Companies don't make decisions based on morality.

This is a question of liability. Gitlab's liability, based on whatever internal metrics being measured, would be significantly higher than the potential economic rewards of having employees in sensitive positions in these two countries--at the moment.

Also, on a side note, morality != legality. They're two different things. What is moral isn't necessarily illegal, and vice versa.

There's no need to beat up the strawman "techbro." It seems to me that this was a difficult decision to make and somebody had to make it.

Damned if you do; damned if you don't.

That was roughly the reading of this issue that I assumed initially too, but in fact the liability/reward situation is reversed here, I think.

GitLab are considering making this change in order to satisfy the requirements of a potential customer[0] - i.e. the reward is for adding the restriction.

And in turn, making the change itself could increase liability[1] since it doesn't seem to be based on a legal request or existing defensible GitLab policy.

[0] - https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not...

[1] - https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not...

The thread reads like a case of the compliance arm of the business trying to keep the ship steady and non-discriminatory (which is in-line with GitLab's stated goals, the intent of the law, and likely in-line with their prospects as a long-term global employer), while a sales part of the organization tries to close a deal.

Putting in additional engineering effort to allow the customer to specify their own policy on SRE/support access to data -- which they'd be responsible for defending if there were any questions -- seems like it might be a way forward. Whether the sales team and customer would wait for that is another question.

It's remarkable and very progressive to see this discussion in the open; it's also interesting to note how many side-discussions and different opinions emerge in the comments and in discussion here, while the core communication continues between a small number of participants in the merge request.

> "Companies don't make decisions based on morality."

So let's just label every employee with a Foreign/Chinese/Russian background as a spy, because a client says so?

Why not? And Australians, they're explicitly (by law) required to be spies.

And your comment suggests as much - why would opsec about consumer / sensitive data be important unless you expect your employees to act in less-than-fair manner (be that for personal gain, a competitor's gain, a national gain, ...)?

> "Why not? And Australians, they're explicitly (by law) required to be spies."

How come we don't see Gitlab re-considering hiring Australians then?

> "And your comment suggests as much - why would opsec about consumer / sensitive data be important unless you expect your employees to act in less-than-fair manner (be that for personal gain, a competitor's gain, a national gain, ...)?"

The defense industry will put you through background checks, demand a security clearance, and won't hire you unless you're a citizen - whilst simultaneously employing some of the strictest security measures available today. Security will stay there long after you've stopped hiring Chinese and Russian individuals.

> How come we don't see Gitlab re-considering hiring Australians then?

I can't speak to GitLab specifically, but them restricting Australian hires too has been brought up numerous times in this HN thread. Given the amount of activity on here from their team members and specifically sytse, it would seem likely that they have at least been made aware.

> How come we don't see Gitlab re-considering hiring Australians then?

Because no company has asked them to yet. Give it time ;)

Dammit.. was hoping Australia could silently slip under the radar on this one.

The thing that I suspect that most people don't understand about Australia is that the laws don't really mean shit all unless the situation gets very serious very fast.

I know people who have received aa requests who have literally responded with "get fucked mate, why on earth would I do that?" and the response has (for every instance I'm aware of) been "yea, true. it was a bit of a stretch"

It's rather like the Australian constitution, I'm fairly sure I've seen a joke around about it, we have one but like... no one actually cares... if shit really hits the fan I'm sure we'll all go find a copy and figure it out, but otherwise we're doing only slightly less than alright just kinda playing it by ear...

> It's immoral to discriminate on the basis of fear, prejudice, and rumor.

Except for the fact that state-sponsored hacking and IP theft is a real thing. Your comment reads as naive and extremely uninformed. I would invite you to read the Huawei "Tappy" indictment [1] to understand the lengths that certain nations go to steal from US companies. Here we have a company that is literally offering cash bonuses to their employees for stealing IP.

> the systems should be tight enough to make sure absolutely no-one has access to customer data without consent

If you read the indictment, you'll realize that these rogue employees don't care about audit logging or any punishment that follows as a result of getting caught. In many cases, all they have to do is fly back to their country and they'll be rewarded and regarded as heroes for their loyalty to their country.

[1] https://www.justice.gov/opa/press-release/file/1124996/downl...

> the systems should be tight enough to make sure absolutely no-one has access to customer data without consent - and that any actions taken are logged for auditing.

You haven't really done OpSec have you? There is very little absolutism in defining who gets access to what data. In fact barring nations that have historically shared data with their governments is exactly one step closer to how you would achieve this.

> Investors and potential customers need to know.

Says the guy hiding behind a throwaway (new?) account...

> "You haven't really done OpSec have you? There is very little absolutism in defining who gets access to what data. In fact barring nations that have historically shared data with their governments is exactly one step closer to how you would achieve this."

