Gitlab considers not hiring SREs and Support Engineers in China and Russia • Hacker News Board

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#61

Post by throwawaypolicy » Mon, Nov 04, 2019, 1:38 AM UTC

cyberferret wrote: post #44

throwawaypolicy wrote: post #41

Earlier quoted context omitted.

I've been told (at a different company based in a different country) "don't bring your work laptop to China, don't bring materials to China without authorization, we'll provide what is effectively a burner device for whatever you are bringing to China (I believe they re-used them as different employees went to China)". I imagine Gitlab would have a similar but less restrictive policy, "don't bring a work laptop to Ch…

Consider this scenario: Loyal and long time high performing Gitlab employee Bob, is happily married to Su, who originally hails from China. They live and work in the US. All good. Until Su's ageing parents back home succumb to ill health and she decides that the family need to move back to China to care for them for maybe one or two years - perhaps longer. Bob then has to make the choice between (a) resigning his job…

Consider the exact same scenario at any non-remote company.

If Bob wants to move to China, where the company doesn't have an office, he's going to have to resign or take a leave of absence.

This decision on Gitlab's part would be moving their incredibly generous "you can work from anywhere you want except places where we legally can't let you like Crimea and Iran" to a nearly as generous "you can work from anywhere you want except places where we legally can't let you like Crimea and Iran, and places that are known to coerce people into spying for them like China and Russia".

Most companies operate on a whitelist of places where you can work (where they have offices), not a blacklist. Even many remote companies operate on a whitelist (e.g. "Remote, US only"). Really, I'm amazed they feel that they can operate on a black list approach at all and not accidentally violate tons of local laws.

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#62

Post by Causality1 » Mon, Nov 04, 2019, 1:39 AM UTC

Iv wrote: post #58

Ok, that discussion made it clearer for me, and I am kind of behind @cciresi at that point: https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not... They have a customer that required the personal data they'll give to Gitlab not be handled by people living in Russia and China. Could be a group doing humanitarian or journalistic work. That's actually an interesting conundrum: you want to hire a company, need to…

True. You have to decide what level of security is necessary for you. In some countries like China privacy from the government is basically nonexistent. In some like Australia backdoors are mandated by the government. In others like the US secret FISA courts exist and can demand data from companies and gag them at the same time. Off the top of my head I don't really know any ideal developed countries to do business in where privacy is concerned.

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#63

Post by zonidjan » Mon, Nov 04, 2019, 1:43 AM UTC

zwayhowder wrote: post #6

bluehatbrit wrote: post #3

The title seems misleading, the article specifically states this does not effect any current employees, presumably as they have none in China and Russia. > As such we feel a country block is the most humane solution at this time--especially because it affects zero current employees

It does block them from moving to that country. So if a current employee was planning to move to either country soon they'd be prevented from doing that. I've danced this dance at a previous company when we had an employee working from a country of interest for an extended period of time. They were air-gapped from our systems and it worked because they submitted everything by pull requests (the original way, sending…

All the people who are saying they've never seen a contract with a term like this, I'm just sitting here wondering how my experience is the opposite...

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#64

Post by zik » Mon, Nov 04, 2019, 1:44 AM UTC

type0 wrote: post #37

angry_octet wrote: post #33

Earlier quoted context omitted.

They don't have legal authority to prevent you from resigning. Also, the proposed anti-boycott rules have been widely criticized as unconstitutional, unworkable and ludicrously against the conservatives free speech pronouncements. Unlikely they would get support from Senate cross bench.

They could compel your employer not to accept the resignation before the correct procedures are done and you have completed the task.

Employers can't refuse to accept your resignation in Australia. Or rather they can refuse as much as they like but your resignation still holds.

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#65

Post by zonidjan » Mon, Nov 04, 2019, 1:46 AM UTC

dredmorbius wrote: post #10

bluehatbrit wrote: post #5

Earlier quoted context omitted.

Hm, upon a re-read I think you are right. Thanks for clarifying.

And on my own re-read: "Current team members are prevented from moving to these countries and remaining in a role that prohibits it." That would seem to apply to current employees in Russia / China who are in roles covered by the block. Which is kind of A Big Deal.

No? It would seem to apply to current employees who move to Russia/China who are in roles covered by the block. i.e. they would have the choice of moving and changing roles/quitting, or staying.

