18 ms·

Gitlab's Director of Risk and Global Compliance Resigns

287 points by FLIINO 7y ago

jlgaddis 7y ago
Mark my words: the transparency at GitLab -- that we are all familiar with and very appreciative of -- will soon end. I don't care what your company does or what industry you are in, pretty much any decision you make is going to piss somebody off -- "you can't please all the people all the time" and all that. This is made worse by today's highly divisive political climate. We've seen it recently where a company does something, gets attacked for it, changes their mind, then gets attacked for that. It's bad enough for "non-transparent" companies but it's even worse for a company like GitLab -- when everyone in the world can (and will!) "attack you" for any decision you make. GitLab's transparency will come to an end. That's bad because there are others who are sitting back, waiting to see how this "transparency experiment" turns out -- and they'll decide that operating their company in the same manner is NOT the way they should go. I miss the days when we could agree to disagree on things and not get so damn "offended" at all the time.
- rossmohax 7y ago
  When company makes a decision against Director of Compliance advice, when she is given responses like (paraphrasing): "if we want to stay compliant, we'd lose these lucrative contracts, are you prepared to answer for you decisions?", what else she's left to do other than resign? It is not about polarized world, it is about having a dignity.
  - jcims 7y ago
    Compliance (or lack thereof) is just one element of risk that a company has to face. The folks that take those jobs are typically risk averse and struggle to move quickly, as one might imagine. You can't let them run the company or you're going to get destroyed by less apprehensive competition, but if you ignore everything they say you're running a completely different set of risks. It's a balance, like everything else in risk management. Her decision to leave is obviously a personal one. Bailing over one disagreement seems a bit unsustainable from a career standpoint, but there could be a track record or she could feel exposed by the public nature of the conversation.
    - jiveturkey 7y ago
      I give her more benefit of the doubt. If you express strenuous disagreement and are in an officer role, when your "advice" is only treated as advice to follow or ignore, you have to take a stand if you believe in yourself. Because it's your head that's going to roll when this chicken comes home to roost. Better to go out with honor and preserve your integrity, in some cases. Well, it's either that or she completely misjudged the position offered her. Seems gitlab didn't want an officer in this position but rather just a VP with an officer title.
- deleted 7y ago
  [deleted]
hnthroaway1926 7y ago
I imagine a Director of Compliance in the Russian or Chinese government has more authority to force people to comply.
rossmohax 7y ago
Plot twist: Gitlab censors message from Director of Compliance as violating code of conduct. Just wow.
- JetSpiegel 7y ago
  This issue has 1417 subscribed users, so all of them received the uncensored email. It's completely pointless.
- deleted 7y ago
  [deleted]
- dplanella 7y ago
  From GitLab: We did decide to moderate this post for review, as there have already been credible personal and physical threats against GitLab employees in this issue thread. GitLab cannot tolerate posts that threaten our employees (or anyone) personally, or posts that we believe may further inflame threats that have already been made. While this particular post did not contain a personal threat to anyone, we were concerned it would further inflame this situation. We understand that those who follow the issue already received the comment.
deleted 7y ago
[deleted]
xxs 7y ago
There is not much substance to go by. Yet, with recent events/drama her resignation feels suspicious to put it mildly. I suppose everyone expected the CFO to drop, instead.
bytematic 7y ago
Looks like Gitlab has censored her spreading the message of her resignation as well, nice.
- omani 7y ago
  once an environment got infected with "political correctness" and "censorship" in the name of "free speech" that environment becomes toxic. see.
  - chipotle_coyote 7y ago
    From what I'm reading here: (1) Gitlab decided they won't hire people living in certain countries (2) This appears to be motivated by the politics of business (3) An exec who spoke up against it tendered her resignation out of principle (4) They're trying to suppress conversation about that Please don't try to abstract "this is all the fault of those SJWs pushing political correctness" from this story. I appreciate from your comments that you think it'd be just great if we could keep politics out of business and lament that the Great Culture War has come for coding, and I get it. The Great Culture War has come for everything, though. Science fiction. Movies. Video games. Furries and Bronies. Here's the thing: this isn't the fault of a small number of loud people making things political that weren't before. All these things were always political -- we just weren't having our noses rubbed in it until relatively recently. Making your lead video game character a woman, or black, is a capital-S Statement because making them a white male is also a capital-S Statement. Trying to increase the number of women in STEM through affirmative action policies of one kind or another is obviously a capital-S Statement, but saying "hey, the fact that there are no women in science is itself proof that women just don't science well" is also a capital-S Statement. When your e-sports champion makes a capital-S Statement about Hong Kong protestors and you suspend him, suspend his camera man, and go into a massive PR defense about how gosh darn non-political you are, you are absolutely making a capital-S Statement. As I observed before, the old Rush lyric about "when you choose not to decide, you still have made a choice" holds true whether we want it to or not. You can passionately argue that politics shouldn't affect software companies and coding jobs, but they do. "You shouldn't try to affect your employer's business practices, you should just leave if you disagree with them" may not be intended to be political, but it will have political effects just as much as the reverse will: either the employer changes business practices to be more in line with what the employees are comfortable with, or the employer ends up with employees who are comfortable with their business practices.
alainchabat 7y ago
Gitlab decided to not hire people living in China/Russia because of all risks linked to the Chinese/Russian government. Isn't censoring one of their employee to not enflame the situation would be what China/Russia would do with their citizen for the same reason? kind of an ironic situation.
- Certhas 7y ago
  Governments and corporations doing something are not at all equivalent. Being put in prison for running a blog is not equivalent to having to run a blog because facebook wont have you.
- 9dl 7y ago
  It is more like damage control People who strongly disagree with rf/china government CAN not normally live in that countries So normal Russian/Chinese do not have rf/china citizenship
  - konart 7y ago
    So people who can't leave Russia/China for any reason (let's say sick relative) are not normal? And what does citizenship has to do with "living"?
- frenchyatwork 7y ago
  There's certainly irony, or at least contradiction, here; but there's also a huge difference. In North America, companies regularly try to censor their employees; in China, the government regularly tries to censor its citizens. In both cases though, the government is the only one with the authority to enact violence on its citizens. So while the most Gitlab can do is fire Candice, or censor communications she makes on their platform; in China, such dissension could get you locked up, exiled, or disappeared. Note: I have no love for the sort of thing Gitlab is doing here. It's petty.
  - tracker1 7y ago
    I think editing the comment brought undue attention to it... in the end, a politely worded response as a comment would have probably worked out better.
joshuakelly 7y ago
I wonder if GitLab has reached an inflection point in team-size where the traditional trappings of corporate behaviour will overcome its transparent/open culture. I wonder what the limit of global and remote really is?
- Jasper_ 7y ago
  Most startups are quite transparent until they hit a big backlash "inflection point" and realize they outgrew that culture. Even GitHub used to be that way. Radical transparency works for small startups with heavy us-against-them cultures, a mutual agreement on who the enemy is, but when it starts facing tough challenges from the inside is when that starts to disappear.
  - AnonGitLabEmpl 7y ago
    Can confirm, transparency is rapidly degrading internally too.
    - omani 7y ago
      leave the ship before it is too late. I speak from experience.
      - jahlove 7y ago
        what happens once it's 'too late'?
        omani 7y ago
        you will engange yourself in a fight which is not yours. you will waste time on meaningless things, rather than caring about your own stuff which is much more time worthy. in the end you will find yourself in a situation where you will realize that what you thought was your own opinion was much more a copy of what others said and what you've been told. you will give up because it isnt worth the time and you will go back to your own roots and yourself with the words: "well. guess Ive wasted a year or two." time is the most precious thing you have in this life.
itronitron 7y ago
tl/dr...Director of Compliance at GitLab resigns because they can't force company to comply.
helen___keller 7y ago
