Question

The nature of our business often has 2-3 remote developers working on a single project (mostly Rails), and each one currently has carte blanche access to source so they can checkout, run, and develop locally.

The problem is any one of them could ship the whole base out the back door. Overseas legal action seems futile.

I’m guessing the best way would be separation of duty type of strategy where a contractor only gets specific portions of code – but how can they run and test the full project?

I’m looking for advice, strategies, or even software solutions to mitigate this risk.

Thanks a ton.

Answer 1

You should really allow only trusted people to handle your family jewels. I can’t think of any stronger sign of trust a software company can show than to give someone complete access to their source.

That being said, a few ideas come to mind.

• If they’re consultants, you should see if you can get some kind of business agreement with an entity in the remote country that can take care of local legal hassles for you. US companies with offices in India do this all the time.
• Perhaps you can give access to non-important pieces of the software to the untrusted parties and have them work only on that? The unit testing can be done by them on the pieces but the integ. tests that require the entire system have to be done by you.
• It might also be possible for them to use the ‘important’ parts of the code as a service from a server you provide rather than as modules locally. Admittedly, this requires some reengineering but it might be worth it.

The bottom line is what Stephen said. Low priced off-shore contractors come with certain liabilities. If you’re not willing to accept that, you’ll have to change your mode of working.