I'm not sure I've ever 180'd on a compliance practice as quickly as I have with GitLab's compliance policy repo transparency. When I first stumbled across it during the telemetry situation last week I thought they were nuts. Absolutely nuts. But reading through this thread and the one posted last week it seems like an incredibly effective approach. People from all areas of the company, not just legal/compliance are giving input and asking the right questions. And, just as important, they're not asking the wrong questions.

It's a bit of a chicken/egg situation - is there a strong culture of compliance because of the transparency or does the strong culture of compliance make transparency a non-issue? Whatever their secret sauce I think Wall Street could use some.

This one actually makes me scared for Gitlab. I feel like their exposing themselves to a lot of extra liability by making these discussions public.

For instance - it's been suggested (I don't know if rightly or wrongly) that they have a customer who asked them to do something that would violate the US boycott laws. I'll assume that it is the case that they've been asked to violate these laws.

According to a plain reading of a document someone linked here [0] that means they are required to report the request to the US government. I'll assume that it is the case that they are required to report it too, even though I'm not a lawyer, and that's not really an authoritative source.

> The EAR requires U.S. persons to report quarterly requests they have received to take certain actions to comply with, further, or support an unsanctioned foreign boycott.

If they don't (because they forgot, because they disagree with that interpretation of the law, because they don't want to piss off the customer, etc) they now have a public facing record of them violating the law. Even if the assumptions are wrong (they likely are) and they aren't violating the law, someone might decide they are and it might result in lengthy/costly legal battles.

How many other examples like this probably live in that repo for anyone to see?

[0] https://www.bis.doc.gov/index.php/enforcement/oac

You're concerned because you're worried if they violate the law they'll be held legally accountable? Isn't that the entire point of transparency / accountability?

>Probably the US government or something like that?

The requirement to block some class of people off from some customers is nothing new, and back at Sun there was separate Sun Federal which was dedicated for such clean business.

GitLab's approach (and i think it is just a start of the trend in the industry, time to get rid of the accent :) while theatrically good isn't practically efficient. A Chinese or Russian residing here with some family back at the Motherland is susceptible to the same pressure in the loving, yet firm hands of the Motherland as if s/he were residing there her-/himself. So the next absolutely logical and necessary step for GitLab on this path is to block all Russians and Chinese who has at least some family back there. Giving that there may be other ties too and the hassle to verify (to which degree of relationship?), simply blocking all those nationals would the natural and practically efficient way.

It seems obvious to me that the kind of pressure to which you are referring is not limited to family. It would be easy enough to threaten a high school boyfriend. Or the family of your child's former best friend. Or a former co-worker. Or any friend. Or even a complete stranger.

Extortion can be effective well outside family lines.

And, of course, extortion is equally effective on USians, Brits, Indians, Nigerians, or anybody else.

The next obvious step is to block any employees married to a Russian or Chinese person.

It's about two steps away from intermittent camps.