1"use strict";(self.webpackChunkAuthressKnowledgeBase=self.webpackChunkAuthressKnowledgeBase||[]).push([[4492],{3905:(e,t,o)=>{o.d(t,{Zo:()=>l,kt:()=>p});var r=o(67294);function a(e,t,o){return t in e?Object.defineProperty(e,t,{value:o,enumerable:!0,configurable:!0,writable:!0}):e[t]=o,e}function n(e,t){var o=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),o.push.apply(o,r)}return o}function s(e){for(var t=1;t<arguments.length;t++){var o=null!=arguments[t]?arguments[t]:{};t%2?n(Object(o),!0).forEach((function(t){a(e,t,o[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(o)):n(Object(o)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(o,t))}))}return e}function i(e,t){if(null==e)return{};var o,r,a=function(e,t){if(null==e)return{};var o,r,a={},n=Object.keys(e);for(r=0;r<n.length;r++)o=n[r],t.indexOf(o)>=0||(a[o]=e[o]);return a}(e,t);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);for(r=0;r<n.length;r++)o=n[r],t.indexOf(o)>=0||Object.prototype.propertyIsEnumerable.call(e,o)&&(a[o]=e[o])}return a}var c=r.createContext({}),u=function(e){var t=r.useContext(c),o=t;return e&&(o="function"==typeof e?e(t):s(s({},t),e)),o},l=function(e){var t=u(e.components);return r.createElement(c.Provider,{value:t},e.children)},h={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},d=r.forwardRef((function(e,t){var o=e.components,a=e.mdxType,n=e.originalType,c=e.parentName,l=i(e,["components","mdxType","originalType","parentName"]),d=u(o),p=a,m=d["".concat(c,".").concat(p)]||d[p]||h[p]||n;return o?r.createElement(m,s(s({ref:t},l),{},{components:o})):r.createElement(m,s({ref:t},l))}));function p(e,t){var o=arguments,a=t&&t.mdxType;if("string"==typeof e||a){var n=o.length,s=new Array(n);s[0]=d;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:a,s[1]=i;for(var u=2;u<n;u++)s[u]=o[u];return r.createElement.apply(null,s)}return r.createElement.apply(null,o)}d.displayName="MDXCreateElement"},14834:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>s,default:()=>h,frontMatter:()=>n,metadata:()=>i,toc:()=>u});var r=o(87462),a=(o(67294),o(3905));const n={hide_table_of_contents:!0,title:"Your source code is not that special",authors:"dorota-parad",description:"Whenever the topic of protecting developer machines comes up, I inevitably hear that we must protect the machines in order to protect the source code. It's a fallacy. Your source code is really not that special.",image:"./index.jpg",image_alt:"Your source code is not that special",date:"2025-02-03T10:00"},s=void 0,i={permalink:"/knowledge-base/articles/2025/02/03/your-source-code-is-not-that-special",source:"@site/articles/2025-02-03-your-source-code-is-not-that-special/index.md",title:"Your source code is not that special",description:"Whenever the topic of protecting developer machines comes up, I inevitably hear that we must protect the machines in order to protect the source code. It's a fallacy. Your source code is really not that special.",date:"2025-02-03T10:00:00.000Z",formattedDate:"February 3, 2025",tags:[],readingTime:2.223333333333333,hasTruncateMarker:!1,authors:[{name:"Dorota Parad",url:"https://dorotaparad.ch",page:!0,socials:{bluesky:"dorotaparad.bsky.social",github:"dorotaparad",linkedin:"dorota-parad"},imageURL:"https://authress.io/knowledge-base/img/authors/dorota-parad.jpg",key:"dorota-parad"}],frontMatter:{hide_table_of_contents:!0,title:"Your source code is not that special",authors:"dorota-parad",description:"Whenever the topic of protecting developer machines comes up, I inevitably hear that we must protect the machines in order to protect the source code. It's a fallacy. Your source code is really not that special.",image:"./index.jpg",image_alt:"Your source code is not that special",date:"2025-02-03T10:00"},prevItem:{title:"Unintended consequences of well-meaning changes",permalink:"/knowledge-base/articles/2025/03/13/using-systems-thinking-to-understand-unintended-consequences"},nextItem:{title:"Your security team\u2019s job is not security",permalink:"/knowledge-base/articles/2025/01/20/your-security-teams-job-is-not-security"}},c={image:o(49947).Z,authorsImageUrls:[void 0]},u=[],l={toc:u};
