Oursourcing PHP and Joomla Development

Using companies like OSSMedia Ltd / Xicom Technolgies Ltd - A cautionary Tale

There are many companies offering outsourced programming. It seems a good idea - let their economies of scale provide raw programming skills so you can get on with running all of the other parts of your organsiation. Give them a specification and await the results. Now before you tell us we should know better, you're probably right, although this was a calculated risk. We'd still like to help others avoid the problems we had, as the concept of outsourcing is still good. Engaging OSSMedia Ltd After speaking to various, we engaged one company, "OSSMedia Ltd.". Their salesperson, James Matthews seemed helpful, friendly and convinced us that they could offer exactly what we needed. Ostensibly it was quite a simple requirement - transferring an existing web site onto a PHP/CMS platform, keeping it exactly the same. They claimed "over 1500 clients" and offered a 100% money-back guarantee if we weren't satisfied with their work. We made an initial payment (actually 80% of 'phase 1'). OSSMedia apparently don't have their own bank account and wanted payment by Paypal but as Paypal don't give the best exchange rates we wanted to send to a bank, so they asked the money to be sent to Xicom Technologies Ltd who they said were "their parent company". Actually, we later called Xicom directly; the person we spoke to had never heard of OSSMedia and didn't think they were related. He took our phone number and said we'd get a call back, but we never heard anything from them. Things were okay at first; they delivered a basic working front page within a couple of weeks. There were, however, quite a few snags, but that was to be expected during site development, so nothing to worry about but fixing all of these errors and bugs took us overdue on our project schedule. They also then started work on the content pages. In order to start moving content across for their demo, OSS requested FTP access to our web content. We set up an FTP account which provided them access to all flat-file HTML page (databases and server-side processed files are held elsewhere). That FTP access didn't give them access to anything that isn't publically accessible through HTTP, but it did give them the convenience to download en-masse. We sought OSSMedia's assurance that the access was to be used specifically for downloading files and nothing else; Sushant Srivastava (the project manager) confirmed: "Sure, we will not touch anything else...."

Then things went wrong...

One morning, we noticed that some parts of our web site had stopped working. This was our main, existing web site, not their test site or any of their new work. Index files had been uploaded, and other files had been modified so that they no longer functioned (this had a material affect of custom and operations). Upon examining the FTP directories, we noticed that files had been modified, and upon examining the logs, we saw that many other files had been uploaded, deleted, replaced and so on. The FTP logs showed that the only logins had been from OSSMedia's IP address and using their login ID

An extract of the server log - full log is much longer

This was obviously highly disturbing; OSSMedia had no authority to upload, modify or delete files on our live site, yet they clearly had. We contacted them immediately to ask what they had done and why. We got back a denial:

"we never uploaded or changed anything on server. We required FTP only for downloading image folder which was too large to download manually...."

So, we sent him the logs (a longer version of the above extract) and he still denied it!

"I again had a discussion with programmers and teams and we do not made any changes on your live server. Also as mentioned earlier we do not need to as we just had downloaded the files in order to incorporate it with demo, we never uploaded anything....." James Matthews also then got involved: "I have checked with our team and there was no unauthorized activity from our end on your server."

Now, we're reasonable people. Their unauthorised access and vandalism of our site could have been accidental - someone being careless with the FTP client or something, so if there had been an immediate admission, investigation and apology, we could have moved on but instead they just denied it. That either means that they wanted to cover it up, that they had inadequatw controls and a rogue operative/programmer who had 'stolen' the access credentials, or simpyl that they were incompetent. Any of those options are unacceptable and without a proper explanation, we could not proceed with them.

Various emails went backwards and forwards but OSSMedia still refused to give any explanation of why they had damaged/modified our web site. We asked for the issue to be escalated and that we be put in touch with management, but James and Sushant refused to put us in touch, or provide us with their names. We also asked what their real company address was for formal communication and they refused to provide that information. The USA address is not an operating location; it appears to be a mail forwarding service and all of their personnel (programmers and management) are in India - there appears to be no legitimae reason to list the USA address. As I later found out, James Matthews is not the salesperson's his real name and his Linked-in profile claims he is in Rochester, New York, USA, which he isn't. Maybe this company just wants you to believe they are American-based, and to quote directly from one of their web pages : "OSSMedia ltd is a New York based open source software development company......"

100% Moneyback guarantee

When we asked about their "100% money back" guarantee, James Matthews (not his real name) explained that it doesn't apply because they had started the work! So, it seems if you are unhappy with their work, you can have your money back as long as they havn't started work, and they won't let you look at the code produced during the project so you can't check it anyway!

As OSSMedia have not provided any of the source/PHP of the work they have done, we can't check that it is clean; if a programmer is making unauthorised changes to servers/files (either through ignorance, incompetence or negligence), who knows what else a he might have put in the code if he was rogue or incompetent. OSS have said that they will only provide the code if we agree to drop all claims against them. Imagine if your hairdresser asked you to pay before letting you look in the mirror to see what a mess he had made!

So why are we telling you this?

Is this just sour grapes on our part? Did we try to get a job done cheaply, cut corners, get burned and now want to whinge about it? Well, we certainly did hope and expect to get our job done inexpensively - OSSMedia's costing was attractive and actually money we could have afforded to write off if it had gone horribly wrong. It did go horribly wrong, and trying to get the money back through the Indian system is long-winded. You might think we were naive, that we didn't carry out enough checks, and that we were foolish to provide RW access when they only needed 'R' (actually, the latter is true), so we learned our lesson.

The reason for this posting is, however, to help others. Subcontracting CAN work, and geographically diverse companies can provide good service, so based on our experience of OSSMedia Ltd, here are our top tips:

• Take references - speak to their previous clients
• Examine their work - previous sites they have worked on
• Contact the owners of those sites for feedback, rather than just relying on the
  references that they want you to contact.
• Ask where they are based, both their legal headquarters and operational site
• Ask the names of their directors and/or CEO
• Ask what their dispute resolution process is
• Ensure that you know people's real names
• Verify real, local, landline telephone numbers
• If they offer a "100% satisfaction guarantee" ask what they mean

What about us?

We've taken all of our web development back in house. Will we ever get our money back from OSSMedia? Well, they have specifically refused that and we're advised that getting it back through formal legal means will take time and money; ultimately, through the courts we should get our money back, plus costs and interests, but it's a distraction and one I wish we'd never had. Incidentally, I should point out that this blog entry was not written with any 'warning' to them to return our money; they refused, and that is that. This piece is intended as a genuine warning to others about precautions and applies to all outsourcing companies, whether they are OSSMedia or not.

OSSMedia are still in business, so even if they were negligent, incompetent, dishonest or just poor at communication in our case (we never worked out which), perhaps they have learned some lessons and other people will be saved the cost, inconvenience and hassle of how they handled us. If they have learned nothing and will repeat these same mistakes, then hopefully this article will warn people of their competence and customers will go elsewhere.

Happy outsourcing!

Tags : Wordpress, Outsourcing, Drupal, Magento, Joomla, OSSMedia Ltd, Xicom Technolgies Ltd.