16 ms·

I'm shocked (in a positive way) about the amount of transparency Gitlab provides. Even as a reader, it almost feels as if someone misconfigured the ACLs or I'm

I'm shocked (in a positive way) about the amount of transparency Gitlab provides. Even as a reader, it almost feels as if someone misconfigured the ACLs or I'm reading leaked internal documents, not an intentional decision to make this open. Some of the discussions seem highly sensitive, and yet it seems to work for them. Thank you, Gitlab, for being so open! I've learned a lot about compliance from just reading this thread. For anyone curious, here's some background on the mentioned boycott laws: https://www.bis.doc.gov/index.php/enforcement/oac https://www.bis.doc.gov/index.php/enforcement/oac

sytse 7y ago
Thanks! We try to be transparent by default and even when it is difficult. I think the OP is a good example of something that is hard to be transparent about because the decision isn't obvious and it takes discussion to come to the best conclusion.
- Waterluvian 7y ago
  I just read your CEO page section about flaws and how to engage you about your flaws. On the topic of transparency, I'm curious if this has been working. Do people feel comfortable bringing them up? Is it helping you improve? I'm eager to find ways to be a more transparent person at work. I want to eliminate "politics" and "games" where possible and for work to be Wysiwyg.
  - sytse 7y ago
    You mentioned https://about.gitlab.com/handbook/ceo/#flaws https://about.gitlab.com/handbook/ceo/#flaws I hoped that people would use the sentences I proposed on that page but that never happened. What is helpful is that when people raise a concern I can recognize it more quickly and show them it is clearly my flaw. This doesn’t happen often but it happened last week.
- Sidious 7y ago
  Ot: "In an effort to improve our user['s] experience..."
- burfog 7y ago
  Congratulations on taking a step in the right direction, even if it is a very small step. Nobody else seems to take the threat seriously, somewhat excepting defense contractors of course. I can understand being reluctant to deal with the full extent of the problem. Somebody from China, with a family in China and subject to Chinese law, does not cease to be a security threat by moving to the USA and getting a green card. This gets awkward. It really is no surprise that valuable secrets of all types (private key, customer data, trade secret, insider info for trading, etc.) end up in other countries.
  - seanmcdirmid 7y ago
    In china, not from China. The former is easy to justify, and would affect even Americans of non Chinese descent. The latter would be incredibly difficult to justify, and could easily be seen as unwarranted discrimination.
    - big_chungus 7y ago
      Well, technically it is discrimination, but not racism. I.e. you can still hire a Japanese developer, and with a Chinese regime change you might be able to hire Chinese developers. However, federal law prohibits discrimination based on national origin. This is a touchy subject, but maybe this no longer makes sense? As burfrog pointed out, a Chinese employee living in America isn't free from Chinese control; the gov't will do bad things to his family if he gets a request for, say, information or access and doesn't comply. I'm hesitant to endorse allowing discrimination by national origin, but on the other hand, it doesn't make sense to allow the Chinese access to any kind of important data.
      - seanmcdirmid 7y ago
        It doesn’t matter. As long as a security clearance isn’t required, discriminating based on notational origin is a big no no from an ethical perspective, even if it was legal. I hope we learned our lesson during WW2.
        7y ago
- jacquesm 7y ago
  I think the issue of a week ago was the harder one and I really commend you on walking that one back.
- deleted 7y ago
  [deleted]
- FragenAntworten 7y ago
  If you don't mind me asking, why is this conversation open to comments from non-employees? Having discussions be publicly viewable seems valuable, but letting anyone at all participate seems disruptive and unhelpful (as an outside party, I was having trouble following the thread of employee discussion interrupted as it was by internet furor).
  - sytse 7y ago
    If an issue is public everyone can comment on it until it is locked. I don't think there is another setting.
deleted 7y ago
[deleted]
iiertiosas 7y ago
I also learned a lot and some of the employees made great points. I’m wondering, can the US government legally issue a National Security Letter to an individual employee that forces them to comply and spy for them? If they can, does this also mean the employee has no legal recourse since NSLs must be kept secret?
- cjbprime 7y ago
  Arguably all of this has already happened, with the Lavabit case.
- dodobirdlord 7y ago
  > If they can, does this also mean the employee has no legal recourse since NSLs must be kept secret? No, because that would be unconstitutional. But the proceedings of objecting to a NSL similarly must be kept secret. There wouldn't be any point to the secret component of a NSL if the recipient could object and hash out the merits of the request in public court records.
  - deleted 7y ago
    [deleted]
  - pinkfoot 7y ago
    So how would anyone ever know that the objection was 1) heard, and 2) upheld?
    - K0SM0S 7y ago
      Welcome to the wonderfully paradoxical task of organizing and controlling secret services and jurisdictions in an otherwise democratic state. Most countries do it by subordinating secret agencies to a military division of sorts, wherein martial courts and security access is already structural. Others choose a more 'civilian' approach subordinated to a parallel chain of command within the citizen government/legislation/judiciary — closer to police, interior dpt / homeland security, etc. (in such cases, army intelligence is usually quite distinct from civilian surveillance). Which approach is favored historically by a country typically depends on pre-existing constitutional models and principles — notably how the army features relatively to the ultimate civilian chain of command, and how the latter is accountable to the (sovereign) public in the event of treason. None of this applies in authoritarian regimes where the ruling caste or figure(s) usually answer to no principle (no courts for them, only 'advisors' for they sit above the law) and secret service is almost always directly answering to them, as part of the active coercion of the people (fear of the "enemy within", etc).
hnarn 7y ago
I used to work for a company that had a public Jira bug tracker (security related bugs were hidden). I imagine a lot of customers had the same feeling you had: listing all bugs in a release, their status, the discussion around them, it was all there. Very transparent and very appreciated. Unfortunately, like most good things in corporate software, it didn't last.
