Hacker News Reader

Comment by tgsovlerkhgsel | Hacker News Reader

I'm shocked (in a positive way) about the amount of transparency Gitlab provides.

Even as a reader, it almost feels as if someone misconfigured the ACLs or I'm reading leaked internal documents, not an intentional decision to make this open. Some of the discussions seem highly sensitive, and yet it seems to work for them.

Thank you, Gitlab, for being so open! I've learned a lot about compliance from just reading this thread. For anyone curious, here's some background on the mentioned boycott laws: https://www.bis.doc.gov/index.php/enforcement/oac

View on HN

Thanks! We try to be transparent by default and even when it is difficult. I think the OP is a good example of something that is hard to be transparent about because the decision isn't obvious and it takes discussion to come to the best conclusion.

Congratulations on taking a step in the right direction, even if it is a very small step. Nobody else seems to take the threat seriously, somewhat excepting defense contractors of course.

I can understand being reluctant to deal with the full extent of the problem. Somebody from China, with a family in China and subject to Chinese law, does not cease to be a security threat by moving to the USA and getting a green card. This gets awkward.

It really is no surprise that valuable secrets of all types (private key, customer data, trade secret, insider info for trading, etc.) end up in other countries.

I on the other hand think that splitting countries into allies and enemies is stupid. China is a huge country, and excluding a billion people from your company just because their government does questionable things sounds like a pretty bad idea.

If you are really concerned about the confidentiality of your data, don't store it unencrypted in some SaaS where every customer service rep has full access to all your data. At that point you're already so vulnerable that exluding potenential employees from a whole country is just pointless security theater that some suit with an MBA thought up to justify his position.

> China is a huge country, and excluding a billion people from your company just because their government does questionable things sounds like a pretty bad idea.

People have to do what the state they live in and belong to orders them to do. That's part of the point of having a state. So if you can't trust a state you can't trust its people either.

> you are really concerned about the confidentiality of your data, don't store it unencrypted in some SaaS

I don't think dissolving the company is on the table.

> I don't think dissolving the company is on the table.

Zing! Solid line but it misses the point. As with any other data, you can encrypt source code. It's perfectly easy to envision a setup where Gitlab employees in country X can only see plaintext Gitlab data they could already see over the public internet.

> People have to do what the state they live in and belong to orders them to do. That's part of the point of having a state. So if you can't trust a state you can't trust its people either.

So, I could say that American is sucks if I think Trump is sucks?

That is ridiculous. The first is that 'state is unauthentic' is a subjective speculation. And the most funny is that the conclusion 'people is unauthentic' is came from your first thought.

I can not say American is terrorist if Hillary wanna burn other country. Am I right?

If your world view is based on separating entities into good and bad, nuanced statements will appear ridiculous.

In china, not from China. The former is easy to justify, and would affect even Americans of non Chinese descent. The latter would be incredibly difficult to justify, and could easily be seen as unwarranted discrimination.

Discriminating someone because of their Chinese ethnicity would be hard to justify but what about Chinese citizenship (especially if it's the only one) or ties to China like family living there? Those would make someone vulnerable to pressure by the Chinese government.

No. As long as someone has a green card or citizenship, who cares where their family lives? The only exception would be for national security clearances, and those affect Americans as well.

The argument made in the thread is that someone could be pressured by the foreign government into leaking sensitive information.

Where an employee's family lives seems like the single most important point to consider...

Is it legal for a private US company to apply (some of) the same tests used to determine national security clearances in its hiring decisions? Or is the government the only entity allowed to make decisions that way? I'm genuinely asking, I haven't thought about this conflict before.

Well, technically it is discrimination, but not racism. I.e. you can still hire a Japanese developer, and with a Chinese regime change you might be able to hire Chinese developers. However, federal law prohibits discrimination based on national origin. This is a touchy subject, but maybe this no longer makes sense? As burfrog pointed out, a Chinese employee living in America isn't free from Chinese control; the gov't will do bad things to his family if he gets a request for, say, information or access and doesn't comply. I'm hesitant to endorse allowing discrimination by national origin, but on the other hand, it doesn't make sense to allow the Chinese access to any kind of important data.

