from a whitelist of say 3 countries and then not going to a reciprocal blacklist of 247 countries, but a much smaller blacklist of 3. This is what Gitlab has effectively done in OC's estimation. That either means you vetted those 244 extra countries that are now on your "whitelist", or you're making a lot of assumptions.
Whitelist with 3 countries: I have vetted three countries, and know my employees can operate in those countries legally without issues.
Blacklist with 3 countries: I either need to vet 247 countries to ensure my employees can operate there legally, or I am just assuming that those 247 countries are fine without actually doing the due diligence.
Again, going from a blacklist of 3 countries to a whitelist of 247 countries is obviously not an issue. You're operating on the same data. The issue is going from a whitelist of say 3 countries and then not going to a reciprocal blacklist of 247 countries, but a much smaller blacklist of 3. This is what Gitlab has effectively done in OC's estimation. That either means you vetted those 244 extra countries that are now on your "whitelist", or you're making a lot of assumptions.
you are right, i completely misread that.
Sound like "loyal and high performing" Bob could land a new gig. Life is about choice and Bob might have a difficult one. I hope he'd stay with Su. Better and Worse and all that.
> (a) resigning his job or (b) being forced into a long distance relationship with lots of travel between China and the US, or (c) divorcing his wife.
You forgot D that gitlab is actively discussing which is a role change while staying with the company.
You forgot D that gitlab is actively discussing which is a role change while staying with the company.
Then the good thing is that you are not married to the company you work for. You can even work for more than one at the same time; to be married to more than one person is so much more difficult :/>
"Working vacation."
Do one or the other, please. Otherwise you're not doing either very well.
Do one or the other, please. Otherwise you're not doing either very well.
>Or, What about if one of their employees is married (or wants to get married) to a legal resident of one of these countries? How far removed does the employee have to be from this risk?
Security clearance background checks will cover this sort of thing. For sensitive government contract work, clearances are generally required for the relevant contractor employees.
For non-government customers who still have these concerns, I’m not sure there’s a good answer. I guess you could define your own clearance process and run similar background checks - many of the government’s own background checks are done by private investigators already.
Security clearance background checks will cover this sort of thing. For sensitive government contract work, clearances are generally required for the relevant contractor employees.
For non-government customers who still have these concerns, I’m not sure there’s a good answer. I guess you could define your own clearance process and run similar background checks - many of the government’s own background checks are done by private investigators already.
> "It seems odd that we proclaim that we will accept any customer not prohibited by law (b5a35716) but we are implementing controls that impact employees based on a perceived political climate. This is contradictory."
Second this
Second this
Accepting any customer serves the customers interest.
According to customer requests that their sensitive information not be placed in a situation where it could be relatively easily accessed by state actors ... serves the customers interest.
That’s not contradictory, except in the most superficial sense of “but we have open arms for everyone”.
According to customer requests that their sensitive information not be placed in a situation where it could be relatively easily accessed by state actors ... serves the customers interest.
That’s not contradictory, except in the most superficial sense of “but we have open arms for everyone”.
Nothing stops state actor to access sensitive information through backdooring cleared engineer's system.
That’s not at all contradictory. Employees aren’t customers.
I love to see how propaganda works. The top comment even congratulates gitlab.
I don't understand what I am reading, I feel I am missing some context... Is it about being afraid the Chinese and Russian state will spy on user data if some employees are located in those countries? Or were there updates to their laws that made it mandatory to open databases to the state if an employee is located in these countries?
It's actually in the discussion:
> There is an unacceptably high risk that these nations may apply pressure to individuals living within their borders with sensitive data access (based their role at GitLab). It is our concern. And it is the stated concerns of several customers.
The discussion is actually pretty significant, as they sort out how they might manage the _customer demand_ that is creating these hiring blocks, and in turn, how that is reported and tracked.
I don't see this as a purely "done deal", it's a company having very important discussions in the open that most would just default to "restricted". All this transparency is a great source for others to learn from.
> There is an unacceptably high risk that these nations may apply pressure to individuals living within their borders with sensitive data access (based their role at GitLab). It is our concern. And it is the stated concerns of several customers.
The discussion is actually pretty significant, as they sort out how they might manage the _customer demand_ that is creating these hiring blocks, and in turn, how that is reported and tracked.
I don't see this as a purely "done deal", it's a company having very important discussions in the open that most would just default to "restricted". All this transparency is a great source for others to learn from.
After activating JS I could see the discussion, sorry.
Going a bit deeper, it seems to be a specific demand by a potential client. Can make sense for activists, journalists, humanitarians. Makes sense for gitlab to push back too though.
Going a bit deeper, it seems to be a specific demand by a potential client. Can make sense for activists, journalists, humanitarians. Makes sense for gitlab to push back too though.
Why does it make sense for Gitlab to push back on a reasonable request from customers?
Probably in relation to this:
https://www.chinalawblog.com/2019/09/chinas-new-cybersecurit...
Whether it's real or not or even likely to be effective, there's a chilling effect and businesses are obviously concerned to be raising the issue of Chinese-based employees with GitLab.
https://www.chinalawblog.com/2019/09/chinas-new-cybersecurit...
Whether it's real or not or even likely to be effective, there's a chilling effect and businesses are obviously concerned to be raising the issue of Chinese-based employees with GitLab.
Oh, China is finally following US policies on full takes. Not entirely unexpected. The difference is that China observes their borders, whilst the USA does full takes everywhere they can, which is everywhere in the west.
