Hacker News Reader

Comment by arthurcolle | Hacker News Reader

Pretty sure I heard on HN relatively recently that your contract with Google basically explicitly states that any code you write while you work there is considered theirs and they don't distinguish between personal and professional projects. I was surprised to hear this as well (so I'm not asserting that I know this for a fact) but the person who posted this was very explicit that it was true.

So if it is true, then maybe any software engineer that writes some interesting web app trinket who works for Google could have this happen to them. I'm sure the coder who made the above app will show up in these comments in the next couple hours or so lol.

EDIT: Omg it's the cartoonist guy!

View on HN

That's the default, not just in Google but it pretty much any US company (and probably elsewhere). If you think that's draconian, here's a very good explanation: https://www.joelonsoftware.com/2016/12/09/developers-side-pr...

A caveat is that, in California, you own your project provided that (1) you didn't use any company resource, (2) you didn't do it on work hours, and (3) your project is not related to anything that the company does. Of course, in case of Google, it does pretty much everything, which means Google can easily claim anything you do as its own. (IANAL, don't quote me on this.)

obviously you should read the contract before signing with $MEGACORP_THAT_PAYS_YOUR_BILLS, and I agree with (1) and (2) and (3) kinda sorta not really since it basically just implies you are a work machine, but it just seems so rife with the potential for abuse.

Thankfully I haven't heard of many other cases of this getting people in too much trouble other than Serge Aleynikov and his case with GS (and honestly, it was stupid of him to upload even open source code from work computer to a remote server).

I worked at GS and it was the most locked down development environment ever, so it wouldn't even be feasible/productive for you to "accidentally" work on side projects on these machines. Most security/audit trainings were around "Really - if you do this, you will instantly be teleported into the center of the nearest neutron star"

> Serge Aleynikov

IIRC, he saw some open source code used in Goldman Sachs, believed that they should be open (whether right or wrong, I don't know), and uploaded it public. Right? I remember HN discussion from years ago.

I don't think his story is related to developers' side projects. If you work for Company X and knowingly upload some of its internal repository to a public place, of course you're going to be fired. Would you expect anything else?

from my understanding it was more nuanced than that - the code was already open source but he then made some changes to the source and wanted to keep those changes. Obviously this is pretty bad too, but eventually all charges were dropped and this might have just been because how aggressive the plaintiffs and the FBI goons were in pursuing this guy, especially after considering the accusations of "stealing code" that is so dangerous it could manipulate the fabric of financial markets.

In any case, I just pulled up my GS NDA and I probably shouldn't comment any further.

Funny side note though: GS realtime risk/lazily loaded object graph database is called SecDB, and @saleyn has a repo on GitHub called secdb which has to do with having an efficient data store for financial data... I guess he was feeling invulnerable after getting off of the previous charges haha

I live in the US, but not in California. I've worked at three different companies. Each time when signing the employment contract I have pushed back on any terms that would make code that I write outside of work owned by the company. I haven't had any push back on this. My experience may be limited and may not generalize, but I find that in most employment contracts there are just a handful of points that the other party will not concede on. This may be less true at $MEGACORP.

Having tried this at $MEGACORP on this specific issue, can confirm it's less true.

Neither of the two $MEGACORPs (or at least $LARGECORPs) I've worked at have had any issue with various things I've done on the side and I've never kept them secret. So it varies--and neither were in California.

The clause isnt overly broad coz they have a problem with you doing side projects.

It's overly broad so that if you have a dispute about something you did outside of work they don't have to prove shit in court to get you to stop.

When I took my current position at a financial firm, it had the clause, but it also came with a form where I could declare, in specific or broad terms, things I did outside of employment. The company still included language affirming the CA guidance on this, and I spoke to HR and gave them hypotheticals, which they responded to in email.

I have lots of technical interests that aren't even remotely related to fintech, so I feel comfortable with these boundaries. Plus, at work I'm given a Windows machine, and all my personal projects -- and other commercial endeavors -- won't run on Windows. For that reason alone, I haven't requested alternative hardware/OS even though I could.

When I read stupid contracts like this, it becomes so obvious that the Universe wasn’t created by lawyers.

It’s just so in conflict with the creative process.

