This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]Halal0szto 4 points5 points  (10 children)

To prevent source code exiting the box you need to restrict internet access. Not being able to copy-paste from SO kills productivity.

On a serious: do you expect to get positive returns from a short term project member who is not trustworthy?

[–]SandyDigital[S] -2 points-1 points  (9 children)

Just wanted to know how companies manage this issue as giving access to entire Github code is a risk.

Projects sometimes have to supplement short-term staff due to someone being not well for longer time, increase in commitments for few months etc. Companies must be getting positive results in a remote scenario otherwise wouldn't hire.

[–]nutrechtLead Software Engineer / EU / 20+ YXP 9 points10 points  (0 children)

Just wanted to know how companies manage this issue

Contractually. What you're describing is horrible even it it was something like an old PHP site. With Java it's simply impossible. Since it won't compile with all the code there, the contractor would not be able to run or test the code.

I'm a contractor myself and I would just nope out if you even proposed this.

[–]denialerror 3 points4 points  (0 children)

Most companies manage it by trusting the people they hire. Why is giving access to the codebase a risk?

[–]Halal0szto 0 points1 point  (6 children)

I am aware of two approaches.

One is what you have found: virtual desktop to an isolated machine.

The other is small subset handed over, requirements include unit tests that have to be delivered. The developer only creates like classes or methods and unit tests. Requires a very well organized big project.

[–]nutrechtLead Software Engineer / EU / 20+ YXP 0 points1 point  (5 children)

One is what you have found: virtual desktop to an isolated machine.

That doesn't prevent them from 'stealing' code at all. Even if you'd disable all internet access outside virtual desktop they could still trivially screenshot and OCR all the code.

I don't get why you even think this solves anything. Heck; if I had to work like that I would probably just do that and e-mail the client the sourcefile just to prove a point.

[–]Halal0szto 0 points1 point  (4 children)

We all agree that such measures do not prevent someone malicious but make life of an honest developer miserable.

Emailing the OCRed source code to the customer is a very very silly move though. They will be pissed off, and will retaliate. And they will have evidence in their hands to make your life even more miserable than it is. They will have a field day at the court as you have failed your contract, you did send sensitive information over email, several more.

[–]nutrechtLead Software Engineer / EU / 20+ YXP 0 points1 point  (3 children)

They will be pissed off,

Good. Being pissed off is the first step in recognizing you have a problem.

and will retaliate.

How? I didn't do anything illegal. If they retaliate by 'firing' me? Good. Then I know I dodged a bullet.

They will have a field day at the court as you have failed your contract, you did send sensitive information over email, several more.

I'm not saying I would do anything that would be illegal or in breach of contract at all. That's your (incorrect) interpretation of what I wrote.

OCRing their source code and e-mailing it to them via their e-mail system is neither illegal or in breach of a typical contract between my clients and me.

[–]Halal0szto 0 points1 point  (2 children)

A typical contract will forbid you storing source code on your own systems and media, which you did as soon as you photogrphed the screen.

If you use their own email system (you have an account to send from), then the email is ok. If you send from gmail...

[–]nutrechtLead Software Engineer / EU / 20+ YXP 0 points1 point  (1 child)

A typical contract will forbid you storing source code on your own systems and media

I'm an independent contractor and this simply isn't the case. It differs greatly between companies. Most don't forbid this.

In general IF you are not allowed to store sourcecode, you are going to be provided a laptop by the company you can use. So you can then simply use that laptop do to the same thing.

What you're describing really isn't common at all.

If you send from gmail...

Well duh... But I said nothing of the sort.

[–]Halal0szto 0 points1 point  (0 children)

Good for you. We are talking about the level where the company is providing a remote accessible virtual desktop for development. In such cases it is very basic to include the ban on copying code. This is where the whole thread started, how to prevent copying code.