Gitlab considers not hiring SREs and Support Engineers in China and Russia • Hacker News Board

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#121

Post by pnako » Mon, Nov 04, 2019, 5:30 AM UTC

wolco wrote: post #42

type0 wrote: post #9

@edjdev wrote There is an unacceptably high risk that these nations may apply pressure to individuals living within their borders with sensitive data access (based their role at GitLab). Given the current australian law changes, the rampant israelian IT spy sector and despotic Belarus position on human rights, it's surprising that they only mention China and Russia. This whole debacle doesn't look good and makes one…

Debacle? The week hasn't even started yet. Let's take a moment to breathe. China and Russia are known to put pressure or watch/listen on nationals who work in key positions in foreign companies. As US allys Australia, Israel don't pose the same threat. A lot of information that could be gained would be available through the US government and shared with the those parties if there was a need.

>As US allys Australia, Israel don't pose the same threat

China or Russia would not pose any threat if they managed to completely infiltrate US institutions, because they would be, at this stage, the US greatest allies. Sure, China might try to constantly drag the US into pointless wars in Asia, but again it would be fine because it would be to defend the interests of China, the greatest ally.

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#122

Post by angry_octet » Mon, Nov 04, 2019, 5:32 AM UTC

crispinb wrote: post #45

type0 wrote: post #37

Earlier quoted context omitted.

They could compel your employer not to accept the resignation before the correct procedures are done and you have completed the task.

Executive powers in Aus aren't that strong - they'd have to pass a law to give themselves that specific power. I don't think there's one to permit this now, though I'm no expert and there are many obscure laws. That's the good(ish) news - the bad is that restraints on the passing of bad law are generally pretty weak in the absence of a hostile Senate. This is particularly true with the current feeble opposition, and…

There is a good description of the many shortcomings of the legislation at https://stateofit.com/interception/ and https://stateofit.com/interceptionpart2/ -- TCNs (compelled changes) are not the real problem, its the more than willing compliance from companies with TARs -- voluntary technical assistance requests. It is unclear how much (if any) the company is shielded from civil suits for complying with TARs.

The problem is not really that you couldn't resign -- it is that the company would hire replacements that would get the job done. The company executive would be compelled to.

Albanese (and his forgettable deputy Marles) have so far been a disaster for the ALP.

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#123

Post by enriquto » Mon, Nov 04, 2019, 5:34 AM UTC

I'm surprised Australia does not appear on this list.

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#124

Post by chupasaurus » Mon, Nov 04, 2019, 5:41 AM UTC

wolco wrote: post #95

babesh wrote: post #55

Earlier quoted context omitted.

That is a load of cow manure aka confirmation bias. Israel has no compunction spying on the US. https://en.m.wikipedia.org/wiki/Jonathan_Pollard https://www.google.com/amp/s/amp.theguardian.com/world/2019/... There are definitely Chinese and Russian spies but there are spies from many countries besides those. The question is why are you singling out those countries and why now. The reason is that there is a Cold War…

Spying is happening between all nations and the leaked cables showed this. Why those two countries specifically? In Russia you can get imprisoned for a variety of political/strategic reasons if you refuse to cooperate. China implemented there own internet for spying. When you visit these countries you are advised to buy new devices and throw them out on return to avoid backdoors. General Powell misleading the UN and…

Direct imprisonment in Russia isn't the reason for this topic, Federal Security Service had succesfully got their cooperation proposal accepted in most of the cases due to the unlimited number of ways they could coerce their target.

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#125

Post by person_of_color » Mon, Nov 04, 2019, 5:52 AM UTC

qtplatypus wrote: post #116

person_of_color wrote: post #31

This is one strange company. Imagine if governments worked like this? Holy hell. This is what Assange should have aimed for instead of getting involved in geopolitical intrigue.

Audrey Tang Minister without Portfolio in the government of the Republic of China (aka Taiwan) advocated this type of radical transparency in government.

Radical transparency will change everything.

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#126

Post by rurban » Mon, Nov 04, 2019, 5:56 AM UTC

dwd wrote: post #66

Iv wrote: post #47

I don't understand what I am reading, I feel I am missing some context... Is it about being afraid the Chinese and Russian state will spy on user data if some employees are located in those countries? Or were there updates to their laws that made it mandatory to open databases to the state if an employee is located in these countries?

Probably in relation to this: https://www.chinalawblog.com/2019/09/chinas-new-cybersecurit... Whether it's real or not or even likely to be effective, there's a chilling effect and businesses are obviously concerned to be raising the issue of Chinese-based employees with GitLab.

