GitLab are considering making this change in order to satisfy the requirements of a potential customer[0] - i.e. the reward is for adding the restriction.
And in turn, making the change itself could increase liability[1] since it doesn't seem to be based on a legal request or existing defensible GitLab policy.
[0] - https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not...
[1] - https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not...
The thread reads like a case of the compliance arm of the business trying to keep the ship steady and non-discriminatory (which is in-line with GitLab's stated goals, the intent of the law, and likely in-line with their prospects as a long-term global employer), while a sales part of the organization tries to close a deal.
Putting in additional engineering effort to allow the customer to specify their own policy on SRE/support access to data -- which they'd be responsible for defending if there were any questions -- seems like it might be a way forward. Whether the sales team and customer would wait for that is another question.
It's remarkable and very progressive to see this discussion in the open; it's also interesting to note how many side-discussions and different opinions emerge in the comments and in discussion here, while the core communication continues between a small number of participants in the merge request.
So let's just label every employee with a Foreign/Chinese/Russian background as a spy, because a client says so?
And your comment suggests as much - why would opsec about consumer / sensitive data be important unless you expect your employees to act in less-than-fair manner (be that for personal gain, a competitor's gain, a national gain, ...)?
How come we don't see Gitlab re-considering hiring Australians then?
> "And your comment suggests as much - why would opsec about consumer / sensitive data be important unless you expect your employees to act in less-than-fair manner (be that for personal gain, a competitor's gain, a national gain, ...)?"
The defense industry will put you through background checks, demand a security clearance, and won't hire you unless you're a citizen - whilst simultaneously employing some of the strictest security measures available today. Security will stay there long after you've stopped hiring Chinese and Russian individuals.
I can't speak to GitLab specifically, but them restricting Australian hires too has been brought up numerous times in this HN thread. Given the amount of activity on here from their team members and specifically sytse, it would seem likely that they have at least been made aware.
Because no company has asked them to yet. Give it time ;)
The thing that I suspect that most people don't understand about Australia is that the laws don't really mean shit all unless the situation gets very serious very fast.
I know people who have received aa requests who have literally responded with "get fucked mate, why on earth would I do that?" and the response has (for every instance I'm aware of) been "yea, true. it was a bit of a stretch"
It's rather like the Australian constitution, I'm fairly sure I've seen a joke around about it, we have one but like... no one actually cares... if shit really hits the fan I'm sure we'll all go find a copy and figure it out, but otherwise we're doing only slightly less than alright just kinda playing it by ear...
This is a question of liability. Gitlab's liability, based on whatever internal metrics being measured, would be significantly higher than the potential economic rewards of having employees in sensitive positions in these two countries--at the moment.
Also, on a side note, morality != legality. They're two different things. What is moral isn't necessarily illegal, and vice versa.
There's no need to beat up the strawman "techbro." It seems to me that this was a difficult decision to make and somebody had to make it.
Damned if you do; damned if you don't.