Outsourcing program development and retain privacy

Question

Hi,

we are a small company and implement medium size programs for our clients, mostly in C++. Sometimes we are running out of time and we think about outsourcing the development of some parts of our programs. We are able to pay up to 50$ per hour if the programmer worths it.

But the problem that we face, is that of privacy. I mean, we want to be sure that the developer only concentrates on his/her tasks (for instance, implement, test and debug a function which does something specific) and that he/she does not play later or sells this information, because sometimes he/she needs to have a look at the whole code of the program, and we have had bad experiences with this.

What would you do in this case? I mean, apart from signing a contract, etc, which in some of the cases is not possible (programmers do not want to, etc), how would you deal with this situation?

Some possible options would be to send compiled as objects all the parts that this programmer does not need to touch. Another would be to obfuscate the code, etc

Thanks

Answer 1

Make sure your contract restricts what the contractor can do with the source they have access to or other proprietary information they have access to. If you have employees, you have the same issues. Make sure a lawyer writes and/or reviews your contracts.

Answer 2

In many cases this is a design problem. If your code is reasonably decoupled and your requirements are well described you can let the outsider developers work against mocks/stubs. The problem is that having a clean, decoupled design, a well documented requirement, a set of unit tests and mocks/stubs requires a lot of time, a very scarce resource.

Answer 3

Thats what non-disclosure agreements are for. Some companies even make you sign one when you interview as in the interview they will have to reveal certain proprietary information to you in order to see if your a good fit.

Answer 4

I'd recommend reading the chapters regarding government coding standards in Snow Crash.

More seriously. It's always a concern that they'll retain or misuse your code. I know several developers who have retained copies of code they've worked on from several jobs past.

The best advice I'd have is to try to reduce their need to see the whole codebase or sensitive data. By having solid test data and clean APIs you can do a lot to limit this. And of course, as mentioned by the others, a good contract is essential.

I'd recommend being cautious of having a too strict contract though, as if it ever did go to court it could potentially be thrown out. So make sure it's not overreaching.