"We have the best employees in the world... because of jail"

https://www.youtube.com/watch?v=eiyfwZVAzGw

Key quote:

Anything you do on your own time, with your own equipment, that is not related to your employer’s line of work is yours, even if the contract you signed says otherwise

(from California state law, but it could reasonably be directly in a contract from a reasonable employer)

Joel makes the case that if you work for Google, this is meaningless because what isn't related to Google? They do everything. This makes sense to me, and in Google's defense, they pay the part. But then Joel goes on to make the case that "related" is such a vague term that as an employee you can't safely depend on it, even if you work for a company with a narrower scope (ie nearly any other company).

I don't know, this seems pretty far fetched to me. Say, you work at SoundCloud and your side project is an iOS game. Wrote it on your own device, in your own time, and so on and so forth. That is so obviously not related that I have a very hard time seeing how, with a clause such as this, any potential judge or jury could decide otherwise. Let alone the reputation damage SoundCloud could get trying to lawyer up on this shit. It just makes no sense.

Therefore, I still feel it's a draconian piece of contract and that, unless you apply at a company that truly does everything or pays top dollar, it shouldn't be a reasonable expectation to sign stuff like that.

If your game has music (like most do) wont you have a problem?

Especially in the rare case that the game becomes popular.

That's like saying a game competes with GitHub because it contains source code.

Soundcloud could claim that their roadmap includes music-based games for mobile devices.

How does this work for contributions to FOSS? What happens if $MEGACORP decides that any off-work contributions to FOSS software are rightfully theirs?

It would work in the same way as any off-work side projects. If it's (legally) your code, then you can do whatever you want with it, whether you sell it or contribute to FOSS. Otherwise, it was never your code to begin with, so you couldn't "contribute to FOSS" any more than you could donate your work notebook to a charity.

In reality, I think Google has an "open source committee" where you would show your proposed contribution, get approved, and then you can contribute to outside open source projects. I heard the process was fairly reasonable.

Here in the UK I worked for a small company in 2001. Each person recorded time spent on projects on one spreadsheet on a shared drive, a nightmare. I had a free website with uklinux (now no more) and in my spare time quickly knocked together a web based solution. Over a year or two I enhanced it, in my own time, and everyone liked it. But the company started losing money and one day the finance director came up to me and said my contract said that the system belonged to the company and I should hand it over. Well it was on my web site - I said no. Next day people complained they couldn't log in. I sent them to the finance director! Oh, and I had explained to the systems guys how to do a daily download of their data, so that was OK wasn't it? Next day finance director changed his mind.

The company did go bust, and only then did I open it up as a paid service. I ran it as a side project, but got a steady profit from it. Closed it when I retired.

Just to add to the other comments here, from a more freelance perspective:

Most work for large corporations is done under a "work for hire" agreement which means the company owns the copyright to the source you write. Additionally, many big companies will pressure you to accept employment clauses that claim ownership of anything you create in your free time, 24/7. This is not just for code, it's also standard for contract employees in the TV and film industry.

Note I'm distinguishing here between "employee" and "freelancer". I refuse to sign work-for-hire agreements, which means when hired, I still own the copyright to the source. I grant the company hiring me free use and modification and in some cases, right to resell.

I had a case of a startup where I was the sole coder, who turned around and sold their app to [Fortune 100 company] who didn't realize that I still owned this source. This company then asked me to consult - offering half what I'd been paid to write it - and further, asked me to sign a contract stating that they owned the code and everything else I made while I was consulting with them. Oh and also, without my help, they were missing some major assets they needed to recompile it.

I told them where to stick it, so they hired a bunch of people to try to reverse engineer it rather than agreeing to my terms. That didn't work (not least because I had trapped the fuck out of the code they did have, in ways that made it crash the compiler) so they ended up down a couple million bucks and shuttering the site. If they had only been nice, and hadn't come at me with the aggressive attitude, it could've been a nice little asset.

If you do not sign a work-for-hire agreement, and you're an independent contractor - not an employee - you own the source code unless otherwise stated in a contract. Beware that some jurisdictions will view you as a de facto employee in some cases (for better or worse). And my advice to anyone listening is, never, ever sign a contract with one of these companies that stipulates that they own your off-time work product. It's completely abusive and unnecessary. It's not worth taking a job with such a company.

So you wasted their time and money writing “traps” in the code? Sounds really unethical.

You sound like someone that owns a lot of equity at the place you work at - congratulations!

Bellum omnium contra omnes

If by the place I work at you mean nowhere, yes I own a lot of equity there. But in my past employment and contracting relationships, equity or not, I can't imagine shipping code with kill switches or booby traps that weren't in the spec or otherwise requested by the person I was working for.

Welcome to the world of business.

