4 ms·
> "You haven't really done OpSec have you? There is very little absolutism in defining who gets access to what data. In fact barring nations that have historica
by 490d0aff0ee8 7y ago
> "You haven't really done OpSec have you? There is very little absolutism in defining who gets access to what data. In fact barring nations that have historically shared data with their governments is exactly one step closer to how you would achieve this."
When was the last time you've contracted for a serious client? When it comes to tech - you don't implement "OpSec" by blanket banning hiring Chinese/Russian individuals. Disregarding your bizarre definition of "OpSec" - plenty of individuals with Chinese/Russian background are working for companies such as Google/Microsoft/Facebook/Uber - making significant contributions and getting paid vast sums of money for it. Those companies actually invest into background checks, have dedicated security teams, are investing into locking networks down and improving monitoring. It appears that Gitlab simply wants the easy way out, or, they can't afford to refuse the aforementioned client's offer.
- mbesto 7y ago> When was the last time you've contracted for a serious client? Uhh, today? I have about 20 on-going contracts with "serious clients", which include manufacturers, distributors, software companies, etc. What's your point? > When it comes to tech - you don't implement "OpSec" by blanket banning hiring Chinese/Russian individuals. Disregarding your bizarre definition of "OpSec" Banning hiring from countries isn't an exclusively isolated tactic for executing OpSec...I'm not sure why you implied that. > Those companies actually invest into background checks, have dedicated security teams, are investing into locking networks down and improving monitoring. Those companies all have physical presences in those countries. Gitlab does not. BIG DIFFERENCE.
- cloud226 7y agoI believe “serious clients” meaning more towards to military/banking clients. The access to their production env is very strict, and the personnels are always being audited no matter their nationality and/or geolocation