Hacker News Reader

Comment by 3pt14159 | Hacker News Reader

I've done some travelling to risky places before (Kiev and other places) and even though the networks were hostile there, I still don't understand the point of pretending that Russia et al can't get into Gitlab whenever they want to. They can. Air-gapping isn't going to slow them down.

View on HN

> I still don't understand the point of pretending that Russia et al can't get into Gitlab whenever they want to

Security isn’t absolute, it’s layered. The harder you make it for the adversary, the more it costs the adversary (eg: potentially burning a zero day), and the more chance there is of detection.

Can Russian intelligence get into Gitlab? Probably. Are measures that make it more expensive liable to deter them? I think so.

> They can. Air-gapping isn't going to slow them down.

Two points here. First of all, failing to acheive absolute security is not a justification for ignoring best practices.

Second, this isn't air gapping. It is preventing a bugged laptop from sitting in on conference calls and meetings for the next year or two until it gets aged out.

As the subject of this thread also points out, there's an important factor of risk to the individual: to prevent them from getting put in a position where they can be coerced into turning over data access.

Or just bribing people in “allowed” countries.

I think it would probably be costly to bribe someone in the "allowed" countries. I'm not going to risk going to prison for some small sum of money, and a large sum of money is logistically difficult to give me. People will ask questions, the scheme will probably be found out.

Meanwhile, if the government can just arrest you and say "change this repository and you go free", it's essentially free.

Reply on news.ycombinator.com