1function h(e){let{components:t,...o}=e;return(0,a.kt)("wrapper",(0,r.Z)({},l,o,{components:t,mdxType:"MDXLayout"}),(0,a.kt)("p",null,"Whenever the topic of protecting developer machines comes up, I find myself dismantling the same fallacies over and over again. One of those fallacies goes like this: we must protect our source code! So far so good. Protecting your source code makes sense. But then it turns into: our source code is precious! It is our Intellectual Property! And then: our precious source code is on developers\u2019 machines, we must do everything in our power to protect these machines! And that\u2019s a fallacy."),(0,a.kt)("p",null,"It turns out, your source code itself, that treasured IP, is really not that special. Let\u2019s think about it for a moment."),(0,a.kt)("p",null,"How much of your code is truly unique and innovative? How much of it is copy/pasted from Stack Overflow? How much is done by third party libraries you depend on? If you were given a chance to start from scratch and completely rewrite all your company\u2019s software, how much of the end result would look exactly like your today\u2019s code? (Ignoring, of course, those few who would jump at the opportunity because they haven\u2019t yet had the privilege of spending countless years doing a migration project\u2026) Unless you\u2019re working on developing something new at the already cutting edge of software technology, your code is largely a glue holding various common pieces together. There aren\u2019t many companies out there that have some secret sauce hidden in their code, and even if they do, that secret sauce is a tiny fraction of the whole code base."),(0,a.kt)("p",null,"Here\u2019s a thought experiment\u2014Imagine that your source code suddenly goes public. What is the worst that would happen? Would some indie hacker just copy it and spin up a new business just like yours to become your biggest competitor over night? Or what if it is your biggest competitor getting access to your code? Would they go \u201cah-ha!\u201d and replace their code with yours? Spoiler alert: no engineer I\u2019ve ever worked with has had the thought while looking at someone else\u2019s code \u201cWow this is great, we would never be able to write this better.\u201d"),(0,a.kt)("p",null,"If exposing your source code was such a catastrophe, how do we explain all these software companies who make their code available to the public? ",(0,a.kt)("a",{parentName:"p",href:"https://en.wikipedia.org/wiki/Open-core_model#Examples"},"Multiple very successful businesses")," nowadays operate under that principle and chances are the company you work for is paying for some of them. It\u2019s worth noting that most of the open-core or source-available software is not simple nor does it solve some trivial problem. Yet all these companies are doing well, commercially."),(0,a.kt)("p",null,"These days, the code is rarely the source of competitive advantage. And if it is, it\u2019s not down to how well or clever it\u2019s written. What matters is how you position yourself in the market, how you acquire your customers, how you retain them, and how you convey your value to the customers. What also matters is your pricing model, your operational efficiency, your margins, and how well you control the cost over time. Notice how these have very little to do with the code you\u2019ve written? As a matter of fact, the code a company writes is a result of those exact strategies. Even if we look at the software itself, there are multiple other factors about it that are more important than the source code. Are there bugs in production? How often and how quickly do they get fixed? How easy is it for a customer to get help when something isn\u2019t working? How easy is it to get started and onboard new users? How reliable is your software? How often do you leak your customers' data and do they care?"),(0,a.kt)("p",null,"The true value of your code is not the source, but rather how well it supports the business model, how it\u2019s operated and how it runs in production. And of these three, the most crucial bit is the latter - your source code running in production. That is the only thing truly worth protecting. So that code on your developer machine? Who cares."))}h.isMDXComponent=!0},49947:(e,t,o)=>{o.d(t,{Z:()=>r});const r=o.p+"assets/images/index-c832e245add8d875ba74567e9bf6864c.jpg"}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.