News for hackers. Stuff that matters.
Re:GitLab reinstates list of servers that have malware by nihonium on Saturday October 15, 2016 @06:12PM (#12715869)
Hi, How does it work when someone apply to a remote job from another country? Do you have to be on their payroll, or is it contract basis via an umbrella company or own limited company? Cheers
Re:GitLab reinstates list of servers that have malware by sytse on Saturday October 15, 2016 @06:18PM (#12715885)
In most countries we would hire you as a contractor. In the US, UK, Netherlands, and India you would be an employee. For our contracts see https://about.gitlab.com/handbook/contracts/
Re:GitLab reinstates list of servers that have malware by Normal_gaussian on Saturday October 15, 2016 @07:15PM (#12716058)
I find it admirable that you publish these contracts publicly however I was curious as to how aware the employees are of part 14 of the European contract:

> Other than with the prior written permission of the Employer, the Employee is prohibited during the term of the Employment Contract to carry out work – either paid or not – of any nature whatsoever, either for himself and/or for third-parties.

Personally I would never sign this because it prohibits any form of work for myself. Notably it would also prohibit any and all work for open source projects. Laughably this would also seem to prevent me working on my own house.

In fact, to my mind, this is a beyond unreasonable clause. And has really made me put on hold all the positive thought I had had for GitLab (which was relatively significant due to employee comments and my minimal experience with the product).

As you are the CEO I'm hoping you have a perfectly reasonable explanation for how such a clause landed in the contract.

Re:GitLab reinstates list of servers that have malware by sytse on Saturday October 15, 2016 @07:31PM (#12716117)
Properly assigning IP rights is very important to us and it is hard to get right. This is standard language to ensure it is taken care of.

If you have side projects (many of us do, for example https://github.com/jneen/rouge is maintained by our team member Jeanine Adkisson) we recommend you email us the name to have an granted exception on record. If you want we can also add it to your hiring contract. We never declined such an exception.

But if there is an IP lawyer that wants to make an alternative proposal for this language we're all ears.

Re:GitLab reinstates list of servers that have malware by Normal_gaussian on Saturday October 15, 2016 @07:53PM (#12716173)
It would help if you limited it in scope to related areas. The scope of the current wording is beyond ridiculous.

As it stands the clause effectively prohibits anything done by someone employed by you, regardless of whether it has anything to do with the company or not.

Parts 15 and 16 are worded as IP and business protection. 14 is certainly over-reaching.

Taking the wording you have used it would appear that an employee has to request written permission from their boss to do practically anything:

* Participate in a code dojo or hackathon

* Assist a friend in moving

* Help someone change a flat tyre

* Change your own flat tyre

The absurdity of the examples follow directly from the absurdity of the restriction placed upon people accepting the contract.

Whilst an individual sensible enough to read the contract would likely raise issue with it, it is all too easy to pressure them into signing anyway with phrases such as "standard language", leaving all the rest not sensible enough trapped.

I also note it is ironic that you suggest an external lawyer gives free advice on rewording, presumably this lawyer would have to foresight to have pre-approved giving such advice with their boss as they operate under their standard contract?

Of course I understand this is very likely a complete oversight. And that GitLab is very unlikely to have any malicious intent in this. However I do find the existence of such a clause very alarming.

Re:GitLab reinstates list of servers that have malware by sytse on Saturday October 15, 2016 @09:23PM (#12716376)
I agree the scope is very broad.

What do you think of the language used in 2b of https://www.docracy.com/53/employee-proprietary-information-... ?

"To the fullest extent under applicable law, the Company shall own all right, title and interest in and to all Inventions (including all Intellectual Property Rights therein or related thereto) that are made, conceived or reduced to practice, in whole or in part, by me during the term of my employment with the Company and which arise out of any use of Company’s facilities or assets or any research or other activity conducted by, for or under the direction of the Company (whether or not (i) conducted at the Company’s facilities, (ii) during working hours or (iii) using Company assets), or which are useful with or relate directly or indirectly to any “Company Interest” (meaning any product, service, other Invention or Intellectual Property Right that is sold, leased, used, proposed, under consideration or under development by the Company)."

Re:GitLab reinstates list of servers that have malware by pyre on Sunday October 16, 2016 @12:33AM (#12716938)
You've got me sucked in now. So let's assume that I work for Gitlab, and I host all of my side-work / personal projects on Gitlab. Do that mean that those projects are effectively using "company facilities or assets?"

Usually "using company time/equipment/etc." are viewed as things that you obtained via your employment with the company. But what about things owned by the company that I would have obtained via the same channels as any other customer. Does Oracle have a claim on IP created using a piece of Oracle consumer software by an Oracle employee?

Re:GitLab reinstates list of servers that have malware by Normal_gaussian on Saturday October 15, 2016 @09:52PM (#12716433)
Yes this seems much more reasonable.