When was the last time you've contracted for a serious client? When it comes to tech - you don't implement "OpSec" by blanket banning hiring Chinese/Russian individuals. Disregarding your bizarre definition of "OpSec" - plenty of individuals with Chinese/Russian background are working for companies such as Google/Microsoft/Facebook/Uber - making significant contributions and getting paid vast sums of money for it. Those companies actually invest into background checks, have dedicated security teams, are investing into locking networks down and improving monitoring. It appears that Gitlab simply wants the easy way out, or, they can't afford to refuse the aforementioned client's offer.

> When was the last time you've contracted for a serious client?

Uhh, today? I have about 20 on-going contracts with "serious clients", which include manufacturers, distributors, software companies, etc. What's your point?

> When it comes to tech - you don't implement "OpSec" by blanket banning hiring Chinese/Russian individuals. Disregarding your bizarre definition of "OpSec"

Banning hiring from countries isn't an exclusively isolated tactic for executing OpSec...I'm not sure why you implied that.

> Those companies actually invest into background checks, have dedicated security teams, are investing into locking networks down and improving monitoring.

Those companies all have physical presences in those countries. Gitlab does not. BIG DIFFERENCE.

I believe “serious clients” meaning more towards to military/banking clients. The access to their production env is very strict, and the personnels are always being audited no matter their nationality and/or geolocation

I think you're being a bit disingenuous. It seems you're almost implying Chinese and Russians are being randomly discriminated against for no reason, as if the kind of thing Gitlab is worried about has never happened before. Specifically with people loyal to those two countries. Yes, it is discrimination, whether it is baseless discrimination is much more debatable.

> "It seems you're almost implying Chinese and Russians are being randomly discriminated against for no reason, as if the kind of thing Gitlab is worried about has never happened before. Specifically with people loyal to those two countries. Yes, it is discrimination, whether it is baseless discrimination is much more debatable."

Do you have concrete numbers that prove Chinese/Russian workers are significantly more likely to act in bad faith against the companies they work in?

To quote Gitlab's chief legal officer, @cciresi:

> "The highest risk countries for hackers are: Romania, Brazil, Taiwan, Russia, Turkey, China and the United States (The US ranks number two in hackers according to ABC news). Surely, we aren't going to start restricting employment on all these countries?"

If you look at the vetting processes in the defence sector they have strict nationality and background checks.

Why should the same not be true for something with a damage multiplier the size of github which is basically carrying a big chunk of commercial IP in private repos?

> "If you look at the vetting processes in the defence sector they have strict nationality and background checks.

Why should the same not be true for something with a damage multiplier the size of github which is basically carrying a big chunk of commercial IP in private repos?"

I'm all for background checks. Those at-least try to give everyone an equal opportunity - and if you fail them, you'll know why and have a chance to challenge the decision. There is a due process - as opposed to having some random techbro creating "need to get rid of {arbitrary nationality} asap" issues and having a bunch of random employees debating it...

If by having "nationality requirements" you mean "being a US citizen" - then Gitlab will lose 50% of its workforce overnight. The same will be true for many other tech companies. You make it sound like the defense sector is enjoying the strict employment regulations...

The issue is not necessarily the background checks but the fact that you can be compelled by the state you reside in after the fact. For example the state could target known employees of GitHub after they are employed and checks passed.

I'm not suggesting any national correlation here. I suspect the same is true for Chinese and Russian companies too!

As for the defence sector it is not enjoying it, at least in Europe as the incoming staff into the sector are shrivelling up pretty rapidly.

I think that last paragraph is suggesting that GitLab could simply reject such clients - or better, direct them to the self-hosted plan where they have full access control.

That's a fair point for sure.

Director of Compliance raised very similar concerns in the discussion over there, it's funny (not really) to see how our good old friend Paul (CFO) stomps over it again

Gitlab's CFO Paul Machle is becoming a liability to the reputation of the company.

Lol, our employees who have access to sensitive data cannot be citizens of: - A country the country our company is based in is currently in war with. - A communist dictatorship known for pressuring its citizens into stealing IP/corporate secrets abroad.

It's not arbitrary banning from foreign countries on your client's request if there's actually good reasons to take precautions with these nation-states.

And why not? They're a private company they can choose to employ whomever they want as long as they're compliant to local labour laws. There's no "due proccess" in business.

"Finally - it actually looks like Gitlab's security practices are truly lacking. That an employee is Chinese/Russian shouldn't be a consideration - the systems should be tight enough to make sure absolutely no-one has access to customer data without consent - and that any actions taken are logged for auditing. Whenever necessary - pass your employees through a background-check. In sensitive (government) scenarios - restrict to employees with government clearance."

Don't improve HR security practices because you're vulnerable in different ways anyways?

If you as a company simply don't trust the government your employees work under, you cannot trust them with sensitive information, even if they're outstanding trustworthy people.

If it makes no sense whatsoever, why do you think it makes sense to some other people?