Ignoring for a second the ethics of hiring bans around particular countries, I find it interesting that this is in a way a problem that uniquely belongs to a distributed organization In a traditional organization, none of your employees will reside in country X unless you actively open an office in that country. The organization may choose to develop satisfactory IT controls and administration tools before doing so, or simply not do so at all. For a distributed organization like Gitlab, there is a presumption that employees live where they want unless told otherwise. Hence, the pains that Gitlab is going through now.
- lacker 7y ago
  Even in a distributed organization, you have to deal with taxes separately per-country, so each country has to be approved by HR, in a sense. And you can’t have employees living in places like Iran.
  - helen___keller 7y ago
    Right but the default case is that every country is okay, minus the exceptions. This whole debacle is Gitlab choosing to add China and Russia to their list of exceptions. For physical offices, it's a whitelist: if we didn't decide your country gets an office, too bad
  - e1g 7y ago
    Distributed startups often use a 3rd party to do the actual employment/compliance of people across N countries. Those providers are called Professional Employer Organization (PEO) and serve as Employers of Record (EOR) - handling employee/contractor agreements, payroll, compliance, tax, etc. The startup itself does not even register a legal entity in the country, and everything is managed by the likes of Papaya Global, Globalization Partners, etc.
- hrktb 7y ago
  That ship has sailed IMO, in that even in single location orgs you will have foreign employees with potential legal obligation toward different governments, and domestic employees with strong ties to other countries. From that point of view Gitlab’s diacussion on hiring or not employees from specific countries seems a bit old (except if it’s for paperwork reasons)
rdslw 7y ago
Candice Ciresi (aforementioned director) commented: "As I believe GitLab is engaging in discriminatory and retaliatory behavior, I have tendered my resignation." E-mail notification (her resignation): https://i.imgur.com/AE8UtvD.png https://i.imgur.com/AE8UtvD.png First time it was edited: https://i.imgur.com/7N7mTC2.png https://i.imgur.com/7N7mTC2.png Current version: https://i.imgur.com/YjWmpGk.png https://i.imgur.com/YjWmpGk.png
- cjbprime 7y ago
  This: We will not tolerate Very Serious Charge X. This post did not do X, but other people did and this post says something critical of us so we removed it. construct is quite something.
  - dplanella 7y ago
    For clarity and for the context of this thread => From GitLab: We did decide to moderate this post for review, as there have already been credible personal and physical threats against GitLab employees in this issue thread. GitLab cannot tolerate posts that threaten our employees (or anyone) personally, or posts that we believe may further inflame threats that have already been made. While this particular post did not contain a personal threat to anyone, we were concerned it would further inflame this situation. We understand that those who follow the issue already received the comment.
    - dev_by_day 7y ago
      You can stop copy and pasting this response everywhere, it's already in the screenshot. Censoring a respectful employee resignation, regardless of whatever "spin" you try to justify it with, is not a good look for your company. You're guideline here is basically it makes gitlab look bad and you want to hide it to avoid further negative feedback. The thread is already locked so no further trolling can be posted in that thread.
      - Acatalepsy 7y ago
lacker 7y ago
To me this seems like a huge self-inflicted mess by GitLab. Normal companies don’t make touchy personnel issues public. Things like “we need to stop hiring Russian employees onto the support team because clients disapprove”. It’s cool to be so open in an abstract sense, but watching this play out in public really just makes me want to not air this sort of issue out in public when it comes to my own workplace.
- icebraining 7y ago
  "If people don't know what you're doing, they don't know what you're doing wrong." -- Sir Arnold, Yes, Minister
  - mprev 7y ago
    I want transparency from my government. Would I want an unwavering commitment to do everything in the open from my employer? Clearly people who joined GitLab knew that was the deal and, while I see the point you're making, VC-funded code hosting (plus extras) isn't in the same league as the government.
- CydeWeys 7y ago
  Is it "no Russian employees" or "no employees located in Russia"? Because there's a big difference here, and the latter is a pretty common policy (and de facto true for the vast majority of companies, even if not intentionally). See e.g.: https://www.cnbc.com/2014/12/12/google-closes-russia-office-after-internet-crackdown.html https://www.cnbc.com/2014/12/12/google-closes-russia-office-...
  - gpm 7y ago
    It's the latter. (Strictly speaking "no employees in <roles that need admin credentials> residing in Russia or China")
    - sytse 7y ago
      Indeed. This is about residence not about nationality. As for making this public we are public by default. But we are learning that anything involving countries needs to be communicated with a lot of context. Countries are a core part of people their identity. In the future any decision involving countries will still be public but the discussion will not be.
dessant 7y ago
I was expecting Paul Machle (CFO) to resign, at least they seem to be completely divorced from the values that GitLab was built upon. > I don’t understand. This should not be an opt in or an opt out. [Telemetry] is a condition of using our product. There is an acceptance of terms and the use of this data should be included in that. https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#note_203849107 https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no...
- Operyl 7y ago
  Honestly, it's the end of an era for Gitlab it seems to me. The CFO's views are going to become the new norm, and I doubt there's much the CEO will do to course correct (since this latest issue seemed to involve him with a big client contract?). I expect another "we're sorry, we won't do it again!" as we've gotten the past few times, but I am trusting those less and less.
  - dessant 7y ago
    The general direction of GitLab can also be steered by employees. They could organize, publish a statement, and refuse to check in for work on Monday. It all depends on how many GitLab employees believe strongly enough in these values, and how many are willing to take some risks and defend the company and its values.
    - AnonGitLabEmpl 7y ago
      I've thought about this a lot. We could, but we are all literally terrified for our jobs and of retaliation.
      - dessant 7y ago
        I completely understand, retaliation is a real possibility in such cases. This is why it's important to find a safe way to organize, and for a considerable number of employees to protest.
bdcravens 7y ago
I like my infrastructure to be nice and stable. I realize that all the recent drama MAY not be a cause for concern, but I imagine this makes Gitlab a harder sell, in a world of many choices.
- icebraining 7y ago
  And this is how we discriminate against transparency. This sort of drama happens all the time in many companies, we just don't see it publicly.
  - babesh 7y ago
    Prior to the recent debacles, they were rewarded for their transparency.
- alkz 7y ago
  well it's not like gitlab.com was stable either way
icebraining 7y ago
Off-topic, but I wonder if Gitlab employees have some way to filter the discussion, or if they have to manually skip posts by random people.
- AnonGitLabEmpl 7y ago
  We have to manually skip posts by random people.
ben_jones 7y ago
1. Company is applauded for strong morals 2. Company raises a ton of money 3. ??? 4. Company appears "divorced or original morals"
- ativzzz 7y ago
  Are we surprised that companies choose money over morals? That seems to be the status quo for most companies in the U.S. currently. There are, and always will be exceptions depending on the particular people involved, but generally if you as a company want to preserve your moral ground, do not take external funding.
AdministrativeA 7y ago
We use GitLab self-hosted at my company so I've been following this for a while. My speculation is there's pressure for the C suite to push this Russia and China hiring ban for some reason. Looks like the board is telling the CEO this has to happen or they're in negotiation talks to be acquired by a big company like Google who wants this to happen now and the backlash to have passed by the time it's announced. So this will happen whether it's illegal or not (and it looks like it will and is illegal) but the risk will cost less than the reward. If they go to court they spend at most a few mil fighting it over the course of a few years and the executives walk away super rich anyway. If they don't go to court they walk away even more rich. But if they don't do it they might rely on an IPO that's looking shaky because of this bad decision making for the past 2 months. So even if it's illegal, it still makes sense to do this. It looks like an exit strategy because they will never be personally liable. She probably sees this and knows everything going on behind the scenes, but she won't walk away super rich from this but could lose her law license by engaging in discrimination.
- AdministrativeA 7y ago
  One other thought: in most companies, you just don't open an office there. Or you lock your data down. But they don't have the technical capability to monitor or restrict access to prod data (their VP said this). Because they're remote they can't just not open an office there so they have to restrict hiring to keep Chinese and Russians living in China and Russia out. Normally what would happen is you'd hire them but then not give them access to prod data (usually by saying it requires some background check or clearance you know they can't get) or when it's illegal not to give access, just lock the data down. The alternative is probably illegal, but it's the only one that GitLab has.
