Ask Slashdot: How To Work On Source Code Without Having the Source Code?

occamboy writes: Perhaps the ultimate conundrum!

I've taken over a software project in an extremely specialized area that needs remediation in months, so it'll be tough to build an internal team quickly enough. The good news is that there are outside software engineering groups that have exactly the right experience and good reputations. The bad news is that my management is worried about letting source code out of the building. Seems to me that unless I convince the suits otherwise, my options are to:

1) have all contractors work on our premises — a pain for everyone, and they might not want to do it at all

2) have them remote in to virtual desktops running on our premises — much of our software is sub-millisecond-response real-time systems on headless hardware, so they'll need to at least run executables locally, and giving access to executables but not sources seems like it will have challenges. And if the desktop environment goes down, more than a dozen people are frozen waiting for a fix. Also, I'd imagine that if a remote person really wanted the sources, they could video the sources as they scrolls by.

I'll bet there are n better ways to do this, and I'm hoping that there are some smart Slashdotters who'll let me know what they are; please help!

Comments

Re:You pretty much covered the options

[Tjp($)pjT]

I have done some forensics work in software. The most secure setup was a room with cameras, the computers in a locked box, PS/2 keyboard and mouse with attached cords that go into the locked box, VGA only monitor, and a printer filled with pre-numbered sheets of paper. I emptied all my electronics including watch, no calculator, no phone, etc. Allowed items were a pen/pencil and notepad. I was escorted into the room (roughly 1500 miles from my office) the paper was loaded by the escort. When I wanted to leave the room I pressed a buzzer button. The escort collected the printouts, and the paper supply. briefly looked to see if there were obvious missing pages. They can't see my notepad, and my instructions were to write small, though the cameras were not supposed to see the monitor or desk surface. After their side examined the pages I printed out, they allowed a lawyer to pick up the copies, as I had to review the printouts in the lawyers offices and not personally ever posses them. Under those conditions with a 10 hour work day (8 onsite, 2 writing up the days notes onto a computer at the hotel room) it is amazing how little code can be reviewed in a day. They did allow tools of our choice to be installed on the computers at their expense. And they installed the software versions we said were suspect in source form.

Under these conditions, if you forced them on developers, you'd be paying them what I was paid for forensic investigation, somewhere around $250-300 an hour if you want top quality people. And they will burnout in short order, so keep a queue filled with replacements. I could do that for only short bursts at a time.

Even then, I could have copied the code onto paper line by line. And in some cases did for short segments that showed infringement.

In even the harshest of conditions code can still leak. But your biggest weak point is if your network is not air gapped and you use source code control, keeping the social engineering aspect in check so you aren't hacked. For contractors and employees, only hire ones you trust and depend on NDAs and integrity. And a VPN that is appropriately encrypted is like working in the office. Supply the computers and you can install monitoring software on them, and USB management software to provide gentle no-no-no reminders as they try to work they way they normally would.