It doesn’t matter. As long as a security clearance isn’t required, discriminating based on notational origin is a big no no from an ethical perspective, even if it was legal.

I hope we learned our lesson during WW2.

> discriminating based on notational origin is a big no no from an ethical perspective

However, discriminating based on exposure to coercive pressure from aggressive and hostile foreign powers is probably OK, even if such exposure is heavily correlated with national origin. The key is that the discrimination must be based on an individual analysis of the applicant and his/her life circumstances.

It's not OK to blanket deny any person of Chinese ancestry.

Denying such a person access to sensitive data or positions might be OK, however, if that person is exposed to coercive threats by, e.g. having family located in a jurisdiction known to use its power over expatriates' families as leverage to recruit sources and agents.

So long as the intent is genuinely to serve a compelling interest in protecting against security threats and the vetting policy is as narrowly tailored as possible to minimizing insider risk from applicants with vulnerability to certain threat actors, I think such a policy could pass ethical and (IANAL) maybe legal muster.

I disagree completely. By that reasoning, a presidential candidate of Chinese descent who was a natural born American citizen but had relatives back in china would be disqualified, and that is nowhere justified by the constitution. A private company likewise shouldn’t be able to discriminate on speculative threats alone. What if they had a relative in prison, a hostile coercive environment by any measure?

I accept that I do not qualify for a high security clearance because I’m married to a Chinese national. I don’t think that should have any bearing on any other jobs that don’t require such clearances (nor my wife nor my son should be subject to such restrictions).

> By that reasoning, a presidential candidate of Chinese descent who was a natural born American citizen but had relatives back in china would be disqualified

Not so. The Constitution is very clear on eligibility requirements for the President. A natural born American citizen of Chinese descent who otherwise satisfies the requirements in Article II, Section 1, Clause 5 is perfectly eligible to run for the office. If there is concern about potential leverage foreign states have over that candidate--as there rightly would be if our natural born American had close family in PRC--voters might vote for someone else. My position is that such a motivation on the part of the voters is ethical.

> I accept that I do not qualify for a high security clearance because I’m married to a Chinese national. I don’t think that should have any bearing on any other jobs that don’t require such clearances (nor my wife nor my son should be subject to such restrictions).

First, I agree that your or your son's relationship to a Chinese national should not be sufficient grounds to deny you or your son any given job. My position is that a narrowly tailored policy to reject candidates with high risk of coercion from sensitive positions, or to limit such employees' access to sensitive data, is probably OK. Having close family residing in PRC unfortunately does raise the risk of coercive pressure being applied. If your wife has no surviving close relatives in PRC and she never goes to visit, you and your son should be assessed to have no greater vulnerability to coercion than any other citizen with otherwise similar circumstances (debts, addictions, etc.).

Second, I am curious why you disagree completely, yet accept that your relationship with your wife may disqualify you from holding a government security clearance. That means you accept that the government has an interest in protecting classified information from foreign powers, and that your relationship raises your risk profile. Do you not accept that private companies have an interest in protecting their IP and customer data from theft or sabotage? Or do you not accept that your relationship also raises your risk profile for these positions? Just because a position may not require a clearance does not mean that position is not highly sensitive to a potential insider threat. And unfortunately the PLA's targets are not restricted to intelligence agencies; they target virtually every sector of our economy.

> Second, I am curious why you disagree completely, yet accept that your relationship with your wife may disqualify you from holding a government security clearance.

This has to do with companies making their own rules about what is right or wrong without any checks, balances, or voter feedback. Security clearances are actually defined by law, I’m against corporations becoming their own extra judicial entities.

> This has to do with companies making their own rules about what is right or wrong without any checks, balances, or voter feedback.