What is a full take, what do you mean by US policies on full takes, and can I also have a source on US performing full takes everywhere in the west? Thanks!
The USA Cloud Act of 2018.
Every US company must hand over any customer data held anywhere, by any subsidiary or joint venture, on earth at the request of the US government.
Every US company must hand over any customer data held anywhere, by any subsidiary or joint venture, on earth at the request of the US government.
So. As a freelancer living in one of the scary red states and seeing a lot of US people and companies in the potential client crowd, should I now start looking for opportunities more in Asia, South America and Africa? Is the Gitlab client's sentiment spreading among Western companies?
Reading the discussion, it appears this policy was due to a customer request, and not some legal requirement.
I wonder how the HN crowd feels about that? There was a lot of talk recently about how companies should not sacrifice their values and kowtow to the demands of large clients.
As a company that values freedom of movement and is remote first, this prevents their employees from moving to where they want. Does this also mean they can’t vacation there either?
I wonder how the HN crowd feels about that? There was a lot of talk recently about how companies should not sacrifice their values and kowtow to the demands of large clients.
As a company that values freedom of movement and is remote first, this prevents their employees from moving to where they want. Does this also mean they can’t vacation there either?
> Does this also mean they can’t vacation there either?
No, the post is fairly explicit about what the proposed block is.
While I agree with the position that companies should avoid trading ethics for short-term profit, this is a move I hesitate to condemn - the cost is fairly minimal (their remote-first position is still quite generous), and there is much to be said for the increase in privacy and security this provides their customers.
No, the post is fairly explicit about what the proposed block is.
While I agree with the position that companies should avoid trading ethics for short-term profit, this is a move I hesitate to condemn - the cost is fairly minimal (their remote-first position is still quite generous), and there is much to be said for the increase in privacy and security this provides their customers.
Completely dumb that it even came up to this level of discussion. Fire that contract & opportunity into the sun and move on with your life.
This is just ridiculous. It is truly unfair to discriminate people based on the country of their birth. It's not like they had a choice.
Am I the only one who thinks that both China and Russia have spies who are not native Chinese or Russians? And are people really naive to believe that a stupid decision like this would prevent China or Russia from trying to obtain the information they need (if they really want it)
Am I the only one who thinks that both China and Russia have spies who are not native Chinese or Russians? And are people really naive to believe that a stupid decision like this would prevent China or Russia from trying to obtain the information they need (if they really want it)
You might have misread the issue at hand, this is not discriminating on country of birth, but country of residence. You can choose not to continue living in the above mentioned countries, and this would no longer be a problem it seems.
Ultimately it affects the developers who are born in China and Russia as well. Not everyone can afford migrating to a "white listed" country due to various reasons like family, friends and other commitments.
How is that different from any other job? Unless they support remote work, which most don't, is it not discrimination for a job to only consider people who are willing to move to city X or country Y?
[deleted]
> Eric Johnson @edjdev · 5 days ago
> Owner
> @cciresi I appreciate your position. Please be aware there is an active, time-sensitive contract negotiation linked to this matter. And you need to advocate to the DRI that the company walk away from that contract in order to enact your proposal.
https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not...
Well now, that's interesting.
> @cciresi I appreciate your position. Please be aware there is an active, time-sensitive contract negotiation linked to this matter. And you need to advocate to the DRI that the company walk away from that contract in order to enact your proposal.
https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not...
Well now, that's interesting.
See https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/... for more discussions. Here's one from sytses (CEO/co-founder)
> @cciresi this is a request from a customer considering using GitLab.com. @mmcb has more context on the why. We should probably add that to the MR.
Probably the US government or something like that?
> @cciresi this is a request from a customer considering using GitLab.com. @mmcb has more context on the why. We should probably add that to the MR.
Probably the US government or something like that?
I'm not sure I've ever 180'd on a compliance practice as quickly as I have with GitLab's compliance policy repo transparency. When I first stumbled across it during the telemetry situation last week I thought they were nuts. Absolutely nuts. But reading through this thread and the one posted last week it seems like an incredibly effective approach. People from all areas of the company, not just legal/compliance are giving input and asking the right questions. And, just as important, they're not asking the wrong questions.
It's a bit of a chicken/egg situation - is there a strong culture of compliance because of the transparency or does the strong culture of compliance make transparency a non-issue? Whatever their secret sauce I think Wall Street could use some.
It's a bit of a chicken/egg situation - is there a strong culture of compliance because of the transparency or does the strong culture of compliance make transparency a non-issue? Whatever their secret sauce I think Wall Street could use some.
This one actually makes me scared for Gitlab. I feel like their exposing themselves to a lot of extra liability by making these discussions public.
For instance - it's been suggested (I don't know if rightly or wrongly) that they have a customer who asked them to do something that would violate the US boycott laws. I'll assume that it is the case that they've been asked to violate these laws.
According to a plain reading of a document someone linked here [0] that means they are required to report the request to the US government. I'll assume that it is the case that they are required to report it too, even though I'm not a lawyer, and that's not really an authoritative source.
> The EAR requires U.S. persons to report quarterly requests they have received to take certain actions to comply with, further, or support an unsanctioned foreign boycott.
If they don't (because they forgot, because they disagree with that interpretation of the law, because they don't want to piss off the customer, etc) they now have a public facing record of them violating the law. Even if the assumptions are wrong (they likely are) and they aren't violating the law, someone might decide they are and it might result in lengthy/costly legal battles.
How many other examples like this probably live in that repo for anyone to see?
