Consider your naming schemes - a cautionary tale

21 points

15 years ago

Recently we had a contract for a large company that required the code be put in escrow. This isn't unusual, we're in an industry where if you have fewer than 10,000 employees you're regarded as small and a risky proposition. We have succeeded despite that perception because we're very good at what we do.

So an agent for the appointed escrow company comes in to vet the software, check that we can do a full and complete build from the source provided, and then are about to take away the copy to put in safe storage. It'll never be seen again unless we fail to meet our (fairly reasonable) obligations.

Then the agent doing the vetting asks for a break. He goes away and makes a phone call. Then another. Then another. Finally he comes back and says that he has a legal responsibility to report us to the authorities.

Why?

We use a package called "upskirt" - https://github.com/tanoku/upskirt - and he has concerns not because it's open source, but because of the potential pornographic implications.

It takes a while, but we manage to explain several things:

* One - it's not actually part of the system we provide to the customer, it's just used in our internal documentation system

* Two - it's not what it seems. Programmers (we've learned never to use the word "hackers") have an odd sense of humor.

* Three - under the legal agreement we have they are welcome to check our systems for "inappropriate" material.

* Four - it's not actually their responsibility, and they are over-stepping their bounds

* Five - but it doesn't matter, because it's not what they might have thought, and it's all OK.

Even so, I can just see federal agents coming in to seize material on the basis of something like this, and then we're screwed. 30 people out of work.

We've now purged our systems. We've traced every filename, grep'ed every file, and generally undertaken the mammoth task of removing anything that someone not steeped in hacker culture might find questionable.

So by all means, continue to use clever and risqué names for your projects. Just don't expect me to use them.

========

The above is not a true story, although most of the elements are true. We do put code in escrow, we have had to explain "questionable" names, and we have had to convince someone not to call the authorities. I've put the components together into a single story for effect.

The result is real. We won't, for example, use "upskirt" at work.

(edited to correct a typo - there are probably more)

4 comments