Source Control: Anything But SourceSafe

August 16, 2006

Everyone agrees that source control is fundamental to the practice of modern software development. However, there are dozens of source control options to choose from. VSoft, the makers of FinalBuilder, just published the results of their annual customer survey. One of the questions it asked was which version control systems do you currently use, or plan to use, in the next 12 months?

Source control adoption graph, May 2005 to August 2006

The top 9 responses are reprinted here. I'm disheartened to see that Visual SourceSafe is still at the top of the list. If you are serious about the practice of software development, you should not be using SourceSafe. This isn't a new idea; plenty of other developers have been warning us away from SourceSafe for years:

There's simply no reason to use SourceSafe when there are so many inexpensive (and even free) alternatives that are vastly superior. The more customers I visit, and the more developers I talk to, the more I believe that SourceSafe poisons the minds of software developers. Note that I include our own shop, Vertigo Software, in this list.

  • SourceSafe gives you the illusion of safety and control, while exposing your project to risk.
  • SourceSafe teaches developers bad habits: avoid branching, exclusive locks, easy permanent deletions.

SourceSafe was a perfectly adequate source control system in the late 90's. Unfortunately, SourceSafe was never updated architecturally to reflect modern source control practices. Even the latest version, SourceSafe 2005, absolutely reeks of 1999. And, to be fair, some of the same criticisms apply to CVS. CVS is no longer a modern source control system, either; it doesn't even support the concept of atomic checkins.

One of my biggest hurdles has been unlearning all the bad things SourceSafe taught me about source control. Source control is the absolute bedrock of software engineering. It's as fundamental as it gets. If my knowledge in this area isn't deep, wide, and fundamentally sound, can I really call myself a software engineer?

So, how do we learn modern source control?

  1. Start with Eric Sink's Source Control HOWTO. Eric is self-admittedly biased because his company created SourceGear Vault, but he's up front about this. He has truly lived and breathed the topic of source control, and it shines through in his excellent writing.
  2. The online Subversion manual is well worth your time. The first few introductory chapters, starting with Chapter 2: Basic Concepts, are wonderful primers.
  3. Chris Birmele's paper on Branching and Merging is the best introduction I've found to this essential source control task. There are dozens of ways to branch, and no one correct way to do it. Get familar with your options so you know what the tradeoffs are with each one.

Visual SourceSafe was most Microsoft developers' first introduction to any kind of source control at all. That's great. But holding on to SourceSafe's archaic source control conventions is doing more damage than good these days. Make the switch to Team System, Subversion, or any other modern source control system of your choice.

But whatever you do, please don't use Visual SourceSafe. Think of the children.

Posted by Jeff Atwood
133 Comments

I'd recommend taking a look at the stream-based products if you are managing multiple releases and are having difficulty with branching and merging. Of course one of the tools is 1/10th the cost of the other, but see Accurev and ClearCase.

Here's a good comparison between branches and streams:
http://www.daveonscm.com/

Good luck with those using VSS.

Mark

Mark on October 3, 2007 8:49 AM

BryanV --

My recommendation: pay for Subversion support. There are a number of vendors who will happily charge your employer to support Subversion. Some of them will even host and maintain your repositories as well.

Cheers!

RG on October 6, 2007 11:38 AM

I have personally used several version control tools. Actually, I do not think SourceSafe is a bad version control tool. Like many the other comments in this thread, i also think SourceSafe is effective tool for small teams.

The biggest drawbacks of SourceSafe are poor remote access performance and possible data corruption (especially for remote access). Without these drawbacks, there willnot be somany compalins about SourceSafe. :)

There are two tools that have all the benefits of SourceSafe and fix all the sourcesafe issues:
1. Dynamsoft SourceAnywhere Standard.
http://www.dynamsoft.com/Products/SAWstandalone_Overview.aspx

2. Sourcegear Vault
http://www.sourcegear.com/vault/index.html

I see that there are less discussions about SourceAnywhere Standalone than Vault, may because of SourceAnywhere is a newer product.

Tim on October 11, 2007 5:26 AM

Ever think that maybe the problem isn't with sourcesafe, but you? We use source safe to manage hundreds of products and don't have any of the issues with it that you're seeing. But, then again, we didn't start with any of the open source stuff, so we're not trying to get source safe to do things it wasn't designed to do. And, in our opinion, the stuff you want it to do don't make much sense. I think the problem is you're too mired in your old way of doing things and rather than just learning something new, you bitch. Get over yourselves, please. There's a reason source safe is the #1 version control: it works.