[0] https://www.bis.doc.gov/index.php/enforcement/oac
For instance - it's been suggested (I don't know if rightly or wrongly) that they have a customer who asked them to do something that would violate the US boycott laws. I'll assume that it is the case that they've been asked to violate these laws.
According to a plain reading of a document someone linked here [0] that means they are required to report the request to the US government. I'll assume that it is the case that they are required to report it too, even though I'm not a lawyer, and that's not really an authoritative source.
> The EAR requires U.S. persons to report quarterly requests they have received to take certain actions to comply with, further, or support an unsanctioned foreign boycott.
If they don't (because they forgot, because they disagree with that interpretation of the law, because they don't want to piss off the customer, etc) they now have a public facing record of them violating the law. Even if the assumptions are wrong (they likely are) and they aren't violating the law, someone might decide they are and it might result in lengthy/costly legal battles.
How many other examples like this probably live in that repo for anyone to see?
[0] https://www.bis.doc.gov/index.php/enforcement/oac
You're concerned because you're worried if they violate the law they'll be held legally accountable? Isn't that the entire point of transparency / accountability?
>Probably the US government or something like that?
The requirement to block some class of people off from some customers is nothing new, and back at Sun there was separate Sun Federal which was dedicated for such clean business.
GitLab's approach (and i think it is just a start of the trend in the industry, time to get rid of the accent :) while theatrically good isn't practically efficient. A Chinese or Russian residing here with some family back at the Motherland is susceptible to the same pressure in the loving, yet firm hands of the Motherland as if s/he were residing there her-/himself. So the next absolutely logical and necessary step for GitLab on this path is to block all Russians and Chinese who has at least some family back there. Giving that there may be other ties too and the hassle to verify (to which degree of relationship?), simply blocking all those nationals would the natural and practically efficient way.
The requirement to block some class of people off from some customers is nothing new, and back at Sun there was separate Sun Federal which was dedicated for such clean business.
GitLab's approach (and i think it is just a start of the trend in the industry, time to get rid of the accent :) while theatrically good isn't practically efficient. A Chinese or Russian residing here with some family back at the Motherland is susceptible to the same pressure in the loving, yet firm hands of the Motherland as if s/he were residing there her-/himself. So the next absolutely logical and necessary step for GitLab on this path is to block all Russians and Chinese who has at least some family back there. Giving that there may be other ties too and the hassle to verify (to which degree of relationship?), simply blocking all those nationals would the natural and practically efficient way.
It seems obvious to me that the kind of pressure to which you are referring is not limited to family. It would be easy enough to threaten a high school boyfriend. Or the family of your child's former best friend. Or a former co-worker. Or any friend. Or even a complete stranger.
Extortion can be effective well outside family lines.
And, of course, extortion is equally effective on USians, Brits, Indians, Nigerians, or anybody else.
Extortion can be effective well outside family lines.
And, of course, extortion is equally effective on USians, Brits, Indians, Nigerians, or anybody else.
The next obvious step is to block any employees married to a Russian or Chinese person.
It's about two steps away from intermittent camps.
I've never heard of Russian government using their state powers to take advantage of some developer and break into foreign network. That seems like strange and unethical move. I, personally, won't ever use Gitlab after that move.
Thanks, that's scary. May be I'm wrong.
Interestingly, Ukraine was also on the list initially, but then was removed. Is it a coincidence, that Gitlab co-founder, Dmitry Zaporozhets, is from Ukraine?
The real "threat" is more and more people, companies, and institutions caving in to pressure to take more explicit national-boundary stances.
Doesn't this directly imply non-US entities should have severe reservations about American SREs and Support Engineers?
Perhaps if they are Chinese or Russian and work closely with their nation's government or military, but in that case I imagine they probably are already taking whatever precautions they can to limit access by Americans.
That is just whataboutism. China has a long demonstrated history of using its intelligence services for the benefit of domestic corporations, as well as exploiting its citizens working overseas to aid in the same.
[deleted]
>I'm shocked (in a positive way) about the amount of transparency Gitlab provides.
Same here. I was pretty surprised they sent an apologise email few days ago
Saying sorry after actions you made, show how they care about their users
Same here. I was pretty surprised they sent an apologise email few days ago
Saying sorry after actions you made, show how they care about their users
Well, that's a "goodbye gitlab" for me.
What if large chinese customer to demand that none of US SRE engineers have access to their data?
What if China to ban GitLab?
You gotta lower your ideals of freedom if you wanna suck on the warm teat of China. (c)
You gotta lower your ideals of freedom if you wanna suck on the warm teat of China. (c)
Could someone "in the know" elaborate on what specifically prompted them to contemplate this? e.g. They mention concerns from enterprise customers.
I commend the transparency of debating it in the open, but I suspect it'll get hard to maintain reasonable discourse once the issue hits mainstream headlines and becomes sensationalized.
The suggestion does feel like a giant cudgel. I get there are genuine concerns, and I don't have better ideas to offer. I can't help feeling bad for legitimate future job applicants who will feel discriminated against. I'm sure if a bad actor wants to do something adversarial, they'll find ways around it (like agents in a non-banned country).
It used to feel like attitudes of major world powers were slowly converging (Russia got some democrazy, China started to open up its economy, tolerance seemed to be growing). Now it scares me how fast they're diverging. Politics is seeping deeper into tech, and it's going to get more fervent. Curtailing trade is loosening the ties between disparate cultures (https://www.cato.org/publications/commentary/peace-earth-fre...).
