5 ms·

Ask HN: A contractor published all my private code publicly. What would you do?

I own a small company with 3 full time software developers on payroll and a contractor from India. This person has been helping for about 4 months now but we decided to end our relationship because there's a lack of experience so we are spending too much time reviewing and fixing. Minutes later, Mailchimp alerts us that our keys have been published publicly on Github, and we find a copy of all our propietary code just published on someone's account. We know this person is from a big consulting firm in india (aprox. 250 developers). We immediately informed the manager of the firm and minutes later the repo was deleted, but haven't had an opportunity to talk more to them (it's too late in India now). What would you do in this situation? I know that what they did is illegal (sharing propietary code from a private repository to the world). Is there any real way to compensate for what they did, or should I just assume they can do this without repercussion with every client they have? Things that come to mind: - Reporting their github accounts - Report their contractor accounts in different websites (UpWork etc)

robthebrew 5y ago
Did you log (screenshot) the infringement with a name? Can you trace that name back to your ex-employee? You have a copyright infringement case if so. However, you need to show or posit losses due to it. It is difficult and possibly expensive. If you have solid evidence, I would trash their name all over the internet.
- take_me_out_pls 5y ago
  I do have screenshots and "solid" evidence that the account is from a developer from the same consulting firm, but I think it's a very hard case to defend. I agree that trashing their name all over the internet is the easiest, but I don't think a lot of people will see it and I won't get anything in return other than (some) immediate satisfaction. The positive side is that at least for the few that might see it, I'm warning them of the dangers of trusting third parties...
Trias11 5y ago
Indian contractors always associated to me with mediocrity bordering with fraud. You get what you paying. Quite often indian "consultant" is a middleman (or few) doing nothing but frontending the cheapest guy in town to do something just enough to not getting fired. Chasing them or thrashing them is unproductive. You're not be seeing a dime. They'll change their name by lunch time and will screw the next sucker.
- take_me_out_pls 5y ago
  Unfortunately, I think you are 100% right. I thought they could help with easy-to-do tasks which they were competent enough to do, but not only they failed with this, now this happens. This is not just incopetency, like you said, this is fraud by all means.
- raincom 5y ago
  Exactly this is what one expects of these offshoring companies. This consultant makes $400 per month or $2.27 per hour, while his company makes off of him $4800 per month or $27.72 per hour, assuming this company is paying $30 per hour. You should go after the consulting company instead, no that poor contractor, because they are the chief cause of this kind of behavior. Of course, many people say that this is how big law firms, accounting firms, etc work even in the states.
  - take_me_out_pls 5y ago
    Yes, you are right. In fact, the github username that published the code is not the same as the one that was working for us. So it's clearly on the consulting firm to blame and not the developer in particular
sp332 5y ago
Reporting the Github accounts won't hurt. It will let Github admins look for a pattern of abuse and maybe block future leaks.
davismwfl 5y ago
Sorry to hear that has happened, seen similar things a few times over the years. FWIW -- my advice is based on having worked with India firms and individual freelancers since 1998 in various capacities, overwhelmingly positive experiences but not all. In general you got it removed quickly, which is critical and really awesome. I'd push the company in India to refund some of your fees (or not bill for anything outstanding) and affirm that they are dealing with the situation and have them guarantee (in writing) that this will not reoccur and that all code has been removed from their and their employees equipment. Reputable India contracting firms do not want the bad look either so they generally will deal with it quickly and make sure it doesn't happen again. Personally, I'd be really cautious on going super public and shaming them at this point because you have to understand that your chances of recourse with an India based company and individual are nearly zero. Creating a lot of noise posting their names and stuff could cause them to retaliate and put the code up for good in many places not just GitHub. GitHub you'd have a good chance of a DMCA type takedown since it is your property, but they'll just post it in 30 other places that won't recognize such requests. You also have to understand the courts in India are SLOW and won't favor a western company over one of their companies/citizens, with a few exceptions. If you were a large corp, e.g. GE, Fiserv, Microsoft etc then things are different -- plus most of those have in Country subsidiaries to try and control IP etc. If you took them to court in the US (based on how your contract is setup) the US courts may rule in your favor but they have no way to enforce a ruling against them overseas, so great you get a judgement but your code is still published. If they publish again to GitHub, absolutely send a takedown request and document the details. Otherwise, my 2 cents is to just move on and be thankful you got it down quickly.
