35 ms·

Gitlab considers not hiring SREs and Support Engineers in China and Russia

• michaelxia 7y ago
  actually if you read the comments, the internet in general wasn't super supportive. kinda crazy, how different audiences get very different reactions.
• capableweb 7y ago
  See https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/32606 https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/... for more discussions. Here's one from sytses (CEO/co-founder) > @cciresi this is a request from a customer considering using GitLab.com. @mmcb has more context on the why. We should probably add that to the MR. Probably the US government or something like that?
  • elliekelly 7y ago
    I'm not sure I've ever 180'd on a compliance practice as quickly as I have with GitLab's compliance policy repo transparency. When I first stumbled across it during the telemetry situation last week I thought they were nuts. Absolutely nuts. But reading through this thread and the one posted last week it seems like an incredibly effective approach. People from all areas of the company, not just legal/compliance are giving input and asking the right questions. And, just as important, they're not asking the wrong questions. It's a bit of a chicken/egg situation - is there a strong culture of compliance because of the transparency or does the strong culture of compliance make transparency a non-issue? Whatever their secret sauce I think Wall Street could use some.
    • gpm 7y ago
      This one actually makes me scared for Gitlab. I feel like their exposing themselves to a lot of extra liability by making these discussions public. For instance - it's been suggested (I don't know if rightly or wrongly) that they have a customer who asked them to do something that would violate the US boycott laws. I'll assume that it is the case that they've been asked to violate these laws. According to a plain reading of a document someone linked here [0] that means they are required to report the request to the US government. I'll assume that it is the case that they are required to report it too, even though I'm not a lawyer, and that's not really an authoritative source. > The EAR requires U.S. persons to report quarterly requests they have received to take certain actions to comply with, further, or support an unsanctioned foreign boycott. If they don't (because they forgot, because they disagree with that interpretation of the law, because they don't want to piss off the customer, etc) they now have a public facing record of them violating the law. Even if the assumptions are wrong (they likely are) and they aren't violating the law, someone might decide they are and it might result in lengthy/costly legal battles. How many other examples like this probably live in that repo for anyone to see? [0] https://www.bis.doc.gov/index.php/enforcement/oac https://www.bis.doc.gov/index.php/enforcement/oac
      • fastball 7y ago
        You're concerned because you're worried if they violate the law they'll be held legally accountable? Isn't that the entire point of transparency / accountability?
  • trhway 7y ago
    >Probably the US government or something like that? The requirement to block some class of people off from some customers is nothing new, and back at Sun there was separate Sun Federal which was dedicated for such clean business. GitLab's approach (and i think it is just a start of the trend in the industry, time to get rid of the accent :) while theatrically good isn't practically efficient. A Chinese or Russian residing here with some family back at the Motherland is susceptible to the same pressure in the loving, yet firm hands of the Motherland as if s/he were residing there her-/himself. So the next absolutely logical and necessary step for GitLab on this path is to block all Russians and Chinese who has at least some family back there. Giving that there may be other ties too and the hassle to verify (to which degree of relationship?), simply blocking all those nationals would the natural and practically efficient way.
    • supportlocal4h 7y ago
      It seems obvious to me that the kind of pressure to which you are referring is not limited to family. It would be easy enough to threaten a high school boyfriend. Or the family of your child's former best friend. Or a former co-worker. Or any friend. Or even a complete stranger. Extortion can be effective well outside family lines. And, of course, extortion is equally effective on USians, Brits, Indians, Nigerians, or anybody else.
    • vkou 7y ago
      The next obvious step is to block any employees married to a Russian or Chinese person.
    • select-all 7y ago
      It's about two steps away from intermittent camps.
• bluehatbrit 7y ago
  The title seems misleading, the article specifically states this does not effect any current employees, presumably as they have none in China and Russia. > As such we feel a country block is the most humane solution at this time--especially because it affects zero current employees
  • dredmorbius 7y ago
    The block is on current non-residents of China or Russia from moving to those countries. <strike>Not on any present residents of those countries from having further access.</strike> <BOLD>See self-reply below, not the case.</BOLD> Though that is alluded to as a possibility, with complications. ________________________________ Update: My first read was incorrect.
    • bluehatbrit 7y ago
      Hm, upon a re-read I think you are right. Thanks for clarifying.
      • dredmorbius 7y ago
        And on my own re-read: "Current team members are prevented from moving to these countries and remaining in a role that prohibits it." That would seem to apply to current employees in Russia / China who are in roles covered by the block. Which is kind of A Big Deal.
        • zonidjan 7y ago
          No? It would seem to apply to current employees who move to Russia/China who are in roles covered by the block. i.e. they would have the choice of moving and changing roles/quitting, or staying.
          • dredmorbius 7y ago
            Depends on whether you read that as: X: "Current team members" A: "moving to these countries" B: "remaining in a role that prohibits it" X are prevented from BOTH A AND B. (X may do neither A NOR B) Or: X are prevented from (A AND B). Whether or not remaining in one of these countries and MOVING to a role that prohibits it is included in the prohibition is unclear. Someone's future transfer may hinge on that.
• gpm 7y ago
  The title here really should say "considers" - the discussion seems to be ongoing - and it looks like legal is advising strongly against it.
• type0 7y ago
  @edjdev wrote There is an unacceptably high risk that these nations may apply pressure to individuals living within their borders with sensitive data access (based their role at GitLab). Given the current australian law changes, the rampant israelian IT spy sector and despotic Belarus position on human rights, it's surprising that they only mention China and Russia. This whole debacle doesn't look good and makes one to loose all faith in Gitlab.
  • wolco 7y ago
    Debacle? The week hasn't even started yet. Let's take a moment to breathe. China and Russia are known to put pressure or watch/listen on nationals who work in key positions in foreign companies. As US allys Australia, Israel don't pose the same threat. A lot of information that could be gained would be available through the US government and shared with the those parties if there was a need.
    • type0 7y ago
      Yes debacle, because why are we only talking about gov secrets here. You know, industrial espionage is real too and some big potential customers could just as well reside outside the US.
