6 ms·

GitLab CEO here, thanks Nat for doing everything you can do to keep open source accessible around the world. We have to comply with the same restrictions and re

by sytse 7y ago

GitLab CEO here, thanks Nat for doing everything you can do to keep open source accessible around the world. We have to comply with the same restrictions and respect greatly that GitHub is taking the broadest possible interpretation of US sanctions law to help users.

deleted 7y ago
[deleted]
relaunched 7y ago
Do you though? Really? https://www.wsj.com/articles/resignation-at-gitlab-highlights-concerns-over-corporate-espionage-11573686134 https://www.wsj.com/articles/resignation-at-gitlab-highlight...
- bdcravens 7y ago
  I'm not sure what those hiring practices have to do with the legally-mandated sanctions being referenced.
  - relaunched 7y ago
    Glad you asked. Since Sid respects the broadest interpretation, take a look at https://www.export.pitt.edu/sites/default/files/6.%20Anti-boycott%20Regulations.pdf https://www.export.pitt.edu/sites/default/files/6.%20Anti-bo... It seems like, if a VP wants to discriminate hiring within certain countries, based on a pending customer contract, as stated by Mr. Johnson - it's reasonable to assume that GitLab should report, as per the EAR requirement, that: Any person under U.S. Jurisdiction who is asked to enter into an agreement or provide information that would violate anti-boycott laws must report this to BIS using a form BIS-621-P or form BIS-6051P in accordance with 15 C.F.R. § 760.5.
    - bdcravens 7y ago
      That's not an interpretation of sanctions, you're pulling in a second set of laws. Additionally, I'm pretty sure a country being on a boycotted list doesn't prohibit a company from making hiring decisions for reasons outside of the boycott.
      - relaunched 7y ago
        At best, it's a matter of law to determine what doing business in a country means. In the broadest interpretation, employing seems like doing business. Merely being asked, by a customer, is reportable and the government gets to make the determination. How to act seems like a determination / recommendation made by the head of compliance.
- cortesoft 7y ago
  Yes, they do. If you are suggesting they should do what those employees did and quit in protest (which for a company would be to shut itself down), then I guess you are right they don't HAVE to comply with US law... but they do if they want to continue to exist.
  - relaunched 7y ago
    So, all companies are lawful because they are required to be. That's a bit of a tautology, no? It also doesn't play out in reality. Maybe they keep the company running so they can do secondary offerings and an IPO, so the investors and executives get paid, is the motivation to do unlawful things. Maybe it's okay to break the law now, cause when they are bigger and public they'll go back and fix it - breaking the law is a cost of doing business. Maybe they were so focused on signing the deal that they didn't want to hear from compliance. It's not the first time legal / compliance was railroaded or disregarded at a startup, in the name of doing something great. In the startup world, that's kind of a badge of honor.
  - mirimir 7y ago
    They could move everything to Tor onion services, and offer clearnet access via disposable VPS as reverse proxies. Paying staff anonymously would be problematic, I know.
    - cortesoft 7y ago
      Pay them with what money? How are they going to earn anything? Meanwhile, they would also face arrest for ignoring US law.
      - mirimir 7y ago
        Doesn't GitHub pay staff? I'm saying to take the whole operation into anonymous space. Or replace it with one that is. It could be Tor, or perhaps Loki, based on what little I know about it so far. And pay with cryptocurrencies. People who work anonymously enough can't be arrested. For example, see http://cryptohippie.net/AnonAdmin.html http://cryptohippie.net/AnonAdmin.html
- dependenttypes 7y ago
  > Ms. Ciresi’s most recent post on GitLab’s public thread, published five days ago, has been redacted by the company. Would you happen to have her post? Kind of amusing how they talk about valuing transparency when they censored her post.
  - relaunched 7y ago
    https://m.imgur.com/a/grRvEWt https://m.imgur.com/a/grRvEWt
    - blanche_56 7y ago
      Well that does seem hysterical. I wonder what kind of overlap exists between those who have been panicking about "Russian hackers" for the last four years and those who now believe that reluctance in allowing remote Russian developers access to potentially sensitive or valuable US code bases is "racist".
      - luckylion 7y ago
        > allowing remote Russian developers access to potentially sensitive or valuable US code bases is "racist". You do realize that GitLab is open source, right?
        httpsterio 7y ago
        yes, the issue wasn't access to the source of gitlab, but customers who host their closed source code on gitlab.
        rndgermandude 7y ago
        While their code is open source, the data and metadata in their hosted repositories belonging to their customers/users a lot of times is not.
      - andrepd 7y ago
        >remote Russian developers access to potentially sensitive or valuable US code bases What do you mean by this exactly?
- yorwba 7y ago
  That article doesn't seem to link to the GitLab issue where they had the discussion, so let me link to the corresponding HN thread: https://news.ycombinator.com/item?id=21437334 https://news.ycombinator.com/item?id=21437334

by sytse 7y ago

deleted 7y ago

[deleted]

relaunched 7y ago

Do you though? Really? https://www.wsj.com/articles/resignation-at-gitlab-highlights-concerns-over-corporate-espionage-11573686134 https://www.wsj.com/articles/resignation-at-gitlab-highlight...