Usually the developer gets taken advantage of because they assumed the world to be fair and equal and companies to have your best interest.

In this case the developer got wind of an attempt to take advantage of him. He put in protection to prevent this. That's what a company would do.

To not understanding why someone needed do that strikes me as a bit naive.

To be fair, the kill switches were mostly to prevent decompilation and reverse engineering. And I added them on my own time after I learned of the pending sale, which no one had consulted me about, and before the company took control of the servers, which I was administering. Was it worth my time? Absolutely.

The people who sold the company intentionally misrepresented what they actually owned. They only owned the final compiled software they had purchased, and the right to use and repair or modify it. They didn't have a right to sell the source code, and I had no obligation to make it easy for the buyer to reverse engineer it.

Lesson learnt: If I had consultants, I’d ask for open-source delivery. Which has the side-effect of also advancing humanity, so we all win.

Is that even a lesson that needs to be learnt? Nuts not to, surely? Even this sort of issue aside, what happens when you want to add a feature and for whatever reason (that could include the original author's retirement or death!) hire someone else?

Binary delivery seems like buying some cool-looking alien device that manufacturers widgets; you have no idea how it works or how to maintain it, so you just sell widgets hoping it keeps working without maintenance.

Imagine you're a company looking for software as a cloud service. Suppose the best software for the purpose only does 70% of what you want. So you contact the company who runs that cloud service and pay them to develop the additional features and specific business logic you need. Then you contract with them to manage private servers with your build on them. At no point have you seen or purchased source code - not even for the 30% new features that were written on your behalf. Those are entwined with, and only work as a result of, the other 70%. You're basically using a black box that's maintained by another company, and trusting in that company's competence and goodwill. That's essentially what the situation was here. If you sold your company and touted your special build of the software as a feature, and passed the contract along to the buyer, that would be fine. But if you misrepresented the situation and said you owned 100% of the code and were selling that along with the right to distribute it, that would be fraud.

Of course, you could have gone the more expensive route and hired your own team of coders to write the whole thing from scratch, under whatever license you wanted, and then you would own the source. But if a company needs document software or meeting software in the cloud, how many pay to reinvent the wheel and roll their own?

Perfect! Possession is nine-tenths of the law. Pacta sunt servanda. You made a good deal about something you created, and you had the powerful means to enforce the deal. I like that. People can say this "sounds unethical", but this is exactly what every other employee or freelancer should aspire.

Yes, it's nice to have it _when you need it_, but consider all your other honest customers that years later discover your kill switches littered throughout the code they paid you to write. They'll have to pay some other developer to untangle or work around them. If your contract with your customer doesn't include a provision for the them, or it wasn't on the roadmap you worked out with your customer, you're delivering them something with defects that may cost them later. To say nothing about how they will feel about you once they discover you anticipated that they were a cheat the whole time you worked with them.

Paranoia-driven engineering decisions like this are no good. If your customers are bottom-of-the-garbage-can customers, get better customers. If you can't find better customers, then perhaps you are right where you deserve to be, doing garbage work for lousy cheats, which you must booby trap to make sure you get paid. If that's where you are, fine, but I hope no one with a brighter future reads these kinds of comments and thinks that being a bottom feeder is the norm.

I might have misread the comment. I was under the assumption that a business deal went wrong, and that the programmer never ceded ownership of the source code to begin with. Ofcourse, preventing is better than healing. But if you happen to make a deal and the other party turns out to be illegally selling something that's yours, than it is better to be able to enforce that deal.

I think you may be misunderstanding my position. To be clear, the original company owned the functionality they were purchasing. They needed software that did X, Y and Z. A lot of the code that went into it was code that I had already written for other purposes, including my own projects. They never owned that. They then sold the company as if they owned it - i.e. as if the purchaser would have free access to the source to repackage as they liked. I had no such contract with the original company, much less the buyer.

I should also clarify that this was a PHP backend that was handed over freely, and a public-facing Flash app that was handed over as an SWF. At heart it was a highly specialized video / social platform. Graphics assets were handed over. What was not handed over were the front-end AS3 scripts; and I used a few hex editing methods and other ways to trap the compiled bytecode that would crash all known SWF decompilers. I also had it phone home if someone tried to decompile it. (All those decompilers would start by importing the SWF onto the root object of another SWF; root detects a higher parent; kaboom).

