3 ms·

The only thing you can do is to be a good employer! Focus on relationships and if they want to go, let them, and ask they keep you in mind if the grass didn't t

The only thing you can do is to be a good employer! Focus on relationships and if they want to go, let them, and ask they keep you in mind if the grass didn't turn out to be greener on the other side of the fence. If someone is going to leak you're stuff, there's no tech in the world that can prevent a disgruntled person from wrecking you. So don't try, it's laughable, and it wrecks culture. Also: code is not valuable. The idea already exists in their head so they'd just rewrite it anyway. Data is valuable though, which is why there's extensive laws governing it.

gonzo41 6y ago
I came here to make your point about code not being valuable. Everyone can decompose features, your companies edge is you have those features in production. Even without a leak someone could beat you on features and price and you realize the same risk. Leaking pre-production IP is probably a bigger issue, and there's a bunch of laws around that.
- pmiller2 6y ago
  Exactly. I could easily download almost all of my company's code and send it wherever. But, nobody is going to be able to make any use of it, because they don't know how all of the various pieces (services) go together necessarily, and you'd probably still need a bare minimum of 50 engineers to run it (although that's just a guess). And, even if you did all of that, and replaced the very few things I'm not allowed to access with your own stuff, you still don't have my company's data, which is way, way, more valuable than the code. The moral here, I guess is that "code is not a company." Even if I handed you the code, you couldn't replicate the company I work for in any reasonable amount of time.
fbelzile 6y ago
Exactly. The technical controls required to prevent this will: 1) Degrade employer/employee trust 2) Decrease employee productivity Anything more than an NDA is probably overkill and is going to work against you as an employer.
II2II 6y ago
While I agree with the sentiment, the employee's tolerance of security measures will likely vary according to industry (at least it should). Finance and military applications have been brought up several times for good reason: there is the issue of protecting sensitive information of the client. That may extend to the code, or procedures that can be inferred from the code. In other industries, the sensitive information may only pertain to the employer itself. That's when relationships will be more important.
- sriku 6y ago
  This is the right attitude. In cases, information leak can lead to even loss of life (ex: healthcare) and "we're nice to our employees" cannot be a plan to protect this info when you're working with clients of that kind.
- exabrial 6y ago
  I don't think a defense industry CEO or HIPAA covered entity is asking on HN how to prevent leaks, but I've been wrong before.
throwaway235325 6y ago
Legit question and I'm sorry if this comes across as condescending. Do you know the difference between "you're" and "your"? I'm really asking. It's shocking to me that someone on Hacker News can make this kind of error.
- fbelzile 6y ago
  Everyone makes mistakes or is not a native English speaker.
- andybak 6y ago
  I'm often a grammer/spelling nazi and even I do it occasionally. Typing in haste, especially on a mobile device.
- pokot0 6y ago
  My story with mistakes like these: I am not a native English speaker but have lived in the US for about a decade. I used to feel the same about those mistakes and as someone who has learned english as a second language it was impossible for me to make such and many more similar mistakes in written english (while I was and still struggle with fluency and pronunciation). As the language became more natural to me, I started doing those mistakes myself. I think the culprit is in the way written and spoken english differ. In my native language, if I make up a word and speak it out loud to 100 people, there is a 99% chance that they all write it down exactly as I invented it. This is unthinkable in english and basically force your brain to learn two languages (spoken and written) and in spoken language "you're" and "your" are really not that different. If you write without focusing too much, you just write down spoken english. I don't know why I wrote this down! Just my experience.

gonzo41 6y ago

I came here to make your point about code not being valuable. Everyone can decompose features, your companies edge is you have those features in production. Even without a leak someone could beat you on features and price and you realize the same risk. Leaking pre-production IP is probably a bigger issue, and there's a bunch of laws around that.

pmiller2 6y ago
Exactly. I could easily download almost all of my company's code and send it wherever. But, nobody is going to be able to make any use of it, because they don't know how all of the various pieces (services) go together necessarily, and you'd probably still need a bare minimum of 50 engineers to run it (although that's just a guess). And, even if you did all of that, and replaced the very few things I'm not allowed to access with your own stuff, you still don't have my company's data, which is way, way, more valuable than the code. The moral here, I guess is that "code is not a company." Even if I handed you the code, you couldn't replicate the company I work for in any reasonable amount of time.

fbelzile 6y ago

Exactly. The technical controls required to prevent this will: 1) Degrade employer/employee trust 2) Decrease employee productivity Anything more than an NDA is probably overkill and is going to work against you as an employer.

II2II 6y ago

While I agree with the sentiment, the employee's tolerance of security measures will likely vary according to industry (at least it should). Finance and military applications have been brought up several times for good reason: there is the issue of protecting sensitive information of the client. That may extend to the code, or procedures that can be inferred from the code. In other industries, the sensitive information may only pertain to the employer itself. That's when relationships will be more important.

sriku 6y ago
This is the right attitude. In cases, information leak can lead to even loss of life (ex: healthcare) and "we're nice to our employees" cannot be a plan to protect this info when you're working with clients of that kind.
exabrial 6y ago
I don't think a defense industry CEO or HIPAA covered entity is asking on HN how to prevent leaks, but I've been wrong before.

throwaway235325 6y ago

Legit question and I'm sorry if this comes across as condescending. Do you know the difference between "you're" and "your"? I'm really asking. It's shocking to me that someone on Hacker News can make this kind of error.

fbelzile 6y ago
Everyone makes mistakes or is not a native English speaker.
andybak 6y ago
I'm often a grammer/spelling nazi and even I do it occasionally. Typing in haste, especially on a mobile device.
pokot0 6y ago
My story with mistakes like these: I am not a native English speaker but have lived in the US for about a decade. I used to feel the same about those mistakes and as someone who has learned english as a second language it was impossible for me to make such and many more similar mistakes in written english (while I was and still struggle with fluency and pronunciation). As the language became more natural to me, I started doing those mistakes myself. I think the culprit is in the way written and spoken english differ. In my native language, if I make up a word and speak it out loud to 100 people, there is a 99% chance that they all write it down exactly as I invented it. This is unthinkable in english and basically force your brain to learn two languages (spoken and written) and in spoken language "you're" and "your" are really not that different. If you write without focusing too much, you just write down spoken english. I don't know why I wrote this down! Just my experience.