62

I've had a technical interview with one person (software development) and I don't usually request for code samples. Reasons aside, this one person offered to show me code that they've been doing for their current employer.

Should I accept? Could I keep a copy?

Here are the reasons why I think I shouldn't:

  • It is another company's property
  • I don't yet have any legal arrangement with this interviewee or their company
  • Even if I didn't ask, there's no proof of that, so I could not defend myself if i got into trouble

Here are the reasons why I think I should:

  • It is really valuable information, specifically when evaluating on code quality and cleanliness
  • They said it was fine, since they could always write it again
  • The most raw information I can receive from a candidate helps in validating my assessment with other evaluators

For context, I work in the US, but I was seeking for answers not giving legal advice, but rather is this is common/uncommon or advised/unadvised for companies to do.

13 Answers 13

134

No, you should not accept their offer, and you should absolutely pass on this candidate. This is horribly unprofessional and in the USA would widely be considered unethical.

Anyone willing to offer code from their current employer without properly explaining why they can do so is someone who clearly has a disregard for intellectual property. The reason they gave you is laughable.

You don't want that person at your company. Why would you expect them to treat your IP any better?

Why immediate no-hire

My answer ignores the "how to accept the code in a way that doesn't get you fired or in legal trouble" piece of the question, because it's irrelevant because you should not accept the code samples and not hire this candidate. It would also be very different if the candidate had a good explanation for why you could see the code (e.g., it was open sourced and available on GitHub).

But then you wouldn't be asking this question. You would have just clicked on their GitHub link.

If someone is interviewing for a software development position and doesn't make it 100% clear to me when volunteering to provide proprietary code why it's permissible, I don't want them on my team.

Why should I trust this candidate with my company's code if we hire them?

Why should I even trust the candidate wrote the code they give me (another advantage of GitHub vs. proprietary)?

If I, as an interviewer, have to ask a candidate who tells me they would just "write it again" for me whether they have appropriate IP and license permissions to share that with me, it proves they don't have a proper professional understanding of how important this is. Part of being a professional software developer involves knowing and respecting this, particularly given how easy it is to copy an entire codebase.

I don't want that person working for my company.

  • 30
    unless, of course, the other employer has open sourced this code or already has an NDA in place specifically around this project and that specifically allows this code to be shared – atk Oct 22 '16 at 17:06
  • 27
    @atk sure. But that would fall into "properly explaining" and this is what the OP said: "They said it was fine, since they could always write it again" – enderland Oct 22 '16 at 17:25
  • 18
    Maybe it's because I've had remarkably nice and patient managers, but if he's a junior developer, I think he should be given the benefit of the doubt. Don't accept the code, of course, but don't make the situation a deal-breaker, either. This is an opportunity to teach the candidate why what he suggested is a Bad Idea and see how he reacts. His follow-up reaction can then feed into your decision (not) to hire him. – Pedro Oct 23 '16 at 2:39
  • 4
    Depending on the person's experience, though, you may want to send them a note -- if they're fresh out of college, for example (and the previous employer was someone they interned with or did a co-op with) they might have no idea this is unethical. – Fund Monica's Lawsuit Oct 23 '16 at 3:22
  • 3
    How much of the boilerplate garbage code your employer owns is revolutionary to such an extent you would even care? The answer is bugger all. – Gusdor Oct 24 '16 at 10:26
65

Ask the candidate about the situation.

You actually don't know whether the candidate has been given permission to disclose this code. Rejecting them out of hand without knowing that is an overreaction.

Ask them explicitly if they have permission. You will presumably get one of these answers:

  1. Yes I have permission. With a plausible reason. It's up to you if you take them at their word. If it's clearly not critical to the company, and they have told you they have permission, you are not going to get into trouble.
  2. I didn't think about permissions. Remind them that all their work is confidential and any employer who hired them would expect code to be treated confidentiality, including you. Delete any copies of the code you have. Pursue or not, depending on if you think they have learned their lesson.
  3. I don't care about confidentiality. Instant reject. Don't forget to delete that code.

