Where I work, we have a lot of developers and an awful lot of code running our proprietary applications used by staff & customers alike.
We also have a lot of smart support staff that like to understand the inner workings of our systems to better support our customers, and perhaps even submit a patch from time to time.
Should we open up our code for our non-development staff to be able to read? What factors should we take into account when making this decision? I have come across a bunch of arguments and counter-arguments each way & would like to make a decision based on the experience of others as well as well-understood risks.
Some arguments thus far:
- Passwords in VCS are exposed (solution: get rid of the passwords - they shouldn't be there to begin with)
- Code is open to white-box security attacks (counter-argument: this only keeps out the honest/lazy attackers)
- Support staff can ask developers "how" things work (counter: teach a man to fish, etc)
Does anyone open their code to staff at their organisation? Has it caused any problems?