网站源代码的企业间谍活动
这可能不是最具技术性的问题，但我只是感兴趣......
像 Google 这样的大公司如何防止其代码被员工窃取？也许我错了，但我认为他们的搜索算法的源代码（除其他外）对于他们的竞争对手（即微软）来说是有价值的。
我想我最好这样表述：
是什么让一个人不择手段 拥有足够许可的员工 访问 Google 的代码存储库 特定项目并复制大量代码 到闪存驱动器并将其带到他们的 竞争对手？
This may not be the most technical question, but I was just interested, nonetheless...
How does a giant company like Google keep from having their code stolen by employees? Maybe I'm wrong, but I would assume that their source code to their search algorithms (amongst other things) would be valuable to their competitors (i.e. Microsoft).
I guess I can best phrase it like this:
What's keeping an unscrupulous
employee who has sufficient clearance from
accessing Google's code repository for
a specific project and copying significant amounts of code
to a flash drive and taking it to their
competitors?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
害怕被起诉？
像谷歌这样的公司内部的事物也是划分的。所以并不是每个人都可以访问所有代码。如果某人有权访问代码，您可以打赌 Google 知道他们何时访问代码。我确信他们有某种算法可以查看是否有人很快下载了大量文件。搜索算法显然不是一个小文件，它是一个巨大的应用程序。
所有这些都将使他们能够追踪谁从内部窃取了代码。还有一个事实是，任何有自尊心的公司或有损失的公司（例如微软）都不会从别人那里拿走这样的东西。他们甚至可能会告诉谷歌这件事。
Fear of being sued?
Things within a company like Google are also compartmentalized. So not everybody has access to all code. If someone has access to code, you can bet that Google knows when they access it. I'm sure they have some kind of algorithm that looks and sees if somebody just downloads a lot of files very fast. The search algorithm isn't a small file obviously, it is a gigantic application.
All this would allow them to track who has stolen the code from within. There is also the fact that any self-respecting company or company with something to lose (i.e. Microsoft) would not take anything like this from somebody. They would probably even tell Google about it.
它被称为协议。只有少数人了解代码的想法。然后，那些少数人必须向其他人讲述一个非常尴尬的重大秘密。所以没人能告诉他们，否则他们就会被公开。这可能很简单，比如他们喜欢某样东西，而相比之下，他们害羞，因为他们一路杀了人。
It is called protocol. The idea that only a few people get to know the code. In which then those few have to tell a major very embarrassing secret to the others. So then nobody can tell or else they get outed in the public. Which can be very simple like they like something, compared to as bashful as they are all the way to they killed somebody.
许多雇主，包括我曾经工作过的雇主，都完全禁止闪存驱动器。
但在许多情况下，这是为了保护非技术机密信息。
Many employers, including one that I've worked for, completely block flash drives.
In many cases, though, this is to protect non-technical confidential information.
认真保护其资产的公司将有权访问其核心系统的日志记录并主动扫描以检测可疑模式。对于持有敏感个人信息的政府机构（例如税务、社会保障）的雇员也实施了类似的安全措施。可以标记并调查在分配的案例之外访问数据的用户。
我怀疑（但不知道）类似的扫描可以在高价值的源代码存储库中实现。
一些组织阻止使用可移动媒体（据报道，一些机构已通过此类政策对维基解密作出反应），在某些情况下，通过物理粘合 USB/媒体端口。这限制了潜在的窃贼通过网络传输可扫描的材料。
Companies that are serious about protecting their assets will have access logging on their core systems and active scanning to detect suspicious patterns. Similar security is implemented for employees of government agencies (e.g. tax, social security) holding sensitive personal information. Users who access data outside of their assigned cases can be flagged and investigated.
I suspect (but don't know) that similar scanning could be implemented in high value source code repositories.
Some organizations block the use of removable media (It has been reported that some agencies have reacted to Wikileaks with such policies), in some cases by physically gluing up the USB/media ports. This restricts potential thiefs to network transfers of material which can be scanned.
我认为像谷歌这样的公司将会对其源代码存储库/版本控制系统实施访问控制。因此，他们的员工只能访问他们参与的源代码。如果他们被分配给不同的项目，他们的访问权限可能会从以前的存储库中撤销。和普通的内部文件一样，一个有安全意识的公司会允许任何员工自由下载文件吗？
I think companies such as Google will implement access control on their source code repository / version control system. So their employee would only be able to access source code in which they were involved. And their access could be revoked from previous repository if they're being assigned to different project. Its the same thing with normal internal documents, would a security-conscious company let documents be downloaded by any employee freely ?
我认为这段代码击中了要害。一些不可靠的操作可能会感兴趣，但微软、雅虎等不会用十英尺的杆子接触被盗的代码。而且不靠谱的人没有基础设施。如果你没有告诉任何人它被偷了——你不可能走进一家在你的拇指驱动器上有整个蜘蛛/搜索算法的公司并声称你上周写了它而逃脱惩罚。
更大的威胁是搜索算法的细节泄露。 SEOer，作为一个整体，是相当阴暗的——许多人会为了算法如何对页面进行排名或降级的确凿事实而杀人。即便如此，谷歌已经证明了他们有能力如此迅速地改变他们的排名算法，以至于这并不重要。
另一方面，谷歌没有那么多超级秘密代码。他们的大多数很酷的东西（MapReduce 等）都是公开可用的（请参阅 Hadoop）。这个问题可能更适用于像 Adobe 这样的公司。他们的一些 Photoshop 算法确实很酷，如果他们泄露出去可能会伤害他们 - 但同样，没有合法公司会碰它。
I think codethis hit the nail on the head. Some fly-by-night operation may be interested, but Microsoft, Yahoo, etc - wouldn't touch stolen code with a ten foot pole. And the fly-by-night wouldn't have the infrastructure. If you didn't tell anybody it was stolen - it's not like you could get away with walking in to a company with an entire spider/searching algorithm on your thumbdrive and declare you wrote it last week.
The bigger threat is details of the search algorithm getting out. SEOers, as a whole, are rather shady - and many would kill for solid facts about how the algorithm ranked or downranked pages. Even then, Google has demonstrated the ability to change their ranking algorithms so quickly that it wouldn't much matter.
On the other hand, Google doesn't have that much super-secret code. Most of their cool stuff (MapReduce et.al) is publicly available (see Hadoop). This question is probably more applicable to a company like Adobe. Some of their Photoshop algorithms are really cool, and would probably hurt them if they got out - but again, no legit company would touch it.