Hacker News Reader

Comment by zwayhowder | Hacker News Reader

It does block them from moving to that country. So if a current employee was planning to move to either country soon they'd be prevented from doing that.

I've danced this dance at a previous company when we had an employee working from a country of interest for an extended period of time. They were air-gapped from our systems and it worked because they submitted everything by pull requests (the original way, sending git patches by email). They didn't have access to our CRM or any customer systems because several of our contracts - not just with governments but also major multinationals - prevented employees in certain countries from having access.

Even when I traveled to the same country I used a burner laptop that was decommissioned when I returned. When we EOL'd laptops in the office they'd go in the burner pile to have one last holiday abroad before they were wiped again and sent to a local charity.

View on HN

I've done some travelling to risky places before (Kiev and other places) and even though the networks were hostile there, I still don't understand the point of pretending that Russia et al can't get into Gitlab whenever they want to. They can. Air-gapping isn't going to slow them down.

> I still don't understand the point of pretending that Russia et al can't get into Gitlab whenever they want to

Security isn’t absolute, it’s layered. The harder you make it for the adversary, the more it costs the adversary (eg: potentially burning a zero day), and the more chance there is of detection.

Can Russian intelligence get into Gitlab? Probably. Are measures that make it more expensive liable to deter them? I think so.

> They can. Air-gapping isn't going to slow them down.

Two points here. First of all, failing to acheive absolute security is not a justification for ignoring best practices.

Second, this isn't air gapping. It is preventing a bugged laptop from sitting in on conference calls and meetings for the next year or two until it gets aged out.

As the subject of this thread also points out, there's an important factor of risk to the individual: to prevent them from getting put in a position where they can be coerced into turning over data access.

Or just bribing people in “allowed” countries.

I think it would probably be costly to bribe someone in the "allowed" countries. I'm not going to risk going to prison for some small sum of money, and a large sum of money is logistically difficult to give me. People will ask questions, the scheme will probably be found out.

Meanwhile, if the government can just arrest you and say "change this repository and you go free", it's essentially free.

All the people who are saying they've never seen a contract with a term like this, I'm just sitting here wondering how my experience is the opposite...

Or into affected roles.

So, someone in, say, QA or documentation, looking to head into SRE or Support, would be unable to if they presently reside in China or Russia.

> they'd be prevented from doing that.

Their employment being dependent on them residing within specific locales is not the same as "prevention". It's an incentive scheme, afaik.

Reply on news.ycombinator.com