Devgod on October 18, 2007 8:29 AM

We (~15 developers) use Sourcesafe since more than 10 years for hundreds of projects in one database and never experienced any problems with it. Sometimes we run ssarc and remove old trash and we use an infinite number of labels and checkin/outs.

Bob Gosnell on October 24, 2007 3:43 AM

We evaluated both Vault and SourceAnywhere. There are stability issues in Vault. We even lost our whole repository once (not visible from the client side). SourceAnywhere seems stable and several times faster.

Walker on December 7, 2007 6:31 AM

Hi!

I want to switch from CVS to Source safe. Is there a migration tool I can migrate my repository from CVS to Source safe with?

Tamas on February 7, 2008 5:36 AM

We switched from VSS to SourceGear Vault and we love it! Incidenatlly, we use Beyond Compare for diffs, a great combination!

Dennis on April 6, 2008 3:07 AM

Even a one person development effort should keep a source code archive of some sort even if it is just versioned zip files. A source control tool should be unobtrusive and give you an intuitive and time saving interface for managing the source archive when that is necessary.

I've had some experience with Clearcase, CVS, and PVCS. Managing my source code shouldn't take as much of my time as those packages required.

I've used VSS at several jobs over the last 10 years. It's not perfect but it works and it's relatively inexpensive.

I think we had some trouble with VSS corruptions at a job way back in 1999/2000 but I've not seen any serious problems since then. Using it over a VPN was crazy slow but VssConnect solved that for the short time we needed it.

We are using VSS now and after seeing the comment about the 2GB database size, I just verified that ours is up over 2.5GB in size. So I am a little worried but not overly so. Our data is automatically backed up daily and once in a while I back everything up again before the occasional major operations like branches. Yes, branching/sharing are problematic in VSS and I wish MS had done that better but it is what it is. If VSS gets corrupted, then we'll have to retrieve an uncorrupted version from the backups. If you don't back up your data then you are just asking for trouble.

The integration of VSS with Visual Studio is nice. I rarely notice a delay when I start typing and the file is automatically checked out. I'm not too interested in any source control tools that require me to open another interface to check in/out or merge back in - whatever your tool requires you to do. I even begrudge the time I have to open the VSS UI to create labels and do other minor tasks.

We are considering moving to Team System but we're going to have to try it out first and then we are going to have to convince our management to pay for it... I don't think I could ever trust an automated merge. As someone said, one reason people stick with what they have is that change can be costly/problematic.

VSS and the rest of the source control systems are just tools. Use the tool that is appropriate for the job - whatever gets the job done and makes it easier for you and your team. If I start developing in a different IDE that doesn't integrate with VSS then I might consider a different source control tool. I know that if I was archiving lots of binary files (multimedia development) then VSS would not work very well. If something besides VSS makes your job easier, then promote it for your scenario but don't get emotional about it and call it names just because it failed you at some point. Maybe you failed to use VSS properly just as I may have failed to use Clearcase properly. Or perhaps I was trying to use a sledgehammer to set finishing nails.

Some people like cake and some people like pie and some people like both. I want them both AND some ice cream but I've got to be careful because they all tend to be fattening and cost money. I think I'll go check out that "free 2-person" version of Perforce.

mapsehtpots on April 10, 2008 9:35 AM

Has anyone tried QVCS?

Wondering on April 13, 2008 9:43 AM

Thanks for such a good article.

Martin on May 13, 2008 11:49 AM

S ,what would be the recommended free source management tool?

mbowles on June 20, 2008 9:54 AM

I know that many people have issues or complaints on the history of BitKeeper from BitMover, but having used it, CVS, PVCS, VSS and Vault, I would have to say that it has been the best product I've used.

There are a lot of arguements from the open source developers that the cost is high. I would agree, it is expensive, especially when you're in the business of developing free software. If you're in the business of profiting from your development efforts, the cost is still a factor, but one might argue that the benefits out weigh the cost. I like it so much that I use it for my small side business to manage my codebase and I'm the primary developer.