    • babesh 7y ago
      That is a load of cow manure aka confirmation bias. Israel has no compunction spying on the US. https://en.m.wikipedia.org/wiki/Jonathan_Pollard https://en.m.wikipedia.org/wiki/Jonathan_Pollard https://www.google.com/amp/s/amp.theguardian.com/world/2019/sep/12/israel-planted-spying-devices-near-white-house-says-report https://www.google.com/amp/s/amp.theguardian.com/world/2019/... There are definitely Chinese and Russian spies but there are spies from many countries besides those. The question is why are you singling out those countries and why now. The reason is that there is a Cold War brewing between the US and China and this company has become an agent of that war. The seems to be a propaganda war against China brewing in the US. I last saw this level of jingoism when Bush Jr decided to take over Iraq on the pretense of Saddam Hussein supposedly having nuclear weapons. All the TV network anchors were pushing for war and pushing the supposed threat. Later we find out it was all lies.
• benologist 7y ago
  Probably an idea to throw Australia on that list - https://www.zdnet.com/article/whats-actually-in-australias-encryption-laws-everything-you-need-to-know/ https://www.zdnet.com/article/whats-actually-in-australias-e...
  • LilBytes 7y ago
    I'm surprised we (Australia) aren't already on more of these lists. After having this discussion with my manager and colleagues (the conversation with my manager was in my interview process where I bluntly stated if I was asked to comply with anything from this law, I'd immediately resign, my manager also agreed). Everyone I've spoken to agreed we'd immediately resign since it was the only potential option to protect our selves as employees and our employers. Edit: I'll need to spend a little more time looking into the Assistance and Access Laws. The following article attempts to downplay some of these concerns: https://www.homeaffairs.gov.au/about-us/our-portfolios/national-security/lawful-access-telecommunications/myths-assistance-access-act https://www.homeaffairs.gov.au/about-us/our-portfolios/natio...
    • deleted 7y ago
      [deleted]
    • baroffoos 7y ago
      > I'd immediately resign You are assuming that is actually an option. There is nothing to suggest the current Australian government would not prevent you from resigning until the task had been completed. This is the same government currently attempting to make it illegal to boycott businesses that are damaging to the environment.
      • angry_octet 7y ago
        They don't have legal authority to prevent you from resigning. Also, the proposed anti-boycott rules have been widely criticized as unconstitutional, unworkable and ludicrously against the conservatives free speech pronouncements. Unlikely they would get support from Senate cross bench.
• archie2 7y ago
  Do they already block Australia, because of the backdoor laws passed a while back?
  • dredmorbius 7y ago
    I suspect this is driven more by surveillance or sabotage risks posed by employee access rather than jurisdictional risks. Australian law is likely to have little impact on what an SRE or support engineer might be able to do. Australia having an established practice of recruiting and placing enterprise surveillance moles would. China and Russia have some history with this latter. Though one might say similarly of the US and Israel, as two examples.
    • deleted 7y ago
      [deleted]
    • type0 7y ago
      Alright, I also thought about Israel and AU at first but this thing is so political that no way can they include US allies in there because gov wouldn't approve this sort of thing. To my eye, american companies are becoming more and more like chinese companies in the amount of control governments can extort on them and that is highly troublesome.
      • dilyevsky 7y ago
        I know of a couple major us companies that do include Israel along with other usual suspects but they don’t spray about it on the internet. There’s also growing concern regarding what corporate equipment you can take across us border so there’s that.
  • type0 7y ago
    They can't. It seems that the only way to do this would be if AU and US wasn't close allies and the US gov sanctioned it.
• tgsovlerkhgsel 7y ago
  I'm shocked (in a positive way) about the amount of transparency Gitlab provides. Even as a reader, it almost feels as if someone misconfigured the ACLs or I'm reading leaked internal documents, not an intentional decision to make this open. Some of the discussions seem highly sensitive, and yet it seems to work for them. Thank you, Gitlab, for being so open! I've learned a lot about compliance from just reading this thread. For anyone curious, here's some background on the mentioned boycott laws: https://www.bis.doc.gov/index.php/enforcement/oac https://www.bis.doc.gov/index.php/enforcement/oac
  • sytse 7y ago
    Thanks! We try to be transparent by default and even when it is difficult. I think the OP is a good example of something that is hard to be transparent about because the decision isn't obvious and it takes discussion to come to the best conclusion.
    • Waterluvian 7y ago
      I just read your CEO page section about flaws and how to engage you about your flaws. On the topic of transparency, I'm curious if this has been working. Do people feel comfortable bringing them up? Is it helping you improve? I'm eager to find ways to be a more transparent person at work. I want to eliminate "politics" and "games" where possible and for work to be Wysiwyg.
      • sytse 7y ago
        You mentioned https://about.gitlab.com/handbook/ceo/#flaws https://about.gitlab.com/handbook/ceo/#flaws I hoped that people would use the sentences I proposed on that page but that never happened. What is helpful is that when people raise a concern I can recognize it more quickly and show them it is clearly my flaw. This doesn’t happen often but it happened last week.
    • Sidious 7y ago
      Ot: "In an effort to improve our user['s] experience..."
• stevespang 7y ago
  GitLab wants to be "on the right side of the law" when things get stickier . . . plus China and Russia both have State supported hacking (US does too, probably all 5 eyes countries), but if they have to choose between Allies or Axis powers - - it's a pretty easy choice for the side that is more stable, that does not actively promote organ harvesting of live humans, less obvious police state and their money is accepted everywhere . . .
• lacker 7y ago
  It sounds like there is nobody that this affects, and nobody it is likely to affect. They just want an official policy in place to reassure their customers.
  • fastball 7y ago
    It apparently impacts one new hire.
• person_of_color 7y ago
  This is one strange company. Imagine if governments worked like this? Holy hell. This is what Assange should have aimed for instead of getting involved in geopolitical intrigue.
  • qtplatypus 7y ago
    Audrey Tang Minister without Portfolio in the government of the Republic of China (aka Taiwan) advocated this type of radical transparency in government.
    • person_of_color 7y ago
      Radical transparency will change everything.
• cyberferret 7y ago
  While I acknowledge the pragmatic approach taken by the company to protect their user's data, I am curious as to how this will play out over time. Factors such as longer term travel or working vacations to these countries by their employees? Or, What about if one of their employees is married (or wants to get married) to a legal resident of one of these countries? How far removed does the employee have to be from this risk? And how much of an impact on their (and their family's) civil liberties could this have?
