asp.net business/legal question (full post)
-
the company i was just hired to had contracted another company to code them an ecommerce site from scratch. it is in an asp.net system running on sql server 2000. the initial estimate was in the 20k range, for web design, sql and os licenses , database design and coding of the asp.net components. The site as-is is not exactly what my company needed, the database design is very poor, and the program they generated for inventory is rudimentary. In short, i need to get in and make the necessary changes currently, and also have the source so our company can continue to innovate and market itself online. When i came on board i emailed the company that made the site because i couldnt find the sourcecode files. The responded that it was proprietary code of their business, and that i could not have access to them. I have called them twice with our lawyer to try and negotiate the release of the code developed from scratch, for us. Our lawyer is not versed in the code/internet law, so i am hoping some of the developers here can lend some insights. One of the main arguments on their end is that releasing the code would be a security risk. even we employed them to develope the code for us from scratch, they have resold it to three other companies. they claim that us having the code would be a security risk because our it staff (read:me) would be able to find holes and crack into other businesses systems. our response is we would sign a NDA saying that the code will only be used for our site and business, and at no time will i release it or resell it to anyone else, or for personal use. this ties into their next argument, which is: Releasing the code to us "for free" is unfair because they have supposedly spent "$70,000" developing it. basically trying to get us to purcahse the code we already paid them to write. We would only hold the rights to use this in house, so purchasing it for any price seems unfair on our end. I personally thought the original price of 20k was excessive, and that was before i knew we didnt have the code to make changes. They currently use our site to advertise their services on their own website, and use it as an example of the product they sell, which is what they developed on our bill. So right now all our lawyer can think of is pulling our info from their site, as we never agreed to let them use us to advertise, nor did they ask. I am looking for feedback on the following: a) this deal is not indicative of typical asp.net contract work b) we have legal recourse in the matter c) t
-
the company i was just hired to had contracted another company to code them an ecommerce site from scratch. it is in an asp.net system running on sql server 2000. the initial estimate was in the 20k range, for web design, sql and os licenses , database design and coding of the asp.net components. The site as-is is not exactly what my company needed, the database design is very poor, and the program they generated for inventory is rudimentary. In short, i need to get in and make the necessary changes currently, and also have the source so our company can continue to innovate and market itself online. When i came on board i emailed the company that made the site because i couldnt find the sourcecode files. The responded that it was proprietary code of their business, and that i could not have access to them. I have called them twice with our lawyer to try and negotiate the release of the code developed from scratch, for us. Our lawyer is not versed in the code/internet law, so i am hoping some of the developers here can lend some insights. One of the main arguments on their end is that releasing the code would be a security risk. even we employed them to develope the code for us from scratch, they have resold it to three other companies. they claim that us having the code would be a security risk because our it staff (read:me) would be able to find holes and crack into other businesses systems. our response is we would sign a NDA saying that the code will only be used for our site and business, and at no time will i release it or resell it to anyone else, or for personal use. this ties into their next argument, which is: Releasing the code to us "for free" is unfair because they have supposedly spent "$70,000" developing it. basically trying to get us to purcahse the code we already paid them to write. We would only hold the rights to use this in house, so purchasing it for any price seems unfair on our end. I personally thought the original price of 20k was excessive, and that was before i knew we didnt have the code to make changes. They currently use our site to advertise their services on their own website, and use it as an example of the product they sell, which is what they developed on our bill. So right now all our lawyer can think of is pulling our info from their site, as we never agreed to let them use us to advertise, nor did they ask. I am looking for feedback on the following: a) this deal is not indicative of typical asp.net contract work b) we have legal recourse in the matter c) t
JVillan wrote: ...contracted another company to code them an ecommerce site from scratch *disclaimer* I am not a lawyer, and I am not advising you in any legal capacity *end disclaimer* Therein lies the problem. Your company is at the mercy of whatever the terms of the original contract were with the contractor. Did your company's management read the contract? Are the terms of performance and customer satisfaction spelled out? Did your company sign off on any kind of acceptance of the work completed by the contractor? Find the contract. If your company has an attorney, he or she ought to be able to analyze a contract, even if they are not familiar with IS contracting. This is not necessarily indicative of typical contract work... but it can happen. What's that old cliche? "Caveat Emptor" -- "Buyer Beware". An ASP.NET site compiled into a DLL can be reverse-engineered, but if the contractor was that savvy about protecting its intellectual property, the DLL is obfuscated so that that won't work very well -- not to mention that their license and/or contact agreement might very spell out that reverse-engineering is a breach of contract, which in turn could subject you to legal and financial risk. Sounds like you might want to start a new project... What a piece of work is man, how noble in reason, how infinite in faculties, in form and moving how express and admirable . . . and yet to me, what is this quintessence of dust? -- Hamlet, Act II, Scene ii.