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#66

Post by dwd » Mon, Nov 04, 2019, 1:48 AM UTC

Iv wrote: post #47

I don't understand what I am reading, I feel I am missing some context... Is it about being afraid the Chinese and Russian state will spy on user data if some employees are located in those countries? Or were there updates to their laws that made it mandatory to open databases to the state if an employee is located in these countries?

Probably in relation to this:

https://www.chinalawblog.com/2019/09/chinas-new-cybersecurit...

Whether it's real or not or even likely to be effective, there's a chilling effect and businesses are obviously concerned to be raising the issue of Chinese-based employees with GitLab.

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#67

Post by Waterluvian » Mon, Nov 04, 2019, 1:54 AM UTC

Iv wrote: post #48

Waterluvian wrote: post #39

Super ignorant question that I'm sure has an obvious answer because nobody else is asking: How is this not a form of Japanese internment camps? Russia and China are a problem so we block Russian and Chinese citizens? Also, wouldn't I just have my Russian agents living and working in Sweden or Canada or something?

Well first, it is not a camp. No one is putting no one in prison there. Second, a company will want to abide by the laws of the countries it operates in. Having an employee somewhere may, nowadays, count as "operating in" that country. If they are not comfortable with some state laws, that makes sense to avoid these countries. Just like the companies that say they can't operate in Europe because of GDPR. Third, if yo…

Yeah I guess that's a bit of an extreme analogy. What you said about this abiding by laws of the country makes sense. Thanks.

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#68

Post by Sidious » Mon, Nov 04, 2019, 1:55 AM UTC

sytse wrote: post #21

tgsovlerkhgsel wrote: post #19

I'm shocked (in a positive way) about the amount of transparency Gitlab provides. Even as a reader, it almost feels as if someone misconfigured the ACLs or I'm reading leaked internal documents, not an intentional decision to make this open. Some of the discussions seem highly sensitive, and yet it seems to work for them. Thank you, Gitlab, for being so open! I've learned a lot about compliance from just reading this…

Thanks! We try to be transparent by default and even when it is difficult. I think the OP is a good example of something that is hard to be transparent about because the decision isn't obvious and it takes discussion to come to the best conclusion.

Ot: "In an effort to improve our user['s] experience..."

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#69

Post by burfog » Mon, Nov 04, 2019, 2:02 AM UTC

sytse wrote: post #21

tgsovlerkhgsel wrote: post #19

I'm shocked (in a positive way) about the amount of transparency Gitlab provides. Even as a reader, it almost feels as if someone misconfigured the ACLs or I'm reading leaked internal documents, not an intentional decision to make this open. Some of the discussions seem highly sensitive, and yet it seems to work for them. Thank you, Gitlab, for being so open! I've learned a lot about compliance from just reading this…

Thanks! We try to be transparent by default and even when it is difficult. I think the OP is a good example of something that is hard to be transparent about because the decision isn't obvious and it takes discussion to come to the best conclusion.

Congratulations on taking a step in the right direction, even if it is a very small step. Nobody else seems to take the threat seriously, somewhat excepting defense contractors of course.

I can understand being reluctant to deal with the full extent of the problem. Somebody from China, with a family in China and subject to Chinese law, does not cease to be a security threat by moving to the USA and getting a green card. This gets awkward.

It really is no surprise that valuable secrets of all types (private key, customer data, trade secret, insider info for trading, etc.) end up in other countries.

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#70

Post by kevml » Mon, Nov 04, 2019, 2:06 AM UTC

throwawaypolicy wrote: post #61

cyberferret wrote: post #44

Earlier quoted context omitted.

Consider this scenario: Loyal and long time high performing Gitlab employee Bob, is happily married to Su, who originally hails from China. They live and work in the US. All good. Until Su's ageing parents back home succumb to ill health and she decides that the family need to move back to China to care for them for maybe one or two years - perhaps longer. Bob then has to make the choice between (a) resigning his job…

Consider the exact same scenario at any non-remote company. If Bob wants to move to China, where the company doesn't have an office, he's going to have to resign or take a leave of absence. This decision on Gitlab's part would be moving their incredibly generous "you can work from anywhere you want except places where we legally can't let you like Crimea and Iran" to a nearly as generous "you can work from anywhere y…

I may be reading into things here but it sounds a lot like the reason for this is to gain business from the US Government. Limiting reach from governments such as China and Russia is already standard practice for most security/defense related functions of the government.