Ask HN: A contractor published all my private code publicly. What would you do?

Sorry to hear that has happened, seen similar things a few times over the years. FWIW -- my advice is based on having worked with India firms and individual freelancers since 1998 in various capacities, overwhelmingly positive experiences but not all.

In general you got it removed quickly, which is critical and really awesome. I'd push the company in India to refund some of your fees (or not bill for anything outstanding) and affirm that they are dealing with the situation and have them guarantee (in writing) that this will not reoccur and that all code has been removed from their and their employees equipment. Reputable India contracting firms do not want the bad look either so they generally will deal with it quickly and make sure it doesn't happen again.

Personally, I'd be really cautious on going super public and shaming them at this point because you have to understand that your chances of recourse with an India based company and individual are nearly zero. Creating a lot of noise posting their names and stuff could cause them to retaliate and put the code up for good in many places not just GitHub. GitHub you'd have a good chance of a DMCA type takedown since it is your property, but they'll just post it in 30 other places that won't recognize such requests.

You also have to understand the courts in India are SLOW and won't favor a western company over one of their companies/citizens, with a few exceptions. If you were a large corp, e.g. GE, Fiserv, Microsoft etc then things are different -- plus most of those have in Country subsidiaries to try and control IP etc. If you took them to court in the US (based on how your contract is setup) the US courts may rule in your favor but they have no way to enforce a ruling against them overseas, so great you get a judgement but your code is still published.

If they publish again to GitHub, absolutely send a takedown request and document the details. Otherwise, my 2 cents is to just move on and be thankful you got it down quickly.

That's awesome feedback. I think I'll ask to get a refund on the latest bill. They are not the biggest contracting firm, but I'm sure they value their reputation and this is a "low" price to pay for their mistake. Thanks for your comment.

Another reason not to raise a public fuss is if you intend to do future business in India. It can come across as your word against theres, and nobody watching the fight really would know who is right. Then you might have future trouble with getting good work out of an Indian contractor.

It might be worth even being forthright with the manager in a tough convo when asking for your money back along these lines, depending on your level of trust, desire for a future relationship.

Indian contractors always associated to me with mediocrity bordering with fraud.

You get what you paying.

Quite often indian "consultant" is a middleman (or few) doing nothing but frontending the cheapest guy in town to do something just enough to not getting fired.

Chasing them or thrashing them is unproductive. You're not be seeing a dime.

They'll change their name by lunch time and will screw the next sucker.

Unfortunately, I think you are 100% right. I thought they could help with easy-to-do tasks which they were competent enough to do, but not only they failed with this, now this happens. This is not just incopetency, like you said, this is fraud by all means.

Exactly this is what one expects of these offshoring companies. This consultant makes $400 per month or $2.27 per hour, while his company makes off of him $4800 per month or $27.72 per hour, assuming this company is paying $30 per hour.

You should go after the consulting company instead, no that poor contractor, because they are the chief cause of this kind of behavior.

Of course, many people say that this is how big law firms, accounting firms, etc work even in the states.

Yes, you are right. In fact, the github username that published the code is not the same as the one that was working for us. So it's clearly on the consulting firm to blame and not the developer in particular

First off, recognize that it wasn't the "firm" that did this, it was an individual developer. It never should have happened, but people love to blame the big corporation, and they do need to take responsibility for the actions of their employees, but you should thank the manager for taking down the code so quickly. That puts you on the right footing with the manager. Things went wrong, you've taken the first step of action, now what's next.

Let them show you that they are a respectable company. They don't want you bad mouthing them. If they don't play ball, then you can take out a stick and see how far it will get you, but I'd start by asking them what other actions they've taken to ensure the security of your IP, etc etc. Act as if you've assumed they've done it and if they haven't, then you can have an open discussion about what you think should happen.

You can take it as an opportunity to also help them make sure something similar doesn't happen to future customers. You don't want them out of business, just this contract didn't work out.

Maybe you are right and I'm making wrong assumptions. The reason I make them is that the github account that published it is not the same as the one that worked for us. In fact, the repo was created by another account and the code was actually published to the repo by a different one, but all from the same contracting firm. It just difficult not to think badly about all this

Don't misunderstand me. It is BAD! I'm thinking more about how you approach it with them. They took down the repo, so they don't have their heads completely up their *s, but having a go at the manager won't help. He did the right thing to correct the wrong thing. Working WITH him to ensure it was removed correctly, and getting him on your side is all I am suggesting.

You changed the keys, right? (I didn't see it mentioned)

yes, did that instantly

1. Speak to them to understand circumstances. There could be an explanation. 2. Feels like you’re angling for compensation - that doesn’t feel right 3. If this is malicious the code may have been posted elsewhere - I’d check in other public repos like GitLab - ask for assurance from him/them 4. This should be 1. But change your keys

1. I will do so today. 2. It felt like the only positive thing I could get of this, but maybe it's selfish? 3. Right, I should check that for sure, thanks. 4. Did that immediately when it happened, thanks

Move on. It doesn’t sound as if there is any damage to your income or reputation. Focus on moving forward not looking behind.

Yes, but the fact that nothing happened yet doesn't mean it can't happen, right? If they have the code, they can potentially replicate it / sell it. It's not a fun place to be.

You are right though, most likely, I can just move forward and forget about all this

Don't overthink this hypothetical scenario. When/if it happens you should be able to prove you're the original owner of the code and make sure any product based on stolen code in taken down.

Rather spend your brainpower on making the product better. Steer the product towards a future where this code leak is irrelevant because the product moved forward so much. Leverage this negative experience to make sure you'll remain the customers' preferred choice even if they can get today's version for free.

Product is so much more than the code. You have assets which you may not yet see as such:

- mistakes made and learned from. These can also come in form of code in the automated test suite.

- machinery around the product: cash flows, relationships between people involved (inside the team, and with customers)

- market insights

Genuine question, how do you figure out if a competitors product is based on stolen code?

Depends on how much effort they put in to conceal it and the type of product. There is no universal way to figure this out.

Yep you are absolutely right. Software is only a small part of running a successful business.

Reporting the Github accounts won't hurt. It will let Github admins look for a pattern of abuse and maybe block future leaks.

Did you log (screenshot) the infringement with a name? Can you trace that name back to your ex-employee? You have a copyright infringement case if so. However, you need to show or posit losses due to it. It is difficult and possibly expensive. If you have solid evidence, I would trash their name all over the internet.

I do have screenshots and "solid" evidence that the account is from a developer from the same consulting firm, but I think it's a very hard case to defend.

I agree that trashing their name all over the internet is the easiest, but I don't think a lot of people will see it and I won't get anything in return other than (some) immediate satisfaction. The positive side is that at least for the few that might see it, I'm warning them of the dangers of trusting third parties...