As far as I understand, companies are generally free to make their own hiring decisions, so long as they do not amount to discrimination against a protected class. That limitation, by the way, stems from federal legislation--so companies are very much not extra-legal entities operating without any judicial accountability. If a state or federal Congress decide to further regulate companies' hiring decisions, they are free to do so.

I don't understand what exactly you would like companies to do: Simply ignore potential security risks? Do you have a specific process you advocate should be used to evaluate risks? What different kind of restrictions on companies' personnel decisions would you like to see? Do you just have a problem with a focus on risk from family members in PRC as opposed to a broader vetting process where that is only one risk factor?

> Security clearances are actually defined by law

I am not sure that an exact formula for grant/deny decisions exists in statute. These decisions strike me as inherently subjective, although certain facts are obviously pertinent to the decision. I would be very interested to read the relevant laws and regulations, though, if you'd be so kind as to point me to them.

As long as companies are operating faithfully within the law, they’re free to do that. And you’re free to criticize it and boycott it.

Companies like Apple and others should be allowed to be concerned about theft of sensitive data just as much as the government. Just because it’s not a matter of national security doesn’t mean it’s okay.

Nobody here is trying to discriminate against a race. The problem is having ties to relatives living under a government that is known for making people disappear. The same would apply for a white person with many relatives there, etc.

Your argument of companies not being allowed to take cautionary steps against a foreign government doesn’t hold water.

> I’m against corporations becoming their own extra judicial entities.

They already are, with most disputes being settled with Binding Arbitration rather than via the court systems.

Others have already pointed out though, that a company needs to act in its own interests and one of the things it would certainly find interesting is whether an individual is capable of being coerced into sabotaging/sharing corporate trade secrets.

> By that reasoning, a presidential candidate of Chinese descent who was a natural born American citizen but had relatives back in china would be disqualified

If large numbers of voters felt that, then they would never get elected.

> nowhere justified by the constitution

The voters are entitled to vote however they like; that's implied by the constitution.

> I accept that I do not qualify for a high security clearance because I’m married to a Chinese national

Then you essentially agree with me.

> I don’t think that should have any bearing on any other jobs that don’t require such clearances

I agree. The question is, which jobs should require such clearances?

The Title of Nobility / Emoluments Clause [1] and the natural born (and age) qualifier are fairly specific as to what the framers thought were overly corrupting influences for the office of president.

They notably did not include "or family".

The expectation presumably being that foreign powers were clearly enough signalled to tread carefully with regards to exerting pressure on government officials.

At high levels, that seems reasonable. At lower levels, where there's less scrutiny and less opportunity for diplomatic redress? "Reasonable" measures seem murkier.

[1] https://www.law.cornell.edu/constitution-conan/article-1/sec...

Constitutionally speaking, the President does not require a security clearance; the President ex officio has unlimited access to classified information. If there are concerns the President may be vulnerable to foreign influence, the constitutional processes to address those concerns are election and impeachment not security clearances.

Is it a constitutional principle that no secrets may be kept from the President? Or is it just that the “security clearance” system is currently based on executive orders that the President issues, rather than Congress exercising its power to “make Rules for the Government and Regulation of the land and naval forces"?

According to the Congressional Research Service, "By virtue of his constitutional role as commander-and-in-chief and head of the executive branch, the President has access to all national intelligence collected, analyzed and produced by the Intelligence Community"

Source: https://web.archive.org/web/20110113190609/http://feinstein....

I think if Congress tried to pass a law limiting the President's access to classified information, the Supreme Court would likely find it to be unconstitutional.

True. Trump wouldn’t have qualified for high security access anyways just given his public relationship history, not even considering what an FBI clearances check would dig up.

The situation with presidential qualifications is one-of-a-kind special. Hiring at tech companies isn't spelled out in the constitution.

Constitutional requirements can also be changed, and it is long past time that we do so. The country has been around for 2.5 centuries, and now has hundreds of millions of people. We wouldn't suffer a shortage of presidential candidates if we required that all 4 grandparents (determined all possible ways) and all descendants and spouses have been born in the USA, along with all living ancestors and descendants of all of those. The job is simply too important to allow otherwise. (this would disqualify the most recent two, along with failed candidates like Romney and Cruz)

For tech companies we shouldn't be quite so extreme, but it also isn't good to ignore the problems.