bdcravens 7y ago
I'm not sure what those hiring practices have to do with the legally-mandated sanctions being referenced.
- relaunched 7y ago
  Glad you asked. Since Sid respects the broadest interpretation, take a look at https://www.export.pitt.edu/sites/default/files/6.%20Anti-boycott%20Regulations.pdf https://www.export.pitt.edu/sites/default/files/6.%20Anti-bo... It seems like, if a VP wants to discriminate hiring within certain countries, based on a pending customer contract, as stated by Mr. Johnson - it's reasonable to assume that GitLab should report, as per the EAR requirement, that: Any person under U.S. Jurisdiction who is asked to enter into an agreement or provide information that would violate anti-boycott laws must report this to BIS using a form BIS-621-P or form BIS-6051P in accordance with 15 C.F.R. § 760.5.
  - bdcravens 7y ago
    That's not an interpretation of sanctions, you're pulling in a second set of laws. Additionally, I'm pretty sure a country being on a boycotted list doesn't prohibit a company from making hiring decisions for reasons outside of the boycott.
    - relaunched 7y ago
      At best, it's a matter of law to determine what doing business in a country means. In the broadest interpretation, employing seems like doing business. Merely being asked, by a customer, is reportable and the government gets to make the determination. How to act seems like a determination / recommendation made by the head of compliance.
cortesoft 7y ago
Yes, they do. If you are suggesting they should do what those employees did and quit in protest (which for a company would be to shut itself down), then I guess you are right they don't HAVE to comply with US law... but they do if they want to continue to exist.
- relaunched 7y ago
  So, all companies are lawful because they are required to be. That's a bit of a tautology, no? It also doesn't play out in reality. Maybe they keep the company running so they can do secondary offerings and an IPO, so the investors and executives get paid, is the motivation to do unlawful things. Maybe it's okay to break the law now, cause when they are bigger and public they'll go back and fix it - breaking the law is a cost of doing business. Maybe they were so focused on signing the deal that they didn't want to hear from compliance. It's not the first time legal / compliance was railroaded or disregarded at a startup, in the name of doing something great. In the startup world, that's kind of a badge of honor.
- mirimir 7y ago
  They could move everything to Tor onion services, and offer clearnet access via disposable VPS as reverse proxies. Paying staff anonymously would be problematic, I know.
  - cortesoft 7y ago
    Pay them with what money? How are they going to earn anything? Meanwhile, they would also face arrest for ignoring US law.
    - mirimir 7y ago
      Doesn't GitHub pay staff? I'm saying to take the whole operation into anonymous space. Or replace it with one that is. It could be Tor, or perhaps Loki, based on what little I know about it so far. And pay with cryptocurrencies. People who work anonymously enough can't be arrested. For example, see http://cryptohippie.net/AnonAdmin.html http://cryptohippie.net/AnonAdmin.html
dependenttypes 7y ago
> Ms. Ciresi’s most recent post on GitLab’s public thread, published five days ago, has been redacted by the company. Would you happen to have her post? Kind of amusing how they talk about valuing transparency when they censored her post.
- relaunched 7y ago
  https://m.imgur.com/a/grRvEWt https://m.imgur.com/a/grRvEWt
  - blanche_56 7y ago
    Well that does seem hysterical. I wonder what kind of overlap exists between those who have been panicking about "Russian hackers" for the last four years and those who now believe that reluctance in allowing remote Russian developers access to potentially sensitive or valuable US code bases is "racist".
    - luckylion 7y ago
      > allowing remote Russian developers access to potentially sensitive or valuable US code bases is "racist". You do realize that GitLab is open source, right?
      - httpsterio 7y ago
        yes, the issue wasn't access to the source of gitlab, but customers who host their closed source code on gitlab.
      - rndgermandude 7y ago
        While their code is open source, the data and metadata in their hosted repositories belonging to their customers/users a lot of times is not.
    - andrepd 7y ago
      >remote Russian developers access to potentially sensitive or valuable US code bases What do you mean by this exactly?
yorwba 7y ago
That article doesn't seem to link to the GitLab issue where they had the discussion, so let me link to the corresponding HN thread: https://news.ycombinator.com/item?id=21437334 https://news.ycombinator.com/item?id=21437334