Ok, I've temporarily changed from the submitted title ("Gitlab blocks current employees and stops future hires in China and Russia") to the page title—which I assume is accurate but is uninformative—until we get clarity about what an accurate, neutral title would be. Does anybody want to suggest one?

Edit: I've provisionally gone with "Gitlab blocks hiring SREs and Support Engineers in China and Russia". If that's wrong, or if anyone can suggest a more accurate and neutral title, we can change it again.

Can we get "Gitlab considers blocking hiring SREs and Support Engineers from China and Russia" since this decision hadn't been made yet.

Maybe substitute "not" for "blocking" as well since that seems clearer.

Ok, sure. Edited.

Correct, this block would be for two functions (Site Reliability Engineer and Support) and we currently have no people in that role in China and Russia.

Please note that we're still discussing this change. We work out in the open so you can see us working on it. I hope that people appreciate the difference between that and what you would see in a non-transparent company (probably nothing, they would just not open up a vacancy in the offices in that country).

Concerns on privacy, data and IP are understandable. However, this ban would be a symbolic move with absolutley zero substance. The world is small and highly interconnected and it would be extremely easy for the Russian and Chinese governments to compromise and co-opt support staff from pretty much any country of their chosing. This will lulll your customers and your infosec teams into a false sense of security. Considering how forthcoming you are with the names, roles and location of your team. They would pick you off in a heart beat and you would not suspect or see it coming. The Chinese are extremely well entrenched across the global - with enough money to grease anybody's wheels. Not to mention it would be trivial for them to get their "agents" passports from anywhere in the world

Would you consider extending this to other roles? If you remember the Juniper VPN backdoor was so well done it would have likely (or did) passed code review, putting most software engineering in to scope.

Additionally would this extend to individuals who are of Chinese or Russian origin? China in particular leans on nationals who are on visas or have family still in country to conduct espionage operations.

It would be strange to not accept code from certain countries since we are an open core company that gets contributions from around the world. There are other ways to prevent supply chain attacks. A difference with data is that there are always multiple people involved before code is merged while data can be extracted by a single individual who has access.

Discriminating on origin is likely illegal.

> A difference with data is that there are always multiple people involved before code is merged while data can be extracted by a single individual who has access.

It sounds like you just need to harden your production perimeter. Jump boxes with two-man-rule access and terminal logging. Apply the same practices to data as you do code.

> Discriminating on origin is likely illegal.

You should ask your legal folks about the national security exceptions of Title VII. It sounds like your customer requirements are pushing you in that direction anyway.

> open core company that gets contributions from around the world

The irony...

I appreciate that Gitlab discusses this in open, the only real disappointment that it's so one sided.

I meant from the US perspective, Gitlab seems to have a few remote workers that aren't Americans, but still...

Well actually we have over 1000 team members (all are remote) and only half are in the US. The other half are in 63 other countries. If you want to see where we all work from you can check out our team https://about.gitlab.com/company/team/.

The reason this is viewed from a US legal perspective is because we are a US company so we are governed by US laws.

It does block them from moving to that country. So if a current employee was planning to move to either country soon they'd be prevented from doing that.

I've danced this dance at a previous company when we had an employee working from a country of interest for an extended period of time. They were air-gapped from our systems and it worked because they submitted everything by pull requests (the original way, sending git patches by email). They didn't have access to our CRM or any customer systems because several of our contracts - not just with governments but also major multinationals - prevented employees in certain countries from having access.

Even when I traveled to the same country I used a burner laptop that was decommissioned when I returned. When we EOL'd laptops in the office they'd go in the burner pile to have one last holiday abroad before they were wiped again and sent to a local charity.

I've done some travelling to risky places before (Kiev and other places) and even though the networks were hostile there, I still don't understand the point of pretending that Russia et al can't get into Gitlab whenever they want to. They can. Air-gapping isn't going to slow them down.

> I still don't understand the point of pretending that Russia et al can't get into Gitlab whenever they want to

Security isn’t absolute, it’s layered. The harder you make it for the adversary, the more it costs the adversary (eg: potentially burning a zero day), and the more chance there is of detection.

Can Russian intelligence get into Gitlab? Probably. Are measures that make it more expensive liable to deter them? I think so.

> They can. Air-gapping isn't going to slow them down.

Two points here. First of all, failing to acheive absolute security is not a justification for ignoring best practices.

Second, this isn't air gapping. It is preventing a bugged laptop from sitting in on conference calls and meetings for the next year or two until it gets aged out.

As the subject of this thread also points out, there's an important factor of risk to the individual: to prevent them from getting put in a position where they can be coerced into turning over data access.

Or just bribing people in “allowed” countries.

I think it would probably be costly to bribe someone in the "allowed" countries. I'm not going to risk going to prison for some small sum of money, and a large sum of money is logistically difficult to give me. People will ask questions, the scheme will probably be found out.

Meanwhile, if the government can just arrest you and say "change this repository and you go free", it's essentially free.

All the people who are saying they've never seen a contract with a term like this, I'm just sitting here wondering how my experience is the opposite...

Or into affected roles.

So, someone in, say, QA or documentation, looking to head into SRE or Support, would be unable to if they presently reside in China or Russia.

> they'd be prevented from doing that.

Their employment being dependent on them residing within specific locales is not the same as "prevention". It's an incentive scheme, afaik.

It affects no employess (per clarification in this thread) presently in affected roles.

It could affect present employees who are in other roles, located in China or Russia, from moving to a covered role, whilst continuing to reside in China or Russia.

The block is on current non-residents of China or Russia from moving to those countries. <strike>Not on any present residents of those countries from having further access.</strike>

<BOLD>See self-reply below, not the case.</BOLD>

Though that is alluded to as a possibility, with complications.

________________________________

Update: My first read was incorrect.

Hm, upon a re-read I think you are right. Thanks for clarifying.

And on my own re-read: "Current team members are prevented from moving to these countries and remaining in a role that prohibits it."

That would seem to apply to current employees in Russia / China who are in roles covered by the block.

Which is kind of A Big Deal.

No? It would seem to apply to current employees who move to Russia/China who are in roles covered by the block. i.e. they would have the choice of moving and changing roles/quitting, or staying.

Depends on whether you read that as:

X: "Current team members"

A: "moving to these countries"

B: "remaining in a role that prohibits it"

X are prevented from BOTH A AND B.

(X may do neither A NOR B)

Or:

X are prevented from (A AND B).

Whether or not remaining in one of these countries and MOVING to a role that prohibits it is included in the prohibition is unclear.

Someone's future transfer may hinge on that.