The internet was supposed to connect us all and help bring us closer together. What happened?
I commend the transparency of debating it in the open, but I suspect it'll get hard to maintain reasonable discourse once the issue hits mainstream headlines and becomes sensationalized.
The suggestion does feel like a giant cudgel. I get there are genuine concerns, and I don't have better ideas to offer. I can't help feeling bad for legitimate future job applicants who will feel discriminated against. I'm sure if a bad actor wants to do something adversarial, they'll find ways around it (like agents in a non-banned country).
It used to feel like attitudes of major world powers were slowly converging (Russia got some democrazy, China started to open up its economy, tolerance seemed to be growing). Now it scares me how fast they're diverging. Politics is seeping deeper into tech, and it's going to get more fervent. Curtailing trade is loosening the ties between disparate cultures (https://www.cato.org/publications/commentary/peace-earth-fre...).
The internet was supposed to connect us all and help bring us closer together. What happened?
[deleted](1)
I don't mind this, as long as they would offer a relocation from the country in question. I would even volunteer! It's not my fault I was born in this shithole.
The discussion on Gitlab is completely out of control now. Gitlab should never have opened that can of worms. Geopolitics and all, first started talking about limiting nationals of China and Russia to do certain jobs and now so many have conflated this to ethnicity, political views, hacking and anything in between.
One would this the best solution for this would be a Federated structure that would ensure a Chinese Systems administrator could only deal with whatever resources assigned (China maybe) and a US administrator can only work with whatever resources are assigned (U.S customers??). Therefore you can have the separation of data but please everyone.
I am not saying it would be simple to iron out, but it would allow for distrusting customers to all play together without worrying about data compromise.
Just a thought, i read all the comments and they are about politics and such and very few are about a technical solution to work for all.
One can argue only letting a Chinese Administrator work on a subset is again a geopolitical thing, but that point should be moot if other administrators are restricted as well.
I am not saying it would be simple to iron out, but it would allow for distrusting customers to all play together without worrying about data compromise.
Just a thought, i read all the comments and they are about politics and such and very few are about a technical solution to work for all.
One can argue only letting a Chinese Administrator work on a subset is again a geopolitical thing, but that point should be moot if other administrators are restricted as well.
Gitlab can restrict SRE selection for concerned clients and change their process to make sure every SRE doesn’t have access to every client. I’m sure some Chinese companies wouldn’t be happy to have American SREs access their data either and I can think about dozens other countries with political issues against each other.
But off topic, I’m wondering how many companies have similar policies that nobody knows just because they don’t have “open-source” policy.
Sadly recruitment process is polluted with many hidden policies and while we appreciate and expect honesty and transparency from applicants, the recruiters themselves aren’t anything close to honest and transparent.
But off topic, I’m wondering how many companies have similar policies that nobody knows just because they don’t have “open-source” policy.
Sadly recruitment process is polluted with many hidden policies and while we appreciate and expect honesty and transparency from applicants, the recruiters themselves aren’t anything close to honest and transparent.
IMO this is not really about hiring, the hiring aspect is just a temporary workaround for a broader policy/technical challenge.
Namely, how to maintain your overall organization and software-stack while internally isolating data-flows and rules which are unique to different jurisdictions.
Even if today it's some potential client expressing general concern, tomorrow it might be something you can't simply ignore, like an EU privacy law that must be complied with to avoid dropping a bunch of customers. (Or a demand by Elbonian officials for an account that lets their secret police snoop on Elbonian business, but hopefully that one would be resisted.)
Namely, how to maintain your overall organization and software-stack while internally isolating data-flows and rules which are unique to different jurisdictions.
Even if today it's some potential client expressing general concern, tomorrow it might be something you can't simply ignore, like an EU privacy law that must be complied with to avoid dropping a bunch of customers. (Or a demand by Elbonian officials for an account that lets their secret police snoop on Elbonian business, but hopefully that one would be resisted.)
This is where it is important to get back to first principles, and making distinctions based on nationality is less helpful than making distinctions based on rules-oriented-organisations vs. people-oriented organisations. The primary distinguishing characteristic which we need to pay attention to is rule-of-law and the power-predominance of rules-oriented-organizations across the political and economic system. This is something which should in principle be apolitical and possible to evaluate empirically.
Gitlab is investing hard on looking good in the press, but forgetting to fix their critical bugs. Their CI/CD feature is useless due to the bugs that are never fixed as they are not prioritized. One example is this 1-year old critical bug in CI/CD:
https://gitlab.com/gitlab-org/gitlab-runner/issues/4119 (Gitlab CI/CD jobs finishing midway with Success)
https://gitlab.com/gitlab-org/gitlab-runner/issues/4119 (Gitlab CI/CD jobs finishing midway with Success)
Deleting everything I have on gitlab and leaving this racist platform
As someone who resides in a neutral country, I fully support your decision. That’s how I feel about HN. Go well. I am also considering leaving HN because of propaganda against China and Russia. You will think USA is this saint when you read comments on HN. How I wish user base of HN wasn’t dominated by one country or can completely stay away from international politics. There are many other sites for such discussions.
[deleted]
So, give any quote from the link or elsewhere that in any way shows the reasoning for this consideration is based on how much they don’t like Chinese people or how inferior they are as a race. People keep throwing around the racist label even when it’s absolutely clear that it’s not about race. It’s about the Chinese and Russian governments and how they operate. These are legitimate informational/operational security concerns that can’t be waved away with "well, it’s racist to protect ourselves, so we just won’t".
