Say I am developing an app for sale. Does it make sense to use a public repository for this project? Doesn't default copyright protect the code from someone else using it? If so, what advantages are there in paying for a private repository?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
If your application is closed-source, it should go in a private repository. Copyright might protect you legally, but if someone decides to steal your code, they likely won't care. Then it's up to you to be able to find these people, be able to identify that they've used your source code in their application, and prove it to a judge.
This is especially problematic if you're doing something new. Maybe you've created a new algorithm of sorts, or combined web-services or APIs in a way not yet done. You're releasing your application for money, and leaving a comprehensive how-to guide online for all to see, significantly damaging your competitive advantage.
If you're handling user security in any way, any mistakes you made (and you will have) will be much more easily found and exploited if attackers can read your source code. Some online repositories have bug trackers -- people can follow that, and it will point them straight to the vulnerabilities that have been found, and will have a window to take advantage of them (the time it takes you to fix the bugs, and for your users to apply a patch).
I should also mention that if you have a team of five people or less, you can host your code privately with BitBucket for free. There are other services I'm sure, I just know of that one because I use it.
Private repo is, well... private. :-)
Being something of an open-source fanatic, I'd differ somewhat with Carson. He's perfectly right in a sense, but it is (in my humble opinion anyway) no big deal to open source private software either.
For all intents and purposes you could keep it unlicensed on github and it'll make no difference: the github traffic to your repo will be about zero until you release. And then, you never know -- some user/coder might bump into it and volunteer a patch, a suggestion, a feature request, etc.
Unless you're building the billion dollar application, nobody will care about your code in a material manner. And if you do, you'll have your billions already and won't care much if they have access to it. The value of your application will come not from its source code but in your ability to market, support, and maintain it.
Here I go again. I'm not a lawyer and this is not legal advice. Basically, there is nothing preventing anyone from looking at the source code and creating a derivative work from it. At the very best you can have a check-box or a registration form to restrict access if you have put this in a public repository. And then, here's the kicker, it is upto to you to establish your claim that the other party has created the derived work. It is not up to them to prove them that they didn't look at your source code; besides, it's counter-intuitive isn't it and it essentially sets up the scenario where it is your word against their word.
Based on the above, it would not make sense to create a public repository. It has to go into a private repository where you can control access to the source code. Most large companies extend access control to a much larger extent - typically a developer would have access only to the projects that he deals with, i.e. access is provided on a need-to-know basis. Anything else is asking for trouble, especially if some of the features constitute intellectual property and are being patented, or for that matter happen to be the secret sauce that lends competitive advantage to the company.
Apart from the ones listed above, the typical advantage lent by a private repository is that the contract between you and provider would essentially include a NDA. If you do not have one, then you are only paying for the services of having a repository that is supposedly private. After all, there is nothing preventing a member on the operations team of the provider from peeking into your sources and creating a derived work.
If you're going to sell the application, I wouldn't use a public repository since you're showing the whole world HOW to bypass your licensing system without spending any huge effort. If they really want to crack it, they'll get there at some point, but the investment will be much higher and thus less likely to happen right away (without going further offtopic on obfuscation etc).
The only point in which you could host the source in a public repository, is when the application should be bought in a marketplace (iphone, android, wp7, ..) and you don't have to worry that much about licenses, ... And even then I wouldn't recommend it, since people can just download the source and publish it themself (with some minor changes, ...) or install on an unlocked device.
For the copyright issue: I'm not a lawyer, but at some point you'll have to be able to prove your code was there first if you want to fight over copyright. Timestamped version history might help you a bit, but there are ways to bypass that (private hosting, ..) If you keep it private, people can't steal it (only the idea, not the actual implementation), and you won't have to deal with it.