  • throwawaypolicy 7y ago
    I've been told (at a different company based in a different country) "don't bring your work laptop to China, don't bring materials to China without authorization, we'll provide what is effectively a burner device for whatever you are bringing to China (I believe they re-used them as different employees went to China)". I imagine Gitlab would have a similar but less restrictive policy, "don't bring a work laptop <with credentials that gives you access to one of these roles> to China, ...". I don't see why a policy against residing/working in China would care about who you are married to or where they live.
    • cyberferret 7y ago
      Consider this scenario: Loyal and long time high performing Gitlab employee Bob, is happily married to Su, who originally hails from China. They live and work in the US. All good. Until Su's ageing parents back home succumb to ill health and she decides that the family need to move back to China to care for them for maybe one or two years - perhaps longer. Bob then has to make the choice between (a) resigning his job or (b) being forced into a long distance relationship with lots of travel between China and the US, or (c) divorcing his wife. When company policy gets in the way of important life decisions, I think it is a dangerous line to walk.
      • edoceo 7y ago
        Sound like "loyal and high performing" Bob could land a new gig. Life is about choice and Bob might have a difficult one. I hope he'd stay with Su. Better and Worse and all that.
• Waterluvian 7y ago
  Super ignorant question that I'm sure has an obvious answer because nobody else is asking: How is this not a form of Japanese internment camps? Russia and China are a problem so we block Russian and Chinese citizens? Also, wouldn't I just have my Russian agents living and working in Sweden or Canada or something?
  • Iv 7y ago
    Well first, it is not a camp. No one is putting no one in prison there. Second, a company will want to abide by the laws of the countries it operates in. Having an employee somewhere may, nowadays, count as "operating in" that country. If they are not comfortable with some state laws, that makes sense to avoid these countries. Just like the companies that say they can't operate in Europe because of GDPR. Third, if you identify one of your employee as a Russian agent living abroad, you fire them and Russia is in the wrong there. But if you hire a Russian and that makes you legally forced to share some data, you would be in the wrong to not comply.
    • Waterluvian 7y ago
      Yeah I guess that's a bit of an extreme analogy. What you said about this abiding by laws of the country makes sense. Thanks.
• Iv 7y ago
  I don't understand what I am reading, I feel I am missing some context... Is it about being afraid the Chinese and Russian state will spy on user data if some employees are located in those countries? Or were there updates to their laws that made it mandatory to open databases to the state if an employee is located in these countries?
  • mr_tristan 7y ago
    It's actually in the discussion: > There is an unacceptably high risk that these nations may apply pressure to individuals living within their borders with sensitive data access (based their role at GitLab). It is our concern. And it is the stated concerns of several customers. The discussion is actually pretty significant, as they sort out how they might manage the _customer demand_ that is creating these hiring blocks, and in turn, how that is reported and tracked. I don't see this as a purely "done deal", it's a company having very important discussions in the open that most would just default to "restricted". All this transparency is a great source for others to learn from.
    • Iv 7y ago
      After activating JS I could see the discussion, sorry. Going a bit deeper, it seems to be a specific demand by a potential client. Can make sense for activists, journalists, humanitarians. Makes sense for gitlab to push back too though.
      • fastball 7y ago
        Why does it make sense for Gitlab to push back on a reasonable request from customers?
  • dwd 7y ago
    Probably in relation to this: https://www.chinalawblog.com/2019/09/chinas-new-cybersecurity-program-no-place-to-hide.html https://www.chinalawblog.com/2019/09/chinas-new-cybersecurit... Whether it's real or not or even likely to be effective, there's a chilling effect and businesses are obviously concerned to be raising the issue of Chinese-based employees with GitLab.
• stinky_phoenix 7y ago
  That’s nice you’re being transparent. Be transparent about your theft of IP with that Meltano ripoff of Looker.
• stinky_phoenix 7y ago
  Good job being transparent. How about you be transparent about the theft of IP that was Meltano, though. You literally linked to documentation from the company whose IP you stole. Gl, hope you have a good legal team.
• Iv 7y ago
  Ok, that discussion made it clearer for me, and I am kind of behind @cciresi at that point: https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#note_237336244 https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not... They have a customer that required the personal data they'll give to Gitlab not be handled by people living in Russia and China. Could be a group doing humanitarian or journalistic work. That's actually an interesting conundrum: you want to hire a company, need to trust it for handling sensitive material, and can't afford it to fall between specific states' hands. I don't think there is an objective process to do that. I know that USA and France and probably many other countries have laws to authorize seizure of data they consider linked to a variety of vaguely labeled activities (from "trouble to public order" to "terrorism"). You may end up excluding 80% of the world if you use objective criterion there.
  • Causality1 7y ago
    True. You have to decide what level of security is necessary for you. In some countries like China privacy from the government is basically nonexistent. In some like Australia backdoors are mandated by the government. In others like the US secret FISA courts exist and can demand data from companies and gag them at the same time. Off the top of my head I don't really know any ideal developed countries to do business in where privacy is concerned.
    • eternalban 7y ago
      See QA with Angelo Codevilla: https://www.tabletmag.com/jewish-arts-and-culture/culture-news/292763/angelo-codevilla https://www.tabletmag.com/jewish-arts-and-culture/culture-ne... Search for "You were directly involved in the drafting of the original FISA law in 1978."
  • efuquen 7y ago
    Honestly I don't understand @cciresi's position. As far as a I know anti-boycott regulations have primarily (only?) been used to prevent US companies from not doing business with Isreal. China & Russia are geopolitical rivals to the US and I don't see any sort of risk of anti-boycott regulations being applied in restricting business with residents of those countries. I guess you could say there is a risk that could change, but that seems hypothetical to the extreme and realistically irrelevant to worry about from a risk perspective. And this isn't discriminating on nationality or national origin, it is on the nation you currently live in. Employers decide not to hire employees living in other countries all the time, it's the most prevalent choice (i.e. US companies only hiring employees living in the US). I don't see why doing this because a customer you've considered critical has asked for it is any more legally risky that having done it for other reasons, assuming we discount the anti-boycott argument. This is all with the huge caveat of I'm not a lawyer, just giving my perspective based on how I've seen these laws/regulations applied in the past.
