I understand the basic issues involved here. Both countries are doing very odd things when it comes to information and privacy. However, I feel like making this a "country issue" is really not exactly the right horse to ride on. Rather, I think it should be stated due to the security policies of these governments, we are banning them as information safeholds at this time or something of the sort. Then, the issue is LESS the country, and more the governmental informational policies.
Gitlab considers not hiring SREs and Support Engineers in China and Russia
101–110 of 584 posts
Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia
#102It sounds like there is nobody that this affects, and nobody it is likely to affect. They just want an official policy in place to reassure their customers.
It apparently impacts one new hire.
Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia
#103Earlier quoted context omitted.
It does block them from moving to that country. So if a current employee was planning to move to either country soon they'd be prevented from doing that. I've danced this dance at a previous company when we had an employee working from a country of interest for an extended period of time. They were air-gapped from our systems and it worked because they submitted everything by pull requests (the original way, sending…
I've done some travelling to risky places before (Kiev and other places) and even though the networks were hostile there, I still don't understand the point of pretending that Russia et al can't get into Gitlab whenever they want to. They can. Air-gapping isn't going to slow them down.
Or just bribing people in “allowed” countries.
Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia
#104Earlier quoted context omitted.
It does block them from moving to that country. So if a current employee was planning to move to either country soon they'd be prevented from doing that. I've danced this dance at a previous company when we had an employee working from a country of interest for an extended period of time. They were air-gapped from our systems and it worked because they submitted everything by pull requests (the original way, sending…
All the people who are saying they've never seen a contract with a term like this, I'm just sitting here wondering how my experience is the opposite...
[deleted]
Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia
#105Reading the discussion, it appears this policy was due to a customer request, and not some legal requirement.
I wonder how the HN crowd feels about that? There was a lot of talk recently about how companies should not sacrifice their values and kowtow to the demands of large clients.
As a company that values freedom of movement and is remote first, this prevents their employees from moving to where they want. Does this also mean they can’t vacation there either?
Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia
#106Earlier quoted context omitted.
It does block them from moving to that country. So if a current employee was planning to move to either country soon they'd be prevented from doing that. I've danced this dance at a previous company when we had an employee working from a country of interest for an extended period of time. They were air-gapped from our systems and it worked because they submitted everything by pull requests (the original way, sending…
I've done some travelling to risky places before (Kiev and other places) and even though the networks were hostile there, I still don't understand the point of pretending that Russia et al can't get into Gitlab whenever they want to. They can. Air-gapping isn't going to slow them down.
> I still don't understand the point of pretending that Russia et al can't get into Gitlab whenever they want to
Security isn’t absolute, it’s layered. The harder you make it for the adversary, the more it costs the adversary (eg: potentially burning a zero day), and the more chance there is of detection.
Can Russian intelligence get into Gitlab? Probably. Are measures that make it more expensive liable to deter them? I think so.
Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia
#107Earlier quoted context omitted.
Well, technically it is discrimination, but not racism. I.e. you can still hire a Japanese developer, and with a Chinese regime change you might be able to hire Chinese developers. However, federal law prohibits discrimination based on national origin. This is a touchy subject, but maybe this no longer makes sense? As burfrog pointed out, a Chinese employee living in America isn't free from Chinese control; the gov't…
It doesn’t matter. As long as a security clearance isn’t required, discriminating based on notational origin is a big no no from an ethical perspective, even if it was legal. I hope we learned our lesson during WW2.
> discriminating based on notational origin is a big no no from an ethical perspective
However, discriminating based on exposure to coercive pressure from aggressive and hostile foreign powers is probably OK, even if such exposure is heavily correlated with national origin. The key is that the discrimination must be based on an individual analysis of the applicant and his/her life circumstances.
It's not OK to blanket deny any person of Chinese ancestry.
Denying such a person access to sensitive data or positions might be OK, however, if that person is exposed to coercive threats by, e.g. having family located in a jurisdiction known to use its power over expatriates' families as leverage to recruit sources and agents.
So long as the intent is genuinely to serve a compelling interest in protecting against security threats and the vetting policy is as narrowly tailored as possible to minimizing insider risk from applicants with vulnerability to certain threat actors, I think such a policy could pass ethical and (IANAL) maybe legal muster.
Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia
#108It’s hard when you have people in your circle of trust who are subject to coercive law enforcement. My heart goes out to victims of such apparatus.
It isn’t even as simple as worrying that foreign national employees can be coerced by their home nation police or state security services — anyone subject to policies like Gitlab’s who is local to your business but who has family or assets abroad that can be used to effect duress, or who can be blackmailed in some way elsewhere, would need to be vetted.
Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia
#109I'm shocked (in a positive way) about the amount of transparency Gitlab provides. Even as a reader, it almost feels as if someone misconfigured the ACLs or I'm reading leaked internal documents, not an intentional decision to make this open. Some of the discussions seem highly sensitive, and yet it seems to work for them. Thank you, Gitlab, for being so open! I've learned a lot about compliance from just reading this…
Thanks! We try to be transparent by default and even when it is difficult. I think the OP is a good example of something that is hard to be transparent about because the decision isn't obvious and it takes discussion to come to the best conclusion.
[deleted]
Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia
#110Reading the discussion, it appears this policy was due to a customer request, and not some legal requirement. I wonder how the HN crowd feels about that? There was a lot of talk recently about how companies should not sacrifice their values and kowtow to the demands of large clients. As a company that values freedom of movement and is remote first, this prevents their employees from moving to where they want. Does th…
> Does this also mean they can’t vacation there either?
No, the post is fairly explicit about what the proposed block is.
While I agree with the position that companies should avoid trading ethics for short-term profit, this is a move I hesitate to condemn - the cost is fairly minimal (their remote-first position is still quite generous), and there is much to be said for the increase in privacy and security this provides their customers.