- pavelz 7y ago
  Red Hat has a public Bugzilla with (almost) all the open bugs in their software.
  - justinclift 7y ago
    It used to be open for most things. Doesn't seem to be that way for at least the last 6 months or so (may more).
  - goatinaboat 7y ago
    Public for their paying customers. Which is fair enough, but it’s also nothing particularly unusual. Source: am a former RHEL customer now using Fedora
emrehan 7y ago
Check out the concept of "open startup": https://hackernoon.com/what-does-it-mean-to-be-an-open-startup-f4446984189 https://hackernoon.com/what-does-it-mean-to-be-an-open-start...
thekevan 7y ago
Wait, am I to understand that this law says I cannot boycott doing business with businesses located in Israel? I am in the US, so can not say, "I disagree with how the Israeli government is treating Palestine and thus don't want to do business with any entity located there."?
- microcolonel 7y ago
  > Wait, am I to understand that this law says I cannot boycott doing business with businesses located in Israel? No. That link the parent commenter shared is a very good overview: it basically means that your company will not receive special corporate tax consideration if your company: Enters agreements to refuse or actually refuses to do business with or in Israel or with blacklisted companies. Enters agreements to discriminate or actually discriminates against other persons based on race, religion, sex, national origin or nationality. Enters agreements to furnish or actually furnishes information about business relationships with or in Israel or with blacklisted companies. Enters agreements to furnish or actually furnishes of information about the race, religion, sex, or national origin of another person. (e.g. “hey [anti-Semitic company], this competing businessperson is a Jew, if you were wondering”) In any of these cases, there are exceptions and matters of interpretation. Whether or not you think this is appropriate for the government, it's not as simple as “you can't engage in a boycott as a matter of personal conscience”.
  - thekevan 7y ago
    >your company will not receive special corporate tax consideration if your company: >Enters agreements to refuse or actually refuses to do business with or in Israel The link does actually include the penalties, which are far more than just losing special tax considerations. It includes hefty fines and even imprisonment under the TRA. The "just losing tax consideration" part is only under the EAR. I understand that part. It's the fact that they say I cannot boycott Israel independently. I'm still confused at how this can be fully Constitutional. Say I care a lot about the Palestinians and object to their treatment by the government and military of Israel. Say I make widgets wholesale for people to resell retail. So I say, if you buy my product and resell it you make money and your government takes some of that money, as is normal. Therefore, I will not sell to any company that sells this in Israel as I do not want to my product to be used to make money for a government whose actions I condemn. I don't care if you are a Jew, a Christian, an Arab and/or even a Palestinian, if you want to sell my product in Israel and taxes which go to the Israeli government will be collected on that, I'm not selling it to you. Not just certain companies within Israel, all of them. Anyone who sells my product and thus makes money for the Israel government, nope, I'm not doing it. That's the part I have a problem with. If I don't actively try to stop Israel from doing anything but want to take an active role in not helping them in any way, I'm breaking the law? I don't see if how I want to act independently the Arab League but what I want to do aligns with part of what they want to do, that is a problem? I should be able to not support what I see as a bad actor.
pinkfoot 7y ago
From the website: > forbidden from … Agreements to discriminate or actual discrimination against other persons based on race, religion, sex, national origin or nationality. So, to be clear - GitLab can merrily discriminate against Chinese citizens of the US on national origin by themselves, but are breaking the law if they do the same under a joint venture with a non-US entity. Bonkers.
AsyncAwait 7y ago
Indeed, thanks GitLab for being so open about your bigotry. I wonder what would happen if GitLab started excluding say Israeli nationals, because a large number of companies that sell 0-days for profit are based there, I suspect that accusations of antisemitism would pour in from all corners & rightfully so, but since demonizing China has been cool since the USSR's collapse & Russia rejoined the club it never really left in the eyes of Americans, it's all good. Disgraceful. GitLab was once an inspiration to me in terms of its openness & culture, but the recent moves around tracking and now this, make it clear that GitLab has been around for too long to stay a hero.
- kortilla 7y ago
  > it never really left in the eyes of Americans Nice bigotry in a post complaining about bigotry.
  - AsyncAwait 7y ago
    Except when you look at Hollywood production, U.S TV news etc. that's exactly what you get. The Red Scare was a real thing, so was Russiagate. The anti-Chinese sentiment is very much real in the U.S. too, if the campaign rhetoric, current trade policies & the constant stream of accusations from newspapers of record are to be any indication. Maybe I could have worded it better, but I am referring to American culture and the mindset that when you think 'anti-hero', it's going to be a Russian/Chinese most of the time.
Dolores12 7y ago
If we are so transparent about everything, can we know the name of that customer?
dlgeek 7y ago
I'm shocked that they'd extend it to their lawyers. This thread (and the one the other day about telemetry and the GDPR) are a plaintiff and/or prosecutor's dream. One of the hardest parts of most white collar prosecutions is proving that an action was taken "knowingly and willfully". Unlike other areas of criminal law, most white collar offenses require prosecutors to prove that not only did the person know they were doing the things they were doing, they had to know they were illegal. Having the party's own lawyer offering legal advice outside the scope of privileged communication is normally windfall enough. Having them do it publicly and in the media's eye is just insane.
- user5994461 7y ago
  On the other hand, the discussion threads actually show that they have no idea what they are doing. It's a good question what one could prosecute out of that and what to gain. There are so many open angles and I don't think there is any precedent with a fully opened company.