• RomanPushkin 7y ago
  > "It seems odd that we proclaim that we will accept any customer not prohibited by law (b5a35716) but we are implementing controls that impact employees based on a perceived political climate. This is contradictory." Second this
  • arkades 7y ago
    Accepting any customer serves the customers interest. According to customer requests that their sensitive information not be placed in a situation where it could be relatively easily accessed by state actors ... serves the customers interest. That’s not contradictory, except in the most superficial sense of “but we have open arms for everyone”.
    • Dolores12 7y ago
      Nothing stops state actor to access sensitive information through backdooring cleared engineer's system.
  • daseiner1 7y ago
    That’s not at all contradictory. Employees aren’t customers.
• jhurewitz 7y ago
  Personally for me, coming into a company that was so transparent was very difficult at first, especially as an attorney. However, over time I realized how much I developed and grew from it. I became much more open and accepting of criticism and feedback. Instead of becoming defensive, I listened to it and learned from it. I also welcomed all of the extra eyes on my work, it helped me create much better work product, just as the open source community does with open source code. When you are transparent, people know what you are doing and that you are genuinely putting the efforts in to do your best. You never know what is going on with others behind closed doors.
  • logical_person 7y ago
    why do you all show up in this thread on another website. isn't it embarassing that your company has no concept of a "federal" branch that restricts access to selected vetted employees? this seems like a very basic business decision that preempts all this hubbub.
    • deleted 7y ago
      [deleted]
• kong75 7y ago
  I think one of the reasons should be that Gitlab does not have many enterprise customers in China and Russia. Native Chinese or Russian speakers are not needed for Support.
  • MiZ10 7y ago
    Russians and Chinese could not care less but gitlab. They have progressed so much in the last years, they have their own gitlab systems. Demonizing Russia and China for bad practices and not doing any introspection on yourself is hypocritical. US suppremacy is over. Get on with it
• yosefzeev 7y ago
  I understand the basic issues involved here. Both countries are doing very odd things when it comes to information and privacy. However, I feel like making this a "country issue" is really not exactly the right horse to ride on. Rather, I think it should be stated due to the security policies of these governments, we are banning them as information safeholds at this time or something of the sort. Then, the issue is LESS the country, and more the governmental informational policies.
  • jplayer01 7y ago
    But the problem isn’t storing information in these countries in this case. It’s how these are known to coerce nationals with ties to the homeland into spying for them.
• iiertiosas 7y ago
  Reading the discussion, it appears this policy was due to a customer request, and not some legal requirement. I wonder how the HN crowd feels about that? There was a lot of talk recently about how companies should not sacrifice their values and kowtow to the demands of large clients. As a company that values freedom of movement and is remote first, this prevents their employees from moving to where they want. Does this also mean they can’t vacation there either?
  • larkeith 7y ago
    > Does this also mean they can’t vacation there either? No, the post is fairly explicit about what the proposed block is. While I agree with the position that companies should avoid trading ethics for short-term profit, this is a move I hesitate to condemn - the cost is fairly minimal (their remote-first position is still quite generous), and there is much to be said for the increase in privacy and security this provides their customers.
  • slackfan 7y ago
    Completely dumb that it even came up to this level of discussion. Fire that contract & opportunity into the sun and move on with your life.
• gorgoiler 7y ago
  It’s hard when you have people in your circle of trust who are subject to coercive law enforcement. My heart goes out to victims of such apparatus. It isn’t even as simple as worrying that foreign national employees can be coerced by their home nation police or state security services — anyone subject to policies like Gitlab’s who is local to your business but who has family or assets abroad that can be used to effect duress, or who can be blackmailed in some way elsewhere, would need to be vetted.
• slackfan 7y ago
  Dumb customers are dumb customers, but the bigger question is how bad is Gitlab's backend architecture that this is a concern at all?
  • nostrebored 7y ago
    Why are you assuming that their backend architecture is bad when these positions touch sensitive data much more frequently than a software engineering position in companies globally? In order to effectively support customers, you need to make a decision into how much visibility you'll give customers. Alternatively, you give your support the even more unfortunate circumstance of needing to request sensitive data. SREs need to be able to work with hardware and software and by virtue of needing to take decisive action are in a similar situation.
• isen7055475 7y ago
  Wow! racism!
• enriquto 7y ago
  I'm surprised Australia does not appear on this list.
  • wildchild 7y ago
    Because he is ukrainian nazi and there is a big hate boner on everything related to russia and it was so before and after crimea conflict.
• m0zg 7y ago
  Well, technically you should then block people from these countries irrespective of where they reside. They have extended families back in their home countries, so the spooks can still lean on them quite heavily, and there's nothing they'll be able to do. This is why I refused to obtain a DoD security clearance when my job needed me to: I go to Russia to visit my family every 2-3 years, and I don't want to be in any way valuable to their intelligence services or the like, nor do I want to put myself or my family in danger. All of the above is in spite of me having spent most of my life in the US by now. IMO a better solution is for nobody to have permanent access, and granting it on as-needed basis, with a full audit trail. It's not perfect, but it's a heck of a lot better than the ineffectual geography-based blocking that you are implementing.
• ridaj 7y ago
  If you want to be serious about it, you probably have to temporarily revoke access privileges for anyone in that job role who is traveling there too.
  • dodobirdlord 7y ago
    They likely will. If a customer is asking for something like this they probably aren't messing around.
  • avaika 7y ago
    You can never be sure, that the guy didn't sell his soul to intelligence agency and some government official during his visit. Better completely terminate the account and fire the employee if (s)he happened to travel there. /sarcasm (just in case)
• PeterStuer 7y ago
  Doesn't this directly imply non-US entities should have severe reservations about American SREs and Support Engineers?
  • mike_d 7y ago
    That is just whataboutism. China has a long demonstrated history of using its intelligence services for the benefit of domestic corporations, as well as exploiting its citizens working overseas to aid in the same.
    • deleted 7y ago
      [deleted]
  • dodobirdlord 7y ago
    Perhaps if they are Chinese or Russian and work closely with their nation's government or military, but in that case I imagine they probably are already taking whatever precautions they can to limit access by Americans.