I like not having to have a centralized server, the ability to put hooks/triggers into the checkin/checkout process, the ability to clone multiple times to quickly create working projects while it manages the complexity of merging changesets back. You can be on an airplane and clone from your local repository to quickly make a new beta build or try something new. If you don't like it, just delete the clone and do it again if you'd like.

The key to BitKeeper like any other system is to understand that by itself, it's not the complete solution. You must understand how your business deploys / distributes code/hotfixes/QA builds, etc... Knowing that, BitKeeper makes it EXTREMELY easy to glue it all together and provide for a very reliable Change Management tool that helps prevent you from forgetting to check in a piece of code or add a new one to the repository (VSS). BitKeeper will alert you of those and ask if you want them to participate in the current changeset. If not, no worries, your work in progress won't impact the up-stream repositories.

It's a beautiful product. The people at BitMover are very nice to work with and even though most say that the licensing is expensive, but if you have a large development team the cost of licensing bitkeeper is nothing compared to the salaries you're probably paying.

George

George Peters on July 18, 2008 1:45 PM

I'm a software configuration manager who has administered SCCS, RCS, CMVision, MKS Source Integrity, MS Visual SourceSafe, Continuus, and ClearCase. What I found is that software developers usually don't think SCM is important until they've been bit by the alligator. Without decent configuration management, developers make foolish mistakes in managing their code that would make the angels weep.

Working in all types of situations, little companies and big corporations, government and commercial, my observation is that almost all code shops are mom pop operations with few controls. They rely on heroics to get code out the door, not process. The worst example of this I've seen is Sabre, the reservation company for American Airlines. They had no idea where the code for their systems was. They were interviewing me to go find it. Consequently, they could not update their system because all they had were the executables. That's what happens when all you think about is making your deadline.

Part of the reason that developers screw up CM is that they are improperly trained at their universities. They are given an assignment which they do solo and turn it, never to rework it nor version it. They are not trained to preserve their work nor exercised in the software development process. It's like learning to fly but never learning to use the air traffic control system.

Another problem is that software developers tend to think of themselves as artists rather than engineers. Artists just do what they want to do and heroically save the day. Engineers build up processes which they relentlessly repeat to increase the quality of their work. Much of the bellyaching here seems more like the typical objection to having CM at all. Developers generally have a shorter term focus than their organization. They only care about delivering the release they're currently working on. Their organization has the larger concern of preserving that release and being able to reproduce it or retreat to it. That puts developer and organization in contention.

It's amazing to me how many shops I've worked where the developers bitch about doing CM but quietly spend days trying to reassemble releases they've lost or misplaced. They never have time to do it right but always have time to do it over. It's like they don't get it. If you don't use a CM tool, it's like not using a refrigerator for your food, laying it out on your patio instead. It's not likely to be there in a couple weeks.

That said, VSS is OK for garage shop operations. If you only have one or two developers working on a simple application, it's simple and free. I don't much care for it because it appears MS just kind of winged the application, not referring to any of the rather considerable body of knowledge on SCM. If SCCS and RCS are the flint axes of SCM, then MS VSS is the bronze sword.

Personally, MKS Source Integrity is the nicest of the low end tools, most of which are pretty much the same. You don't want to do branching in any of them. SI was easy to manipulate and it had a wonderful admin console. It took a long time to pull in the code to build a release.

ClearCase is a pretty good CM tool. You will never lose your code. Once it goes in the database, it's like a fly trapped in amber. If you back up the database, you're bulletproof. I've had my entire ClearCase application and archive wiped clean off the server and had it all back up and running in a couple days, as soon as the tape came back from the archive.

When properly installed on the correct equipment and competently administered, ClearCase runs like a champ. It's the implementation where most ClearCase problems arise.

First, there is a bottleneck in training CC admins because they have to train on the job with developers as their lab rats. There is usually only one CC admin in a code shop. Usually there is nobody with any useful expertise who can help him in the nitty gritty of CC administration.

Second, ClearCase is not an intuitive program, particularly when using UCM. It also lacks guard rails for the users, who can hang up their client with enough determination. The problem is that ClearCase was not designed but rather evolved. Nobody modeled what developers did and worked back to the code. They built it up from the RCS utility, adding features to use the RCS better but never thinking through the whole process. Therefore, it's confusing for the users.