sytse 7y ago

Thanks! We try to be transparent by default and even when it is difficult. I think the OP is a good example of something that is hard to be transparent about because the decision isn't obvious and it takes discussion to come to the best conclusion.

Waterluvian 7y ago
I just read your CEO page section about flaws and how to engage you about your flaws. On the topic of transparency, I'm curious if this has been working. Do people feel comfortable bringing them up? Is it helping you improve? I'm eager to find ways to be a more transparent person at work. I want to eliminate "politics" and "games" where possible and for work to be Wysiwyg.
- sytse 7y ago
  You mentioned https://about.gitlab.com/handbook/ceo/#flaws https://about.gitlab.com/handbook/ceo/#flaws I hoped that people would use the sentences I proposed on that page but that never happened. What is helpful is that when people raise a concern I can recognize it more quickly and show them it is clearly my flaw. This doesn’t happen often but it happened last week.
Sidious 7y ago
Ot: "In an effort to improve our user['s] experience..."
burfog 7y ago
Congratulations on taking a step in the right direction, even if it is a very small step. Nobody else seems to take the threat seriously, somewhat excepting defense contractors of course. I can understand being reluctant to deal with the full extent of the problem. Somebody from China, with a family in China and subject to Chinese law, does not cease to be a security threat by moving to the USA and getting a green card. This gets awkward. It really is no surprise that valuable secrets of all types (private key, customer data, trade secret, insider info for trading, etc.) end up in other countries.
- seanmcdirmid 7y ago
  In china, not from China. The former is easy to justify, and would affect even Americans of non Chinese descent. The latter would be incredibly difficult to justify, and could easily be seen as unwarranted discrimination.
  - big_chungus 7y ago
    Well, technically it is discrimination, but not racism. I.e. you can still hire a Japanese developer, and with a Chinese regime change you might be able to hire Chinese developers. However, federal law prohibits discrimination based on national origin. This is a touchy subject, but maybe this no longer makes sense? As burfrog pointed out, a Chinese employee living in America isn't free from Chinese control; the gov't will do bad things to his family if he gets a request for, say, information or access and doesn't comply. I'm hesitant to endorse allowing discrimination by national origin, but on the other hand, it doesn't make sense to allow the Chinese access to any kind of important data.
    - seanmcdirmid 7y ago
      It doesn’t matter. As long as a security clearance isn’t required, discriminating based on notational origin is a big no no from an ethical perspective, even if it was legal. I hope we learned our lesson during WW2.
      - 7y ago
jacquesm 7y ago
I think the issue of a week ago was the harder one and I really commend you on walking that one back.
deleted 7y ago
[deleted]
FragenAntworten 7y ago
If you don't mind me asking, why is this conversation open to comments from non-employees? Having discussions be publicly viewable seems valuable, but letting anyone at all participate seems disruptive and unhelpful (as an outside party, I was having trouble following the thread of employee discussion interrupted as it was by internet furor).
- sytse 7y ago
  If an issue is public everyone can comment on it until it is locked. I don't think there is another setting.

