3 ms·

Companies don't make decisions based on morality. This is a question of liability. Gitlab's liability, based on whatever internal metrics being measured, would

Companies don't make decisions based on morality. This is a question of liability. Gitlab's liability, based on whatever internal metrics being measured, would be significantly higher than the potential economic rewards of having employees in sensitive positions in these two countries--at the moment. Also, on a side note, morality != legality. They're two different things. What is moral isn't necessarily illegal, and vice versa. There's no need to beat up the strawman "techbro." It seems to me that this was a difficult decision to make and somebody had to make it. Damned if you do; damned if you don't.

jka 7y ago
That was roughly the reading of this issue that I assumed initially too, but in fact the liability/reward situation is reversed here, I think. GitLab are considering making this change in order to satisfy the requirements of a potential customer[0] - i.e. the reward is for adding the restriction. And in turn, making the change itself could increase liability[1] since it doesn't seem to be based on a legal request or existing defensible GitLab policy. [0] - https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#note_237506130 https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not... [1] - https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#note_239385982 https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not... The thread reads like a case of the compliance arm of the business trying to keep the ship steady and non-discriminatory (which is in-line with GitLab's stated goals, the intent of the law, and likely in-line with their prospects as a long-term global employer), while a sales part of the organization tries to close a deal. Putting in additional engineering effort to allow the customer to specify their own policy on SRE/support access to data -- which they'd be responsible for defending if there were any questions -- seems like it might be a way forward. Whether the sales team and customer would wait for that is another question. It's remarkable and very progressive to see this discussion in the open; it's also interesting to note how many side-discussions and different opinions emerge in the comments and in discussion here, while the core communication continues between a small number of participants in the merge request.
490d0aff0ee8 7y ago
> "Companies don't make decisions based on morality." So let's just label every employee with a Foreign/Chinese/Russian background as a spy, because a client says so?
- tomp 7y ago
  Why not? And Australians, they're explicitly (by law) required to be spies. And your comment suggests as much - why would opsec about consumer / sensitive data be important unless you expect your employees to act in less-than-fair manner (be that for personal gain, a competitor's gain, a national gain, ...)?
  - hvindin 7y ago
    Dammit.. was hoping Australia could silently slip under the radar on this one. The thing that I suspect that most people don't understand about Australia is that the laws don't really mean shit all unless the situation gets very serious very fast. I know people who have received aa requests who have literally responded with "get fucked mate, why on earth would I do that?" and the response has (for every instance I'm aware of) been "yea, true. it was a bit of a stretch" It's rather like the Australian constitution, I'm fairly sure I've seen a joke around about it, we have one but like... no one actually cares... if shit really hits the fan I'm sure we'll all go find a copy and figure it out, but otherwise we're doing only slightly less than alright just kinda playing it by ear...
  - 490d0aff0ee8 7y ago
    > "Why not? And Australians, they're explicitly (by law) required to be spies." How come we don't see Gitlab re-considering hiring Australians then? > "And your comment suggests as much - why would opsec about consumer / sensitive data be important unless you expect your employees to act in less-than-fair manner (be that for personal gain, a competitor's gain, a national gain, ...)?" The defense industry will put you through background checks, demand a security clearance, and won't hire you unless you're a citizen - whilst simultaneously employing some of the strictest security measures available today. Security will stay there long after you've stopped hiring Chinese and Russian individuals.

jka 7y ago

That was roughly the reading of this issue that I assumed initially too, but in fact the liability/reward situation is reversed here, I think. GitLab are considering making this change in order to satisfy the requirements of a potential customer[0] - i.e. the reward is for adding the restriction. And in turn, making the change itself could increase liability[1] since it doesn't seem to be based on a legal request or existing defensible GitLab policy. [0] - https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#note_237506130 https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not... [1] - https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#note_239385982 https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not... The thread reads like a case of the compliance arm of the business trying to keep the ship steady and non-discriminatory (which is in-line with GitLab's stated goals, the intent of the law, and likely in-line with their prospects as a long-term global employer), while a sales part of the organization tries to close a deal. Putting in additional engineering effort to allow the customer to specify their own policy on SRE/support access to data -- which they'd be responsible for defending if there were any questions -- seems like it might be a way forward. Whether the sales team and customer would wait for that is another question. It's remarkable and very progressive to see this discussion in the open; it's also interesting to note how many side-discussions and different opinions emerge in the comments and in discussion here, while the core communication continues between a small number of participants in the merge request.

490d0aff0ee8 7y ago

> "Companies don't make decisions based on morality." So let's just label every employee with a Foreign/Chinese/Russian background as a spy, because a client says so?

tomp 7y ago
Why not? And Australians, they're explicitly (by law) required to be spies. And your comment suggests as much - why would opsec about consumer / sensitive data be important unless you expect your employees to act in less-than-fair manner (be that for personal gain, a competitor's gain, a national gain, ...)?
- hvindin 7y ago
  Dammit.. was hoping Australia could silently slip under the radar on this one. The thing that I suspect that most people don't understand about Australia is that the laws don't really mean shit all unless the situation gets very serious very fast. I know people who have received aa requests who have literally responded with "get fucked mate, why on earth would I do that?" and the response has (for every instance I'm aware of) been "yea, true. it was a bit of a stretch" It's rather like the Australian constitution, I'm fairly sure I've seen a joke around about it, we have one but like... no one actually cares... if shit really hits the fan I'm sure we'll all go find a copy and figure it out, but otherwise we're doing only slightly less than alright just kinda playing it by ear...
- 490d0aff0ee8 7y ago
  > "Why not? And Australians, they're explicitly (by law) required to be spies." How come we don't see Gitlab re-considering hiring Australians then? > "And your comment suggests as much - why would opsec about consumer / sensitive data be important unless you expect your employees to act in less-than-fair manner (be that for personal gain, a competitor's gain, a national gain, ...)?" The defense industry will put you through background checks, demand a security clearance, and won't hire you unless you're a citizen - whilst simultaneously employing some of the strictest security measures available today. Security will stay there long after you've stopped hiring Chinese and Russian individuals.