>It’s about the Chinese and Russian governments and how they operate
Have you ever thought that Russian government consists of Russian people? Same with Chinese
Have you ever thought that Russian government consists of Russian people? Same with Chinese
Yes, so? Nobody is concerned about the Chinese because they’re Chinese. Unless the CCP adopts principles like freedom of speech or other values that are foundational to Western countries, the CCP is forever going to be at odds with us. As long as they oppress their population and minorities and expand their influence on neighboring countries in undemocratic ways, and seek to extend that influence to the West, there’s a conflict. And the conflict isn’t race. It’s values. This tolerating undemocratic behavior because it might be intolerant only allows authoritarian regimes like the CCP to continue their spread.
It’s hilarious and depressing to see people using their freedom of speech to defend China, a place that suppresses any and all criticism in absurdly draconian ways.
It’s hilarious and depressing to see people using their freedom of speech to defend China, a place that suppresses any and all criticism in absurdly draconian ways.
[deleted]
I'm a little surprised this isn't illegal, and it really should be. It's irrelevant whether or not this actually would work, it's in principle immoral.
(Poor English warning...)
As a Chinese I'm actually very disappointed at Gitlab. I think anyone wouldn't be happy if one's country is banned from the company. And I also think some people just worry too much about people in China. Actually, ordinary people in China are not so oppressed by the government. And ordinary developers from China is just as ones in America. Few of them will steal data from the company.
As a Chinese I'm actually very disappointed at Gitlab. I think anyone wouldn't be happy if one's country is banned from the company. And I also think some people just worry too much about people in China. Actually, ordinary people in China are not so oppressed by the government. And ordinary developers from China is just as ones in America. Few of them will steal data from the company.
This is reported in Gittalk (a high impact platform for Chinese IT workers). I admire the transparency. The issue can't be solved by a company alone. Practically there might be workaround but it's up to the employer..
Which clause of which act, or which executive order specifically prevent Gitlab from recruiting non-enemy state person?
Which clause of which act, or which executive order specifically prevent Gitlab from recruiting non-enemy state person?
This leads to discussion of using Chinese alternative other than Gitlab/GIthub, and the expansion would lead to more employment by Chinese code repository providers...
Everyone get what they want, in long term?
Everyone get what they want, in long term?
Today they have requested GitLab to enforce employment policy and GitLab started to implement it.
Tomorrow they will ask GitLab to inject backdoors and GitLab will implement that as well?
It is probably happening in other US tech companies at this time affecting those who want to get lucrative DoD and government contracts.
Tomorrow they will ask GitLab to inject backdoors and GitLab will implement that as well?
It is probably happening in other US tech companies at this time affecting those who want to get lucrative DoD and government contracts.
[deleted]
/s
"Gitlab considers" is the new "British scientist" news headline.
"Gitlab considers" is the new "British scientist" news headline.
How big of a customer one needs to be to request some other country citizens to be banned from working as SRE? How much do we need to pay to ban Israelis for example?
Am I missing something? Why does said customer just self host the open source software and purchase support. 90% of the sensitive issues will be solved
If you want to be serious about it, you probably have to temporarily revoke access privileges for anyone in that job role who is traveling there too.
You can never be sure, that the guy didn't sell his soul to intelligence agency and some government official during his visit. Better completely terminate the account and fire the employee if (s)he happened to travel there.
/sarcasm (just in case)
/sarcasm (just in case)
They likely will. If a customer is asking for something like this they probably aren't messing around.
First they came for the Russians, and I did not speak out —
Because I was not a Russian.
Then they came for the Chinese, and I did not speak out— Because I was not a Chinese.
...
Then they came for the Chinese, and I did not speak out— Because I was not a Chinese.
...
Well, the answer to that is simple. #boycottgitlab
I am working at a European company where the amount of Russian engineers is constantly increasing (similar thing happens in many of the bigger companies nearby). And they prove to be quite ok.
So since today I will speak strongly against use of Gitlab in my workplace should such a talk begin.
I am working at a European company where the amount of Russian engineers is constantly increasing (similar thing happens in many of the bigger companies nearby). And they prove to be quite ok.
So since today I will speak strongly against use of Gitlab in my workplace should such a talk begin.
I think you are confusing them having something against Russia(gov) with Russians(people).
They also clearly state that current employees will not be affected. Reading the motivation behind it and the possible dangers it would pose to their clients.
I think it's very reasonable not to continue having sensitive data be available in Rus & Chi.
What would you do in this case?
What would you do in this case?
Gitlabs actions affect Russians(people) and not Russia(gov).
Their motivation, should they apply it to UK, US, Spain and France, should lead them to forbid having employees from those countries as well.
As a Swede, I would not like my gitlab sensitive data to be in the hands of US gov.
If you really believe national security agencies do not apply pressure to any tech employees just because they are X citizens of their X country - you need to mature a little bit more, perhaps read Snowdens book and look into what happened with Wikileaks.
Their motivation, should they apply it to UK, US, Spain and France, should lead them to forbid having employees from those countries as well.
As a Swede, I would not like my gitlab sensitive data to be in the hands of US gov.
If you really believe national security agencies do not apply pressure to any tech employees just because they are X citizens of their X country - you need to mature a little bit more, perhaps read Snowdens book and look into what happened with Wikileaks.
Maybe Russian people should do something about their government then. Alas, it enjoys massive support.
What made you think the Russians are not OK with their government?