  - deleted 7y ago
    [deleted]
  - itronitron 7y ago
    There is no way that not granting an employee access to prod data can be illegal. That sort of access is a privilege not a right.
ddevault 7y ago
I don't understand why GitLab is doing these things. Even on behalf of Sourcehut, there are subsets of the industry that I don't really try to compete with GitLab on. They have a place in this ecosystem and they're working to undermine it. They're making a void that I, even as a competitor, don't want to and am not prepared to fill. The community is going to suffer for their missteps. I feel really bad for their employees. If I could help, I would, but Sourcehut isn't big enough to provide another employment option for them. To any GitLab employees who know something I can do to help, or just want to talk, I can lend a sympathetic and private ear at sir@cmpwn.com.
- marcinzm 7y ago
  Someone told Gitlab they'll pay them $XXX/year but only if Gitlab has no employees in China/Russia in sensitive roles. Gitlab decided the money is worth it since they have bills to pay. Doesn't seem very mysterious to me. There's many stories of companies only letting people use burner laptops if they go to China and Russia so it's not a very far fetched contract requirement.
  - alteria 7y ago
    I know several companies, including one I've worked for before, with very strict no company property laptop or phone policy for entering China. Issues were mainly related to IP and data sovereignty.
    - remoteworker471 7y ago
      My current employer maintains a list of banned countries. While there's nothing stopping me from going to any of them, I am not allowed to bring my laptop into the country, and accounts will generally be locked during the duration of travel. I'm honestly not seeing what the problem is with this policy. Gitlab's reaction to the outrage has been incredibly poor, but the policy itself seems sane based on IP laws and data protection laws in certain countries.
- AnonGitLabEmpl 7y ago
account73466 7y ago
One day your grandkids will ask you how it happened so that we are now slaves? Well, you can say it was not up to you, kinda.
sebtoast 7y ago
Do any of you have a recommendation for an alternative to GitLab and GitHub?
- echelon 7y ago
  What's the issue with GitHub?
  - _emacsomancer_ 7y ago
    Motives of the new owners.
  - w457uiw4gftyi 7y ago
    Last week people were mad that Microsoft complied with an order from the Spanish government to remove a controversial repo: https://news.ycombinator.com/item?id=21395629 https://news.ycombinator.com/item?id=21395629 And before that some anti-Microsoft people were mad in general that MS bought GitHub.
- mendelmaleh 7y ago
  sourcehut (https://git.sr.ht https://git.sr.ht)
  - scient 7y ago
    Quite the feat to build a site this slow...
    - Rebelgecko 7y ago
      Their front page loads much more quickly for me than either Gitlab or Github's.
- smichael 7y ago
  Darcs hub! :-) https://hub.darcs.net https://hub.darcs.net
- 7y ago
deleted 7y ago
[deleted]
rukittenme 7y ago
Paraphrasing: > "We had to moderate her resignation because of credible threats against our employees[0]. I'm sorry, how do you know they're credible? Did you call them and ask if they were super serious? Did you contact the FBI and find out they're members of ISIS? What a load of bullshit. Honestly Gitlab, blow it out your ass. Of course these "credible" threats were "inflamed" by a single sentence[1] that was critical of the company. 0. https://i.imgur.com/YjWmpGk.png https://i.imgur.com/YjWmpGk.png 1. https://i.imgur.com/AE8UtvD.png https://i.imgur.com/AE8UtvD.png
tempsy 7y ago
Who would've thought version control software would have so much public internal drama...both Github and Gitlab.
- omani 7y ago
  because it all comes down to the root cause: the attack on an area which until now couldnt care less about politics. now in the context of "free speech" we try to brake the last knowm union out there in the world. developers, who only let code speak so far.
  - dfalfndfk 7y ago
    Technology always cared about politics. Exactly what about missiles is apolitical? What about telemetry and data collection? Do not conflate ignorance with impact.
    - michaelt 7y ago
      > Exactly what about missiles is apolitical? "Once ze rockets are up, who cares where they come down? That's not my department, says Wernher von Braun" https://youtu.be/QEJ9HrZq7Ro?t=16 https://youtu.be/QEJ9HrZq7Ro?t=16
99_00 7y ago
Haven't been following this debate but has it been mentioned that China has a law that says that every Chinese citizen must spy for the government if asked. >The law provides official sanction for the intelligence services to do things long observed in their activities: coopting officials in other government agencies; compelling cooperation from PRC citizens; https://www.canada.ca/en/security-intelligence-service/corporate/publications/china-and-the-age-of-strategic-rivalry/chinas-intelligence-law-and-the-countrys-future-intelligence-competitions.html https://www.canada.ca/en/security-intelligence-service/corpo...
- deleted 7y ago
  [deleted]
- Twirrim 7y ago
  Same is true for Australia, IIRC.
  - austhrow743 7y ago
    Source?
    - rwiggum 7y ago
      https://gizmodo.com/australia-s-new-encryption-law-is-forcing-tech-companie-1835074557 https://gizmodo.com/australia-s-new-encryption-law-is-forcin...
      - austhrow743 7y ago
        Seems to be very different from the above. One is about Chinese citizens the other is about Australian companies and even then, only technology based parts of them. I as an Australian don't appear to be facing the gulag if Scomo calls me up and asks me what the Balinese are up to (I'm in Bali) and I tell him to shove it.
  - angry_octet 7y ago
    Fortunately that is an insanely wrong statement.
busterarm 7y ago
Sourcehut is pretty great, y'all.
deleted 7y ago
[deleted]
dev_by_day 7y ago
An important point to communicate here is this is based on someone's geographic residence, not their ethnicity or nationality. An American living in China or Russia would be subject to the same policy of not being hired. A Chinese or Russian person living in Europe would still be eligible for employment.
- yani 7y ago
  IMO 99.9% of remote workers from a country are also citizens of the country. The only difference would be top expat/nomad countries.
  - filoleg 7y ago
    The parent comment has never mentioned citizenship, only country of residence and nationality. As long as a Chinese/Russian/etc. national resides in one of the non-banned countries and can get hired just as well as any other national (regardless of whether they have a citizenship of the country they reside in or not), everything is alright in my book, because it has nothing to do with them on a personal level.
tachion 7y ago
And I thought we already had this quarter's GitLab drama in the GitLabTrackerGate ;)
- xiphias2 7y ago
  This is part of the same drama, as Candice Ciresi was the one who told other people at GitLab management that what they are doing (opt out tracking) is illegal in multiple juridictions. I'm interested in what her next job will be, as hopefully another company will value her knowledge and integrity.
bhouston 7y ago
I just wish that GitLab didn't have weekly (or more frequent) outages. Is this because they are all distracted by the drama ongoing there?
simonswords82 7y ago
I'm out of the loop here, what is going on with Git Lab? They were well regarded and now they are not?
- throwawaypolicy 7y ago
  There were basically two "scandals" recently. - GitLab announced that they were going to start including third party telemetry. This predictably annoyed developers. They made it substantially worse by originally announcing that it would be included in self-hosted enterprise versions as well (a really big no-no from many companies perspective), and by tone deaf comments from the CFO that made it clear they were going to violate the GDPR. - GitLab started talking about not allowing people working in support rolls to live in China, Russia, and Ukraine because of security concerns brought up by a customer. No one ever really came up with a good justification for why Ukraine was on the list, so it was removed (but you will still see references to it in some of the earlier discussions). Someone noticed the discussion and posted it here (and elsewhere). Communication around what they're actually planning on doing has been pretty poor, likely partially as a result of this being noticed on their public-yet-internal issue tracker instead of being released via clearly written messages. Some people have legal concerns about it (see: anti boycott laws), some have ethical issues, others think it sounds fine. Meanwhile the issue on gitlab itself has been subjected to intense astroturfing by largely new accounts which caused it to be locked. The new development today is that the director of compliance has resigned since they are of the opinion that what they are planning to do is illegal. Personally I think they're still pretty well regarded, but these two events in such close proximity have definitely given them a bloody nose.
- nemothekid 7y ago