• cgcgbcbc 7y ago
  Anyone knows how to migrate gitlab-ce to gogs? Since US government accuse Huawei 5G of monitoring and Edward Snowden actually shows that it is US government doing such thing. I believe this is the same thing: when Gitlab making the decision which hints Chinese or Russian will leak customer data, the truth may be that the US government has always been able to access such data. Although the gitlab-ce is the open source version, but it is released by gitlab company and I cannot trust it anymore, so I want to migrate my long running self hosted gitlab-ce to gogs.
• libpcap 7y ago
  There is an unacceptably high risk that these nations may apply pressure to individuals living within their borders with sensitive data access (based their role at GitLab).
• jsonline 7y ago
  Cold War?
• d1ffuz0r 7y ago
  Deleting everything I have on gitlab and leaving this racist platform
  • deleted 7y ago
    [deleted]
  • jplayer01 7y ago
    So, give any quote from the link or elsewhere that in any way shows the reasoning for this consideration is based on how much they don’t like Chinese people or how inferior they are as a race. People keep throwing around the racist label even when it’s absolutely clear that it’s not about race. It’s about the Chinese and Russian governments and how they operate. These are legitimate informational/operational security concerns that can’t be waved away with "well, it’s racist to protect ourselves, so we just won’t".
    • hkustliqi 7y ago
      Great. I'm sure US government never coerces its citizens, never spies on its citizens.. After all, USA is the chosen land by god, and its people has every reason to believe they are superior in morality.
    • d1ffuz0r 7y ago
      >It’s about the Chinese and Russian governments and how they operate Have you ever thought that Russian government consists of Russian people? Same with Chinese
      • deleted 7y ago
        [deleted]
      • jplayer01 7y ago
        Yes, so? Nobody is concerned about the Chinese because they’re Chinese. Unless the CCP adopts principles like freedom of speech or other values that are foundational to Western countries, the CCP is forever going to be at odds with us. As long as they oppress their population and minorities and expand their influence on neighboring countries in undemocratic ways, and seek to extend that influence to the West, there’s a conflict. And the conflict isn’t race. It’s values. This tolerating undemocratic behavior because it might be intolerant only allows authoritarian regimes like the CCP to continue their spread. It’s hilarious and depressing to see people using their freedom of speech to defend China, a place that suppresses any and all criticism in absurdly draconian ways.
• beyondcompute 7y ago
  Well, the answer to that is simple. #boycottgitlab I am working at a European company where the amount of Russian engineers is constantly increasing (similar thing happens in many of the bigger companies nearby). And they prove to be quite ok. So since today I will speak strongly against use of Gitlab in my workplace should such a talk begin.
  • rutierut 7y ago
    I think you are confusing them having something against Russia(gov) with Russians(people). They also clearly state that current employees will not be affected. Reading the motivation behind it and the possible dangers it would pose to their clients. I think it's very reasonable not to continue having sensitive data be available in Rus & Chi. What would you do in this case?
    • beyondcompute 7y ago
      I believe, that I am capable of discerning those things :) Though I suspect that we are over-thinking. Imagine Germany, 1935. “Company X will stop hiring Jews as it deals with stuff important for the military”. And the society be like, “thank you, company X, we are positively pleased with your transparency and shmamparency”. Are you crazy, people? I think, that Gitlab is the one that confuses Chinese, the people and Chinese government, let’s say.
      • antocv 7y ago
        They are not crazy. They never changed from being slave-masters, imperialists, colonialists and racists. Its the same elite class which holds power today in US and UK with direct lineage from slave-masters and imperialists.
    • antocv 7y ago
      Gitlabs actions affect Russians(people) and not Russia(gov). Their motivation, should they apply it to UK, US, Spain and France, should lead them to forbid having employees from those countries as well. As a Swede, I would not like my gitlab sensitive data to be in the hands of US gov. If you really believe national security agencies do not apply pressure to any tech employees just because they are X citizens of their X country - you need to mature a little bit more, perhaps read Snowdens book and look into what happened with Wikileaks.
• stunt 7y ago
  Gitlab can restrict SRE selection for concerned clients and change their process to make sure every SRE doesn’t have access to every client. I’m sure some Chinese companies wouldn’t be happy to have American SREs access their data either and I can think about dozens other countries with political issues against each other. But off topic, I’m wondering how many companies have similar policies that nobody knows just because they don’t have “open-source” policy. Sadly recruitment process is polluted with many hidden policies and while we appreciate and expect honesty and transparency from applicants, the recruiters themselves aren’t anything close to honest and transparent.
• hkai 7y ago
  Even though things like this could hit me personally (as someone who was born in Russia and lives in China), I support this because my two countries are truly evil at a scale that no other countries can ever match.
  • MiZ10 7y ago
    Oh please little troll, you are from both Russia and China and you hate them so much. Give us a break
• account73466 7y ago
  I love to see how propaganda works. The top comment even congratulates gitlab.
  • sacrificedcapon 7y ago
    I think it's more PR rather than propaganda. But I guess both are ultimately the same thing. There is a pattern here where the top comment praises a corporation and the top response is an employee of the company thanking the commenter for the praise.
• konart 7y ago
  Well, that's a "goodbye gitlab" for me.
  • antocv 7y ago
    Alternatives to gitlab: https://gogs.io/ https://gogs.io/ https://gitea.io/en-us/ https://gitea.io/en-us/ https://www.atlassian.com/software/bitbucket/download https://www.atlassian.com/software/bitbucket/download https://gitbucket.github.io/ https://gitbucket.github.io/ https://kallithea-scm.org/ https://kallithea-scm.org/
    • shpx 7y ago
      https://sourcehut.org/ https://sourcehut.org/ https://nest.pijul.com/ https://nest.pijul.com/
• breadandcrumbel 7y ago
  >I'm shocked (in a positive way) about the amount of transparency Gitlab provides. Same here. I was pretty surprised they sent an apologise email few days ago Saying sorry after actions you made, show how they care about their users
• 490d0aff0ee8 7y ago
  It's immoral to discriminate on the basis of fear, prejudice, and rumor. One client can demand that Gitlab get rid of Chinese and Russian nationals today. Tomorrow, a different client can make similar demands - aimed at the nationals of different countries. This makes no sense whatsoever, and will blow out of control quickly. Sanction programs are the established legal frameworks for such things: https://www.treasury.gov/resource-center/sanctions/programs/pages/programs.aspx https://www.treasury.gov/resource-center/sanctions/programs/... It's disappointing to see the promise of some money making the company go full 180 on its hiring and employment procedures - going as-far as potentially rescinding one employee's offer, and flagging another employee's personal choice to live in a different country as a risk. The due process here is concerning. Some techbro starts by creating a "we need to block all Russian/Chinese" issue - followed by a bunch of echo-chamber "yessir" comments. When a legal advisor steps in - everyone tries to silence her and convince her it's just an "iterative process". Finally - it actually looks like Gitlab's security practices are truly lacking. That an employee is Chinese/Russian shouldn't be a consideration - the systems should be tight enough to make sure absolutely no-one has access to customer data without consent - and that any actions taken are logged for auditing. Whenever necessary - pass your employees through a background-check. In sensitive (government) scenarios - restrict to employees with government clearance. Honest question: Is Gitlab now a company not in a position to say "no"? Investors and potential customers need to know.