What those guys did, and what the other company tried to do to me, was unethical. I didn't even have the right to sell them exclusive use of some of that source, because it was already deployed in other commercial projects. I didn't have the right to sell it out from under the other companies who already had paid for use of it. My refusal to sign [Fortune 500 company's] contract was on their behalf as well as my own. That company wouldn't listen to reason, so I left them a working binary and said "good luck", and then watched it keep phoning home until they gave up trying to decompile it.

Also, I've never prevented an honest customer from accessing source code they needed, and in this case I was willing to negotiate a non-exclusive use of the source code with the new company, for a fair price. But they refused that. They demanded sole ownership for $0, and they wanted to pay me half my rate for consulting. Not to mention they themselves are one of the most blatantly unethical companies in the world. I didn't feel like I owed them anything.

You perfectly defended yourself and your possessions. More software developers and knowledge workers should take this as an example.

In general to claim personal projects as your own, in California anyway, I’ve been told it has to be on your own time and on your own equipment. (and probably a non-conflicting subject matter) By offering hosting for the personal time projects on their infrastructure, Google would make it their equipment.

Just to double check, if you are developing a project in the evening at your own - Google still owns it(How does it work under CA law)? How about other FAANGs?

If you're in the US, Google claims that they own it (even in California, where local law means they can only do so if it "Relate[s] at the time of conception or reduction to practice of the invention to the employer's business, or actual or demonstrably anticipated research or development of the employer" - they asserted ownership of a Linux driver I wrote on my own time for hardware produced by a company that went out of business before Google even existed).

Google's actually better than many though - there's a process to release your code under an open source license (although with Google's copyright), you can contribute patches to third party open source projects without additional permission (again, under Google's copyright), and you can request that Google assign copyright for a personal project back to you. My understanding is that Apple basically forbid all of this outright. I'm not sure what the situation is at Amazon or Netflix.

two years ago at an apple all hands someone asked craig federighi about this and he more or less said "i know you all hate this {we get a lot of questions about this issue}... but for legal reasons we're not going to change it."

There is also an IARC process that grants you the copyright if you get approval.

https://opensource.google/docs/iarc/

What does it mean to contribute to third party OSS (that has whatever X licence) under Google's copyright?

That the project owners couldn't change licence (and keep that code) without Google's consent? Is this why some (/all of a certain size or commerce) worry about CLAs?

Google remains the copyright holder of the submitted patch. There's nothing special in this from the project's perspective - in the absence of copyright assignment as a required part of patch submission, the default is that the submitter retains copyright. In this case, it's just Google claiming ownership of their employee's patch rather than the employee holding the copyright.

In California, if you're doing it with your own resources, and handwavey it's not related to something that Google is having you work on, it's yours.

That doesn't mean that they won't try to sue you though.

Microsoft has the most permissive moonlighting policy amongst the major SE companies that I’m aware of. Sometimes they actively encourage it, like during the goldrush days of the Windows Phone and Windows 8 App Stores when they had on-campus hackathons for personal projects and everyone there was using their company-issue laptops, but I guess they were just desperate for content, heh. I remember we had received blanket assurances in writing that MS wouldn’t try to co-opt anything we’d post, just so that we don’t do anything that competes with Office…)

Thing is while many cases are easy to tell if they’re obviously in violation of policy, it’s still possible to sleepwalk into it:

Doing personal email in OWA/Gmail on a company laptop in lunch? OK

Doing personal email in desktop Outlook on a company laptop? OK (as was my understanding of policy at the time: there was a carve-out for having personal email on company hardware)

Doing personal email which involves a quick code-review of a rando’s PR to your personal github repo? hmmmm…

What about making slight modifications to that code?

What if you clone the repo because you need to get a bigger-picture?

What if you inadvertently start a build of your cloned repo?

Where is the line?

Probably a good thing, because otherwise anything on GitHub would count as using company equipment if you're at Microsoft

I doubt Apple would make that claim of your personal Macbook. Likewise if you're not using the /Microsoft account on GitHub, it's not 'company equipment' in that sense, it's just happens that in a personal capacity you are a client of (a subsidiary of) the company you work for.

is it just Google that owns any code you write while working there or it's just the usual requirement for FAANG

It's the same in most companies. It's mostly hidden in some company rule book you agree to when signing your contract.

> It's mostly hidden in some company rule book

In every employment contract I've ever seen, IP assignment is right there in the dozen or so pages of the contract. It is far too critical to just hide it away in "some company rule book" that the contract references. The contract itself will spell it out in great detail.

Reply on news.ycombinator.com