Hostage

[David Whatley]

I am in a dilema and looking for input. We have a small company and employ two developers/programmers. As of today I feel like I am being held hostage by them. Only they have the pasword to the servers, know where the source is located, the comments, etc.
How do I solve that? And no, we do not have a great relationship. As an FYI we have 2 products, one in VB6 and the other is in Cold Fusion.
Anyone out there very profieicent in either language?
DW

[brad]

One is always held hostage by the developers.

Have they been paid regularly and on time? Is there a reason why you think they feel this way?

If they are your servers, you have every right to have the passwords.. the company should institute a backup policy.. they have to archive all the current source to external drives... and keep on them doing it.

Use the "what do we do if you guys get hit by a bus" excuse.

[Howard Barlow]

Use the "what do we do if you guys get hit by a bus, and I do have a bus," excuse.

[epoh]

Ditto the others. There should always be some type of secure storage of passwords (we use PasswordSafe) and documentation. Any decent programmer/developer/admin has documentation.

[andyz]

Remind management/owners of Terry Childs and the San Francisco city network. He held the city hostage, virtually. http://www.cio.com/article/438368/Te...e_IT_Employees

[David_3]

I don't know diddly about computers or servers, but the first thing I would do is speak to an attorney in order to initiate legal action (criminal and/or civil) against them, and secondly, I would fire them so fast it would make their head spin. Damned if I would put up with that crap in MY company.

[David Whatley]

Maybe I need to clarify. It's not what they ar ecurrently doing, it is my fear what might happen shoud I fire one or both of them. I worry about the CF developer the most, he has a temper and an attitude.
Should we make a chage in staff, there is always a learning curve, and I can live with that. Its the problems he could cause if he wanted to.
david

[gmarblestone]

You need to have source control. Do you have anything like that?
They need to check in their work regularly to the source database and that needs to be backed up. This backup should be in your possession at your house or some other safe location. It might be worth hiring a contractor to come in and help you figure out how to do this. You can't protect yourself completely other than learning everything that your employee's know. All you can do is have the information for the next person to try to figure out. If he is malicious you will be in trouble for a while, but another programmer can come in and fix it IF you have the backup.

If you have questions feel free to PM me. I am a software engineer and not a hardware guy, but i can steer you in the right direction.

Thanks,
Grant

Originally Posted by David Whatley

Maybe I need to clarify. It's not what they ar ecurrently doing, it is my fear what might happen shoud I fire one or both of them. I worry about the CF developer the most, he has a temper and an attitude.
Should we make a chage in staff, there is always a learning curve, and I can live with that. Its the problems he could cause if he wanted to.
david

[David_3]

Originally Posted by David Whatley

It's not what they ar ecurrently doing, it is my fear what might happen shoud I fire one or both of them.

I thought they were withholding access to intellectual property from you. If it's your company, all of those programs/files/servers (and access to them) belong to you, right? I wouldn't have backstabbing or thieving or rogue employees around my company. They can do it MY way, or they can find a new job.

Don't fire them, or even hint that you are going to fire them, UNTIL you have initiated the legal action. The first time they should find out about it, is when someone hands them a subpoena, or a cop puts them in handcuffs. Five seconds after that, you say "Oh BTW, you're fired". Once they have the legal action hanging over their heads, they would be total fools to do damage to your computer system. If they do, it's just more legal charges against them.


FIRST thing, however, is to speak to an attorney, and find out what your legal standing is. You really should do that.


Good luck.

[David Whatley]

We make daily/weekly and monthly backups and use safe source. It is more the malicious problem I worry about. They work from home quite a bit, and so they also have remomte capabilities and that is a concern.
So, let me ask another question. If I wanted to move from CF to .NET or ROR, any ideas how difficult a challenge that might be?
DW

[ggeen]

First, never get a developer administrative permission on a production server. All work must be done in a development environment, tested and then moved to production by qualified system administrators.

Second, if your contract says you own the source code, make 'em fess up.

Third, create policy. If something happens all of this /could/ be a messy court case some day. Especally who owns the source code. Policy should include such things as standard OS load requirements, personnel responsibilities, and separration of duties defined -- a programmer is not a system administrator -- a system administrator is not an applicatin owner, etc. Additionaly, document in policy who is the primary and secondary gatekeeper. These should be managment or trusted long-time employees, not contractors, and make sure the keys to the gate (admin passwords) get changed quarterly

If you fail the bus test, then Windows does have a convoluted password recovery mechanism.

[gmarblestone]

I went from C++ to java to .net so i am not really familiar with CF or Ruby on rails. But, the change is the same really no matter where you go from/to. It's never easy and always slower than you think. If you have real business reasons to make a move then it makes sense but if things are working in your current language, i don't suggest changing.

I agree they should be isolated to a development area in the "real" world, but you have a small company and no tech department. Best i can see is that you log them into the production server when they need to be in there.

Again, if you have the source code you can get another person to come in and fix whatever they messed up.

G

Originally Posted by David Whatley

We make daily/weekly and monthly backups and use safe source. It is more the malicious problem I worry about. They work from home quite a bit, and so they also have remomte capabilities and that is a concern.
So, let me ask another question. If I wanted to move from CF to .NET or ROR, any ideas how difficult a challenge that might be?
DW

[epoh]

If it were me, I'd hire a 3rd person, and tell the other two he was being hired as a back-up/helper to them. Make sure the 3rd person is someone you trust a little more than these two, obviously. Have the 3rd person train with the others and check back with you when he gets a feel for everything. If the 3rd person understands everything and is comfortable taking over, you can then fire the guy you don't trust.

The fact of the matter is virtually every IT company has some level of what you are talking about going on. I document everything I do and the root passwords to all my servers are stored in a secure database. But I am still the only person here who does what I do and really has a good working knowledge of the stuff. If I quit they would be pretty much up sh*t creek for probably 2 or 3 months while they found another person, hired them, and that person tried to get up to speed. Your best best is never have just 1 person doing anything. And if you have to have just 1 person, make sure you pay them really well, and trust them with your life.

[DeannaD]

I thought of the same solution as Amy. You'd need a VERY competent person. Possibly on a contract basis to be hired on to learn everything and then (after you fire those two) to help transition over their replacements. Of course, you could keep this person, but I'd recommend you to pay that person to help setup a system that will benefit YOU and then bow out gracefully. You may have to pay some obscene contractor rates to accomplish this, but probably worth it.

One caution, this person would need to go in as a 'helper' and you could assign them the job of documenting everything as they learn (in front of the other two). Do NOT hang out with this person. You don't want to let the other two know what you're up to! I can tell you from experience that when your coworker goes to lunch with the boss everyday it can't help but make you nervous.

Good luck! Sorry you ran into these losers. I've been a software developer (I have an engineering degree, but would not call myself a software engineer) for > 20 years. Most of us are decent folks and would never sabotage a business no matter what personal grievances we might have against the bosses!

Deanna

[cwford]

Originally Posted by David Whatley

So, let me ask another question. If I wanted to move from CF to .NET or ROR, any ideas how difficult a challenge that might be?
DW

Think of moving from English to Spanish to French. It can be done but its not simple. It's more easily done if you understand the application that you're translating. It even more easily done if you're experienced in both languages.