Here's a very clear restriction you're faced with: You could never become a Chinese citizen. Why must be pretend that it's ok for this to be entirely one-sided? We should give what we get, imo.

You can't assume what ethical choices a person will make, before they make them. A Chinese citizen in that situation might find a way to get their family out of China, or otherwise find a way to avoid the issue, or just flat out refuse. You can't just take it for granted that you can't trust someone without much more specific evidence. That's a very greasy slippery slope towards justifying highly constructed justifications for discrimination.

> So long as the intent is genuinely to serve a compelling interest

"Your honor, of course my intent was genuine ..."

Therein lies the rub ;)

> I hope we learned our lesson during WW2.

You can rest assured that we did not, I have zero doubt that if there ever was another war at that scale we'd have internment camps for nationals of the enemy before the end of that war.

Have you ever been to China? Such discrimination happens left, right and center. If you’re of an “acceptable” origin and have the right skin color, you might be ok...

I lived and worked in China for almost 10 years. I get that the foreigner glass ceiling is much lower there than here, and things like naked officials are actively discriminated against in government. That has nothing to do with the USA, however.

Well, it does. Because they will use your ethical values against you to slowly boil you like a frog in a pot 'til you find yourself in a concentration camp having your organs harvested. Sometimes bad things have to happen to prevent worse things.

Verwoed

and where it's different? look at distribution of people of color among boards of directors, senate etc.

Because there are less people of ethnic minorities than in the majority demographic. That’s why they’re called minorities. The key point is that they have a chance.

If a security clearance requirement suddenly makes it allowable it argues that it maybe isn't unethical, unless the argument is implicitly that it is ok to ask for unethical things when involving a security clearance?

> discriminating based on notational origin is a big no no from an ethical perspective

Yes it is. You know what's also a big no-no from an ethical perspective? Letting China win so they turn the world into a global dictatorship with concentration camps, organ harvesting and ubiquitous surveillance.

Sometimes you have to do a bad thing to prevent a worse thing.

Depends "national security" is much more than defence industries back when I worked BT the team leaders on some projects where getting positively vetted for SC clearance - That's top secret in US terms.

Arguably now the FANGS are now CNI - which is going to suck if your on a H1B or Green Card.

Lessons are getting unlearned by concerning enterprise customers.

Yes, this is old school racism wrapped in company policy. Bigoted leadership in this country gives this kind of activity permission.

The wiser among us know historically garbage thinking when we see it.

China seems to have noticed how accusations of racism, xenophobia and "white supremacy" are a very effective button to push to try and get western countries to act against their own interests.

The thing is, coming from a country that is practicing cultural genocide against various ethnic groups, we can probably take those accusations and survive.

Better place them all into internment camps. Just in case.

Are we seriously going 9066 here?

I never thought I'd see this level of xenophobia becoming widely acceptable in the United States. For everything educated Americans loathe about Trump, the one thing they've taken on board from him is fear of the Yellow Peril - which is probably the most dangerous aspect of his Presidency.

It’s not xenopohobia, it’s a hard problem. China actively exploits American tolerance for their own gain, and we have no good way to stem corporate espionage other than a blanket ban.

Even then, good old corruption of non-Chinese is still possible.

I'm sorry, targeting Chinese people on Green Cards is xenophobia. I'm not interested in whatever rationalizations are given for this sort of discriminatory behavior. The US is sadly headed down a path towards socially acceptable racial discrimination, justified by the new bogeyman - China.

The same argument would apply if the person was white and had many relatives in China. Or real estate, or other leverage that can be used against them.

You can’t ignore the fact that the PRC uses those things as leverage against people abroad in order to get information. Until that stops, what are companies and governments supposed to do? Roll over and allow espionage because we’re so tolerant?