Oh, China is finally following US policies on full takes. Not entirely unexpected. The difference is that China observes their borders, whilst the USA does full takes everywhere they can, which is everywhere in the west.

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#127

Post by angry_octet » Mon, Nov 04, 2019, 5:57 AM UTC

type0 wrote: post #46

angry_octet wrote: post #30

Earlier quoted context omitted.

Since National Security Letters exist, blocking all employees from the US would also be logical. Same for running anything on third-party hardware. There needs to be a more effective response than Hari Kiri.

> Since National Security Letters exist, blocking all employees from the US would also be logical. Sure, it would be, especially for companies located in neutral countries, but since US influence is so strong everywhere almost all over the world that's also practically impossible. "Every animal is equal but some animals are more equal than others"

We haven't seen the implementation details for Gaia-X, but it would not be unreasonable for it to include that priviledged persons (admins, company management) by EU citizens and resident in the EU, or possibly even FR/DE only. Full document below in Deutch.

https://www.bmwi.de/Navigation/EN/Home/home.html https://www.bmwi.de/Redaktion/DE/Publikationen/Digitale-Welt...

China and Russia obviously have their own systems, but many other countries some some element of national control which is less obvious. Japan certainly has a mature native cloud capability, although it would be highly disruptive to move everything to it.

Its like plans to be 'cloud agile', it doesn't work unless you deploy to both every time, and you probably just double your cost and bugs for deployment ops. So the tendency will be towards cloud balkanization. Which could really suck, or it could force a path away from proprietary APIs towards standards, which will suck in a different way.

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#128

Post by m0zg » Mon, Nov 04, 2019, 5:58 AM UTC

Well, technically you should then block people from these countries irrespective of where they reside. They have extended families back in their home countries, so the spooks can still lean on them quite heavily, and there's nothing they'll be able to do.

This is why I refused to obtain a DoD security clearance when my job needed me to: I go to Russia to visit my family every 2-3 years, and I don't want to be in any way valuable to their intelligence services or the like, nor do I want to put myself or my family in danger.

All of the above is in spite of me having spent most of my life in the US by now.

IMO a better solution is for nobody to have permanent access, and granting it on as-needed basis, with a full audit trail. It's not perfect, but it's a heck of a lot better than the ineffectual geography-based blocking that you are implementing.

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#129

Post by dang » Mon, Nov 04, 2019, 6:02 AM UTC

gpm wrote: post #120

dang wrote: post #87

Earlier quoted context omitted.

Ok, I've temporarily changed from the submitted title ("Gitlab blocks current employees and stops future hires in China and Russia") to the page title—which I assume is accurate but is uninformative—until we get clarity about what an accurate, neutral title would be. Does anybody want to suggest one? Edit: I've provisionally gone with "Gitlab blocks hiring SREs and Support Engineers in China and Russia". If that's wr…

Can we get "Gitlab considers blocking hiring SREs and Support Engineers from China and Russia" since this decision hadn't been made yet. Maybe substitute "not" for "blocking" as well since that seems clearer.

Ok, sure. Edited.

Re: Gitlab considers not hiring SREs and Support Engineers in China and Russia

#130

Post by ethbro » Mon, Nov 04, 2019, 6:04 AM UTC

seanmcdirmid wrote: post #119

kyboren wrote: post #107

Earlier quoted context omitted.

> discriminating based on notational origin is a big no no from an ethical perspective However, discriminating based on exposure to coercive pressure from aggressive and hostile foreign powers is probably OK, even if such exposure is heavily correlated with national origin. The key is that the discrimination must be based on an individual analysis of the applicant and his/her life circumstances. It's not OK to blanke…

I disagree completely. By that reasoning, a presidential candidate of Chinese descent who was a natural born American citizen but had relatives back in china would be disqualified, and that is nowhere justified by the constitution. A private company likewise shouldn’t be able to discriminate on speculative threats alone. What if they had a relative in prison, a hostile coercive environment by any measure? I accept th…

The Title of Nobility / Emoluments Clause [1] and the natural born (and age) qualifier are fairly specific as to what the framers thought were overly corrupting influences for the office of president.

They notably did not include "or family".

The expectation presumably being that foreign powers were clearly enough signalled to tread carefully with regards to exerting pressure on government officials.

At high levels, that seems reasonable. At lower levels, where there's less scrutiny and less opportunity for diplomatic redress? "Reasonable" measures seem murkier.

[1] https://www.law.cornell.edu/constitution-conan/article-1/sec...