I think, that it’s reasonable not to use servers located in certain countries and not to use (closed-source) software made by some bigger companies there. I myself would not use much of the software or services from the countries mentioned. Because I know who might well be getting access to my data and what those people’s approximate values are.
But not hiring devs that are maybe trying to get away from those places? As a dev and an immigrant myself I could not just stay silent about that.
But not hiring devs that are maybe trying to get away from those places? As a dev and an immigrant myself I could not just stay silent about that.
If anything, I'll start doing exact opposite. So since today I will speak strongly in favor of use of Gitlab in my workplace should such a talk begin.
What? For me this is a big reason on why I want to use Gitlab.
I am european and I think you're being pretty stupid. You celebrate that the company you work for hire people in Russia rather from where you live. You seem to fail to realize that if all companies in your country would do that you would soon find yourself out of a job since there is always some place cheaper.
No one is saying russians aren't knowledgeable or good at what they do. Maybe you should read what they actually write instead of simply projecting your straw man ideas onto them.
I am european and I think you're being pretty stupid. You celebrate that the company you work for hire people in Russia rather from where you live. You seem to fail to realize that if all companies in your country would do that you would soon find yourself out of a job since there is always some place cheaper.
No one is saying russians aren't knowledgeable or good at what they do. Maybe you should read what they actually write instead of simply projecting your straw man ideas onto them.
Maybe you should read more about "protectionism", "nationalism" and "discrimination" - not just definitions, but how they affect economic.
How is their action discrimination? That's silly. Obviously it would be discrimination if they wouldn't hire people because they have a specific country of birth but that is not what they are doing.
They are afraid that the governments of China and Russia could easily force people who live in those countries to give up data. That is a valid concern since that is happening in China.
I know how it affects the economic. Just look at where stuff is produced. It's hard to find things that are produced in Europe or the states. You may say that this is a good thing but I disagree, the same thing could easily happen with software and that would be a dark day in my opinion.
I don't care if that would make me "poorer" in the sense that I can have less material goods. It would still be a better world in my view and better for the environment. I rather pay more for something produced in the EU than to have something shipped from China just to save a few bucks.
They are afraid that the governments of China and Russia could easily force people who live in those countries to give up data. That is a valid concern since that is happening in China.
I know how it affects the economic. Just look at where stuff is produced. It's hard to find things that are produced in Europe or the states. You may say that this is a good thing but I disagree, the same thing could easily happen with software and that would be a dark day in my opinion.
I don't care if that would make me "poorer" in the sense that I can have less material goods. It would still be a better world in my view and better for the environment. I rather pay more for something produced in the EU than to have something shipped from China just to save a few bucks.
I live in Europe and I use/consume things made in Europe every day. And instead of arguing to me, just read if protectionism was ever a good decision - just from the history.
> I rather pay more for something produced in the EU than to have something shipped from China just to save a few bucks.
Protectionism works quite contrary, so you do not support it anyway :)
> I rather pay more for something produced in the EU than to have something shipped from China just to save a few bucks.
Protectionism works quite contrary, so you do not support it anyway :)
Yes, it certainly is a good decision. For example, if we had no protections like customs China would easily subsidize any market they wish to gain monopoly of the market in question.
This is happening even WITH protectionism like customs and tolls. Chinas government subsidize stuff like steel production which makes it hard for companies like SSAB in Sweden to compete with them since they sell their steel cheaper than the cost to produce it.
How shall countries protect themselves from countries that act like that without protecting their market? It's extremely naive to think that countries that are rough dictatorships will play fair and nice.
EU should have A LOT higher customs against countries like China. Trading with them on a fair level gives them too much economic control which is good for us in the short term but incredibly bad in the long term.
That is why south park can make an episode like "Band in China" today because we have already given them a lot of control.
This is happening even WITH protectionism like customs and tolls. Chinas government subsidize stuff like steel production which makes it hard for companies like SSAB in Sweden to compete with them since they sell their steel cheaper than the cost to produce it.
How shall countries protect themselves from countries that act like that without protecting their market? It's extremely naive to think that countries that are rough dictatorships will play fair and nice.
EU should have A LOT higher customs against countries like China. Trading with them on a fair level gives them too much economic control which is good for us in the short term but incredibly bad in the long term.
That is why south park can make an episode like "Band in China" today because we have already given them a lot of control.
One thing is a response to unfair competition and completely different - protectionism just to support local companies and give them advantage in competition - it leads to stagnation.
Does that reading include Russia's plan to create their own internet free of influence from the rotten West?
"Influence"? Lol :) They want to isolate own people from any information, it's pure dictatorship, not related to anything I enlisted.
There is no such plan, you are misinformed.
And you know this how?
https://www.bbc.com/news/world-europe-50259597
https://www.bbc.com/news/world-europe-50259597
Haven't you heard about Russell's teapot? The burden of proof lies on you.
For one thing, such isolation of Russian internet would have negative economic effect and it's the last thing Putin needs.
For one thing, such isolation of Russian internet would have negative economic effect and it's the last thing Putin needs.
Dumb customers are dumb customers, but the bigger question is how bad is Gitlab's backend architecture that this is a concern at all?
Why are you assuming that their backend architecture is bad when these positions touch sensitive data much more frequently than a software engineering position in companies globally?
In order to effectively support customers, you need to make a decision into how much visibility you'll give customers. Alternatively, you give your support the even more unfortunate circumstance of needing to request sensitive data.
SREs need to be able to work with hardware and software and by virtue of needing to take decisive action are in a similar situation.