deleted 7y ago

[deleted]

iiertiosas 7y ago

I also learned a lot and some of the employees made great points. I’m wondering, can the US government legally issue a National Security Letter to an individual employee that forces them to comply and spy for them? If they can, does this also mean the employee has no legal recourse since NSLs must be kept secret?

cjbprime 7y ago
Arguably all of this has already happened, with the Lavabit case.
dodobirdlord 7y ago
> If they can, does this also mean the employee has no legal recourse since NSLs must be kept secret? No, because that would be unconstitutional. But the proceedings of objecting to a NSL similarly must be kept secret. There wouldn't be any point to the secret component of a NSL if the recipient could object and hash out the merits of the request in public court records.
- deleted 7y ago
  [deleted]
- pinkfoot 7y ago
  So how would anyone ever know that the objection was 1) heard, and 2) upheld?
  - K0SM0S 7y ago
    Welcome to the wonderfully paradoxical task of organizing and controlling secret services and jurisdictions in an otherwise democratic state. Most countries do it by subordinating secret agencies to a military division of sorts, wherein martial courts and security access is already structural. Others choose a more 'civilian' approach subordinated to a parallel chain of command within the citizen government/legislation/judiciary — closer to police, interior dpt / homeland security, etc. (in such cases, army intelligence is usually quite distinct from civilian surveillance). Which approach is favored historically by a country typically depends on pre-existing constitutional models and principles — notably how the army features relatively to the ultimate civilian chain of command, and how the latter is accountable to the (sovereign) public in the event of treason. None of this applies in authoritarian regimes where the ruling caste or figure(s) usually answer to no principle (no courts for them, only 'advisors' for they sit above the law) and secret service is almost always directly answering to them, as part of the active coercion of the people (fear of the "enemy within", etc).

hnarn 7y ago

I used to work for a company that had a public Jira bug tracker (security related bugs were hidden). I imagine a lot of customers had the same feeling you had: listing all bugs in a release, their status, the discussion around them, it was all there. Very transparent and very appreciated. Unfortunately, like most good things in corporate software, it didn't last.

pavelz 7y ago
Red Hat has a public Bugzilla with (almost) all the open bugs in their software.
- justinclift 7y ago
  It used to be open for most things. Doesn't seem to be that way for at least the last 6 months or so (may more).
- goatinaboat 7y ago
  Public for their paying customers. Which is fair enough, but it’s also nothing particularly unusual. Source: am a former RHEL customer now using Fedora

emrehan 7y ago

Check out the concept of "open startup": https://hackernoon.com/what-does-it-mean-to-be-an-open-startup-f4446984189 https://hackernoon.com/what-does-it-mean-to-be-an-open-start...

thekevan 7y ago

Wait, am I to understand that this law says I cannot boycott doing business with businesses located in Israel? I am in the US, so can not say, "I disagree with how the Israeli government is treating Palestine and thus don't want to do business with any entity located there."?