  • m0xte 7y ago
    If you look at the vetting processes in the defence sector they have strict nationality and background checks. Why should the same not be true for something with a damage multiplier the size of github which is basically carrying a big chunk of commercial IP in private repos?
    • jiofih 7y ago
      I think that last paragraph is suggesting that GitLab could simply reject such clients - or better, direct them to the self-hosted plan where they have full access control.
• shrimpx 7y ago
  The real "threat" is more and more people, companies, and institutions caving in to pressure to take more explicit national-boundary stances.
• rajeshmoov 7y ago
  nice
• rossmohax 7y ago
  Interestingly, Ukraine was also on the list initially, but then was removed. Is it a coincidence, that Gitlab co-founder, Dmitry Zaporozhets, is from Ukraine?
• peterkelly 7y ago
  How is this not unfair discrimination? Imagine if the issue was the following: > In e-group on Monday October 15, 2019 we took the decision to enable a "job family race and sexual orientation block" for team members who have access to customer data. This is at the expressed concern of several enterprise customers, and also what is becoming a common practice in our industry in the current social climate. > The groups of people involved are: > - Black people > - Gay people > This issue is to track the addition of the process to the support handbook, and whatever recruiting processes need to be update to make certain that: > We do not make offers to individuals of these races or who practice these sexual deviances. Current team members are prevented from entering a relationship with someone of the same sex or of the specified races and remaining in a role that prohibits it.
• blaesus 7y ago
  I am Chinese living in China. Nationalism is on the rise lately in China, not just for domestic reasons, but also as an reaction to nationalistic moves from "the West" like this one. It's a recurring theme, not just in governmental propaganda, but also in daily conversations, that "the West" would talk about fairness and justice then commit blatant discrimination and double standards. As a founder of a tech company based in China, I benefit from US companies blocking Chinese (and Russian) engineers; still I am saddened by this. I hope they could come up with more intelligent policies to protect their OPSEC.
  • Craighead 7y ago
    How are those actual death camps going? How's that credit system going? China is a techno authoritarian dystopia, regardless of what the compass tells you.
  • deleted 7y ago
    [deleted]
  • d1ffuz0r 7y ago
    Those people are completely brainwashed https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#note_239511333 https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not...
    • ichik 7y ago
      Care to elaborate, comrade major?
  • mb_72 7y ago
    Curious as the way I see it it's very often China who is the 'initiator', eg internment of Muslims, stealing of territory in South China sea, debt-trap diplomacy, and so forth. Presuming that you are aware of these occurrences, do you agree with your government's positions and actions, and - if not - what actions, if any, do you take to make it clear your opposition? The Chinese government is, IMO, massively over sensitive to any outside commentary or criticism, eg: https://www.abc.net.au/news/2019-10-31/china-warns-australia-not-to-strain-relations-over-human-rights/11656922 https://www.abc.net.au/news/2019-10-31/china-warns-australia...
• ameshkov 7y ago
  If I was a Chinese or a Russian engineer working for Gitlab, I'd consider quitting right now regardless of how this discussion ends. I am surprised that this initiative is not just considered by them, but basically approved by some of the senior staff: > In e-group on Monday October 15, 2019 we took the decision to enable a "job family country-of-residence block" for team members who have access to customer data. I don't think there's a need to explain what's wrong with this idea, there are a lot of sane comments on this thread explaining this just okay. On a side note, I really like how company transparency saves them from making wrong decisions final. I think that this initiative will be dropped just like the recent third-party tracking issue, and I wish more companies were as transparent as this one.
  • account73466 7y ago
    >> If I was a Chinese or a Russian engineer working for Gitlab, I'd consider quitting right now regardless of how this discussion ends. This is partially the goal of such moves and will accelerate the rise of discrimination. Thus, one should not quit despite the situation.
    • ameshkov 7y ago
      So you'd suggest staying and fighting against this inside the company? If they truly love the company and it deserves this, you might be right. edit: what bothers me is that at least by some senior staff members these employees are already considered second-class citizens as otherwise this initiative wouldn't even be discussed, and I wonder how comfortable it will be to continue working with these people now.
      • account73466 7y ago
        by staying you fight it already, better be passive - not being insane is already a lot
        • ameshkov 7y ago
          I have to disagree. Passively staying does not change anything; the fact that they work for this company has not prevented this initiative.
• teknologist 7y ago
  This is a great move by Gitlab. I'd love to see more companies going in a similar direction.
  • avaika 7y ago
    Yep. It also would be nice to provide a form where clients would be able to select race, sex, age, sexual orientation, religion and other employee parameters as they wish to build a real dream team.
    • teknologist 7y ago
      Just a simple checkbox for "lives in a data-hoovering authoritarian regime" would be enough!
      • diggan 7y ago
        Basically all services in the US + Europe (and Russia, and China, and more) disappears with that inclusion.
• sajithdilshan 7y ago
  This is just ridiculous. It is truly unfair to discriminate people based on the country of their birth. It's not like they had a choice. Am I the only one who thinks that both China and Russia have spies who are not native Chinese or Russians? And are people really naive to believe that a stupid decision like this would prevent China or Russia from trying to obtain the information they need (if they really want it)
  • deleted 7y ago
    [deleted]
  • TobbenTM 7y ago
    You might have misread the issue at hand, this is not discriminating on country of birth, but country of residence. You can choose not to continue living in the above mentioned countries, and this would no longer be a problem it seems.
