Source code protection best pratices to collaborate with freelancers

Question

I'm working on a social media site and I'm the only engineer but now I need to hire people to get things going faster and I'm worried about the source code.

How should I go about protecting the source code, I thought of obfuscating the source code and make documentation, I thought of making an external API, I also thought I to not doing anything and just trusting the people I'm hiring.

I'm going to hire freelancers and since they won't be working in the same office as I am, I'm interested to see what are the best practices.

Any help is appreciated!

Edit: I'm using Git as my source control system

Answer 1

Get a source control system running.

Answer 2

You can't. The freelancers will need the code to work on it. The best you can do is provide them only with the minimum amount of code they need.

Obviously if they leak it they would be breaking the law, but it would be difficult to prove in a court.

Answer 3

You've got two problems--the technical problem and the social problem. The social problem is generally approached by making anyone who works on the project sign an NDA. It doesn't guarantee anything, but at least it helps to make your intentions clear.

Edit (re: comments) As for the technical problem, a commercial distributed source control system like Code Coop might attend more to your secrecy concerns (in relation to open source solutions), but I've never used it, so I can't say for sure.

Another option is run your project through a "geographically distributed" company that does outsourced product development, like Art & Logic. I've never worked with them either, but from what I can tell, they run all their projects in a manner similar to what you're describing.

Answer 4

Most of the following is free, open-source software:

• Source Control - Set up (secure) source control; Subversion (SVN), CVS, Git, or what have you.

• Automated Build - Set up an automated build that runs (at least) nightly, and emails developers when a build break occurs (via email list server).

• Developer Wiki - Set up a (secure) Wiki for the developers to communicate technical stuff through.

Most importantly:

• If you're working with new developers/contractors, keep a very close eye on what each developer is producing until you've had enough time to feel comfortable with their working unmonitored. If you don't pay attention, you will end up with an unusable bird's nest of crap source code.

Other nice-to-haves

• Automated Unit Tests - Run as part of the scheduled build. There are unit test frameworks out there like JUnit, CppUnit, etc.

• Automated Documentation - Generated as part of the scheduled build, and available via (secured) http. JavaDoc and Doxygen are such generators.

• Bug Reporting/Tracking - Someplace for developers and testers to keep track of open issues. BugZilla is free. FogBugz is supposed to be awesome.

Answer 5

i have the same problems as yours.

1st i ask my development team if they know any freelancers (friends with any). Usually they tell me about the best and the most trusted because they know them.

2nd, choose freelancers that already worked on other projects, if someone trusted them before me, then i "may" be able to have a little trust in them.

3rd, divide the project as much as possible. try your best to distribute the task independently, in this way the freelancer will not have the complete project, he'll only have the parts he will be working on.

4th, don't inform a lancer about other freelancers working with you so they won't be able to combine their codes together and leak it.

Answer 6

They obviously need to code to work on. But maybe there is a possibility to protect against leaking of the code.

Have a branch for each freelancer and give each freelancer only read/write access to their respective branch. Don't give them access to anything else. Each branch should contain your trunk code, but with some unique changes per branch. This could be for example changing the names of some variables or functions. With this setup you might be able to trace back a leak to one branch.

You will have to be careful in setting up the separate branches with their unique changes, so that it is not visible in the history of those branches.

Answer 7

I say you trust the people working for you. If you don't trust that the freelancers will respect you and your code, you shouldn't be hiring them.

Answer 8

At one point you must make the decision to trust someone you do business with.