79

We are a small team of developers working on a web app. I answer directly to the company directors, who are responsible for hiring decisions. As a cost saving measure, new developers are often hired from countries such as India, Nigeria and Nepal.

Due to the potential difficulties in legally pursuing someone from such countries, the directors are unwilling to give these new developers access to the codebase, even with a watertight NDA.

This comes from the belief that they have spent £x thousand on development costs so far (where x is a big number), and they do not want someone to be able to take the thing they have spent so much money on.

This leaves me with the difficult problem of "How can I make the developers produce any useful work, without being able to steal the codebase".

If someone is invested enough, if they can see the codebase, they can steal it. We have been down routes of working on remote virtual machines, where the ability to copy-paste is limited etc, but even then, they could take a photograph on their mobile phone and type it up themselves. (I agree this is extreme, but I want to explore their request as much as possible).

I'm therefore left with the problem "How can I make the developers produce any useful work, without being able to see the codebase". Which seems like a nonsense statement. How could this possibly be satisfied?

When I explain this to the directors, I am often met with "well how do Microsoft stop people stealing their code?". Which I'll admit is a question I don't really know the answer to, but I suspect it is something to do with not hiring people who would be difficult to legally pursue.

My question is therefore:

  • How can I satisfy their request (is there something I have missed?)

OR

  • How can I explain that the request is unsatisfiable
Improve this question
1
  • 1
    Comments are not for extended discussion; this conversation has been moved to chat.
    – Kilisi
    Commented Apr 8, 2022 at 23:34

10 Answers 10

Reset to default
18

You have had a few answers to the first question; how to do it. I wanted to suggest an answer on the second line: how to persuade them it cannot be done.

There is of course a slight frame challenge. It can be done. What I would suggest is preparing a few scenarios with estimates of the associated costs and risks. This entire conversation exists because your boss believes that the expected or perhaps worst plausible case cost of the approach is lower than the alternative.

As such, your best option is to speak the same language. Don't say "this is impossible." but say instead "I have prepared a rough plan for implementing this scheme. <insert one of the other excellent answers about tooling, modularisation, and vetting.> however I do have to let you know that

  • licensing relevant additional software would cost X
  • we would have to hire D additional devs who we can trust to handle the vetting and integration, at salary plus overheads. We would have to hire Q additional QAs to handle the additional integration load.
  • the productivity of the remote devs working under these constraints would be y percent of normal, corresponding to an effective increased staffing cost of Y
  • it is likely that this would harm morale, corresponding to increased turnover and hiring costs of W. In particular A probably wouldn't stand for it, and it would be quite hard to find someone of a similar calibre who would.
  • even with all this in hand, we would only make it about 3 times harder for a bad guy to walk away with our code, and only about 1.5 times harder for them to insert malware, which would cost X in legal risk and reputational damage.

Meanwhile getting the same development throughput with a trusted foreign remote team would cost this (including the higher risk costs), and doing it with a domestic team would cost that (including the higher base salary costs)"

Improve this answer
1
  • 3
    You could perhaps frame this in terms of a "cost-benefit analysis", or "total cost of ownership", for each of several options. As pointed out in other comments, this could also include a frame challenge of exactly what the cost would be if a developer did steal the source code - how much of a material advantage would that source code actually give a competitor?
    – IMSoP
    Commented Apr 9, 2022 at 17:57
288

Due to the potential difficulties in legally pursuing someone from such countries, the directors are unwilling to give these new developers access to the codebase, even with a watertight NDA.

If this is their feeling, they should stop hiring developers from such countries.

Improve this answer
16
  • 18
    This does not answer the question.
    – Evorlor
    Commented Apr 7, 2022 at 16:29
  • 235
    This does answer the question.
    – stopkillinggames.com
    Commented Apr 7, 2022 at 16:42
  • 31
    Unfortunately this is the answer. If you cannot trust the people you hire, don't hire them. Or, if you trust the people, but not the laws or legal system to which they are subject, then don't hire those people (unless they move to a more favorable jurisdiction where they are subject to laws that are enforced).
    – Greg Burghardt
    Commented Apr 7, 2022 at 19:09
  • 15
    -1 While this is an answer, it is a typical knee-jerk SE one-line answer. There are plenty of good, positive ways to work around the issue and still keep this part of the workforce in a project (e.g. see 520...Monica...'s answer; or if this is indeed "the" answer, a bit more than one sentence would be in order, i.e. an explanation of why that one line is the only possible action.
    – AnoE
    Commented Apr 8, 2022 at 10:27
  • 9
    @Matthew, IMO this is an example where the SE voting mechanism simple fails hard. OP is crystal clear that he is not in the place to decide whether to hire people from such people. He is between the hammer and the rock. He asks how to make it work, or how to explain to management that it's impossible (the latter of which is always incredibly hard). These are non-trivial, valid questions, and we're helping OP in no way whatsoever with a one-liner that doesn't remotely target his question.
    – AnoE
    Commented Apr 8, 2022 at 15:48
152

Modularize your application and give people access only to the components they are working on.