ClearCase is the Stealth bomber of SCM. If you don't train the users how to fly it properly, they'll run it into the weeds on takeoff. Training is essential. The developers get frustrated when the tool doesn't respond as expected or it seems complicated to figure out.

Third, ClearCase needs a good server and network. If you don't have those, you will be plagued with problems. There are discount companies and government organizations who will spend a million bucks on the Rational tools but scrimp on the platforms which deliver it, shooting themselves in the foot.

Fourth, the biggest enemy of ClearCase is the system administrator. There's nothing a user can do to ClearCase that can't be undone, usually in less than five minutes. The ClearCase admin can screw things up moderately, but can fix them with enough work. However, a careless sys admin can screw ClearCase up so that it's spitting up blood. Most of the time it boils down to permission problems within the database and views.

Steve Gregg on July 25, 2008 3:09 AM

I've used VSS, ClearCase, a half-dozen or so free or lowcost systems, MS's old SLM, and MS's internal SourceDepot (SD.) I believe SD is a licensed fork of Perforce, bought and internalized by and for MS.

VSS sucks because it has too many limitations, a goofey kludgey command line interface with commands that end up looking like code out of the obfuscated Perl contests of old, and tends to get flakey on the client side or blow up on the server side. A SCC tool that can't guarantee the integrity of it's repository and file history is worse than no tool at all. VSS also omits, changes the meaning of, or simply does not even address so many common SCC operations that it's laughable. VSS is a toy that, were it not basically free and did not come bundled and already integrated with VS it would not exist. My guess is MS does not want to invest in it because it's basically a freebie, it's like fuzzy mirror dice thrown in with VS.

ClearCase is an absolute abomination. I worked at Rational for years, and we were forced to use it the whole time. Bleck! I could write encyclopedias on its problems. Suffice to say that I, like some others who have posted here, would only work at a ClearCase house as a last resort and only if it were the last and only job I could find! It is true that in some types of scenarios ClearCase works well for builders and the SCC sys admins, but that's about the only not-horribly-negative thing I can say about it.

I did a stint as a Vista builder at a certain SW company between jobs and used their fork of Perforce. Simply the best tool I've ever used. Everything it does is available trivially at the command line, it does only what you ask, you can create, modify, and delete enlistments at will from the command line (or Explorer, etc) simply by creating/modifying two little trivial text files on your local hard drive, powerful sync/merge/branch/etc facilities.

And... and... all of that with very little overhead. You want to work on files offline or hijacked or whatever? Fine. Just change the files in question to RW. The server does not maintain file state information about your client or whatever anyways, just change to RW and work away.

You want to put your offline/hijacked changes under control again?? No sweat - just tell the tool you want to go online. It scans your enlistment, detects controlled files that have changed, and automagically checks them out to you. On and on it goes

Lance on July 30, 2008 6:25 AM

Someone was asking about checkout-edit-checkin for binary files.

I would suggest that you're not really talking about source code control, but document management (now renamed ECM).

Take a look at Interwoven WorkSite, or OpenText LiveLink ECM, or EMC Documentum. You'll probably find that these are all way too expensive, but there really doesn't seem to be a smaller-scale or open source alternative.

Richard Gadsden on August 3, 2008 3:31 AM

I use CVS (or CVSNT, to be precise). It has a lot of cool features and the coming of age of WinCVS makes a big difference to its usability.

I would switch to Subversion, because of its philosophy of commiting changes across an entire repository rather than on a per-file basis, but I have too much invested in the way I do things now.

Paul Sanders
www.alpinesoft.co.uk

Paul Sanders on August 7, 2008 4:46 AM

I use CVS (or CVSNT, to be precise). It has a lot of cool features and the coming of age of WinCVS makes a big difference to its usability.

I would switch to Subversion, because of its philosophy of commiting changes across an entire repository rather than on a per-file basis, but I have too much invested in the way I do things now.

Paul Sanders
http://www.alpinesoft.co.uk

Paul Sanders on August 8, 2008 3:26 AM

VSS and the rest of the source control systems are just tools.
VSS is SCM that can't even manage itself. It's a VCS that makes it *HARD* to manage source code changes. So, what's the point of using VSS?

IMO, Anyone, anyone still using SourceSafe needs to get a clue. This is 2008, not 1998, guys. You're *PAYING* for a product that's much, much, MUCH, MUCH inferior. I'm not kidding, it's *REALLY INFERIOR* to pretty much any other SCM software.