- take_me_out_pls 5y ago
  That's awesome feedback. I think I'll ask to get a refund on the latest bill. They are not the biggest contracting firm, but I'm sure they value their reputation and this is a "low" price to pay for their mistake. Thanks for your comment.
- softwaredoug 5y ago
  Another reason not to raise a public fuss is if you intend to do future business in India. It can come across as your word against theres, and nobody watching the fight really would know who is right. Then you might have future trouble with getting good work out of an Indian contractor. It might be worth even being forthright with the manager in a tough convo when asking for your money back along these lines, depending on your level of trust, desire for a future relationship.
mbrodersen 5y ago
Move on. It doesn’t sound as if there is any damage to your income or reputation. Focus on moving forward not looking behind.
- take_me_out_pls 5y ago
  Yes, but the fact that nothing happened yet doesn't mean it can't happen, right? If they have the code, they can potentially replicate it / sell it. It's not a fun place to be. You are right though, most likely, I can just move forward and forget about all this
  - matjazdrolc 5y ago
    Don't overthink this hypothetical scenario. When/if it happens you should be able to prove you're the original owner of the code and make sure any product based on stolen code in taken down. Rather spend your brainpower on making the product better. Steer the product towards a future where this code leak is irrelevant because the product moved forward so much. Leverage this negative experience to make sure you'll remain the customers' preferred choice even if they can get today's version for free. Product is so much more than the code. You have assets which you may not yet see as such: - mistakes made and learned from. These can also come in form of code in the automated test suite. - machinery around the product: cash flows, relationships between people involved (inside the team, and with customers) - market insights
    - mbrodersen 5y ago
      Yep you are absolutely right. Software is only a small part of running a successful business.
    - Aditya_Garg 5y ago
      Genuine question, how do you figure out if a competitors product is based on stolen code?
      - matjazdrolc 5y ago
mikewarot 5y ago
You changed the keys, right? (I didn't see it mentioned)
- take_me_out_pls 5y ago
  yes, did that instantly
pedalpete 5y ago
First off, recognize that it wasn't the "firm" that did this, it was an individual developer. It never should have happened, but people love to blame the big corporation, and they do need to take responsibility for the actions of their employees, but you should thank the manager for taking down the code so quickly. That puts you on the right footing with the manager. Things went wrong, you've taken the first step of action, now what's next. Let them show you that they are a respectable company. They don't want you bad mouthing them. If they don't play ball, then you can take out a stick and see how far it will get you, but I'd start by asking them what other actions they've taken to ensure the security of your IP, etc etc. Act as if you've assumed they've done it and if they haven't, then you can have an open discussion about what you think should happen. You can take it as an opportunity to also help them make sure something similar doesn't happen to future customers. You don't want them out of business, just this contract didn't work out.
- take_me_out_pls 5y ago
  Maybe you are right and I'm making wrong assumptions. The reason I make them is that the github account that published it is not the same as the one that worked for us. In fact, the repo was created by another account and the code was actually published to the repo by a different one, but all from the same contracting firm. It just difficult not to think badly about all this
  - pedalpete 5y ago
    Don't misunderstand me. It is BAD! I'm thinking more about how you approach it with them. They took down the repo, so they don't have their heads completely up their *s, but having a go at the manager won't help. He did the right thing to correct the wrong thing. Working WITH him to ensure it was removed correctly, and getting him on your side is all I am suggesting.
aaronrobinson 5y ago
1. Speak to them to understand circumstances. There could be an explanation. 2. Feels like you’re angling for compensation - that doesn’t feel right 3. If this is malicious the code may have been posted elsewhere - I’d check in other public repos like GitLab - ask for assurance from him/them 4. This should be 1. But change your keys
- take_me_out_pls 5y ago
  1. I will do so today. 2. It felt like the only positive thing I could get of this, but maybe it's selfish? 3. Right, I should check that for sure, thanks. 4. Did that immediately when it happened, thanks
known 5y ago
Reminds me of Companies ruined or almost ruined by Indians https://archive.is/UpV1Y https://archive.is/UpV1Y