If your application is split into several different bits with developers only having access to what they are working on, you can then set your exported workforce to working on non-sensitive bits of the program (and vet their work with code reviews before merging!)

As for "well, how does Microsoft stop people stealing their code?":

  • Microsoft is a company with a worldwide presence and a lot of influence everywhere. They can pursue people everywhere. Even if the government in question doesn't feel like playing ball, Microsoft can either shut down their pirate copies if they have them or play hardball when it comes to contract negotiations if they don't. Remember, pretty much everyone uses Microsoft Windows and Microsoft Office in some critical capacity.
  • Microsoft has freaking Harvard and MIT graduates making their code, they don't outsource for cheap labour.
  • Microsoft pays really freaking well. There is no way you'd catch them giving security-sensitive work to someone who can be bribed with $500, because they all make more than that in a week.
  • Microsoft modularises their codebases for their most critical products. So does Apple.
  • Even with all that, Microsoft does suffer major leaks. Source
Improve this answer
18
  • 33
    And finally... the leaks kind of don't matter, in any practical way. Even if you got the whole source code of MS Office... so what? What does that give you, that you wouldn't already get by buying (or pirating) Office?
    – Luaan
    Commented Apr 7, 2022 at 12:26
  • 5
    @Luaan There might be interesting libraries that a malicious user might want to use for their own app. And in the case of OP, it's a web app, so buying/pirating the service wouldn't be an option, but running their own instance / clone once they have the source would be. Having the source also makes it easier to search for and exploit vulnerabilities in the application. [not saying that OPs boss is justified in their actions, but imho there might be some practical implications to leaked source]
    – tim
    Commented Apr 7, 2022 at 12:39
  • 22
    Though I fear that the company in question is unlikely to be able to modularize the codebase without a rewrite--just a guess based on their extreme focus on low cost development... That said this is a great answer.
    – bob
    Commented Apr 7, 2022 at 13:11
  • 8
    ...this starts to sound like how the Funniest Joke in the World is managed.
    – J...
    Commented Apr 7, 2022 at 14:24
  • 12
    Although MS does modularize, it's worth noting that they make their "source code viewable within Microsoft" and don't restrict access based on responsibilites
    – lights0123
    Commented Apr 8, 2022 at 2:24
27

Stop hiring individual developers from such countries. Microsoft, Amazon, Google, etc. do not do that (with minor exceptions for exceptional reasons.)

They offshore by hiring companies that do such projects, so that they can have a contractual arrangement with them, and have legal recourse against them should they misbehave.

Of course, that means that they only hire such companies where those contractual arrangements are respected and the legal recourse is available and sufficiently compensatory...

Improve this answer
2
  • This is the correct answer. It's not going to be as cheap as hiring your own offshore developers. But this is the correct answer.
    – Stephan Branczyk
    Commented Apr 9, 2022 at 1:54
  • 1
    And even if those companies might be hard to reach legally if they misbehaved, if they have been in business for a long time, then they had built up trust, and they'd care about their reputation. This is how trade was done even in ancient times, where there was even less chance to prosecute people living in other jurisdictions than yours.
    – Val
    Commented Apr 9, 2022 at 20:57
17

Modularization, unit tests and continuous integration.

Very often there is a core part of a product and interfaces which are work to do but in itself don't provide much value to anything but this product.

Set up an continuous integration server which pulls the developers new code, builds it together with the confidential code and provides the result either as a service, performs tests or a virtual desktop infrastructure access where somebody could do usability tests.

