0

I am presently the only software developer at my company. A while ago, our company hired another company to rewrite one of our FoxPro apps that used a MySQL database backend into a PHP/MySQL based web system using the same database that would run from our local intranet. They were given information including a schema diagram, a PRD, use cases, and a very detailed explanation of how passwords are stored in our database and how to properly test if a login succeeded or not.

I was tasked with getting it up and running on our own IIS web server after they had it up and running on their website. I was given information including a phpinfo() page that described the PHP version and all the extensions that this company used to develop this application, so I set up our web server and PHP installation to have all the same pertinent settings and extensions.

After installing it, there were a number of issues with the product including:

  1. The login system did not follow our encryption scheme properly and nobody was able to log in. I had to patch code in three different classes for it to work properly. I do not have access to actually push changes to the repository, only fetch them, so I emailed the company the corrected PHP files. After I submitted files to the company that contained the correct login code, further updates pushed still did not include the corrections, and I had to patch them again.
  2. There are various settings that a user should be able to edit and then press Submit to commit the changes to the database, many of these will do absolutely nothing after pressing Submit, others will appear to commit the changes, but when the page is refreshed, they are lost, yet others will produce PHP errors when pressed.
  3. Some of the changes that this product required to be made to the database schema broke other applications that I had to recompile.
  4. Most (I would say about 95%) of the comments in the PHP source code are from the authors of the framework, not the company that designed the application. This means that while I am able to understand what the framework itself does (this is a moot point anyway since it has documentation online), the code written by the company is not easy for me to understand.

The app works properly on this company's test/development web server, and this has given my company the impression that it "should be" working out of the box on ours. I considered that maybe I had made mistakes installing the requisite software on our server but:

  • The framework that this company used to design this app is explicitly stated to work with our PHP version
  • I have installed other freely available PHP/MySQL-based web apps including WordPress, phpBB and MediaWiki on our web server to test this, and all of them work just fine.

Since the company I work for is not a software development company, and very few staff have much knowledge of computer science, I'm concerned that blame might fall on me for "not setting it up properly". I am also concerned that if management grows a bizarrely misplaced sense of confidence in this company they will hire them for further projects, and the work of having to clean up after them will continue to fall on me. I also think it's ridiculous that I have to patch an application composed of tens of thousands of lines of code that I've never seen before, written specifically for us, with adequate knowledge of how our system works, just to get it to the point that it's even usable on our system, and that it's beyond the extent of my responsibility as a software developer. What should I do?

closed as too broad by The Wandering Dev Manager, Chris E, mcknz, JasonJ, gnat Nov 22 '16 at 21:41

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 9
    TL;DR - You should knock this down to about 25% of its size to include only the relevant facts and send it to your boss. – brhans Nov 22 '16 at 17:05
  • What communication are you having with this 3rd party? All you say is that you fix code and expect them to implement it. Are you having regular conversations about the issues? – user41891 Nov 22 '16 at 17:30
  • 1
    What is a RPD? The common slang I am finding is Pre-Rolled Doobie. – paparazzo Nov 22 '16 at 17:34
  • @Paparazzi Product Requirements Document – Govind Parmar Nov 22 '16 at 17:35
  • 6
    Congratulations. Your company has fallen into all the traps in the book of "ask other people to build software fos us". You have my sympathy, there is likely no good, painless way to salvage this. – Erik Nov 22 '16 at 17:58
17

You need to produce an acceptance report.

You gave them specific requirements. You need to map out, one by one, which requirements were met, and which ones were not.

You need to categorize each failed requirement by its impact.

  • Breaks functionality (what functionality is lost)
  • Breaks security (and the impact that would have to the business and to its customers)
  • Breaks data schema - what steps had to be taken to mitigate.

You need to provide a very dispassionate, pass/fail report with impact analysis on each one. Submit it to the company and copy your management.

If you just "tell them in the hallway," then you're not going to be taken seriously.

  • 2
    It's also on the OP if proper requirements were not agreed upon before the project was outsourced to these guys. You can't cry foul after failing to establish proper expectations. – AndreiROM Nov 22 '16 at 17:09
  • 1
    @AndreiROM They were given a PRD – Govind Parmar Nov 22 '16 at 17:18
  • 3
    Definitely do exactly this. No need to make any fuss about it, just deliver the cut and dry report exactly as described here. Any time you deal with this company, and the deliverables are not exemplary, be sure to include it in the report. If the next time they deliver something, it's absolutely perfect, file a similar report detailing that all of the requirements were met, so that it doesn't look like you're filing the report just to complain. Make the report a visibility mechanism for management, and if this company isn't doing good work, they'll see it. – Dogs Nov 22 '16 at 17:30
  • 1
    I do want to put out that likely it didn't actually work in their test environment either, but that the screen made it look as if it worked. You said that it appeared to save records but they were basically only cached not in the database. Likely their testers did not know that. Or teh database links are hardcoded to their test database which coudl be why it doesn't work on yours. Very few people are good at actually testing data. However, it works on our machine is not good enough, it has to work on yours. – HLGEM Nov 22 '16 at 20:06
1

I think your greatest need is for clarity, especially on the subject of who within your company is responsible for accepting or rejecting the outsourced result.

Here is one way to look at it. Outsourcing a development project consists of 5 phases:

  1. Select the outsourcing partner.

  2. Create the functional specification. This is extremely important to get right and requires some experience with waterfall methods.

  3. Obtain acceptance of functional specification from outsourcing partner.

  4. Obtain and test finished work from outsourcing partner. This is often iterative but all the iterations fall within this phase. You can only test against the functional specification you provided in step 2, which is why it was so important to get that right.

  5. Accept finished work so payment may be released to outsourcing partner.

Each of these phases must have a responsible person to sign it off, and the phase is completed when that person says it is.

It sounds to me like you are working on step 4 without a specific mandate nor sufficient authority to reject the work. If someone else has the mandate for step 4 then clearly he is not doing his job.

So Wesley Long is correct, but before you submit the report you should clarify who has the authority to accept the product.

-1

I think you should just work the issues and not worry about being blamed. Sounds like you are competent and doing the right things.

First put issues in a report. Include bugs and deployment issues. Be very clear you have to apply patches to get it running. Make sure your boss know what a patch is. Go to your boss with the issues and ask for advise on how to manage the problem.

Not the answer you're looking for? Browse other questions tagged or ask your own question.