The one response you talked about was "It's fine, since I could always write it again." Your answer to that is going to be "Then write it again, and give me the new version."

  • 9
    In the US, IP is serious business, you wouldn't even want to engage with a candidate at this level, it is way too risky, not just for the interviewer, but also the company they work for. I was in a similar situation as an interviewer once, and best I understand it, the only correct response as the interviewer is to immediately and categorically decline such an offer and notify the hiring manager of what transpired (the hiring manager can then follow up with the legal department if deemed necessary). – njuffa Oct 22 '16 at 19:38
  • 7
    @djechlin I see no way of making a determination of the legal status of some code in the course of a 45-minute interview, and it would be way too risky to simply believe the assertions of the interviewee. Depending on what business you are in, it may be risky even to study a piece of open source code, if it is under a viral license like GPL. – njuffa Oct 22 '16 at 19:53
  • 19
    ""Then write it again, and give me the new version." - Select all, Copy, Paste, delete a few comments, done that! You have no way to know that the candidate actually "wrote it again". You don't even know if the candidate wrote the first version you were offered - anyone at his/her current employer might have written it. – alephzero Oct 22 '16 at 21:23
  • 1
    @Paparazzi If a piece of code is trivial enough, it might not fall under copyright or patent restrictions; and, a trivial piece of code would also be useless for evaluating a candidate. – employee-X Oct 23 '16 at 3:56
  • 1
    @MarcStober "Risky" may have been too strong a word, "potentially problematic" may be better. It may be best to avoid any possibility of "subconscious copying" to ensure "independent creation" of your works. – njuffa Oct 23 '16 at 14:30
15

Sharing code with an interviewer is a blatant violation of the Software Engineering Code of Ethics and Professional Practice:

2.05. Keep private any confidential information gained in their professional work, where such confidentiality is consistent with the public interest and consistent with the law.

From your question, I'm guessing that the candidate did not get permission to share the code. Code is owned by the employer, and confidential, unless stated otherwise; so, in this case, this is unethical behavior and you absolutely not accept the code. In fact, dismiss the candidate immediately.

Edit: To clarify, the ACM's SE Code of Ethics is not law. It is a simple set of guidelines as to the "do's and don'ts" of our industry. However, many universities and employers are adopting the code as our standard set of ethical guidelines, making sure that students and employees are aware of the code, and follow its practices. E.g. in my computer science degree, I've had at least 4 significant projects involving the SE Code. Many employers in my area also test candidates with ethical questions during interviews, expecting them to have knowledge of the SE Code and to employ it in their responses.


Aside:

You mention that you want to be able to gauge a candidate's ability to write code, assess its quality an cleanliness, etc., right? Well, have them do some simple programming task that requires a bit more thought that the typical FizzBuzz questions (which are designed to weed out non-programmers, or incompetent programmers).

Personally, I would aim for a question about describing a real world system in code, and not some complex algorithmic "mathy" question, but of course what you ask is dependent on your industry.

  • 1
    Thanks for the feedback. Yes, having a programming exerceise is something I'm debating myself -- but that's probably for another question. Great stuff bringing up the Code of Ethics -- I think most of us found out it exists with your answer. – Alpha Oct 24 '16 at 22:39
  • It would only be a violation if it is confidential information, which assumes facts not in evidence. – David Conrad Oct 25 '16 at 10:34
  • I have to wonder - what percentage of programmers in the real world are even aware of this stunningly verbose document of the ACM's, much less feel the need for it? Or even the ACM itself for that matter. Not that I disagree with the noble intent... – mickeyf_supports_Monica Oct 25 '16 at 12:13
  • @mickeyf Many universities (at least in the US) are making ethics a part of the curriculum for a computer science degree. I think it's a good idea to have a set of ethical guidelines for our industry, just as many others do. It helps clarify what our responsibilities are to ourselves, our employer(s) and the public. – Chris Cirefice Oct 25 '16 at 12:44
  • 1
    Spreading the word and trying to get a code adopted is one thing (the need for a de facto written code of ethics in software engineering is beyond the scope of this discussion) but citing it as an answer to a question is only valid if the code already has established authority in the group within which it's being cited. You can't invoke the rules before the rules have been agreed - it's meaningless. – Ant P Oct 25 '16 at 14:07
10

I would decline the candidate's offer of his employers code AND I would further notify the candidate that he is no longer under consideration for employment with the firm.

