Well, did gitlab forget how it explicitly said to not hire chinese or russian in fear of paranoid espionage concerns, that resulted in a hiring manager quitting gitlab? I wonder how it would do it people are mistreated in GitLab.
Ultimately gitlab has a duty of care to the customers whose code they host. If most of your customers are in the West, and there are persistent security and IP threats from certain national governments, I don't see an alternative here.
There is a lot more nuance than that, and the danger is more about well placed nationals who can be recruited than government trained spies.
This is what risk assesnments are for. The consequence of every piece of gitlab hosted code, much of it which runs on publically visible servers, falling into adveserial hands is catastrophic. A government may well make an offer too good to refuse.
On the otherhand, there are pleanty of other software jobs out there which pose minimal risk, and many companies demonstrably are more than willing to hire Russians or outsource to Russia.
I have to disagree with the idea that it's not a solution, governments refuse to hire foreign nationals all the time and even regulate the private sector through things like ITAR.
Now I agree it's an unfortunate solution in some respects. There are moral issues both utilitarian (1000 Einsteins) and idealistic (all humans are equal). There are also work arounds. For most purposes if you naturalize and renounce your previous citizenship you will legally be treated as a national. ITAR only requires a green card.
Arguing against discrimination in a security context though, when nationality is indeed a reliable discriminant, is difficult.
The threats you’ve mentioned usually come from Western governments. China is often accused, but attacks by US have actually been proven - numerous times. Same with backdoors.
AFAIR, they do hire Chinese and Russians; they just don't hire anyone residing in China or Russia. That's something the relocation policy is supposed to help with.
How does it help if you shd have worked for one year (well this can be waved). But you need to discuss with your manager so you need to be hired anyway.
Paranoid concerns? I mean the Russian conspiracy theories put forth by CIA-aligned agencies are often over the top, but China is indeed a dangerous communist dictatorship. It's not paranoia when it's true.