    • sajithdilshan 7y ago
      Ultimately it affects the developers who are born in China and Russia as well. Not everyone can afford migrating to a "white listed" country due to various reasons like family, friends and other commitments.
      • bart_spoon 7y ago
        How is that different from any other job? Unless they support remote work, which most don't, is it not discrimination for a job to only consider people who are willing to move to city X or country Y?
• teknologist 7y ago
  In my opinion, GitHub should have blocked all Chinese IP addresses on the day the CCP decided to try to firewall it.
• pmlnr 7y ago
  /s "Gitlab considers" is the new "British scientist" news headline.
• deleted 7y ago
  [deleted]
• vbezhenar 7y ago
  I've never heard of Russian government using their state powers to take advantage of some developer and break into foreign network. That seems like strange and unethical move. I, personally, won't ever use Gitlab after that move.
  • rimliu 7y ago
    Do you imply that actions by the Russian government are always ethical?
    • calcifer 7y ago
      What a pointless question. The answer to "Do you imply that actions by the $x government are always ethical?" is always No for all values of $x.
  • defly 7y ago
    https://www.dw.com/en/russian-intelligence-used-blackmail-to-try-hacking-uk-visa-system/a-46335303 https://www.dw.com/en/russian-intelligence-used-blackmail-to...
    • vbezhenar 7y ago
      Thanks, that's scary. May be I'm wrong.
• novaRom 7y ago
  Today they have requested GitLab to enforce employment policy and GitLab started to implement it. Tomorrow they will ask GitLab to inject backdoors and GitLab will implement that as well? It is probably happening in other US tech companies at this time affecting those who want to get lucrative DoD and government contracts.
• EugeneOZ 7y ago
  I live in Spain but was born in Russia, I moved 3 years ago because I hate current russian government and still I hope russian and chinese companies and engineers will boycott Gitlab in response. Such offensive nationalism should not be forgiven.
  • diggan 7y ago
    You moved from a openly repressive country to another secretly repressive country. Congratulations ;) Hope you have the possibility to freely move around Europe, as you'll probably will need to use it in the future
• w_t_payne 7y ago
  This is where it is important to get back to first principles, and making distinctions based on nationality is less helpful than making distinctions based on rules-oriented-organisations vs. people-oriented organisations. The primary distinguishing characteristic which we need to pay attention to is rule-of-law and the power-predominance of rules-oriented-organizations across the political and economic system. This is something which should in principle be apolitical and possible to evaluate empirically.
• phyzome 7y ago
  > Eric Johnson @edjdev · 5 days ago > Owner > @cciresi I appreciate your position. Please be aware there is an active, time-sensitive contract negotiation linked to this matter. And you need to advocate to the DRI that the company walk away from that contract in order to enact your proposal. https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#note_237506130 https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not... Well now, that's interesting.
• Dolores12 7y ago
  What if large chinese customer to demand that none of US SRE engineers have access to their data? What if China to ban GitLab? You gotta lower your ideals of freedom if you wanna suck on the warm teat of China. (c)
• aasasd 7y ago
  So. As a freelancer living in one of the scary red states and seeing a lot of US people and companies in the potential client crowd, should I now start looking for opportunities more in Asia, South America and Africa? Is the Gitlab client's sentiment spreading among Western companies?
• alkz 7y ago
  what if a customer came in requesting not having women engineers accessing their data? I wonder if gitlab would consider that
• type0 7y ago
  The discussion on Gitlab is completely out of control now. Gitlab should never have opened that can of worms. Geopolitics and all, first started talking about limiting nationals of China and Russia to do certain jobs and now so many have conflated this to ethnicity, political views, hacking and anything in between.
• kmm 7y ago
  I'm a little surprised this isn't illegal, and it really should be. It's irrelevant whether or not this actually would work, it's in principle immoral.
• joelhaasnoot 7y ago
  Am I missing something? Why does said customer just self host the open source software and purchase support. 90% of the sensitive issues will be solved
• lonelappde 7y ago
  Ever since the China attack in 2010 when Google pulled out of China, Google has prohibited access to user data from employees in China. They gave since expanded to a more general geographic blocking system. I assume Gitlab lacks the sophistication to do this split of user data access vs other business operations. Gitlab runs an open source company, so I don't understand why they are so concerned about China and Russia. Is it for anonymous/confidential customers?
• Grue3 7y ago
  I don't mind this, as long as they would offer a relocation from the country in question. I would even volunteer! It's not my fault I was born in this shithole.
• peterkelly 7y ago
  I wrote another comment arguing that this proposal was both racist and discriminatory, which got flagged and deleted without explanation, presumably because I worded it in such a way as to give an example that might resonate more with Americans by using examples of specific groups of people that have experienced oppression in the US. In the interests of quality discussion on HN, I'm going to make another attempt but in a way which is hopefully less likely to be misinterpreted. There are employment laws which prevent companies from discriminating against people based on factors such as race, sexual orientation, religion, physical appearance, age, marital status, and other things over which they either have no control or which are not relevant to their job. These laws are in place for good reason and most people (myself included) support them. It is my belief that a company policy prohibiting the hiring of people based on any of the above attributes would be wrong, and probably illegal (depending on the jurisdiction). The question then comes down to whether refusing to hire someone based on either their nationality or the country in which they live (in the case of a remote company) is wrong in the same sense as the above factors. My argument is yes. The fact that someone lives in China or Russia does not, by itself, make them an untrustworthy person, any more than someone living in the United States, Germany, Japan, or the UK. At the request of several customers, GitLab is proposing a policy which discriminates against people based on their naionality/country of residence, which I would argue is almost (if not equally) as bad as discrimination based on the other factors I've mentioned, and should be opposed for the same reasons as a policy which prohibited hires who were of a particular race or sexual orientation. If anyone wants to flag this comment, you are of course free to do so. But I would much prefer, and I think we could all benefit from, a coherent discussion of the flaws in my argument.