Whatever code from his employer he is offering for inspection, rest assured that at some point in the future when he'll be looking for another job, he will do to you what he is doing to his current employer.

Of course, the picture gets worse for your candidate if your candidate signed on an NDA with his current employer because now, he is in possible violation of that NDA. Again, rest assured that if he is willing to violate his current employer's NDA, there is nothing to stop him for doing the same to you when at some time in the future, he is interviewing with his next prospective employer.

If you need to evaluate your candidates' programming capabilities, review their Githubs and/or give that candidate a take-home project of your devising. Then have the candidate review their code with you.

  • This seems harsh but I do think its the right answer; informing them why is a courtesy that they will hopefully learn from in the future but I do think it is a serious enough issue that I'd struggle to trust such a candidate with our own code base. There's the obvious "Oh but it's open source" get-out and that might mean I wouldn't go in all guns blazing from the start when talking to them about this, but that's about as far as I'd go. – Rob Moir Oct 23 '16 at 13:22
  • 1
    @Rob Moir - I wouldn't take somebody's word "It's Open Source" at face value. What if it were your code that this candidate is unilaterally declaring as Open Source? If it's truly Open Source, then it should be in a public Github repository for all to see including their current employer. Having an employee who has zero understanding of Open Source licenses declaring part of your code as Open Source - that's an existential threat to your code base. See the terms of GPL v2, for example.Under the terms of the GPL v2 license,if you include any GPL v2 code in your app, then your app is Open Source – Vietnhi Phuvan Oct 23 '16 at 13:42
  • Believe me, Vietnhi, I share your concerns and wouldn't take their claim at face value; it would just buy them a chance to explain themselves before I consigned them to the trash pile but it would need to be a good explanation that was backed up by more than just fast talking. – Rob Moir Oct 23 '16 at 14:05
  • I amazes me that programmers say this stuff at the same time as other interviewees are asking "if the company I'm interviewing at wants my facebook username and password should I supply them". Yes, saying in an interview that you will disregard confidentiality agreements is a bad idea! And if a candidate does that you should not hire them. – Móż Oct 24 '16 at 22:34
  • @VietnhiPhuvan Open source existed long before Github was created. – David Conrad Oct 25 '16 at 10:35
9

The easiest way to think about it is: slightly modify the situation. Imagine if they wanted you to sign an Non-Disclosure Agreement before showing you the code. But you had never expected to look at their code. Would you sign? No. You would want the company lawyers to look at the NDA first. The NDA doesn't just apply to you, it can apply to your entire company. You don't want that responsibility.

You have no idea if the interviewee has the right to that code. You have no idea if it owned by another company (one of their customers), if it a company secret, or even worse owned by the government.

I would politely decline the offer to see the code. I would also make sure that I highlighted in my notes that they offered, and I said no.

I would discuss this issue with my managers and others doing the interviews. It might even be seen as a negative in our evaluation of the candidate.

  • Upvote for recommending to (1) document, in writing, what transpired (2) notify the hiring manager right away. The likely outcome (in my experience) is that the hiring manager will cancel the rest of the scheduled interviews and dismiss the candidate. – njuffa Oct 22 '16 at 20:30
4

Everyone is addressing the issue of the company's permission to release this information, but I think one aspect of the issue being overlooked is this:

Is the data proprietary in nature?

Is the code being offered proprietary in nature? Is it a library written that solves a general ubiquitous problem or serves as a common cog in many systems that does not give the recipient of that code any real advantage over or unique ability compete with this employer? For example, is the code he is offering a library of mathematical functions that enable a language that does not include built in trigonometric functionality to do trigonometric operations and nothing else? If so, I really don't see how this in any way harms the IP of the employer, in fact I think things like that should be released publicly on GitHub. On the other hand, if this code is a key part of a proprietary system that reveals the schema and mechanism of any internal workflow, internal financial data, or functionality of the company's applications, then this is a problem. Again though, if he is simply revealing something that solves non-proprietary problems ubiquitous to the coding community, then I would be inclined to say it is no harm - no foul.

Still it would be courteous to ask before sharing.

  • 2
    It may be no harm caused (in fact I suspect it would be no real harm caused even if proprietary). However it this case, it demonstrates a kind of lazy attitude. The candidate could consider writing some code specifically to share, but instead is willing to take an easier route that may or may not have moral concerns attached. Some might call that pragmatism, or in this answer's case not being "courteous", but as an employer dealing with any potential employee working with IP, I think concerns go beyond that. – Neil Slater Oct 23 '16 at 7:06
  • yes! thank you. very little code is actually proprietary information. mostly it is just code. – Rostol Oct 25 '16 at 1:28
  • 1
    The purpose/use of the code is irrelevant if it doesn't belong to him. He may have written the code, but that doesn't mean he owns it and is free to share it. – Chris Schneider Oct 25 '16 at 14:39
  • All the code I write for work is proprietary in nature. – HLGEM Oct 25 '16 at 17:42
3

The situation is fishy but I agree it's better not to jump to conclusions before you have to (as an interviewer you might just have to). Showing you a screenshot of code demonstrates a different color of judgment than dumping you a repo. I'm less interested in ethics of any action a candidate took and more in judgment and thought process that led to said actions, which can permit some wiggle room, some of the time. But this?

They said it was fine, since they could always write it again.

Did this actually happen? Translation: "I own everything I wrote and don't bother trying to convince me otherwise. I either don't know about basic business ethics and laws or I just don't care." I would hard-pass on this candidate.

  • Thanks for putting my thoughts in words. Yes, that was off putting. – Alpha Oct 22 '16 at 19:52
  • @Alpha thanks. enderland's answer was pretty comprehensive but I thought the way that line jumped out to me was particularly telling. – user42272 Oct 22 '16 at 20:13
  • Sounds more like a "this is highly general-purpose and non-specific code that has no intrinsic link to my current role and could have been written by me or by anyone else at any time in the same form" argument to me – Lightness Races with Monica Oct 24 '16 at 0:55
  • @LightnessRacesinOrbit that's a great example of an opinion that isn't relevant to whether a developer owns something they wrote. For instance you could maybe use that opinion to convince the company to license the code e.g. as open source. – user42272 Oct 24 '16 at 4:59
  • 4
    @Alpha honestly the more I think about this it really just sounds like ignorance. At some point in my life I learned that what the interviewee did is wrong. I definitely didn't learn it in kindergarten or during my non-business, non-engineering college major. Is it really that surprising if the interviewee's boss didn't explain this? If I were loose with my ethics, that would imply I understand them well enough to know this might off put a future employer. Not saying "hire," just trying to figure out what to make of this candidate. – user42272 Oct 24 '16 at 5:05
2

Its okay, if he is just giving an idea as per his work. That is the only way to represent yourself in any interview. You explain your past experiences and solutions.

I cant imagine that someone keeping exact code with him in any interview. Or if he has or providning thorugh email then what is the gaurantee that he has written that code. May be by this he is trying to grab an opportunity. Simply throw him out with respect :D

2

No. And No.

But...

We don't know yet the experience level of the interviewee.

In many fields, especially those that are creative in nature, a 'portfolio' of previous work is required, and not bringing it to an interview is enough reason for no hire.

A resume/CV/developer story is cool, but doesn't tell as much as the exact logos that were created in the graphic design gig, or the short story you had published, or a video of a lecture you presented. It can even be code/software you create for a class or on your own time. And an internet search for "interview portfolio" finds some passionate views that such a portfolio is a good idea.

Say this is their second job out of college, they got their first job with a portfolio, and a respected mentor/professor/parent not in software engineering told them they always needed a portfolio for any interview. Mentioning it without actually bringing in and handing over the proprietary code may actually be a step in the right direction, and indicative that they understand intellectual property generally, but don't know how to handle the specifics yet.

If this position is very junior, that is not necessarily a problem, and actually could be used by the interviewer to see how they treat new information (in a field they aren't familiar with, law) that contradicts respected authority. That requires an experienced and motivated interviewer though, in order to polish diamonds. An interviewer that takes the time to pose a question here about a specific case may just be that interviewer.

On the other hand, if this is their 5th job, 10+ years in the field, and cavalierly throw around intellectual property, I'm not sure you could turn that around.

1

First before you can answer the "is common/uncommon or advised/unadvised" you have to answer another question.

Does the candidate have the right to distribute the code?

If they do then this is common and advisable. Some examples of where the developer would have this right:

  • Open Source Project
  • Agreements with companies for existing IP the developer wrote on his own time.
  • Agreements with previous employers to use part of a code base when looking for new work.

As a freelancer, I do "work for hire" which means the code I write is the property of the person that pays for it. That said, I commonly make arrangements to open source, or retain rights to, parts of my work. A good example is a modification I made to active merchant to add a card processor. I spoke with the company, and with their permission, open sourced those modules and added them back into Active Merchant. If someone asked me for a code sample, I could provide that work with no need to get new permissions.

I also keep agreements with clients to be able to talk about and share parts of their code with perspective employers.

It's very bad to assume the developer does not have permission to share the code in question. They very well may have all the permission they need.

If they do not have permission to share the code in question, then you should just pass on the candidate. It's usually illegal (IANAL) and certainly unprofessional to share code when you don't have permission to.

Establishing permission to share code, at this level is easy. Just ask. You don't need any fancy paper work, or long legal stuff. Just ask the candidate. Your not going to use the code in your projects/software so there is no real risk there. They (the candidate) are on the hook for sharing, your not, so long as your not asking them to provide that specific piece of code. (Remember IANAL)

1

For a more practical reason to say "no": If you have a good system for evaluating candidates, you shouldn't be using extra material from one candidate that you wouldn't ordinarily look at from other candidates.

That said I'm going to disagree slightly with some of the other people who answered here, in that if it's a minimal amount of code, not specific to the previous business, it's not such a big deal in the whole scheme of the discussion that goes on during an interview and which, necessarily, will touch on what a candidate did for a previous employer. Relying on Open Source contributions or making a candidate write sample code just for you has its own issues because that's making them doing unpaid work and might not be a good example of they work they'd do on the job.

1

No, you should not look at the code sample. It doesn't really help in the interview decision because you cannot be sure of the following:

  1. Did he write it?
  2. How long did it take?
  3. How much help from the internet did he get?

None of these questions can be definitively answered in an interview.

Now, present white board and give a technical challenge to solve in code. That way you can see how he thinks about code, does he know the language? Or rely on intelisense? You can add constraints and see how flexibly he thinks.

All of these help you decide how much support this person would need to do the role you are trying to fill.

  • I think this is good advice but it doesn't directly address the question that was asked – Brad Thomas Oct 24 '16 at 21:49
  • 2
    I disagree. Having code and explaining it will allow him to talk of design decisions that he already knows about, so if I don't get a good explanation out of that, I know I can weed him out. A new problem might be challenging, ambiguous, or way to easy, or not fit for the length of an interview (which should not abuse the interviewee's time). Yes, I won't know who and how it was written exactly, but the discussion about will tell me that. – Alpha Oct 24 '16 at 22:46
0

I would just ignore any future communications with this person. It's highly unethical and probably illegal what they're suggesting and I would see no need to engage in any further dialogue with them. Their email address would go straight to my spam filters.

I wouldn't bother informing them or anything else. I don't have a productive reason to. I already have all the information I need about them.

  • 1
    If the interviewer has time to ask on SE about a specific case of a specific interview, they probably have time to write a rejection email. Not saying everyone needs to, and not saying @Kilisi should make the time. But I would. And I expressed that disagreement with a downvote. – CWilson Oct 25 '16 at 14:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.