DIY 代码托管？
我没有使用第三方代码托管服务，而是考虑以加密形式向客户提供我们的源代码，然后让我的律师制作一份文档，其中包含用于解密源代码的密码以及发布该源代码的条件。
这样做的好处不仅仅是成本。如果大型托管服务之一遭到黑客攻击，您会感到震惊吗？
实现可能非常简单。可以编写一个 Win32 命令行程序，使用 AES、随机数等的一些模糊组合来使用密码加密和解密文件。然后，该程序与加密的源文件和指令打包在一起，并通过多种方法提供给客户。所以客户已经有了货源。他们所需要的只是解密它的密码。
要获得密码，客户只需联系充当托管代理的法律团体，并声称已达到释放代码的条件之一，例如破产、产品已停产等。
有人这样做过吗？您也这样做过吗？看到系统中的缺陷吗？
Rather than using a third party code escrow service, I was thinking about giving customers our source code in encrypted form and then have my attorney produce a document that contains the password for decrypting the source and the conditions under which it is released.
The benifits of doing it this way are not just cost. Would you be shocked to hear if one of the big escrow services was hacked?
The implementation could be very simple. A Win32 commandline program could be written that uses some obscure combination of AES, random nonces, etc to encrypt and decrypt a file using a password. This program is then packaged with the encrypted source file and instructions and made available to customers via any number of methods. So customers already have the source. All they need is the password to decrypt it.
To obtain the password, the customer would simply contact the legal group acting as the escrow agent and claim that one of the conditions for releasing the code has been reached such as bankruptcy, the product was discontinued, etc.
Has anyone done this or do you see a flaw in the system?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
托管系统也是源代码交付的保证。如果尝试解密时发现加密文件或媒体已损坏怎么办？如果密钥不正确怎么办？当您无法自行提供代码时，需要按照托管合同中的规定提供服务。您的律师会在多大程度上确保客户的合同得到履行？这基本上就是您支付托管服务费用的原因。
另一种选择是简单地向他们发布代码，同时您仍然持续关注相当于托管费的价格上涨并将托管费收入囊中。现在给他们源代码有什么风险？
The escrow system is also a guarantee that the source code will be delivered. What if the encrypted file or media is found to be corrupted when decryption is attempted? What if the key is not correct? The service needs to be provided as specified in the escrow contract at a time when you will not be able to provide the code yourself. How far will your lawyer go to ensure that the client's contract is fulfilled? That is basically what you are paying an escrow service for.
Another option is to simply release them the code as it is while you are still a going concern for a price increase equivalent to the escrow fees and pocket the escrow fees. What is the risk in giving them the source code now?
托管账户流程的一部分是法律和财务保证，即使您和托管提供商都被闪电击中或被从脱离轨道的空间站坠落的流星或马桶座圈击中，该代码也将提供给客户。军事承包商要求我们将（我们开发的）编译器的源代码交给第三方托管，以便在我们倒闭时他们可以使用它。
另外，与律师的价格相比，我认为托管会相对便宜。如果这是客户要求，只需将其纳入您的出价中即可。
Part of the escrow account process is a legal and financial guarantee that, even if both you and the escrow provider are struck by lightning or hit by a falling meteor or toilet seat from a deorbited space station, the code will be available to the client. We've been required by military contractors to hand over source for our compiler (that we develop) to escrow so that they can use it if we go out of business.
Also, compared to the price of an attorney, I'd think that escrow would be relatively cheap. Just factor it in to your bid if it's a client requirement.