Improve this answer
13
  • 20
    @LouisIrwin: What? Your Main Codebase is tangled with UI Style information?
    – Sascha
    Commented Apr 6, 2022 at 22:47
  • 38
    @LouisIrwin wait, so your boss is afraid of them stealing HTML/CSS/JS code that will be sent anyway to the users when they open your web app to draw the UI on their screen or am i missing something?
    – John Doe
    Commented Apr 7, 2022 at 13:35
  • 17
    I don't see how unit tests or continuous integration have anything to do with the question at hand.
    – JamesFaix
    Commented Apr 7, 2022 at 13:43
  • 27
    @LouisIrwin it sounds like the correct answer is to tell management that their code base isn't nearly as valuable as they think it is
    – Esther
    Commented Apr 7, 2022 at 14:32
  • 25
    "the directors still see the entire codebase as valuable because they have spent so much money on developers salary making it" - your directors obviously flunked Econ 101. The value of a product has nothing to do with how expensive the inputs were. If I set a highly paid professional to make mud pies all day long, that would cost me thousands of $$$, but the mud pies would still not be valuable. No, I'm not suggesting you tell your directors that... I just hope they bring other qualities to the table than their business acumen...
    – Stephan Kolassa
    Commented Apr 7, 2022 at 15:31
8

What do you really have to protect against?

If you want to protect against somebody copying the whole code base (+scripts and other tools needed to deploy it) a remote-desktop solution where the developers only work on company servers over e.g. VNC could be sufficient. Of course you can still copy&paste text from files or take screenshots, but it would be horribly slow. If you supply some necessary tools/parts in binary format only they’d also be almost impossible to copy this way but the developers could still use and execute them just fine. The disadvantage with this approach is that developers need (fast) internet access to your servers where the VNC session is running.

As others have already answered, another approach is compartmentalization. Only give access to parts of the project. This can create a lot of permission management overhead and can make developers less effective if they can’t see code which is related to their work. If you have some kind of super secret algorithm you really want to protect this is pretty much the only way.

Improve this answer
2
  • 2
    " Of course you can still copy&paste text from files or take screenshots, but it would be horribly slow." Not really. With some tinkering, it should be relatively easy to automate the extraction of code from a series of screenshots or video. Heck, we're talking about explicitly heap to contract labor - so the effort of even manually transcribing would be fairly minimal. It's far faster to copy code than it is to write code.
    – NPSF3000
    Commented Apr 8, 2022 at 3:31
  • You expect to give people access to compilers on at least somewhat internet-connected machines and think they can't find ways around your blocks. I can't imagine being that optimistic.
    – Joshua
    Commented Apr 8, 2022 at 21:17
6

how do Microsoft stop people stealing their code?

Microsoft has successfully open sourced a lot of their projects.

Your company can, too.

And much like Microsoft, you can assist the more successful remote developers with a work visa and relocation so that they would be under the same legal framework as all other regular employees.

Improve this answer
3

I'll assume that ensuring that these off-shore developers are productive is part of your responsibility.

If so, then the usual solution in this type of case is to be the gatekeeper of all information shared with these developers so that they only have access to the bits of your codebase that they need to complete their work assignments.

It's going to be your job to break down work into independent parts that do not require a broad knowledge of the system's source code. You may need to write specifications for APIs and the like so they know what to code against.

Yes, this is certainly a less than ideal situation but it's not at all uncommon both with off-shore developers as well as on-site contractors. Both are basically treated as short-term workers who are available to perform specific tasks and then either move on to another assignment or are given another independent bit of work if they continue with their current assignment with your company.

Yes, this is a lot of extra work for you but clearly this is the business model that your company management believes is best for them at this time.

Improve this answer
3

"well how do Microsoft stop people stealing their code?"

Not successfully

https://appleinsider.com/articles/22/03/22/hackers-allegedly-leak-37gb-of-microsoft-source-code https://thehackernews.com/2020/09/windows-xp-source-code.html
https://www.techpowerup.com/267517/original-xbox-windows-nt-3-5-source-code-leaks-online

But that isn't really the question is it? While I agree with Joe's reply and 520 already hints at this, I want to give answer to how to actually do it.

Even though what your directors are asking for is a little bit silly, it still is good to have an answer for them so the decision is up to them.

The answer is: Software Architecture

While this is not the place to go into details (better ask on Software Engineering SE for that), you can build software in a way that new functionality can be developed with only having to know small parts of the code base and defined APIs.

The short version is:

  • Apply open/closed principle, that allows new code written by extending the code-base with new code rather than modifying existing
  • Ensure separation of concerns so that a developer only has to touch their own teams code.
  • Have clearly defined and documented APIs that allow interaction between modules without knowing their internals.

To get there your organisation will have to hire one or more decent architects, a team of very senior core developers and technical writers to develop your software's core APIs.
This will be expensive, but then extensions can be done at scale and outsourced to developers you only have to trust with the code they are writing themselves.

You probably would have to think about quality assurance as well, if you already are hiring developers you don't trust, but that is not really asked here.

Improve this answer
1

IMHO, it depends on technology you are using

One of the options could be is to compartmentalize any expensive IP work in to assemblies or API`s, accessible only by interface.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .