Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Huge enterprise customer wants to see our source code

news.ycombinator.com

Post reply on HN
Print view View original

111–120 of 293 posts

Re: Ask HN: Huge enterprise customer wants to see our source code

#111

Post by devit »

anonacct37 wrote: post #42

I'll offer a different pov from many other comments. I work for a fortune 50 basically doing web server stuff. Right now our security team would like to run some startups code synchronously as a module in our web server. Their code could easily cost us millions off dollars (if the outage was small). I need to make sure their sdk is free of race conditions, and has proper timeouts and throttling and has proper metrics…

Just run it in a separate process with a seccomp sandbox, using pipe/socket IPC with a timeout (if it's some anti-DoS/intrusion thing, just fail allowing the request, since it's going to have false negatives anyway).

The IPC cost should not be significant compared to the rest of the web server code.

Can also ask them to do the work and provide a small open source in-process shim that sets up and talks to the sandboxed process.

Re: Ask HN: Huge enterprise customer wants to see our source code

#112

Post by valuearb »

Clubber wrote: post #88

Another data point, but I worked for a company that made an expensive DSS for a very lucrative industry. We showed a potential "partner" our code and how it worked and everything. They took our ideas and made their own product as a direct competitor. Reminded me of Apple and Xerox. Definitely get legal council involved. A possible way to protect yourself is print it out and put it in old fashioned binders and let the…

In Apple & Xerox case, legal council was involved. Xerox actually got paid to allow Apple to see their PARC demos. And no source code was shared.

And in the end, the Macintosh was a huge leap beyond the Alto, that really didn't work much like it at all.

Re: Ask HN: Huge enterprise customer wants to see our source code

#113

Post by Jach »

nugget wrote: post #90
sheetjs wrote: post #85

Earlier quoted context omitted.

License compliance is incredibly important and unfortunately overlooked by many smaller firms. The potential liability to a GPL or other violation is just not worth it. Anecdote: We have released code under the Apache 2 License (our biggest project by far is https://github.com/sheetjs/js-xlsx ) and we've been roped into negotiations because some companies tried to take shortcuts by copying our code without proper att…

What exactly is the potential liability for a GPL violation? I've gone 12 rounds with IP lawyers over these theoretical violations (static vs dynamic links). But I found it odd that I could never find a single case of significant liability due to infringement. The nature of damages is unclear and the landscape of counter-parties (with an incentive to sue) is amorphous. It seemed like worst-case, a proven infringer ju…

I have no idea what lawyers actually think but the fears I hear about generally don't come from lawyers. The most common fear I think is "we'll be forced to release our closed code!" But no, my intuition is that even with willful violation of something licensed under e.g. the AGPL which is supposed to force such a thing on a SaaS company, the worst case is something like: the company is hit with the maximum penalty for copyright infringement and will have to shell out a few hundred thousand dollars and someone goes to jail for a few years, and the company has to immediately stop distributing/serving products with the software on them until the software is either legally licensed, legally distributed, or replaced.

Re: Ask HN: Huge enterprise customer wants to see our source code

#114

Post by anonacct37 »

IanCal wrote: post #97
awinder wrote: post #80

Earlier quoted context omitted.

Are you going to audit all of their code changes from now into perpetuity as well? It seems like you kinda alluded to the thing that would actually be effective, which is not synchronously calling external services in high-uptime-requirement applications...

I'm not sure what you mean here by external service, the solution you describe is just "build everything in house" which is possibly not reasonable.

If I read the comment right (a big if, I'm terrible at interpreting sentences that end in the middle with storm of dots and an implication), then he/she is implying that obviously we never considered running code asynchronously.

If so, this implication was inaccurate.

Re: Ask HN: Huge enterprise customer wants to see our source code

#115

Post by FireBeyond »

lasereyes136 wrote: post #14

Well, having worked for a small software startup that did just that, I can tell you what we did. We agreed to letting them audit the code with conditions. 1. The audit happened on our computers with someone from our team in control (me). I locked the computer when I wasn't physically there to watch what they did. 2. We removed the most sensitive part of the code and told them what it did. We kept the method signature…

Slightly tangential, but working for a small software company (<20 employees) who writes Line Of Business code for very large enterprise customers in the health care industry, we at times offer source code licenses, but at the very least (and this was my original point), our license as a vendor also includes source code escrow in the event of our collapse. We haven't really had anyone request a pre-sale source code review.

Re: Ask HN: Huge enterprise customer wants to see our source code

#116

Post by hoodoof »

goialoq wrote: post #110
hoodoof wrote: post #74

Earlier quoted context omitted.

Winning government work (which is probably similar to large enterprise) is all about ensuring all of the government tender requirements get a "yes" tick when considering your product, but then ensuring that your fine print gets you out of all the unsavory things you had to agree to for those "yes" ticks. You can afford at this stage of the process to underprice and beat your competition. Note that the thing you under…

You're exactly right and that makes me feel sick about how ugly the world works.

All business is a variation on this. If you're wanting to be a business person in a "nice" world where its not all about manipulation and sleight of hand then you can do that but you won't be mega successful.

Read up on Bill Gates Windows license contracts that the hardware manufacturers had to sign .... genius.

Truth is all in how you tell the story.

Re: Ask HN: Huge enterprise customer wants to see our source code

#117

Post by dogma1138 »

patio11 wrote: post #56

I think this is a signal that you're probably underpriced by a factor of 2X to 10X. So this is a sales objection. With regards to that justification, I'd want to know a) who in the business is generating it and b) what they expect to feed your answer into. Is this just somebody who wanted to sound smart in a meeting? Then they don't need your source code; they need ~5 nice PowerPoint slides and you're done. I'd be po…

I’m a security engineer at a large financial organization and we audit all 3rd party products most of these audits include a code review.

This is a compliance process and it’s controlled by the SEC.

All of your suggestions would make the company that I at least work for to simply walk away from table.

This has happened more than once and all of our contracts contain a clause that if the application does not get a pass from our application security team the procurement would not continue.

Re: Ask HN: Huge enterprise customer wants to see our source code

#118

Post by trjordan »

patio11 wrote: post #56

I think this is a signal that you're probably underpriced by a factor of 2X to 10X. So this is a sales objection. With regards to that justification, I'd want to know a) who in the business is generating it and b) what they expect to feed your answer into. Is this just somebody who wanted to sound smart in a meeting? Then they don't need your source code; they need ~5 nice PowerPoint slides and you're done. I'd be po…

Another possibility is they're worried you'll go out of business. In that case, they don't need to see the code right now. You can set up a code escrow agreement in case you cease to exist.

Re: Ask HN: Huge enterprise customer wants to see our source code

#119

Post by simonswords82 »

There's a lot of technical focus here. For me, it's about the money. If a client is going to pay me £3m to use my software, you're damn right they can review our source code. As the amount of revenue/profit declines, so too does my desire to expose my business to the risk of a source code review.

Re: Ask HN: Huge enterprise customer wants to see our source code

#120

Post by TAForObvReasons »

nugget wrote: post #90
sheetjs wrote: post #85

Earlier quoted context omitted.

License compliance is incredibly important and unfortunately overlooked by many smaller firms. The potential liability to a GPL or other violation is just not worth it. Anecdote: We have released code under the Apache 2 License (our biggest project by far is https://github.com/sheetjs/js-xlsx ) and we've been roped into negotiations because some companies tried to take shortcuts by copying our code without proper att…

What exactly is the potential liability for a GPL violation? I've gone 12 rounds with IP lawyers over these theoretical violations (static vs dynamic links). But I found it odd that I could never find a single case of significant liability due to infringement. The nature of damages is unclear and the landscape of counter-parties (with an incentive to sue) is amorphous. It seemed like worst-case, a proven infringer ju…

Most cases are settled out of court or aren't publicized.

https://sfconservancy.org/docs/2010-07-27_dj-opinion.pdf interesting read

Post reply on HN