0

Soon I will be hiring some freelancers to continue a project with me.

The project has been created with - Client: HTML, CSS, JavaScript, PHP - Server: C#.NET - Database: MySQL

Just as a security precaution I want to take steps to prevent theft of the code.

Is it possible to protect this, and if so what steps should I take?

Edit: these will be remote workers.

  • 1
    Do the remote workers know each other? If not, you could perhaps ensure that no one gets all the system code – morsor Mar 1 '17 at 11:20
  • I don't think they will know each other. – Terry Mar 1 '17 at 11:40
  • What about NDA? – Gypsy Spellweaver Mar 1 '17 at 18:13
  • Not about freelancing, might be more suitable for security.stackexchange.com – user3244085 Mar 2 '17 at 10:27
  • 1
    @user3244085 I think this question falls under the scope of freelancing; for example, NDAs are a valid answer to this question but NDAs aren't really a relevant topic at the security SE (as far as I know) – user45623 Mar 2 '17 at 21:41
6

Many years ago, I worked for a few years together with an experienced programmer. He told me that when he needed others to help him with software development, and he didn't want to reveal the code to them (so they couldn't at all copy, steal or resell the code or part of it), he used to give them precise tasks to do without letting them know the general project, in this way: "write a function (or library) that takes this input in this format [...], and that returns this output in this format [...]". They even didn't understand what was that about or for. But I don't know if that is suitable in your case.

1

There is very little you can do about a remote worker having the code they work on - unless you make them work in a remote desktop environment set up to prevent copy-pasting code to their actual location. (If that is even possible)

If your goal is to prevent someone reselling the entire product, you could split the work so no one ever has the complete picture. The downside will very probably be added workload due to miscommunication and problems tying everything together.

However, if the delivery essentially is a one-of-a-kind custom product that cannot be reused at another client without major rewriting, I would ignore the risk - because others just having that code doesn't take away business from you.

As a side note, the remote coders will hopefully learn new techniques during the project - and I personally believe they should be allowed to reuse such code later. After all, you are profiting from their past experiences.

1

On the legal side, you have your remote developers sign a non-disclosure agreement. A properly written NDA will prohibit them from stealing your code or disclosing it to others and will generally establish your right to sue them if they violate the NDA. You should consult a lawyer for this, but you might be able to find sample NDAs online to help you get started.

As far as physical prevention methods to make it impossible for them to steal the code, there isn't much you can do, although it can help to put different sections of the code in separate repositories (e.g. HTML in one repo, PHP in another repo) and only give each developer access to the section they're working on.

  • @terry Also important in general conditions with multiple developers, especially when working in isolation, as in remote, is clearly defined interfaces and standards. Having them in place before deploying the team will help in segmentation of the project to aide in protecting your code base from them as well. – Gypsy Spellweaver Mar 2 '17 at 3:04
0

It is indeed pretty difficult to prevent them from using the source code they have had access to.

As a minimum precaution state explicitly in the contract with them that they cannot use the code for other purposes and have to destroy any copies in the end. Even better to announce what the penalty would be in case of infringement.

If you are really paranoid, you can tag the code with discrete strings that encrypt your name, making sure that they end-up in the executables, to serve as evidence of hijacking.

0

Large financial firms use tools like Citrix to provide a desktop environment remotely. They configure Citrix to prevent copy/paste across the gap between client and server.

This enables workers to "see" their work, but not export it. Similarly, they block outgoing web requests, etc.

The reality is that you probably cannot do this - it is a stupefyingly difficult and cumbersome task, and requires pretty much a dedicated department.

If you're just trying to protect code that you wrote from being copied, your best bet is probably to break out your workers into silos, and break your code across multiple repositories: client, server, database, etc.

You can then unite the code during the build process, but restrict individual users to only accessing one or two repos.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.