  I found more interesting information in the Reddit thread. https://www.reddit.com/r/gitlab/comments/dtfccm/gitlabs_director_of_risk_and_global_compliance/f6x00sa/ https://www.reddit.com/r/gitlab/comments/dtfccm/gitlabs_dire... --- Ciresi: The countries selected were not chosen because of legal requirements, they were not chosen based on risk, they were not chosen based on political climate (as other countries are facing heightened sanctions from the US). I do hope they were not selected because a customer asked for it - or that could violate anti-boycott laws. In fact, having no objective basis for the restrictions is not conservative - it is careless. (Please let me know immediately if a customer has requested that we not do business with any particular country as that may be a reportable event.) I recommend against proceeding until you have developed a sound basis - that gets applied equally - for any exclusion of any country. Johnson: I appreciate your position. Please be aware there is an active, time-sensitive contract negotiation linked to this matter. And you need to advocate to the DRI that the company walk away from that contract in order to enact your proposal." --- I think Ciresi has been 2/2 in the recent GitLab scandals (she was also against the telemetry issue). The most obvious version of the story is now Ciresi has "gotten in the way" of sales twice now and is being retaliated upon. I'll admit, its rare to see a company flush its morals down the toilet while chasing revenue.
NoFascistSFBay 7y ago
Despicable racist company. Investors need to pullout now before the fascism spreads.
TA-blahhh 7y ago
sytse is awfully quiet in the comments today... usually he has a reply for everyone whenever a Gitlab/Git/VCS story comes up
- getareallawyer 7y ago
  Maybe he got a real lawyer.
getareallawyer 7y ago
Extremely unprofessional behavior, especially for someone with a law degree. Three serious issues: #1: She shouldn't be speculating about legal liability in a non-privileged medium. Even if she's correct, the risk is too high that her statements will later be quoted out of context. Keep it in a privileged medium, ideally an in-person meeting or phone call. This is absolutely basic stuff, and I'm sure it's taught even at Mitchell Hamline. #2: Even if you disagree with a decision, don't leave a written record that you believe your company is legally in the wrong. There are exceptions (you believe you'd be personally liable, and you want the paper trail to make it clear you didn't make the decision), but there is absolutely no reason to make that record public. #3 (Related) Don't burn bridges on your way out the door. This isn't specific to law - it's just good professional practice. The world is smaller than you think, and you're poisoning your professional network. Doing it publicly is even worse. Why would you be willing to hire someone who has demonstrated that they will publicly torch your company if you make a significant decision they disagree with.
- michaelt 7y ago
  Gitlab is an all-remote, very open startup, where the company's employees can publicly discuss not hiring SREs and Support Engineers in China and Russia with an abundantly clear paper trail in the public issue tracker. Do you believe her actions are inconsistent with those values - or are you saying as the values are problematic, she should not have upheld them?
  - bsder 7y ago
    > Do you believe her actions are inconsistent with those values - or are you saying as the values are problematic, she should not have upheld them? Her actions appear to be inconsistent with being a good lawyer. Part (most?) of being a good lawyer is knowing when to shut up and when to tell your client to shut up. In addition, there is some level of attorney/client privilege to consider. Quite often, two companies will have 4 sets of lawyers in the room for particularly sensitive things. Counsel for the companies and then counsel for the counsel. This ensures that what is discussed stays under attorney/client privilege.
- 7y ago
dustinmoris 7y ago
Wheres sytse? Normally he and his GitLab fake accounts are immediately jumping on every HN thread with Gitlab in the title trolling people with up-/downvotes, but today he seems to be very quiet.
kerpele 7y ago
I hope the contract that sparked this whole fiasco is big enough to cover the ton of goodwill they've lost (and keep losing) over this issue.
llamataboot 7y ago
Hmmm, I wonder what sort of large partnership could be so concerned with these two countries? Could it possibly be something with US intelligence agencies?
marcinzm 7y ago
I'm curious about something. In one of her cited comments Candice Ciresi, the director, mentions that if the ban on Russia/China is due to a client request then it: >could violate anti-boycott laws Does anyone know specifically which laws she's referring to? Many companies have requirements on data not being accessed by individuals outside of certain countries or being sent outside of certain countries. Others have restrictions on not bringing company property into certain countries.
- ktsmith 7y ago
  You can read about them here: https://www.bis.doc.gov/index.php/enforcement/oac https://www.bis.doc.gov/index.php/enforcement/oac
  - marcinzm 7y ago
    Based on my reading there are two laws in question: * Tax Reform Act: This seems to only penalize supporting an existing boycott by another country of a third country [1]. As there is no government boycott of Russia and China (at least not in countries these clients are from I'm guessing) this shouldn't apply. * Export Administration Act: This also specifically says it related to boycotts conducted by a country against another country the US is friendly with [2]. I'm open to someone pointing out my misreading of these laws but it seems that they only apply to government mandated boycotts. So, to me, clients are free to require restrictions if there are no government boycotts in place. [1]: https://www.irs.gov/pub/irs-soi/03-04boycott.pdf https://www.irs.gov/pub/irs-soi/03-04boycott.pdf [2]: https://www.govinfo.gov/content/pkg/CFR-2019-title15-vol2/xml/CFR-2019-title15-vol2-part730.xml https://www.govinfo.gov/content/pkg/CFR-2019-title15-vol2/xm...
    - cosmie 7y ago
      The violation may have been the lack of appropriate reporting. [1] mentions that "unsanctioned boycotts" must be reported. Later in the comments she mentioned that the contract in question was screened and found to not actually be considered a relevant event for anti-boycotting laws. So whatever her initial concerns were, they were allayed by an actual review of the relevant request. Reading through the conversation as a whole, it appears that the customer/contract in question didn't explicitly request Gitlab to take the course of action they decided on. Gitlab proactively decided that the action just happened to be a crude but effective way to comply in a timely fashion with the data restrictions the customer wanted, since their infrastructure itself currently doesn't have granular enough security controls around data access to comply with what the customer request was. [1] https://www.bis.doc.gov/index.php/enforcement/oac#whatmustbereported https://www.bis.doc.gov/index.php/enforcement/oac#whatmustbe...
malvosenior 7y ago
Gitlab's insistence of adjusting remote pay based on geography (and paying below market in general) never sat well with me. You pay people based on the value they provided, period. It's ridiculous to think you would take a pay cut at your current remote job just because you move to a cheaper city. It does not surprise me one bit that where there was smoke, there's fire and a bunch of questionable behavior is going on behind the scenes.
- jiveturkey 7y ago
  I used to think that, but now I think it's completely fair and they way they present is completely honest. So I'm all for it, at least the way they have implemented it. As an employer in a capitalistic society, you do not pay people based on value provided. You pay based on a reverse dutch auction method. This ensures you are getting an employee at the lowest possible cost, which is your financial duty. Anything more is excess expense. This is why unions are so important: to band labor together such that there is no opportunity for a prisoner's dilemma situation, where things become a race to the bottom. It is the employer's duty to wring as much value out of an employee as possible, not to pay them for that value. Paying by value provided would introduce so much inequality it'd be awful. So anyway, paying market rate (or the identical fraction under/over everywhere) at any location is just like having an office in every city where you don't have a WFH policy at all and employees are competing against other local employees. So gitlab employees that have self-selected to live and work in the same location, wherever it may be, are bidding themselves against other employers in that location. gitlab gets the edge over local employers who presumably would require the employee to show up at the office, for those people that don't want to go in the office at all, for whatever reason. And therefore it's justified that gitlab pays less than market because they are only selecting for those employees that value the WFH as opposed to just "work close to home". And this justification is proven because they are actually able to employ people at "less than market". QED
  - couchand 7y ago
    Your reasonable arguments are wholly undermined by the jackhole manner you end your comment.
epiphanitus 7y ago
How do we know her resignation is about hiring devs based in Russia/China and not about something else?
Iv 7y ago
I am so happy I resisted transitioning from GitHub to gitlab and self-hosted instead.
angry_octet 7y ago
It seems more likely that, for unexplained reasons, she was not in the loop on the area she was employed to work on (Global Compliance) and decided therefore to resign. She may have reasoned that this type of policy would have made working in BRICS countries very difficult. Ironically, these countries routinely impose residency and nationality requirements, local hosting and censorship etc. The lack of nuance in her public communication is quite strange for a lawyer. 'Retaliatory behavior' -- against whom are they retaliating and for what? A serious allegation. And other strange and strongly worded warnings of illegality, but which have no basis in law that I can see. So, bluster? Trying to win an argument? I can't help but think that remote work is not for everybody, and especially not for lawyers.
- uuioperter 7y ago
  She said there would be no issues if it was a legal requirement. But there could be issues if it was a demand by a customer. The CFO replied it was part of a possible contract.

