Gitlab considers not hiring SREs and Support Engineers in China and Russia

Re:Gitlab considers not hiring SREs and Support Engineers in... by 3pt14159 on Sunday November 03, 2019 @09:53PM (#21438618)

I've done some travelling to risky places before (Kiev and other places) and even though the networks were hostile there, I still don't understand the point of pretending that Russia et al can't get into Gitlab whenever they want to. They can. Air-gapping isn't going to slow them down.

[ Parent | on HN ]

Re:Gitlab considers not hiring SREs and Support Engineers in... by peteretep on Sunday November 03, 2019 @11:16PM (#21438996)

> I still don't understand the point of pretending that Russia et al can't get into Gitlab whenever they want to

Security isn’t absolute, it’s layered. The harder you make it for the adversary, the more it costs the adversary (eg: potentially burning a zero day), and the more chance there is of detection.

Can Russian intelligence get into Gitlab? Probably. Are measures that make it more expensive liable to deter them? I think so.

[ Parent | on HN ]

Re:Gitlab considers not hiring SREs and Support Engineers in... by mike_d on Monday November 04, 2019 @02:06AM (#21439524)

> They can. Air-gapping isn't going to slow them down.

Two points here. First of all, failing to acheive absolute security is not a justification for ignoring best practices.

Second, this isn't air gapping. It is preventing a bugged laptop from sitting in on conference calls and meetings for the next year or two until it gets aged out.

[ Parent | on HN ]

Re:Gitlab considers not hiring SREs and Support Engineers in... by joatmon-snoo on Sunday November 03, 2019 @11:58PM (#21439151)

As the subject of this thread also points out, there's an important factor of risk to the individual: to prevent them from getting put in a position where they can be coerced into turning over data access.

[ Parent | on HN ]

Re:Gitlab considers not hiring SREs and Support Engineers in... by iiertiosas on Sunday November 03, 2019 @11:01PM (#21438925)

Or just bribing people in “allowed” countries.

[ Parent | on HN ]

Re:Gitlab considers not hiring SREs and Support Engineers in... by jrockway on Monday November 04, 2019 @05:16AM (#21440295)

I think it would probably be costly to bribe someone in the "allowed" countries. I'm not going to risk going to prison for some small sum of money, and a large sum of money is logistically difficult to give me. People will ask questions, the scheme will probably be found out.

Meanwhile, if the government can just arrest you and say "change this repository and you go free", it's essentially free.

[ Parent | on HN ]