I am not knowledgeable or awake enough to comment with certainty on the "or which are useful with or relate directly or indirectly to any “Company Interest”" as backtracking to what the 'or' refers to has broken my brain.

But on the whole that is the kind of clause I would expect. It is more than reasonable (I wouldn't invest in a company that didn't) to seek unilateral ownership over company related work, IP and assets.

Thank you for being so responsive, now I feel somewhat obliged to drop GitLab onto our stack of infrastructure proposals.

Re:GitLab reinstates list of servers that have malware by sytse on Saturday October 15, 2016 @10:10PM (#12716491)
Cool, thanks for your feedback. We'll have our IP lawyer have a look to narrow the scope https://gitlab.com/gitlab-com/www-gitlab-com/issues/861 Feel free to add further context to the issue.

Don't feel obliged but of course I do encourage you to take a look at GitLab :)

Re:GitLab reinstates list of servers that have malware by tibu on Sunday October 16, 2016 @01:41AM (#12717156)
Hungarian law says that the employer can only claim IP rights if there was a clear order from the employer to create the new stuff. I think this is a good approach too.
Re:GitLab reinstates list of servers that have malware by e12e on Sunday October 16, 2016 @11:33AM (#12719047)
I'm guessing you should probably double check that section either way, as I would be surprised if the broad language is legally binding. At least in Norway, adding text to a contract that overreach (ie: tries to enforce a clause that is effectively illegal) generally voids the contract (or at the very least that section) - falling back to standard/minimal protection afforded by the law. This would (in Norway) probably be great for your employees, but maybe not what you want as a company.

As far as I know, several European jurisdictions would work in a similar way.

Re:GitLab reinstates list of servers that have malware by kbaker on Saturday October 15, 2016 @08:24PM (#12716247)
For reference:

14. Additional jobs

Other than with the prior written permission of the Employer, the Employee is prohibited during the term of the Employment Contract to carry out work – either paid or not – of any nature whatsoever, either for himself and/or for third-parties.

Yeah, seems a bit much...

Re:GitLab reinstates list of servers that have malware by TheSpiceIsLife on Saturday October 15, 2016 @08:47PM (#12716305)
It should at least qualify the domain(s) with which the work pertains to.

Like I can't mow the lawn for the little old lady next door. Or take my friends kids to school.

Re:GitLab reinstates list of servers that have malware by tlrobinson on Sunday October 16, 2016 @03:51AM (#12717539)
"... either for himself and/or..."

Can't mow your own lawn either. And if you're an Orthodox Jew you can't use an elevator or oven.

Re:GitLab reinstates list of servers that have malware by TheSpiceIsLife on Saturday October 15, 2016 @08:43PM (#12716291)
My lay understanding is that any contract clause that a reasonable person would find unreasonable is by default not valid.

How would anyone enforce such a clause? Contract law isn't criminal law -the state nor federal prosecutor isn't going to come after you- so the aggrevied party would have to sue the other. Which wouldn't even make it to court for such an overreaching clause.

Edit: having said that, it seems unlikely a reasonable person could write that clause, so I'm not sure how such a thing could come about.

Re:GitLab reinstates list of servers that have malware by FireBeyond on Saturday October 15, 2016 @11:39PM (#12716759)
"My lay understanding is that any contract clause that a reasonable person would find unreasonable is by default not valid."

That understanding is entirely incorrect, unfortunately. While the law does provide for clauses that may be nullified or voided by either a court or existing case law, and does require a meeting of the minds and an exchange, simple "unreasonableness" is not grounds for voiding, nor is onerousness.

Re:GitLab reinstates list of servers that have malware by masterarms on Saturday October 15, 2016 @09:53PM (#12716441)
FWIW this is fairly common legalese in Dutch employement law. It basically boils down to, if you want to do something on the side: 1. Just let us know. 2. Dont built something which competes with us.
Re:GitLab reinstates list of servers that have malware by pyre on Sunday October 16, 2016 @12:35AM (#12716950)
But legally they are claiming full power over everything, and just not exercising that power in practice.
Re:GitLab reinstates list of servers that have malware by oneplane on Saturday October 15, 2016 @07:44PM (#12716150)
That is some excellent and honest language to describe why you put that in the contract the way that you did. Often people don't understand why it's there, and assume malicious intent to "steal" the private work of employees, but as shown in this case, it's simply an IP issue that cannot easily be resolved in a different way as far as you know. Reading your comments on the various places this discussion is happening, your clear and honest answers make me (and probably others) like GitLab even more!
Re:GitLab reinstates list of servers that have malware by tastythrowaway2 on Sunday October 16, 2016 @10:20AM (#12718685)
You are incorrect in your assumption that it cannot easily be resolved. It would be trivial to declare it limited to a smaller domain - specifically the domain in which gitlab operates. As it stands now it is limitless in scope. as pointed out by many others, this is not reasonable.
Re:GitLab reinstates list of servers that have malware by oneplane on Sunday October 16, 2016 @08:21PM (#12721902)
If that is the case, you should definitely offer your legal advice to GitLab.
Re:GitLab reinstates list of servers that have malware by tastythrowaway2 on Thursday October 20, 2016 @02:23AM (#12750097)
I happily would but would like to retain the option to mow my own lawn.
Re:GitLab reinstates list of servers that have malware by allendoerfer on Sunday October 16, 2016 @08:08AM (#12718246)
> Other than with the prior written permission of the Employer, the Employee is prohibited during the term of the Employment Contract to carry out work – either paid or not – of any nature whatsoever, either for himself and/or for third-parties.