microcolonel 7y ago
> Wait, am I to understand that this law says I cannot boycott doing business with businesses located in Israel? No. That link the parent commenter shared is a very good overview: it basically means that your company will not receive special corporate tax consideration if your company: Enters agreements to refuse or actually refuses to do business with or in Israel or with blacklisted companies. Enters agreements to discriminate or actually discriminates against other persons based on race, religion, sex, national origin or nationality. Enters agreements to furnish or actually furnishes information about business relationships with or in Israel or with blacklisted companies. Enters agreements to furnish or actually furnishes of information about the race, religion, sex, or national origin of another person. (e.g. “hey [anti-Semitic company], this competing businessperson is a Jew, if you were wondering”) In any of these cases, there are exceptions and matters of interpretation. Whether or not you think this is appropriate for the government, it's not as simple as “you can't engage in a boycott as a matter of personal conscience”.
- thekevan 7y ago
  >your company will not receive special corporate tax consideration if your company: >Enters agreements to refuse or actually refuses to do business with or in Israel The link does actually include the penalties, which are far more than just losing special tax considerations. It includes hefty fines and even imprisonment under the TRA. The "just losing tax consideration" part is only under the EAR. I understand that part. It's the fact that they say I cannot boycott Israel independently. I'm still confused at how this can be fully Constitutional. Say I care a lot about the Palestinians and object to their treatment by the government and military of Israel. Say I make widgets wholesale for people to resell retail. So I say, if you buy my product and resell it you make money and your government takes some of that money, as is normal. Therefore, I will not sell to any company that sells this in Israel as I do not want to my product to be used to make money for a government whose actions I condemn. I don't care if you are a Jew, a Christian, an Arab and/or even a Palestinian, if you want to sell my product in Israel and taxes which go to the Israeli government will be collected on that, I'm not selling it to you. Not just certain companies within Israel, all of them. Anyone who sells my product and thus makes money for the Israel government, nope, I'm not doing it. That's the part I have a problem with. If I don't actively try to stop Israel from doing anything but want to take an active role in not helping them in any way, I'm breaking the law? I don't see if how I want to act independently the Arab League but what I want to do aligns with part of what they want to do, that is a problem? I should be able to not support what I see as a bad actor.

pinkfoot 7y ago

From the website: > forbidden from … Agreements to discriminate or actual discrimination against other persons based on race, religion, sex, national origin or nationality. So, to be clear - GitLab can merrily discriminate against Chinese citizens of the US on national origin by themselves, but are breaking the law if they do the same under a joint venture with a non-US entity. Bonkers.

AsyncAwait 7y ago

Indeed, thanks GitLab for being so open about your bigotry. I wonder what would happen if GitLab started excluding say Israeli nationals, because a large number of companies that sell 0-days for profit are based there, I suspect that accusations of antisemitism would pour in from all corners & rightfully so, but since demonizing China has been cool since the USSR's collapse & Russia rejoined the club it never really left in the eyes of Americans, it's all good. Disgraceful. GitLab was once an inspiration to me in terms of its openness & culture, but the recent moves around tracking and now this, make it clear that GitLab has been around for too long to stay a hero.

kortilla 7y ago
> it never really left in the eyes of Americans Nice bigotry in a post complaining about bigotry.
- AsyncAwait 7y ago
  Except when you look at Hollywood production, U.S TV news etc. that's exactly what you get. The Red Scare was a real thing, so was Russiagate. The anti-Chinese sentiment is very much real in the U.S. too, if the campaign rhetoric, current trade policies & the constant stream of accusations from newspapers of record are to be any indication. Maybe I could have worded it better, but I am referring to American culture and the mindset that when you think 'anti-hero', it's going to be a Russian/Chinese most of the time.

Dolores12 7y ago

If we are so transparent about everything, can we know the name of that customer?

dlgeek 7y ago

I'm shocked that they'd extend it to their lawyers. This thread (and the one the other day about telemetry and the GDPR) are a plaintiff and/or prosecutor's dream. One of the hardest parts of most white collar prosecutions is proving that an action was taken "knowingly and willfully". Unlike other areas of criminal law, most white collar offenses require prosecutors to prove that not only did the person know they were doing the things they were doing, they had to know they were illegal. Having the party's own lawyer offering legal advice outside the scope of privileged communication is normally windfall enough. Having them do it publicly and in the media's eye is just insane.

user5994461 7y ago
On the other hand, the discussion threads actually show that they have no idea what they are doing. It's a good question what one could prosecute out of that and what to gain. There are so many open angles and I don't think there is any precedent with a fully opened company.