In order to effectively support customers, you need to make a decision into how much visibility you'll give customers. Alternatively, you give your support the even more unfortunate circumstance of needing to request sensitive data.
SREs need to be able to work with hardware and software and by virtue of needing to take decisive action are in a similar situation.
So Gitlab will reject Tourist or Petr because they are Russian nationals (if they felt like working for Gitlab), I guess?
I thought fairly standard industry practice prohibits prod access ACLs to engineers inside China or Russia.
Well done. Bravo. No irony. Really well done. Thank you for showing the way.
I consider not using Gitlab.
I live in Spain but was born in Russia, I moved 3 years ago because I hate current russian government and still I hope russian and chinese companies and engineers will boycott Gitlab in response. Such offensive nationalism should not be forgiven.
You moved from a openly repressive country to another secretly repressive country. Congratulations ;) Hope you have the possibility to freely move around Europe, as you'll probably will need to use it in the future
actually if you read the comments, the internet in general wasn't super supportive.
kinda crazy, how different audiences get very different reactions.
kinda crazy, how different audiences get very different reactions.
what if a customer came in requesting not having women engineers accessing their data? I wonder if gitlab would consider that
This is one strange company.
Imagine if governments worked like this? Holy hell. This is what Assange should have aimed for instead of getting involved in geopolitical intrigue.
Imagine if governments worked like this? Holy hell. This is what Assange should have aimed for instead of getting involved in geopolitical intrigue.
It is a completely necessary action.
The National Intelligence Law of China, passed in 2017, demands that all its citizens "support, assist and comply with works on national intelligence", aka proactively collect intelligence for the regime. (Article 7)
(《国家情报法》第七条 任何组织和公民都应当依法支持、协助和配合国家情报工作，保守所知悉的国家情报工作秘密。 )
This also explains why Huawei devices SHALL be excluded from core communication networks of the free world.
Additionly, unless Jingping 11th go off from his power, the nation should simply be considered another Soviet Union, or even worse, the Nazi.
The National Intelligence Law of China, passed in 2017, demands that all its citizens "support, assist and comply with works on national intelligence", aka proactively collect intelligence for the regime. (Article 7)
(《国家情报法》第七条 任何组织和公民都应当依法支持、协助和配合国家情报工作，保守所知悉的国家情报工作秘密。 )
This also explains why Huawei devices SHALL be excluded from core communication networks of the free world.
Additionly, unless Jingping 11th go off from his power, the nation should simply be considered another Soviet Union, or even worse, the Nazi.
In my opinion, GitHub should have blocked all Chinese IP addresses on the day the CCP decided to try to firewall it.
[deleted]
Well, technically you should then block people from these countries irrespective of where they reside. They have extended families back in their home countries, so the spooks can still lean on them quite heavily, and there's nothing they'll be able to do.
This is why I refused to obtain a DoD security clearance when my job needed me to: I go to Russia to visit my family every 2-3 years, and I don't want to be in any way valuable to their intelligence services or the like, nor do I want to put myself or my family in danger.
All of the above is in spite of me having spent most of my life in the US by now.
IMO a better solution is for nobody to have permanent access, and granting it on as-needed basis, with a full audit trail. It's not perfect, but it's a heck of a lot better than the ineffectual geography-based blocking that you are implementing.
This is why I refused to obtain a DoD security clearance when my job needed me to: I go to Russia to visit my family every 2-3 years, and I don't want to be in any way valuable to their intelligence services or the like, nor do I want to put myself or my family in danger.
All of the above is in spite of me having spent most of my life in the US by now.
IMO a better solution is for nobody to have permanent access, and granting it on as-needed basis, with a full audit trail. It's not perfect, but it's a heck of a lot better than the ineffectual geography-based blocking that you are implementing.
Ever since the China attack in 2010 when Google pulled out of China, Google has prohibited access to user data from employees in China. They gave since expanded to a more general geographic blocking system.
I assume Gitlab lacks the sophistication to do this split of user data access vs other business operations.
Gitlab runs an open source company, so I don't understand why they are so concerned about China and Russia. Is it for anonymous/confidential customers?
I assume Gitlab lacks the sophistication to do this split of user data access vs other business operations.
Gitlab runs an open source company, so I don't understand why they are so concerned about China and Russia. Is it for anonymous/confidential customers?
hkai(1)
Waterluvian(1)
This is a great move by Gitlab. I'd love to see more companies going in a similar direction.
Yep. It also would be nice to provide a form where clients would be able to select race, sex, age, sexual orientation, religion and other employee parameters as they wish to build a real dream team.
Just a simple checkbox for "lives in a data-hoovering authoritarian regime" would be enough!
Basically all services in the US + Europe (and Russia, and China, and more) disappears with that inclusion.
I think one of the reasons should be that Gitlab does not have many enterprise customers in China and Russia. Native Chinese or Russian speakers are not needed for Support.
Russians and Chinese could not care less but gitlab. They have progressed so much in the last years, they have their own gitlab systems. Demonizing Russia and China for bad practices and not doing any introspection on yourself is hypocritical. US suppremacy is over. Get on with it
I understand the basic issues involved here. Both countries are doing very odd things when it comes to information and privacy. However, I feel like making this a "country issue" is really not exactly the right horse to ride on. Rather, I think it should be stated due to the security policies of these governments, we are banning them as information safeholds at this time or something of the sort. Then, the issue is LESS the country, and more the governmental informational policies.