-
JVillan wrote: ...contracted another company to code them an ecommerce site from scratch *disclaimer* I am not a lawyer, and I am not advising you in any legal capacity *end disclaimer* Therein lies the problem. Your company is at the mercy of whatever the terms of the original contract were with the contractor. Did your company's management read the contract? Are the terms of performance and customer satisfaction spelled out? Did your company sign off on any kind of acceptance of the work completed by the contractor? Find the contract. If your company has an attorney, he or she ought to be able to analyze a contract, even if they are not familiar with IS contracting. This is not necessarily indicative of typical contract work... but it can happen. What's that old cliche? "Caveat Emptor" -- "Buyer Beware". An ASP.NET site compiled into a DLL can be reverse-engineered, but if the contractor was that savvy about protecting its intellectual property, the DLL is obfuscated so that that won't work very well -- not to mention that their license and/or contact agreement might very spell out that reverse-engineering is a breach of contract, which in turn could subject you to legal and financial risk. Sounds like you might want to start a new project... What a piece of work is man, how noble in reason, how infinite in faculties, in form and moving how express and admirable . . . and yet to me, what is this quintessence of dust? -- Hamlet, Act II, Scene ii.
John Kuhn wrote: An ASP.NET site compiled into a DLL can be reverse-engineered, but if the contractor was that savvy about protecting its intellectual property, the DLL is obfuscated so that that won't work very well How??? John Kuhn wrote: Sounds like you might want to start a new project... With a 'better' contract signed... if 'JVillan' still wants to outsource :-D;P:-D I was born intelligent
Education ruined me!. -
John Kuhn wrote: An ASP.NET site compiled into a DLL can be reverse-engineered, but if the contractor was that savvy about protecting its intellectual property, the DLL is obfuscated so that that won't work very well How??? John Kuhn wrote: Sounds like you might want to start a new project... With a 'better' contract signed... if 'JVillan' still wants to outsource :-D;P:-D I was born intelligent
Education ruined me!.S P S wrote: How??? Sorry -- how to reverse engineer a DLL or how to obfuscate code? I'm not an expert on reverse engineering software, but it is my somewhat basic understanding that since .NET code is compiled first to IL code and then JIT'ed to run, you can take the IL code and dis-assemble/de-compile it back to code that is pretty darn close to what the original author wrote. I'm not an expert on obfuscating code, either, but there are some components out there, like the "dotfuscator" (i think that's what it's called...) that protect against reverse engineering -- at least to those who aren't that likely to really dedicate themselves to cracking your code. What a piece of work is man, how noble in reason, how infinite in faculties, in form and moving how express and admirable . . . and yet to me, what is this quintessence of dust? -- Hamlet, Act II, Scene ii.
-
S P S wrote: How??? Sorry -- how to reverse engineer a DLL or how to obfuscate code? I'm not an expert on reverse engineering software, but it is my somewhat basic understanding that since .NET code is compiled first to IL code and then JIT'ed to run, you can take the IL code and dis-assemble/de-compile it back to code that is pretty darn close to what the original author wrote. I'm not an expert on obfuscating code, either, but there are some components out there, like the "dotfuscator" (i think that's what it's called...) that protect against reverse engineering -- at least to those who aren't that likely to really dedicate themselves to cracking your code. What a piece of work is man, how noble in reason, how infinite in faculties, in form and moving how express and admirable . . . and yet to me, what is this quintessence of dust? -- Hamlet, Act II, Scene ii.
Thanks I was born intelligent
Education ruined me!. -
the company i was just hired to had contracted another company to code them an ecommerce site from scratch. it is in an asp.net system running on sql server 2000. the initial estimate was in the 20k range, for web design, sql and os licenses , database design and coding of the asp.net components. The site as-is is not exactly what my company needed, the database design is very poor, and the program they generated for inventory is rudimentary. In short, i need to get in and make the necessary changes currently, and also have the source so our company can continue to innovate and market itself online. When i came on board i emailed the company that made the site because i couldnt find the sourcecode files. The responded that it was proprietary code of their business, and that i could not have access to them. I have called them twice with our lawyer to try and negotiate the release of the code developed from scratch, for us. Our lawyer is not versed in the code/internet law, so i am hoping some of the developers here can lend some insights. One of the main arguments on their end is that releasing the code would be a security risk. even we employed them to develope the code for us from scratch, they have resold it to three other companies. they claim that us having the code would be a security risk because our it staff (read:me) would be able to find holes and crack into other businesses systems. our response is we would sign a NDA saying that the code will only be used for our site and business, and at no time will i release it or resell it to anyone else, or for personal use. this ties into their next argument, which is: Releasing the code to us "for free" is unfair because they have supposedly spent "$70,000" developing it. basically trying to get us to purcahse the code we already paid them to write. We would only hold the rights to use this in house, so purchasing it for any price seems unfair on our end. I personally thought the original price of 20k was excessive, and that was before i knew we didnt have the code to make changes. They currently use our site to advertise their services on their own website, and use it as an example of the product they sell, which is what they developed on our bill. So right now all our lawyer can think of is pulling our info from their site, as we never agreed to let them use us to advertise, nor did they ask. I am looking for feedback on the following: a) this deal is not indicative of typical asp.net contract work b) we have legal recourse in the matter c) t
a) I can only speak for the company I work for - we give the client the the code, if they ask. Usually they don't, and we just keep it indefinitely in SourceSafe. c) Technically, their comment about security is a bad sign. Security is not about hiding the code, it is about writing secure code. If their comment is true, it means they *may* have left themselves a backdoor, and have the ability to take your site down on a whim, or borrow whatever info they wanted. Finally, as others have said, it is easy to decompile a .NET dll.