I am not a lawyer, but I am 100% certain that you cannot do this in Germany. At most maybe if the contract is limited to a time period and there are exceptional reasons why this would be necessary.

It is called "Scheinselbstständigkeit" [0] (only seeming to be self-employed). Contractors in Germany have to be actual businesses. They cannot be "weisungsgebunden" (bound to instructions), meaning you can only tell them what to do, not how to do it. E.g. you can have deadlines, but you cannot tell them when to work and so on.

The reason for this is to prevent contracts, which have the characteristics of an employment contract but do not pay taxes and social insurance.

[0] https://de.wikipedia.org/wiki/Scheinselbst%C3%A4ndigkeit

Re:GitLab reinstates list of servers that have malware by detaro on Sunday October 16, 2016 @02:48PM (#12720228)
These contracts look (too my non-lawyer eyes) like a minefield in that regard anyways, but this specific rule certainly is a very big negative sign in that regard :/

That the contracts explicitly mention that possibility and have the "contractor" indemnify the company against all claims if a government or court finds the relationship is actually an employer-employee one doesn't help.

Re:GitLab reinstates list of servers that have malware by Normal_gaussian on Monday October 17, 2016 @03:19AM (#12723198)
The paragraph was taken from the standard employment contract not the contractors contract.
Re:GitLab reinstates list of servers that have malware by stordoff on Sunday October 16, 2016 @12:42AM (#12716981)
I've next to no knowledge of Dutch contract law, but there is no way I would agree to article 14 as written (FWIW, I hold an English Law degree, though it isn't hugely relevant here). Without language restricting "work" to a reasonable scope, Article 14 appears to require written permission for an absurdly wide range of activities:

> Other than with the prior written permission of the Employer, the Employee is prohibited during the term of the Employment Contract to carry out work – either paid or not – of any nature whatsoever, either for himself and/or for third-parties.

For instance, building myself a home server, fixing my parents' laptop, or even helping a friend move house could be construed as "carry[ing] out work [...] of any nature whatsoever", thus requiring prior written permission, which I doubt is the intent. The clause would be much more reasonable, in my opinion, if coupled with something like the following (this obviously isn't legal advice -- I've virtually no knowledge of Dutch contract law [and it's five in the morning!] -- just a rough idea of how the scope could be limited).

> For the purposes of this Article, "work" refers to any activity arsing from or dependant upon any of the Employer's facilities, research, or other assets or activities. It further refers to any activity which may be of use to, or relates directly or indirectly to, any product or service that is produced, sold, developed, researched, or otherwise under consideration by the Employer.

An IP grant could also be added if needed, along the lines of:

> So far as is permitted under Dutch and/or applicable foreign law, the Employer shall own all rights, title, and interests (including, but not limited to, copyrights, (industrial) design rights, patent rights, (semi-conductor) topography rights, plant variety rights, accompanying rights, trade name rights, trade mark rights, database rights) to any activities and inventions arising, directly or indirectly, out of such work (whether or not said work is reliant upon or conducted with any of the Employer's facilities, research, or other assets or activities), unless a written agreement is made with the Employer prior to the work commencing.

Like I mentioned, it's five in the morning here, so it's almost certain I've overlooked something obvious in drafting those (and it isn't legal advice!), but I would be much more willing to agree to a contract that limits the scope to things that are at least somewhat related to the company, especially given the penalty clause (article 21):

> For each infringement of the provisions of [article 14], the Employee will forfeit to the Employer – contrary to the provisions of article 7:650 of the Netherlands Civil Code – an immediately payable penalty of EUR 10,000.- with the addition of EUR 500 for each day (or part of a day) on which the violation continues, without prejudice to the Employer’s right to claim compliance and compensation of damages.

FWIW, I use GitLab for one of my personal projects, and I've had nothing but a positive experience, so I'm certainly not saying that the contract is malicious (nor do I believe it would ever be enforced frivolously/excessively). It just caught my eye whilst scanning through the contract as being excessively broad and something with which I would have a hard time agreeing.

Re:GitLab reinstates list of servers that have malware by YorickPeterse on Saturday October 15, 2016 @06:16PM (#12715879)
This depends on the country. We have an official entity in the United States and The Netherlands. For example, European employees tend to be employed by GitLab B.V. (the Dutch entity). Those outside of the covered areas are officially contractors if I'm not mistaken.