robthebrew 5y ago

Did you log (screenshot) the infringement with a name? Can you trace that name back to your ex-employee? You have a copyright infringement case if so. However, you need to show or posit losses due to it. It is difficult and possibly expensive. If you have solid evidence, I would trash their name all over the internet.

take_me_out_pls 5y ago
I do have screenshots and "solid" evidence that the account is from a developer from the same consulting firm, but I think it's a very hard case to defend. I agree that trashing their name all over the internet is the easiest, but I don't think a lot of people will see it and I won't get anything in return other than (some) immediate satisfaction. The positive side is that at least for the few that might see it, I'm warning them of the dangers of trusting third parties...

Trias11 5y ago

Indian contractors always associated to me with mediocrity bordering with fraud. You get what you paying. Quite often indian "consultant" is a middleman (or few) doing nothing but frontending the cheapest guy in town to do something just enough to not getting fired. Chasing them or thrashing them is unproductive. You're not be seeing a dime. They'll change their name by lunch time and will screw the next sucker.

take_me_out_pls 5y ago
Unfortunately, I think you are 100% right. I thought they could help with easy-to-do tasks which they were competent enough to do, but not only they failed with this, now this happens. This is not just incopetency, like you said, this is fraud by all means.
raincom 5y ago
Exactly this is what one expects of these offshoring companies. This consultant makes $400 per month or $2.27 per hour, while his company makes off of him $4800 per month or $27.72 per hour, assuming this company is paying $30 per hour. You should go after the consulting company instead, no that poor contractor, because they are the chief cause of this kind of behavior. Of course, many people say that this is how big law firms, accounting firms, etc work even in the states.
- take_me_out_pls 5y ago
  Yes, you are right. In fact, the github username that published the code is not the same as the one that was working for us. So it's clearly on the consulting firm to blame and not the developer in particular

sp332 5y ago

Reporting the Github accounts won't hurt. It will let Github admins look for a pattern of abuse and maybe block future leaks.

davismwfl 5y ago

Sorry to hear that has happened, seen similar things a few times over the years. FWIW -- my advice is based on having worked with India firms and individual freelancers since 1998 in various capacities, overwhelmingly positive experiences but not all. In general you got it removed quickly, which is critical and really awesome. I'd push the company in India to refund some of your fees (or not bill for anything outstanding) and affirm that they are dealing with the situation and have them guarantee (in writing) that this will not reoccur and that all code has been removed from their and their employees equipment. Reputable India contracting firms do not want the bad look either so they generally will deal with it quickly and make sure it doesn't happen again. Personally, I'd be really cautious on going super public and shaming them at this point because you have to understand that your chances of recourse with an India based company and individual are nearly zero. Creating a lot of noise posting their names and stuff could cause them to retaliate and put the code up for good in many places not just GitHub. GitHub you'd have a good chance of a DMCA type takedown since it is your property, but they'll just post it in 30 other places that won't recognize such requests. You also have to understand the courts in India are SLOW and won't favor a western company over one of their companies/citizens, with a few exceptions. If you were a large corp, e.g. GE, Fiserv, Microsoft etc then things are different -- plus most of those have in Country subsidiaries to try and control IP etc. If you took them to court in the US (based on how your contract is setup) the US courts may rule in your favor but they have no way to enforce a ruling against them overseas, so great you get a judgement but your code is still published. If they publish again to GitHub, absolutely send a takedown request and document the details. Otherwise, my 2 cents is to just move on and be thankful you got it down quickly.

