I am looking to build and host a website for a client. Their existing site has a facility that allows customers to make donations and they want the new site to have it too.

My manager has told them that we can just lift their existing code and data and put it onto our servers and has asked me to go ahead and do this.

I am wary of doing it because I don't actually know how the code works and can't vouch for it being reliable or even safe. My manager says it must be safe because it has been working ok on their site already. Moreover he cannot afford for me to spend time reading through it and trying to understand it. He just wants me to copy and paste it.

Is it safe for me to proceed?

N.B. I guess this is sort of an ethical/legal question. But I wanted to post it here to understand the technical reasons too.

  • 4
    It's not an ethical or legal question, it's a trust question. There's no way we can tell you if it's safe or not. I can tell you that, based on the limited information you have provided, I can't think of any good reason why you wouldn't want to proceed. Like any other code (including the code you write yourself), you have to evaluate it on its own merits. – Robert Harvey Sep 8 '17 at 14:52
  • 1
    Your company can enhance trust by making a good contract with the client to make them reliable for any damage their code might do on your servers or to your network. They probably want some statement in the contract to be included you took some precautios measures. So give your manager the advice to include a lawyer here for making the contract. – Doc Brown Sep 8 '17 at 15:05
  • 1
    So you've never used third party code? A library, framework, compiler/interpreter, operating system? – HorusKol Sep 8 '17 at 15:07
  • if your servers are properly isolated there's no problem even if the code is malignant, the bad code should be unable to spread. If you don't trust your own infrastructure, yeah, you shouldn't do this. But if you don't trust your infrastructure why should your customer trust you as a business partner... – jwenting Sep 12 '17 at 11:06

From a business process standpoint you have the concept of risk:

  • How likely is something to go wrong?
  • What is the possible impact if it does go wrong?
  • Do you accept, mitigate, or avoid that risk?

You are approaching the process of wanting to avoid the risk while your manager seems to be on the side of accepting that risk.

On the flip side, there is also opportunity cost:

  • What is the potential gain of doing an action?
  • How likely is that action going to pay off?
  • Do you accept, mitigate, or avoid the opportunity?

You have a customer that is paying you to host, and if you refuse to do so, you lose that money--and potentially the contract.

That said, there is that middle ground that I don't think you've explored yet. The middle ground of "mitigation".

It's common practice to put externally facing web applications in a De-Militarize Zone (DMZ), where there are firewalls on either side of the DMZ so that you mitigate bad actors from outside and bad code inside the DMZ.

You might look at adding another set of firewalls around your 3rd party code, assuming that copy and deploy is all you need to get it working. Usually there is further configuration required as well.

We can all argue back and forth whether the code is safe or not, but that really isn't the question we should be asking. It's how badly can this impact your environment and operations. In business there is always a balance of risk and reward. At the end of the day, as long as everyone is working within the legal constructs of your company, someone has to make the decision of how to handle the risk. If your manager decides to accept the risk (and he has the legal right to do so), then he is ultimately responsible if something does go wrong.

In short, if you can't quantify your concerns, or they turn out to be within acceptable limits, you'll have to go with what your manager says to do. If you can come up with a low cost solution to minimize potential damage to your infrastructure then you can propose that.

  • 1
    Or, y'know, he's the manager, so you do what he tells you to do. – Robert Harvey Sep 8 '17 at 14:54
  • 2
    Shh.... That's the ultimate message... I've found managers much more reasonable to work with when you can identify the potential problem and quantify the risk so they are better informed about their decision. It doesn't always change the decision, but it shows you aren't just being insubordinate. – Berin Loritsch Sep 8 '17 at 14:58

You evaluate this code the same way you would evaluate any other code:

  1. Does it do what it is supposed to do?
  2. Does it follow reasonably sound "best practices" for security and stability?
  3. Will it require adaptation or alteration to suit your environment?

These are things which should be considered part of the act of "copy-pasting" the code. Nobody reasonably expects the code to work right out of the gate, just from a simple copy/paste. You have to hook it up, test it, do all of the usual things with it.

There are no legal or ethical issues here, as far as I know. It's not your code, but the other company is granting you permissions to use it. It's up to your manager and legal department to make sure the necessary written agreements are in place.

  • Sure this can be approached from a legal side. – Doc Brown Sep 8 '17 at 15:02
  • That's beyond his pay grade, unless he also happens to be a lawyer. – Robert Harvey Sep 8 '17 at 15:02
  • See my comment under the question. – Doc Brown Sep 8 '17 at 15:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.