I could use the exact same argument to propose banning Americans from GitLab. I'd also have much better empirical grounds for doing so, given how much is known about the extent of US espionage.

There's a growing hysteria in the US about China, which is leading to increasing signs of discrimination and harassment of Chinese people in the US. This sort of demonization of an entire country and the politics behind it (preservation of the US as the world's dominant power by containing China) are very dangerous. The thing that makes it most disturbing is the way people across the political spectrum have bought into the idea of the Yellow Peril, and are now okay with discriminatory policies, the trade war, and challenging Chinese territorial sovereignty.

I don't buy it. Yes there's a growing hysteria of China, but that's due to their government. It's not against the people in general. (Yes, yes, there's always an example of someone being racist/xenophobic. My response is there are always idiots who are racist/xenophobic. Citing them as an example of the populace at large is just lazy.)

People don't care about people from the ROC, aka Taiwan, aka China*. If people in our extremely polarized political environment are uniting on this, it's because it's a Serious Issue that needs to be addressed.

The ban applies to people living in China or Russia, not on chinese or russians.

Any american or european living in either country would similarly be affected by the ban. Untwist your knickers please.

It very quickly escalates to discrimination against Chinese people in the US, as evidenced by the highly upvoted comment I originally responded to. I'm sorry if I get my knickers twisted about people proposing an entire race of people pose a national security threat, but this sort of xenophobia has rarely gone well in history.

Chinese and Russians living outside of China and Russia will not be affected by the ban.

You keep calling it xenophobia even after you've been proven wrong when you claimed this is targetted at green-card holders. You are absolutely disengenuous and have no intention at good-faith discussion.

Read the GP comment, which says this is a good first step and then muses about expanding the ban to Green Card holders: https://news.ycombinator.com/item?id=21438366

I then suggest you edit out your erroneous personal attacks.

I think the issue of a week ago was the harder one and I really commend you on walking that one back.

I just read your CEO page section about flaws and how to engage you about your flaws. On the topic of transparency, I'm curious if this has been working. Do people feel comfortable bringing them up? Is it helping you improve?

I'm eager to find ways to be a more transparent person at work. I want to eliminate "politics" and "games" where possible and for work to be Wysiwyg.

You mentioned https://about.gitlab.com/handbook/ceo/#flaws

I hoped that people would use the sentences I proposed on that page but that never happened.

What is helpful is that when people raise a concern I can recognize it more quickly and show them it is clearly my flaw. This doesn’t happen often but it happened last week.

If you don't mind me asking, why is this conversation open to comments from non-employees? Having discussions be publicly viewable seems valuable, but letting anyone at all participate seems disruptive and unhelpful (as an outside party, I was having trouble following the thread of employee discussion interrupted as it was by internet furor).

If an issue is public everyone can comment on it until it is locked. I don't think there is another setting.

Ot: "In an effort to improve our user['s] experience..."

Wait, am I to understand that this law says I cannot boycott doing business with businesses located in Israel?

I am in the US, so can not say, "I disagree with how the Israeli government is treating Palestine and thus don't want to do business with any entity located there."?

If you're in the US, you can decide to do that. The law restricts your business with foreign entities that might engage in a boycott. The nuances of what might trigger these regulations are not always straightforward (look at https://www.bis.doc.gov/index.php/enforcement/oac/7-enforcem...) but normally you just have to avoid "bad words" in contracts, RFQs, etc.

I would note my understanding is that fines for non-compliance have historically been relatively light and therefore, to my knowledge, these regulations have not been seriously tested in court in recent times. (And the article I read suggested there was a causal link between those two facts.)

Yeah, I also can't quite reconcile that.

I have a hard time believing that the government could do this but the way I read it says that if I said:

As a business, I disagree with the human rights violations the government of China is engaged in. I am again Saudis Arabia's ban of alcohol on its residents, its treatment of gay people--including death for simply being gay and the way it withholds rights from women. I also deplore Israel's treatment of the Palestinians, including the demolishing of houses.