287 points by FLIINO 7y ago

Mark my words: the transparency at GitLab -- that we are all familiar with and very appreciative of -- will soon end. I don't care what your company does or what industry you are in, pretty much any decision you make is going to piss somebody off -- "you can't please all the people all the time" and all that. This is made worse by today's highly divisive political climate. We've seen it recently where a company does something, gets attacked for it, changes their mind, then gets attacked for that. It's bad enough for "non-transparent" companies but it's even worse for a company like GitLab -- when everyone in the world can (and will!) "attack you" for any decision you make. GitLab's transparency will come to an end. That's bad because there are others who are sitting back, waiting to see how this "transparency experiment" turns out -- and they'll decide that operating their company in the same manner is NOT the way they should go. I miss the days when we could agree to disagree on things and not get so damn "offended" at all the time.

rossmohax 7y ago
When company makes a decision against Director of Compliance advice, when she is given responses like (paraphrasing): "if we want to stay compliant, we'd lose these lucrative contracts, are you prepared to answer for you decisions?", what else she's left to do other than resign? It is not about polarized world, it is about having a dignity.
- jcims 7y ago
  Compliance (or lack thereof) is just one element of risk that a company has to face. The folks that take those jobs are typically risk averse and struggle to move quickly, as one might imagine. You can't let them run the company or you're going to get destroyed by less apprehensive competition, but if you ignore everything they say you're running a completely different set of risks. It's a balance, like everything else in risk management. Her decision to leave is obviously a personal one. Bailing over one disagreement seems a bit unsustainable from a career standpoint, but there could be a track record or she could feel exposed by the public nature of the conversation.
  - jiveturkey 7y ago
    I give her more benefit of the doubt. If you express strenuous disagreement and are in an officer role, when your "advice" is only treated as advice to follow or ignore, you have to take a stand if you believe in yourself. Because it's your head that's going to roll when this chicken comes home to roost. Better to go out with honor and preserve your integrity, in some cases. Well, it's either that or she completely misjudged the position offered her. Seems gitlab didn't want an officer in this position but rather just a VP with an officer title.
deleted 7y ago
[deleted]

hnthroaway1926 7y ago

I imagine a Director of Compliance in the Russian or Chinese government has more authority to force people to comply.

rossmohax 7y ago

Plot twist: Gitlab censors message from Director of Compliance as violating code of conduct. Just wow.

JetSpiegel 7y ago
This issue has 1417 subscribed users, so all of them received the uncensored email. It's completely pointless.
deleted 7y ago
[deleted]
dplanella 7y ago
From GitLab: We did decide to moderate this post for review, as there have already been credible personal and physical threats against GitLab employees in this issue thread. GitLab cannot tolerate posts that threaten our employees (or anyone) personally, or posts that we believe may further inflame threats that have already been made. While this particular post did not contain a personal threat to anyone, we were concerned it would further inflame this situation. We understand that those who follow the issue already received the comment.

deleted 7y ago

[deleted]

xxs 7y ago

There is not much substance to go by. Yet, with recent events/drama her resignation feels suspicious to put it mildly. I suppose everyone expected the CFO to drop, instead.

bytematic 7y ago

Looks like Gitlab has censored her spreading the message of her resignation as well, nice.

omani 7y ago
once an environment got infected with "political correctness" and "censorship" in the name of "free speech" that environment becomes toxic. see.
- chipotle_coyote 7y ago
  From what I'm reading here: (1) Gitlab decided they won't hire people living in certain countries (2) This appears to be motivated by the politics of business (3) An exec who spoke up against it tendered her resignation out of principle (4) They're trying to suppress conversation about that Please don't try to abstract "this is all the fault of those SJWs pushing political correctness" from this story. I appreciate from your comments that you think it'd be just great if we could keep politics out of business and lament that the Great Culture War has come for coding, and I get it. The Great Culture War has come for everything, though. Science fiction. Movies. Video games. Furries and Bronies. Here's the thing: this isn't the fault of a small number of loud people making things political that weren't before. All these things were always political -- we just weren't having our noses rubbed in it until relatively recently. Making your lead video game character a woman, or black, is a capital-S Statement because making them a white male is also a capital-S Statement. Trying to increase the number of women in STEM through affirmative action policies of one kind or another is obviously a capital-S Statement, but saying "hey, the fact that there are no women in science is itself proof that women just don't science well" is also a capital-S Statement. When your e-sports champion makes a capital-S Statement about Hong Kong protestors and you suspend him, suspend his camera man, and go into a massive PR defense about how gosh darn non-political you are, you are absolutely making a capital-S Statement. As I observed before, the old Rush lyric about "when you choose not to decide, you still have made a choice" holds true whether we want it to or not. You can passionately argue that politics shouldn't affect software companies and coding jobs, but they do. "You shouldn't try to affect your employer's business practices, you should just leave if you disagree with them" may not be intended to be political, but it will have political effects just as much as the reverse will: either the employer changes business practices to be more in line with what the employees are comfortable with, or the employer ends up with employees who are comfortable with their business practices.

alainchabat 7y ago

Gitlab decided to not hire people living in China/Russia because of all risks linked to the Chinese/Russian government. Isn't censoring one of their employee to not enflame the situation would be what China/Russia would do with their citizen for the same reason? kind of an ironic situation.

Certhas 7y ago
Governments and corporations doing something are not at all equivalent. Being put in prison for running a blog is not equivalent to having to run a blog because facebook wont have you.
9dl 7y ago
It is more like damage control People who strongly disagree with rf/china government CAN not normally live in that countries So normal Russian/Chinese do not have rf/china citizenship
- konart 7y ago
  So people who can't leave Russia/China for any reason (let's say sick relative) are not normal? And what does citizenship has to do with "living"?
frenchyatwork 7y ago
There's certainly irony, or at least contradiction, here; but there's also a huge difference. In North America, companies regularly try to censor their employees; in China, the government regularly tries to censor its citizens. In both cases though, the government is the only one with the authority to enact violence on its citizens. So while the most Gitlab can do is fire Candice, or censor communications she makes on their platform; in China, such dissension could get you locked up, exiled, or disappeared. Note: I have no love for the sort of thing Gitlab is doing here. It's petty.
- tracker1 7y ago
  I think editing the comment brought undue attention to it... in the end, a politely worded response as a comment would have probably worked out better.

joshuakelly 7y ago

I wonder if GitLab has reached an inflection point in team-size where the traditional trappings of corporate behaviour will overcome its transparent/open culture. I wonder what the limit of global and remote really is?

Jasper_ 7y ago
Most startups are quite transparent until they hit a big backlash "inflection point" and realize they outgrew that culture. Even GitHub used to be that way. Radical transparency works for small startups with heavy us-against-them cultures, a mutual agreement on who the enemy is, but when it starts facing tough challenges from the inside is when that starts to disappear.
- AnonGitLabEmpl 7y ago
  Can confirm, transparency is rapidly degrading internally too.
  - omani 7y ago
    leave the ship before it is too late. I speak from experience.
    - jahlove 7y ago
      what happens once it's 'too late'?
      - omani 7y ago
        you will engange yourself in a fight which is not yours. you will waste time on meaningless things, rather than caring about your own stuff which is much more time worthy. in the end you will find yourself in a situation where you will realize that what you thought was your own opinion was much more a copy of what others said and what you've been told. you will give up because it isnt worth the time and you will go back to your own roots and yourself with the words: "well. guess Ive wasted a year or two." time is the most precious thing you have in this life.

itronitron 7y ago

tl/dr...Director of Compliance at GitLab resigns because they can't force company to comply.

helen___keller 7y ago

Ignoring for a second the ethics of hiring bans around particular countries, I find it interesting that this is in a way a problem that uniquely belongs to a distributed organization In a traditional organization, none of your employees will reside in country X unless you actively open an office in that country. The organization may choose to develop satisfactory IT controls and administration tools before doing so, or simply not do so at all. For a distributed organization like Gitlab, there is a presumption that employees live where they want unless told otherwise. Hence, the pains that Gitlab is going through now.

