> The only real downside is data control (ie - the company has less control over how a developer manages assets like source code). I've worked in a remote, sec

> The only real downside is data control (ie - the company has less control over how a developer manages assets like source code). I've worked in a remote, secured development environment and it sucked, but to their credit the company did it for exactly this reason - control over the source. But bear in mind that source control is a two-way street. Losing proprietary source can be harmful (especially in compiled languages where the source might carry much more information than the distributable). But they were mostly worried about the opposite way...that something malicious gets INTO the source which could pose an existential threat. You'd be correct to say "well that should be the domain of source control, peer review etc", but in this case the company assessed the risk high enough to do both.