Therefore, I will not allow my product to be sold in a way which results in any of these governments collecting tax on it, this supporting the government.

The way this reads, it seems the government can say, "Whoa, you can't to that to Israel though." and ignore the other two. Unfair and prejudicial in my opinion.

They'll simply accuse you of being an anti-Semite ;-)

Yeah, even if I have plenty of Jewish customers in the rest of the world. What if I am Jewish?

> Wait, am I to understand that this law says I cannot boycott doing business with businesses located in Israel?

No.

That link the parent commenter shared is a very good overview: it basically means that your company will not receive special corporate tax consideration if your company:

Enters agreements to refuse or actually refuses to do business with or in Israel or with blacklisted companies.

Enters agreements to discriminate or actually discriminates against other persons based on race, religion, sex, national origin or nationality.

Enters agreements to furnish or actually furnishes information about business relationships with or in Israel or with blacklisted companies.

Enters agreements to furnish or actually furnishes of information about the race, religion, sex, or national origin of another person.

(e.g. “hey [anti-Semitic company], this competing businessperson is a Jew, if you were wondering”)

In any of these cases, there are exceptions and matters of interpretation.

Whether or not you think this is appropriate for the government, it's not as simple as “you can't engage in a boycott as a matter of personal conscience”.

>your company will not receive special corporate tax consideration if your company:

>Enters agreements to refuse or actually refuses to do business with or in Israel

The link does actually include the penalties, which are far more than just losing special tax considerations. It includes hefty fines and even imprisonment under the TRA. The "just losing tax consideration" part is only under the EAR. I understand that part.

It's the fact that they say I cannot boycott Israel independently.

I'm still confused at how this can be fully Constitutional. Say I care a lot about the Palestinians and object to their treatment by the government and military of Israel. Say I make widgets wholesale for people to resell retail.

So I say, if you buy my product and resell it you make money and your government takes some of that money, as is normal. Therefore, I will not sell to any company that sells this in Israel as I do not want to my product to be used to make money for a government whose actions I condemn. I don't care if you are a Jew, a Christian, an Arab and/or even a Palestinian, if you want to sell my product in Israel and taxes which go to the Israeli government will be collected on that, I'm not selling it to you. Not just certain companies within Israel, all of them. Anyone who sells my product and thus makes money for the Israel government, nope, I'm not doing it.

That's the part I have a problem with. If I don't actively try to stop Israel from doing anything but want to take an active role in not helping them in any way, I'm breaking the law? I don't see if how I want to act independently the Arab League but what I want to do aligns with part of what they want to do, that is a problem? I should be able to not support what I see as a bad actor.

Honestly, I also do not understand their wording on that. Getting on board with foreign boycott is not ok that much is clear, but exercising your freedom of affiliation as a company is fine as long as it doesn't contradict US foreign policies. So if you don't want to contradict those you shouldn't boycott them if you don't your gov deciding that your decision is not independent. I mean you never know, but stranger things have happened. Just because of that I generally advise foreign entrepreneurs to think hundreds of times over before they go ahead to open their offices in US.

I also learned a lot and some of the employees made great points.

I’m wondering, can the US government legally issue a National Security Letter to an individual employee that forces them to comply and spy for them?

If they can, does this also mean the employee has no legal recourse since NSLs must be kept secret?

Arguably all of this has already happened, with the Lavabit case.

> can the US government legally issue a National Security Letter to an individual employee that forces them to comply and spy for them?

I don’t have a link I can share at the moment to prove this (I’ll update this comment if I find one), but at least in the case of an employee with a security clearance, it is my understanding they can be forced to comply with a US Government order without the ability to inform anyone at their employer (including corporate legal staff). I’m not clear if this order would have to come as an NSL or via another channel.

> If they can, does this also mean the employee has no legal recourse since NSLs must be kept secret?