lacker 7y ago
Even in a distributed organization, you have to deal with taxes separately per-country, so each country has to be approved by HR, in a sense. And you can’t have employees living in places like Iran.
- helen___keller 7y ago
  Right but the default case is that every country is okay, minus the exceptions. This whole debacle is Gitlab choosing to add China and Russia to their list of exceptions. For physical offices, it's a whitelist: if we didn't decide your country gets an office, too bad
- e1g 7y ago
  Distributed startups often use a 3rd party to do the actual employment/compliance of people across N countries. Those providers are called Professional Employer Organization (PEO) and serve as Employers of Record (EOR) - handling employee/contractor agreements, payroll, compliance, tax, etc. The startup itself does not even register a legal entity in the country, and everything is managed by the likes of Papaya Global, Globalization Partners, etc.
hrktb 7y ago
That ship has sailed IMO, in that even in single location orgs you will have foreign employees with potential legal obligation toward different governments, and domestic employees with strong ties to other countries. From that point of view Gitlab’s diacussion on hiring or not employees from specific countries seems a bit old (except if it’s for paperwork reasons)

rdslw 7y ago

Candice Ciresi (aforementioned director) commented: "As I believe GitLab is engaging in discriminatory and retaliatory behavior, I have tendered my resignation." E-mail notification (her resignation): https://i.imgur.com/AE8UtvD.png https://i.imgur.com/AE8UtvD.png First time it was edited: https://i.imgur.com/7N7mTC2.png https://i.imgur.com/7N7mTC2.png Current version: https://i.imgur.com/YjWmpGk.png https://i.imgur.com/YjWmpGk.png

cjbprime 7y ago
This: We will not tolerate Very Serious Charge X. This post did not do X, but other people did and this post says something critical of us so we removed it. construct is quite something.
- dplanella 7y ago
  For clarity and for the context of this thread => From GitLab: We did decide to moderate this post for review, as there have already been credible personal and physical threats against GitLab employees in this issue thread. GitLab cannot tolerate posts that threaten our employees (or anyone) personally, or posts that we believe may further inflame threats that have already been made. While this particular post did not contain a personal threat to anyone, we were concerned it would further inflame this situation. We understand that those who follow the issue already received the comment.
  - dev_by_day 7y ago
    You can stop copy and pasting this response everywhere, it's already in the screenshot. Censoring a respectful employee resignation, regardless of whatever "spin" you try to justify it with, is not a good look for your company. You're guideline here is basically it makes gitlab look bad and you want to hide it to avoid further negative feedback. The thread is already locked so no further trolling can be posted in that thread.
    - Acatalepsy 7y ago

lacker 7y ago

To me this seems like a huge self-inflicted mess by GitLab. Normal companies don’t make touchy personnel issues public. Things like “we need to stop hiring Russian employees onto the support team because clients disapprove”. It’s cool to be so open in an abstract sense, but watching this play out in public really just makes me want to not air this sort of issue out in public when it comes to my own workplace.

icebraining 7y ago
"If people don't know what you're doing, they don't know what you're doing wrong." -- Sir Arnold, Yes, Minister
- mprev 7y ago
  I want transparency from my government. Would I want an unwavering commitment to do everything in the open from my employer? Clearly people who joined GitLab knew that was the deal and, while I see the point you're making, VC-funded code hosting (plus extras) isn't in the same league as the government.
CydeWeys 7y ago
Is it "no Russian employees" or "no employees located in Russia"? Because there's a big difference here, and the latter is a pretty common policy (and de facto true for the vast majority of companies, even if not intentionally). See e.g.: https://www.cnbc.com/2014/12/12/google-closes-russia-office-after-internet-crackdown.html https://www.cnbc.com/2014/12/12/google-closes-russia-office-...
- gpm 7y ago
  It's the latter. (Strictly speaking "no employees in <roles that need admin credentials> residing in Russia or China")
  - sytse 7y ago
    Indeed. This is about residence not about nationality. As for making this public we are public by default. But we are learning that anything involving countries needs to be communicated with a lot of context. Countries are a core part of people their identity. In the future any decision involving countries will still be public but the discussion will not be.

dessant 7y ago

I was expecting Paul Machle (CFO) to resign, at least they seem to be completely divorced from the values that GitLab was built upon. > I don’t understand. This should not be an opt in or an opt out. [Telemetry] is a condition of using our product. There is an acceptance of terms and the use of this data should be included in that. https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#note_203849107 https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no...

Operyl 7y ago
Honestly, it's the end of an era for Gitlab it seems to me. The CFO's views are going to become the new norm, and I doubt there's much the CEO will do to course correct (since this latest issue seemed to involve him with a big client contract?). I expect another "we're sorry, we won't do it again!" as we've gotten the past few times, but I am trusting those less and less.
- dessant 7y ago
  The general direction of GitLab can also be steered by employees. They could organize, publish a statement, and refuse to check in for work on Monday. It all depends on how many GitLab employees believe strongly enough in these values, and how many are willing to take some risks and defend the company and its values.
  - AnonGitLabEmpl 7y ago
    I've thought about this a lot. We could, but we are all literally terrified for our jobs and of retaliation.
    - dessant 7y ago
      I completely understand, retaliation is a real possibility in such cases. This is why it's important to find a safe way to organize, and for a considerable number of employees to protest.

bdcravens 7y ago

I like my infrastructure to be nice and stable. I realize that all the recent drama MAY not be a cause for concern, but I imagine this makes Gitlab a harder sell, in a world of many choices.

icebraining 7y ago
And this is how we discriminate against transparency. This sort of drama happens all the time in many companies, we just don't see it publicly.
- babesh 7y ago
  Prior to the recent debacles, they were rewarded for their transparency.
alkz 7y ago
well it's not like gitlab.com was stable either way

icebraining 7y ago

Off-topic, but I wonder if Gitlab employees have some way to filter the discussion, or if they have to manually skip posts by random people.

AnonGitLabEmpl 7y ago
We have to manually skip posts by random people.

ben_jones 7y ago

1. Company is applauded for strong morals 2. Company raises a ton of money 3. ??? 4. Company appears "divorced or original morals"

ativzzz 7y ago
Are we surprised that companies choose money over morals? That seems to be the status quo for most companies in the U.S. currently. There are, and always will be exceptions depending on the particular people involved, but generally if you as a company want to preserve your moral ground, do not take external funding.

AdministrativeA 7y ago

We use GitLab self-hosted at my company so I've been following this for a while. My speculation is there's pressure for the C suite to push this Russia and China hiring ban for some reason. Looks like the board is telling the CEO this has to happen or they're in negotiation talks to be acquired by a big company like Google who wants this to happen now and the backlash to have passed by the time it's announced. So this will happen whether it's illegal or not (and it looks like it will and is illegal) but the risk will cost less than the reward. If they go to court they spend at most a few mil fighting it over the course of a few years and the executives walk away super rich anyway. If they don't go to court they walk away even more rich. But if they don't do it they might rely on an IPO that's looking shaky because of this bad decision making for the past 2 months. So even if it's illegal, it still makes sense to do this. It looks like an exit strategy because they will never be personally liable. She probably sees this and knows everything going on behind the scenes, but she won't walk away super rich from this but could lose her law license by engaging in discrimination.

