3 ms·
Isn't there a relatively easy way to solve this problem? As an employer, when you decide to hire someone to produce software for you, you assign them a private
by solatic 10y ago
Isn't there a relatively easy way to solve this problem?
As an employer, when you decide to hire someone to produce software for you, you assign them a private key tied to a certificate issued by the employer's certificate authority. The employer then has tooling which requires all commits to the employer's repositories to be signed with a certificate issued by the employer's certificate authority.
Then it's very simple: any code which has been signed by those certificates unambiguously belongs to the employer. Any code which has not been signed by those certificates does not belong to the employer.
Employers can demand that employees sign their work with these certificates in order to consider the work done, so employees who refuse to sign the work with those certificates risk giving up their salary for breach of contract. Employees are then free to sign whichever code they want on their free time, and assert ownership by virtue of it not being signed with their employer's certificate.
- walshemj 10y agoWhat is to stop an employee cloning his work and signing it with his key
- solatic 10y agoThere isn't, but remember, the whole point of signing something is to put it out there in the open. If an employee grabs older work, signs it with his personal-project key, and then tried to sue the employer for using code which belonged to him, then the employer could easily show a court the timestamps/logs which prove that the code was originally signed over to the employer and thus belonged to the employer under contract. And if the employee is secretly signing work with his own key over time before signing it with the employer's certificate, then his own record of ownership will be in parallel to the employer's record of ownership, thus proving that the work belongs to the employer under contract. The whole point is how to distinguish work that the employee is not signing over to the employer at all - because it's originally a personal project. Then the employer will have no record of the code being signed over to the employer, and the proof clearly shows the code belonging to the employee.
- walshemj 10y agoI meant they recreated the company's work (not physically copied)but signed it with there key