No, because that would be unconstitutional. But the proceedings of objecting to a NSL similarly must be kept secret. There wouldn't be any point to the secret component of a NSL if the recipient could object and hash out the merits of the request in public court records.

So how would anyone ever know that the objection was 1) heard, and 2) upheld?

Welcome to the wonderfully paradoxical task of organizing and controlling secret services and jurisdictions in an otherwise democratic state.

Most countries do it by subordinating secret agencies to a military division of sorts, wherein martial courts and security access is already structural. Others choose a more 'civilian' approach subordinated to a parallel chain of command within the citizen government/legislation/judiciary — closer to police, interior dpt / homeland security, etc. (in such cases, army intelligence is usually quite distinct from civilian surveillance).

Which approach is favored historically by a country typically depends on pre-existing constitutional models and principles — notably how the army features relatively to the ultimate civilian chain of command, and how the latter is accountable to the (sovereign) public in the event of treason.

None of this applies in authoritarian regimes where the ruling caste or figure(s) usually answer to no principle (no courts for them, only 'advisors' for they sit above the law) and secret service is almost always directly answering to them, as part of the active coercion of the people (fear of the "enemy within", etc).

I used to work for a company that had a public Jira bug tracker (security related bugs were hidden). I imagine a lot of customers had the same feeling you had: listing all bugs in a release, their status, the discussion around them, it was all there. Very transparent and very appreciated.

Unfortunately, like most good things in corporate software, it didn't last.

Red Hat has a public Bugzilla with (almost) all the open bugs in their software.

Public for their paying customers. Which is fair enough, but it’s also nothing particularly unusual.

Source: am a former RHEL customer now using Fedora

It used to be open for most things. Doesn't seem to be that way for at least the last 6 months or so (may more).

Indeed, thanks GitLab for being so open about your bigotry. I wonder what would happen if GitLab started excluding say Israeli nationals, because a large number of companies that sell 0-days for profit are based there, I suspect that accusations of antisemitism would pour in from all corners & rightfully so, but since demonizing China has been cool since the USSR's collapse & Russia rejoined the club it never really left in the eyes of Americans, it's all good.

Disgraceful. GitLab was once an inspiration to me in terms of its openness & culture, but the recent moves around tracking and now this, make it clear that GitLab has been around for too long to stay a hero.

> it never really left in the eyes of Americans

Nice bigotry in a post complaining about bigotry.

Except when you look at Hollywood production, U.S TV news etc. that's exactly what you get. The Red Scare was a real thing, so was Russiagate. The anti-Chinese sentiment is very much real in the U.S. too, if the campaign rhetoric, current trade policies & the constant stream of accusations from newspapers of record are to be any indication.

Maybe I could have worded it better, but I am referring to American culture and the mindset that when you think 'anti-hero', it's going to be a Russian/Chinese most of the time.

From the website:

> forbidden from … Agreements to discriminate or actual discrimination against other persons based on race, religion, sex, national origin or nationality.

So, to be clear - GitLab can merrily discriminate against Chinese citizens of the US on national origin by themselves, but are breaking the law if they do the same under a joint venture with a non-US entity.

Bonkers.

Check out the concept of "open startup": https://hackernoon.com/what-does-it-mean-to-be-an-open-start...

I'm shocked that they'd extend it to their lawyers. This thread (and the one the other day about telemetry and the GDPR) are a plaintiff and/or prosecutor's dream.

One of the hardest parts of most white collar prosecutions is proving that an action was taken "knowingly and willfully". Unlike other areas of criminal law, most white collar offenses require prosecutors to prove that not only did the person know they were doing the things they were doing, they had to know they were illegal.

Having the party's own lawyer offering legal advice outside the scope of privileged communication is normally windfall enough. Having them do it publicly and in the media's eye is just insane.

On the other hand, the discussion threads actually show that they have no idea what they are doing.

It's a good question what one could prosecute out of that and what to gain. There are so many open angles and I don't think there is any precedent with a fully opened company.

If we are so transparent about everything, can we know the name of that customer?

Reply on news.ycombinator.com