  • nscalf 7y ago
    The fact that you’re in one of these countries makes you easy to access by enemies on the global scale. Assuming the individuals are good, that doesn’t mean they’re not a security risk. The reality is, countries like Russia and China do not respect intellectual property, and are know to perform cyber espionage and attacks. This seems very reasonable to me. Furthermore, the whole point of anti-discrimination laws are to prevent judgement based off traits that cannot be changed. Where you live is not the same thing as your skin color. Imagine if someone refused to change their password and only used 6 characters for it. It’s a security protocol to force a change there. I’m viewing thing more similar to that than similar to racial discrimination, given that gitlab is not saying they won’t hire Russians widely.
• cosmolev 7y ago
  I consider not using Gitlab.
• deleted 7y ago
  [deleted]
  • deleted 7y ago
    [deleted]
• ElonMuskrat 7y ago
  I thought fairly standard industry practice prohibits prod access ACLs to engineers inside China or Russia.
• bjarni1 7y ago
  So Gitlab will reject Tourist or Petr because they are Russian nationals (if they felt like working for Gitlab), I guess?
• siffland 7y ago
  One would this the best solution for this would be a Federated structure that would ensure a Chinese Systems administrator could only deal with whatever resources assigned (China maybe) and a US administrator can only work with whatever resources are assigned (U.S customers??). Therefore you can have the separation of data but please everyone. I am not saying it would be simple to iron out, but it would allow for distrusting customers to all play together without worrying about data compromise. Just a thought, i read all the comments and they are about politics and such and very few are about a technical solution to work for all. One can argue only letting a Chinese Administrator work on a subset is again a geopolitical thing, but that point should be moot if other administrators are restricted as well.
• deleted 7y ago
  [deleted]
• fst7 7y ago
  (Poor English warning...) As a Chinese I'm actually very disappointed at Gitlab. I think anyone wouldn't be happy if one's country is banned from the company. And I also think some people just worry too much about people in China. Actually, ordinary people in China are not so oppressed by the government. And ordinary developers from China is just as ones in America. Few of them will steal data from the company.
• Elhana 7y ago
  How big of a customer one needs to be to request some other country citizens to be banned from working as SRE? How much do we need to pay to ban Israelis for example?
• istinspring 7y ago
  First they came for the Russians, and I did not speak out — Because I was not a Russian. Then they came for the Chinese, and I did not speak out— Because I was not a Chinese. ...
• TiNiPoNi 7y ago
  The Yellow Peril in the west is going crazy. Let's see how they justify this anti-Chinese behavior.
• EETruth 7y ago
  Good thing. They should stop hiring Russians and Chinese period.
• Terr_ 7y ago
  IMO this is not really about hiring, the hiring aspect is just a temporary workaround for a broader policy/technical challenge. Namely, how to maintain your overall organization and software-stack while internally isolating data-flows and rules which are unique to different jurisdictions. Even if today it's some potential client expressing general concern, tomorrow it might be something you can't simply ignore, like an EU privacy law that must be complied with to avoid dropping a bunch of customers. (Or a demand by Elbonian officials for an account that lets their secret police snoop on Elbonian business, but hopefully that one would be resisted.)
• vmmxxx 7y ago
  It is a completely necessary action. The National Intelligence Law of China, passed in 2017, demands that all its citizens "support, assist and comply with works on national intelligence", aka proactively collect intelligence for the regime. (Article 7) (《国家情报法》第七条 任何组织和公民都应当依法支持、协助和配合国家情报工作，保守所知悉的国家情报工作秘密。 ) This also explains why Huawei devices SHALL be excluded from core communication networks of the free world. Additionly, unless Jingping 11th go off from his power, the nation should simply be considered another Soviet Union, or even worse, the Nazi.
• gitkyslab 7y ago
  I think they also need to: 1. Remove Vue.js from the Gitlab Production becuase: - The founder&writer of Vue.js is Chinese and currently in China. - Other than the funder and it's bot, the Top 3 contributors of it are Chinese and live in China 2. Remove vuex from the Gitlab Production becuase: - The founder&writer of vuex is Chinese and currently in China. - Other than the funder, there's still 5 contributors in Top20 that are Chinese and live in China 3. Remove Sizzle from the Gitlab Product becuase: - the #19 contributor is from Russia and he committed twice and 4000+ lines of code The security breach is HUGE, they need to fix it RIGHT NOW! What if there's spy code in those js libs! If they passed the issue but keep those libs they're simply idiotic hypocrites
• rkagerer 7y ago
  Could someone "in the know" elaborate on what specifically prompted them to contemplate this? e.g. They mention concerns from enterprise customers. I commend the transparency of debating it in the open, but I suspect it'll get hard to maintain reasonable discourse once the issue hits mainstream headlines and becomes sensationalized. The suggestion does feel like a giant cudgel. I get there are genuine concerns, and I don't have better ideas to offer. I can't help feeling bad for legitimate future job applicants who will feel discriminated against. I'm sure if a bad actor wants to do something adversarial, they'll find ways around it (like agents in a non-banned country). It used to feel like attitudes of major world powers were slowly converging (Russia got some democrazy, China started to open up its economy, tolerance seemed to be growing). Now it scares me how fast they're diverging. Politics is seeping deeper into tech, and it's going to get more fervent. Curtailing trade is loosening the ties between disparate cultures (https://www.cato.org/publications/commentary/peace-earth-free-trade-men https://www.cato.org/publications/commentary/peace-earth-fre...). The internet was supposed to connect us all and help bring us closer together. What happened?
• stefek99 7y ago
  Well done. Bravo. No irony. Really well done. Thank you for showing the way.
• Hackercloud 7y ago
  This is reported in Gittalk (a high impact platform for Chinese IT workers). I admire the transparency. The issue can't be solved by a company alone. Practically there might be workaround but it's up to the employer.. Which clause of which act, or which executive order specifically prevent Gitlab from recruiting non-enemy state person?
  • Hackercloud 7y ago
    This leads to discussion of using Chinese alternative other than Gitlab/GIthub, and the expansion would lead to more employment by Chinese code repository providers... Everyone get what they want, in long term?
• meursault1 7y ago
  Gitlab is investing hard on looking good in the press, but forgetting to fix their critical bugs. Their CI/CD feature is useless due to the bugs that are never fixed as they are not prioritized. One example is this 1-year old critical bug in CI/CD: https://gitlab.com/gitlab-org/gitlab-runner/issues/4119 https://gitlab.com/gitlab-org/gitlab-runner/issues/4119 (Gitlab CI/CD jobs finishing midway with Success)