Joo M. on August 27, 2008 8:20 AM

Making zip files is still very useful.

Many times I've regretting not making an extra zip file to augment the source control work.

In a multi-developer environment, this is really important.

We work where everything gets shared instantly and there is no private sandbox so extra care must be taken with everyhing.

We use MSVSS, would like to switch but there just isn't time to port to a new system of source control.

Joseph on September 3, 2008 4:34 AM

I actually worked in a place as late as 2004 where there was absolutely no source control in use. It was a web project and not only was there no source control, but there were no dev sandboxes. Everyone worked off of a central server. That's right... there was exactly one copy of the code for all developers. I tried talking some sense into them but was looked at like I came from Mars, because that was the way they had always done it. Each developer just had to keep track of which file they were working on.

Chris on September 3, 2008 8:37 AM

I'm a subversion/trac/nunit/cruisecontrol admin and user. I am always staggered to find people trying to do professional development without proper ticketing, unit testing and continuous integration let alone source control! My first experiences were with PVCS and VSS. When using VSS our contracters used MS's Source Off Site which they referred to as Source Of Sh*te. What a revelation it was to discover subversion even back in the early releases!

Felix on October 16, 2008 2:33 AM

latest version of the finalbuilder survey results (aug 2008): http://www.finalbuilder.com/blogs.aspx?EntryID=264

AJ Finch on December 2, 2008 7:33 AM

Thanx for the nice post Informative one......really appreciated.

http://www.commediait.com

arnold on February 25, 2009 12:46 PM

You may also try SCM Anywhere. It is a SQL Server-based software configuration management (SCM) tool with fully integrated version control, bug tracking and build automation. It is for teams looking for an integrated solution to manage the whole software development life cycle.

SCM Anywhere Hosted is delivered as a SaaS application. Free hosting plan is available:
a href=http://www.scmsoftwareconfigurationmanagement.com/Products/SCMHosted_Plan.aspxhttp://www.scmsoftwareconfigurationmanagement.com/Products/SCMHosted_Plan.aspx/a">http://www.scmsoftwareconfigurationmanagement.com/Products/SCMHosted_Plan.aspx/a">http://www.scmsoftwareconfigurationmanagement.com/Products/SCMHosted_Plan.aspxhttp://www.scmsoftwareconfigurationmanagement.com/Products/SCMHosted_Plan.aspx/a

Thanks.

Catherine

Catherine on May 14, 2009 1:27 PM

Hey Jeff, this is a worthy poll (which version control systems do you currently use, or plan to use, in the next 12 months?) that may stand for a new one given that this one is dated 2006. I think it'd be telling given how far source control has come these days with things like distributed version control. Maybe you can post an update?

Ref: http://www.codinghorror.com/blog/archives/000660.html

Chess on May 26, 2009 8:31 AM

I agree w/ the previous post. Is an update available which would show current popular source control solutions?

Anonymous on June 11, 2009 3:46 AM

I second that an update here would be awesome

Andrew on June 23, 2009 3:19 AM

Sourcesafe is one of the best products of Microsoft.
If you don't know how to use it, blame yourself.

Frans nagel on August 17, 2009 1:33 PM

Love the rants.

I don't agree that source control systems are "fundamental" to development, but that's not to say that they aren't extremely useful in the vast majority of development projects.

I pick Subversion; it's rock-solid in its core competency, free, and has tons of support including front-end support via TortoiseSVN, VisualSVN, RapidSVN, etc.

ClearCase is a Rational product - 'nuff said.

Aaron G on February 6, 2010 9:51 PM

Maybe version control stubs could be in separate folder and not in every folder? Like myproject/source and myproject/stubs. This way source-folder do not have any stubs, because they are all in the stubs-folder.

Don on February 6, 2010 9:51 PM

FWIW, MS uses its own fork of Perforce internally (much like SQL Server was originally a fork of Sybase).

anon on February 6, 2010 9:51 PM

I'd like to note that I added this page to my list of links speaking against Visual SourceSafe on the Better SCM Site’s Version Control Systems to Avoid page. Thanks!

www.shlomifish.org on June 13, 2011 7:52 AM

«Back

The comments to this entry are closed.