take_me_out_pls 5y ago
That's awesome feedback. I think I'll ask to get a refund on the latest bill. They are not the biggest contracting firm, but I'm sure they value their reputation and this is a "low" price to pay for their mistake. Thanks for your comment.
softwaredoug 5y ago
Another reason not to raise a public fuss is if you intend to do future business in India. It can come across as your word against theres, and nobody watching the fight really would know who is right. Then you might have future trouble with getting good work out of an Indian contractor. It might be worth even being forthright with the manager in a tough convo when asking for your money back along these lines, depending on your level of trust, desire for a future relationship.

mbrodersen 5y ago

Move on. It doesn’t sound as if there is any damage to your income or reputation. Focus on moving forward not looking behind.

take_me_out_pls 5y ago
Yes, but the fact that nothing happened yet doesn't mean it can't happen, right? If they have the code, they can potentially replicate it / sell it. It's not a fun place to be. You are right though, most likely, I can just move forward and forget about all this
- matjazdrolc 5y ago
  Don't overthink this hypothetical scenario. When/if it happens you should be able to prove you're the original owner of the code and make sure any product based on stolen code in taken down. Rather spend your brainpower on making the product better. Steer the product towards a future where this code leak is irrelevant because the product moved forward so much. Leverage this negative experience to make sure you'll remain the customers' preferred choice even if they can get today's version for free. Product is so much more than the code. You have assets which you may not yet see as such: - mistakes made and learned from. These can also come in form of code in the automated test suite. - machinery around the product: cash flows, relationships between people involved (inside the team, and with customers) - market insights
  - mbrodersen 5y ago
    Yep you are absolutely right. Software is only a small part of running a successful business.
  - Aditya_Garg 5y ago
    Genuine question, how do you figure out if a competitors product is based on stolen code?
    - matjazdrolc 5y ago

mikewarot 5y ago

You changed the keys, right? (I didn't see it mentioned)

take_me_out_pls 5y ago
yes, did that instantly

pedalpete 5y ago

First off, recognize that it wasn't the "firm" that did this, it was an individual developer. It never should have happened, but people love to blame the big corporation, and they do need to take responsibility for the actions of their employees, but you should thank the manager for taking down the code so quickly. That puts you on the right footing with the manager. Things went wrong, you've taken the first step of action, now what's next. Let them show you that they are a respectable company. They don't want you bad mouthing them. If they don't play ball, then you can take out a stick and see how far it will get you, but I'd start by asking them what other actions they've taken to ensure the security of your IP, etc etc. Act as if you've assumed they've done it and if they haven't, then you can have an open discussion about what you think should happen. You can take it as an opportunity to also help them make sure something similar doesn't happen to future customers. You don't want them out of business, just this contract didn't work out.

take_me_out_pls 5y ago
Maybe you are right and I'm making wrong assumptions. The reason I make them is that the github account that published it is not the same as the one that worked for us. In fact, the repo was created by another account and the code was actually published to the repo by a different one, but all from the same contracting firm. It just difficult not to think badly about all this
- pedalpete 5y ago
  Don't misunderstand me. It is BAD! I'm thinking more about how you approach it with them. They took down the repo, so they don't have their heads completely up their *s, but having a go at the manager won't help. He did the right thing to correct the wrong thing. Working WITH him to ensure it was removed correctly, and getting him on your side is all I am suggesting.

aaronrobinson 5y ago

1. Speak to them to understand circumstances. There could be an explanation. 2. Feels like you’re angling for compensation - that doesn’t feel right 3. If this is malicious the code may have been posted elsewhere - I’d check in other public repos like GitLab - ask for assurance from him/them 4. This should be 1. But change your keys

take_me_out_pls 5y ago
1. I will do so today. 2. It felt like the only positive thing I could get of this, but maybe it's selfish? 3. Right, I should check that for sure, thanks. 4. Did that immediately when it happened, thanks

known 5y ago

Reminds me of Companies ruined or almost ruined by Indians https://archive.is/UpV1Y https://archive.is/UpV1Y