AdministrativeA 7y ago
One other thought: in most companies, you just don't open an office there. Or you lock your data down. But they don't have the technical capability to monitor or restrict access to prod data (their VP said this). Because they're remote they can't just not open an office there so they have to restrict hiring to keep Chinese and Russians living in China and Russia out. Normally what would happen is you'd hire them but then not give them access to prod data (usually by saying it requires some background check or clearance you know they can't get) or when it's illegal not to give access, just lock the data down. The alternative is probably illegal, but it's the only one that GitLab has.
- deleted 7y ago
  [deleted]
- itronitron 7y ago
  There is no way that not granting an employee access to prod data can be illegal. That sort of access is a privilege not a right.

ddevault 7y ago

I don't understand why GitLab is doing these things. Even on behalf of Sourcehut, there are subsets of the industry that I don't really try to compete with GitLab on. They have a place in this ecosystem and they're working to undermine it. They're making a void that I, even as a competitor, don't want to and am not prepared to fill. The community is going to suffer for their missteps. I feel really bad for their employees. If I could help, I would, but Sourcehut isn't big enough to provide another employment option for them. To any GitLab employees who know something I can do to help, or just want to talk, I can lend a sympathetic and private ear at sir@cmpwn.com.

marcinzm 7y ago
Someone told Gitlab they'll pay them $XXX/year but only if Gitlab has no employees in China/Russia in sensitive roles. Gitlab decided the money is worth it since they have bills to pay. Doesn't seem very mysterious to me. There's many stories of companies only letting people use burner laptops if they go to China and Russia so it's not a very far fetched contract requirement.
- alteria 7y ago
  I know several companies, including one I've worked for before, with very strict no company property laptop or phone policy for entering China. Issues were mainly related to IP and data sovereignty.
  - remoteworker471 7y ago
    My current employer maintains a list of banned countries. While there's nothing stopping me from going to any of them, I am not allowed to bring my laptop into the country, and accounts will generally be locked during the duration of travel. I'm honestly not seeing what the problem is with this policy. Gitlab's reaction to the outrage has been incredibly poor, but the policy itself seems sane based on IP laws and data protection laws in certain countries.
AnonGitLabEmpl 7y ago

account73466 7y ago

One day your grandkids will ask you how it happened so that we are now slaves? Well, you can say it was not up to you, kinda.

sebtoast 7y ago

Do any of you have a recommendation for an alternative to GitLab and GitHub?

echelon 7y ago
What's the issue with GitHub?
- _emacsomancer_ 7y ago
  Motives of the new owners.
- w457uiw4gftyi 7y ago
  Last week people were mad that Microsoft complied with an order from the Spanish government to remove a controversial repo: https://news.ycombinator.com/item?id=21395629 https://news.ycombinator.com/item?id=21395629 And before that some anti-Microsoft people were mad in general that MS bought GitHub.
mendelmaleh 7y ago
sourcehut (https://git.sr.ht https://git.sr.ht)
- scient 7y ago
  Quite the feat to build a site this slow...
  - Rebelgecko 7y ago
    Their front page loads much more quickly for me than either Gitlab or Github's.
smichael 7y ago
Darcs hub! :-) https://hub.darcs.net https://hub.darcs.net
7y ago

deleted 7y ago

[deleted]

rukittenme 7y ago

Paraphrasing: > "We had to moderate her resignation because of credible threats against our employees[0]. I'm sorry, how do you know they're credible? Did you call them and ask if they were super serious? Did you contact the FBI and find out they're members of ISIS? What a load of bullshit. Honestly Gitlab, blow it out your ass. Of course these "credible" threats were "inflamed" by a single sentence[1] that was critical of the company. 0. https://i.imgur.com/YjWmpGk.png https://i.imgur.com/YjWmpGk.png 1. https://i.imgur.com/AE8UtvD.png https://i.imgur.com/AE8UtvD.png

tempsy 7y ago

Who would've thought version control software would have so much public internal drama...both Github and Gitlab.

omani 7y ago
because it all comes down to the root cause: the attack on an area which until now couldnt care less about politics. now in the context of "free speech" we try to brake the last knowm union out there in the world. developers, who only let code speak so far.
- dfalfndfk 7y ago
  Technology always cared about politics. Exactly what about missiles is apolitical? What about telemetry and data collection? Do not conflate ignorance with impact.
  - michaelt 7y ago
    > Exactly what about missiles is apolitical? "Once ze rockets are up, who cares where they come down? That's not my department, says Wernher von Braun" https://youtu.be/QEJ9HrZq7Ro?t=16 https://youtu.be/QEJ9HrZq7Ro?t=16

99_00 7y ago

Haven't been following this debate but has it been mentioned that China has a law that says that every Chinese citizen must spy for the government if asked. >The law provides official sanction for the intelligence services to do things long observed in their activities: coopting officials in other government agencies; compelling cooperation from PRC citizens; https://www.canada.ca/en/security-intelligence-service/corporate/publications/china-and-the-age-of-strategic-rivalry/chinas-intelligence-law-and-the-countrys-future-intelligence-competitions.html https://www.canada.ca/en/security-intelligence-service/corpo...

deleted 7y ago
[deleted]
Twirrim 7y ago
Same is true for Australia, IIRC.
- austhrow743 7y ago
  Source?
  - rwiggum 7y ago
    https://gizmodo.com/australia-s-new-encryption-law-is-forcing-tech-companie-1835074557 https://gizmodo.com/australia-s-new-encryption-law-is-forcin...
    - austhrow743 7y ago
      Seems to be very different from the above. One is about Chinese citizens the other is about Australian companies and even then, only technology based parts of them. I as an Australian don't appear to be facing the gulag if Scomo calls me up and asks me what the Balinese are up to (I'm in Bali) and I tell him to shove it.
- angry_octet 7y ago
  Fortunately that is an insanely wrong statement.

busterarm 7y ago

Sourcehut is pretty great, y'all.

deleted 7y ago

[deleted]

dev_by_day 7y ago

An important point to communicate here is this is based on someone's geographic residence, not their ethnicity or nationality. An American living in China or Russia would be subject to the same policy of not being hired. A Chinese or Russian person living in Europe would still be eligible for employment.

yani 7y ago
IMO 99.9% of remote workers from a country are also citizens of the country. The only difference would be top expat/nomad countries.
- filoleg 7y ago
  The parent comment has never mentioned citizenship, only country of residence and nationality. As long as a Chinese/Russian/etc. national resides in one of the non-banned countries and can get hired just as well as any other national (regardless of whether they have a citizenship of the country they reside in or not), everything is alright in my book, because it has nothing to do with them on a personal level.

tachion 7y ago

And I thought we already had this quarter's GitLab drama in the GitLabTrackerGate ;)

xiphias2 7y ago
This is part of the same drama, as Candice Ciresi was the one who told other people at GitLab management that what they are doing (opt out tracking) is illegal in multiple juridictions. I'm interested in what her next job will be, as hopefully another company will value her knowledge and integrity.

bhouston 7y ago

I just wish that GitLab didn't have weekly (or more frequent) outages. Is this because they are all distracted by the drama ongoing there?

simonswords82 7y ago

I'm out of the loop here, what is going on with Git Lab? They were well regarded and now they are not?

throwawaypolicy 7y ago
There were basically two "scandals" recently. - GitLab announced that they were going to start including third party telemetry. This predictably annoyed developers. They made it substantially worse by originally announcing that it would be included in self-hosted enterprise versions as well (a really big no-no from many companies perspective), and by tone deaf comments from the CFO that made it clear they were going to violate the GDPR. - GitLab started talking about not allowing people working in support rolls to live in China, Russia, and Ukraine because of security concerns brought up by a customer. No one ever really came up with a good justification for why Ukraine was on the list, so it was removed (but you will still see references to it in some of the earlier discussions). Someone noticed the discussion and posted it here (and elsewhere). Communication around what they're actually planning on doing has been pretty poor, likely partially as a result of this being noticed on their public-yet-internal issue tracker instead of being released via clearly written messages. Some people have legal concerns about it (see: anti boycott laws), some have ethical issues, others think it sounds fine. Meanwhile the issue on gitlab itself has been subjected to intense astroturfing by largely new accounts which caused it to be locked. The new development today is that the director of compliance has resigned since they are of the opinion that what they are planning to do is illegal. Personally I think they're still pretty well regarded, but these two events in such close proximity have definitely given them a bloody nose.
nemothekid 7y ago
I found more interesting information in the Reddit thread. https://www.reddit.com/r/gitlab/comments/dtfccm/gitlabs_director_of_risk_and_global_compliance/f6x00sa/ https://www.reddit.com/r/gitlab/comments/dtfccm/gitlabs_dire... --- Ciresi: The countries selected were not chosen because of legal requirements, they were not chosen based on risk, they were not chosen based on political climate (as other countries are facing heightened sanctions from the US). I do hope they were not selected because a customer asked for it - or that could violate anti-boycott laws. In fact, having no objective basis for the restrictions is not conservative - it is careless. (Please let me know immediately if a customer has requested that we not do business with any particular country as that may be a reportable event.) I recommend against proceeding until you have developed a sound basis - that gets applied equally - for any exclusion of any country. Johnson: I appreciate your position. Please be aware there is an active, time-sensitive contract negotiation linked to this matter. And you need to advocate to the DRI that the company walk away from that contract in order to enact your proposal." --- I think Ciresi has been 2/2 in the recent GitLab scandals (she was also against the telemetry issue). The most obvious version of the story is now Ciresi has "gotten in the way" of sales twice now and is being retaliated upon. I'll admit, its rare to see a company flush its morals down the toilet while chasing revenue.