But the problem isn’t storing information in these countries in this case. It’s how these are known to coerce nationals with ties to the homeland into spying for them.
@edjdev wrote
There is an unacceptably high risk that these nations may apply pressure to individuals living within their borders with sensitive data access (based their role at GitLab).
Given the current australian law changes, the rampant israelian IT spy sector and despotic Belarus position on human rights, it's surprising that they only mention China and Russia. This whole debacle doesn't look good and makes one to loose all faith in Gitlab.
Given the current australian law changes, the rampant israelian IT spy sector and despotic Belarus position on human rights, it's surprising that they only mention China and Russia. This whole debacle doesn't look good and makes one to loose all faith in Gitlab.
Debacle? The week hasn't even started yet. Let's take a moment to breathe.
China and Russia are known to put pressure or watch/listen on nationals who work in key positions in foreign companies.
As US allys Australia, Israel don't pose the same threat. A lot of information that could be gained would be available through the US government and shared with the those parties if there was a need.
China and Russia are known to put pressure or watch/listen on nationals who work in key positions in foreign companies.
As US allys Australia, Israel don't pose the same threat. A lot of information that could be gained would be available through the US government and shared with the those parties if there was a need.
That is a load of cow manure aka confirmation bias. Israel has no compunction spying on the US.
https://en.m.wikipedia.org/wiki/Jonathan_Pollard
https://www.google.com/amp/s/amp.theguardian.com/world/2019/...
There are definitely Chinese and Russian spies but there are spies from many countries besides those. The question is why are you singling out those countries and why now.
The reason is that there is a Cold War brewing between the US and China and this company has become an agent of that war.
The seems to be a propaganda war against China brewing in the US. I last saw this level of jingoism when Bush Jr decided to take over Iraq on the pretense of Saddam Hussein supposedly having nuclear weapons. All the TV network anchors were pushing for war and pushing the supposed threat. Later we find out it was all lies.
https://en.m.wikipedia.org/wiki/Jonathan_Pollard
https://www.google.com/amp/s/amp.theguardian.com/world/2019/...
There are definitely Chinese and Russian spies but there are spies from many countries besides those. The question is why are you singling out those countries and why now.
The reason is that there is a Cold War brewing between the US and China and this company has become an agent of that war.
The seems to be a propaganda war against China brewing in the US. I last saw this level of jingoism when Bush Jr decided to take over Iraq on the pretense of Saddam Hussein supposedly having nuclear weapons. All the TV network anchors were pushing for war and pushing the supposed threat. Later we find out it was all lies.
Spying is happening between all nations and the leaked cables showed this.
Why those two countries specifically? In Russia you can get imprisoned for a variety of political/strategic reasons if you refuse to cooperate. China implemented there own internet for spying.
When you visit these countries you are advised to buy new devices and throw them out on return to avoid backdoors.
General Powell misleading the UN and TV networks was based on having chemical weapons. Nuclear weapons is the fear with Iran. It was believed because the UN weapon inspector Hans Blix was being railroaded with fake traffic jams and other tactics preventing him from investigating. After he pulled out and Sadam had a history of using these types of weapons on his own people, it made the claim easier to accept without more proof.
Why those two countries specifically? In Russia you can get imprisoned for a variety of political/strategic reasons if you refuse to cooperate. China implemented there own internet for spying.
When you visit these countries you are advised to buy new devices and throw them out on return to avoid backdoors.
General Powell misleading the UN and TV networks was based on having chemical weapons. Nuclear weapons is the fear with Iran. It was believed because the UN weapon inspector Hans Blix was being railroaded with fake traffic jams and other tactics preventing him from investigating. After he pulled out and Sadam had a history of using these types of weapons on his own people, it made the claim easier to accept without more proof.
Direct imprisonment in Russia isn't the reason for this topic, Federal Security Service had succesfully got their cooperation proposal accepted in most of the cases due to the unlimited number of ways they could coerce their target.
>get imprisoned for a variety of political/strategic reasons if you refuse to cooperate
The same is true of Australia, the USA, and the UK - these nations have no issues with imprisoning each others citizens if it behooves them - i.e. if the individual chooses not to cooperate with the military-industrial-pharmaceutical complex.
The same is true of Australia, the USA, and the UK - these nations have no issues with imprisoning each others citizens if it behooves them - i.e. if the individual chooses not to cooperate with the military-industrial-pharmaceutical complex.
Yes debacle, because why are we only talking about gov secrets here. You know, industrial espionage is real too and some big potential customers could just as well reside outside the US.
>As US allys Australia, Israel don't pose the same threat
China or Russia would not pose any threat if they managed to completely infiltrate US institutions, because they would be, at this stage, the US greatest allies. Sure, China might try to constantly drag the US into pointless wars in Asia, but again it would be fine because it would be to defend the interests of China, the greatest ally.
China or Russia would not pose any threat if they managed to completely infiltrate US institutions, because they would be, at this stage, the US greatest allies. Sure, China might try to constantly drag the US into pointless wars in Asia, but again it would be fine because it would be to defend the interests of China, the greatest ally.
Even as a reader, it almost feels as if someone misconfigured the ACLs or I'm reading leaked internal documents, not an intentional decision to make this open. Some of the discussions seem highly sensitive, and yet it seems to work for them.
Thank you, Gitlab, for being so open! I've learned a lot about compliance from just reading this thread. For anyone curious, here's some background on the mentioned boycott laws: https://www.bis.doc.gov/index.php/enforcement/oac