NoFascistSFBay 7y ago

Despicable racist company. Investors need to pullout now before the fascism spreads.

TA-blahhh 7y ago

sytse is awfully quiet in the comments today... usually he has a reply for everyone whenever a Gitlab/Git/VCS story comes up

getareallawyer 7y ago
Maybe he got a real lawyer.

getareallawyer 7y ago

Extremely unprofessional behavior, especially for someone with a law degree. Three serious issues: #1: She shouldn't be speculating about legal liability in a non-privileged medium. Even if she's correct, the risk is too high that her statements will later be quoted out of context. Keep it in a privileged medium, ideally an in-person meeting or phone call. This is absolutely basic stuff, and I'm sure it's taught even at Mitchell Hamline. #2: Even if you disagree with a decision, don't leave a written record that you believe your company is legally in the wrong. There are exceptions (you believe you'd be personally liable, and you want the paper trail to make it clear you didn't make the decision), but there is absolutely no reason to make that record public. #3 (Related) Don't burn bridges on your way out the door. This isn't specific to law - it's just good professional practice. The world is smaller than you think, and you're poisoning your professional network. Doing it publicly is even worse. Why would you be willing to hire someone who has demonstrated that they will publicly torch your company if you make a significant decision they disagree with.

michaelt 7y ago
Gitlab is an all-remote, very open startup, where the company's employees can publicly discuss not hiring SREs and Support Engineers in China and Russia with an abundantly clear paper trail in the public issue tracker. Do you believe her actions are inconsistent with those values - or are you saying as the values are problematic, she should not have upheld them?
- bsder 7y ago
  > Do you believe her actions are inconsistent with those values - or are you saying as the values are problematic, she should not have upheld them? Her actions appear to be inconsistent with being a good lawyer. Part (most?) of being a good lawyer is knowing when to shut up and when to tell your client to shut up. In addition, there is some level of attorney/client privilege to consider. Quite often, two companies will have 4 sets of lawyers in the room for particularly sensitive things. Counsel for the companies and then counsel for the counsel. This ensures that what is discussed stays under attorney/client privilege.
7y ago

dustinmoris 7y ago

Wheres sytse? Normally he and his GitLab fake accounts are immediately jumping on every HN thread with Gitlab in the title trolling people with up-/downvotes, but today he seems to be very quiet.

kerpele 7y ago

I hope the contract that sparked this whole fiasco is big enough to cover the ton of goodwill they've lost (and keep losing) over this issue.

llamataboot 7y ago

Hmmm, I wonder what sort of large partnership could be so concerned with these two countries? Could it possibly be something with US intelligence agencies?

marcinzm 7y ago

I'm curious about something. In one of her cited comments Candice Ciresi, the director, mentions that if the ban on Russia/China is due to a client request then it: >could violate anti-boycott laws Does anyone know specifically which laws she's referring to? Many companies have requirements on data not being accessed by individuals outside of certain countries or being sent outside of certain countries. Others have restrictions on not bringing company property into certain countries.

ktsmith 7y ago
You can read about them here: https://www.bis.doc.gov/index.php/enforcement/oac https://www.bis.doc.gov/index.php/enforcement/oac
- marcinzm 7y ago
  Based on my reading there are two laws in question: * Tax Reform Act: This seems to only penalize supporting an existing boycott by another country of a third country [1]. As there is no government boycott of Russia and China (at least not in countries these clients are from I'm guessing) this shouldn't apply. * Export Administration Act: This also specifically says it related to boycotts conducted by a country against another country the US is friendly with [2]. I'm open to someone pointing out my misreading of these laws but it seems that they only apply to government mandated boycotts. So, to me, clients are free to require restrictions if there are no government boycotts in place. [1]: https://www.irs.gov/pub/irs-soi/03-04boycott.pdf https://www.irs.gov/pub/irs-soi/03-04boycott.pdf [2]: https://www.govinfo.gov/content/pkg/CFR-2019-title15-vol2/xml/CFR-2019-title15-vol2-part730.xml https://www.govinfo.gov/content/pkg/CFR-2019-title15-vol2/xm...
  - cosmie 7y ago
    The violation may have been the lack of appropriate reporting. [1] mentions that "unsanctioned boycotts" must be reported. Later in the comments she mentioned that the contract in question was screened and found to not actually be considered a relevant event for anti-boycotting laws. So whatever her initial concerns were, they were allayed by an actual review of the relevant request. Reading through the conversation as a whole, it appears that the customer/contract in question didn't explicitly request Gitlab to take the course of action they decided on. Gitlab proactively decided that the action just happened to be a crude but effective way to comply in a timely fashion with the data restrictions the customer wanted, since their infrastructure itself currently doesn't have granular enough security controls around data access to comply with what the customer request was. [1] https://www.bis.doc.gov/index.php/enforcement/oac#whatmustbereported https://www.bis.doc.gov/index.php/enforcement/oac#whatmustbe...

malvosenior 7y ago

Gitlab's insistence of adjusting remote pay based on geography (and paying below market in general) never sat well with me. You pay people based on the value they provided, period. It's ridiculous to think you would take a pay cut at your current remote job just because you move to a cheaper city. It does not surprise me one bit that where there was smoke, there's fire and a bunch of questionable behavior is going on behind the scenes.

jiveturkey 7y ago
I used to think that, but now I think it's completely fair and they way they present is completely honest. So I'm all for it, at least the way they have implemented it. As an employer in a capitalistic society, you do not pay people based on value provided. You pay based on a reverse dutch auction method. This ensures you are getting an employee at the lowest possible cost, which is your financial duty. Anything more is excess expense. This is why unions are so important: to band labor together such that there is no opportunity for a prisoner's dilemma situation, where things become a race to the bottom. It is the employer's duty to wring as much value out of an employee as possible, not to pay them for that value. Paying by value provided would introduce so much inequality it'd be awful. So anyway, paying market rate (or the identical fraction under/over everywhere) at any location is just like having an office in every city where you don't have a WFH policy at all and employees are competing against other local employees. So gitlab employees that have self-selected to live and work in the same location, wherever it may be, are bidding themselves against other employers in that location. gitlab gets the edge over local employers who presumably would require the employee to show up at the office, for those people that don't want to go in the office at all, for whatever reason. And therefore it's justified that gitlab pays less than market because they are only selecting for those employees that value the WFH as opposed to just "work close to home". And this justification is proven because they are actually able to employ people at "less than market". QED
- couchand 7y ago
  Your reasonable arguments are wholly undermined by the jackhole manner you end your comment.

epiphanitus 7y ago

How do we know her resignation is about hiring devs based in Russia/China and not about something else?

Iv 7y ago

I am so happy I resisted transitioning from GitHub to gitlab and self-hosted instead.

angry_octet 7y ago

It seems more likely that, for unexplained reasons, she was not in the loop on the area she was employed to work on (Global Compliance) and decided therefore to resign. She may have reasoned that this type of policy would have made working in BRICS countries very difficult. Ironically, these countries routinely impose residency and nationality requirements, local hosting and censorship etc. The lack of nuance in her public communication is quite strange for a lawyer. 'Retaliatory behavior' -- against whom are they retaliating and for what? A serious allegation. And other strange and strongly worded warnings of illegality, but which have no basis in law that I can see. So, bluster? Trying to win an argument? I can't help but think that remote work is not for everybody, and especially not for lawyers.

uuioperter 7y ago
She said there would be no issues if it was a legal requirement. But there could be issues if it was a demand by a customer. The CFO replied it was part of a possible contract.