Live data from Hacker News

Ask HN: Huge enterprise customer wants to see our source code

news.ycombinator.com

141–150 of 293 posts

Re: Ask HN: Huge enterprise customer wants to see our source code

#141

Earlier quoted context omitted.

You're exactly right and that makes me feel sick about how ugly the world works.

All business is a variation on this. If you're wanting to be a business person in a "nice" world where its not all about manipulation and sleight of hand then you can do that but you won't be mega successful. Read up on Bill Gates Windows license contracts that the hardware manufacturers had to sign .... genius. Truth is all in how you tell the story.

I remember the day a friend explained to me that MS Word, Internet Explorer, and MS Frontpage were the same DLL just with different entry points.

Re: Ask HN: Huge enterprise customer wants to see our source code

#142
I'm not experienced with these types of situations but my common sense is telling me that you could, and should, make a high level design presentation.

That could include snippets of code where appropriate to show exactly how decisions are being made.

This presentation will likely benefit you in the future.

Re: Ask HN: Huge enterprise customer wants to see our source code

#144
No way in hell would I show my code if that was my gold. But if you don't get the business otherwise, you have a choice to make. In my experience, people and corps are bastards and will say anything to get what they want. Don't be a sucker, be wise.

Provide a counter offer. If they want to see your code, counter with "we will show our code when you provide a 10 year contract with X dollars per month/year". Then I would do it.

They are covering their ass, so cover yours. People and businesses who are strong, respect others that are strong.

All my clients will rip me off if I let them. ALL OF THEM. They can't help it. If you asked your cable company "can I have free cable for a year?" And they said "yes", wouldn't you take it? That is what is happening to you. They are testing you.

If you are desperate and foolish, they get your code for free. If you are brave and wise, they get a good partner.

Take a leap of wisdom.

Re: Ask HN: Huge enterprise customer wants to see our source code

#145

I'll offer a different pov from many other comments. I work for a fortune 50 basically doing web server stuff. Right now our security team would like to run some startups code synchronously as a module in our web server. Their code could easily cost us millions off dollars (if the outage was small). I need to make sure their sdk is free of race conditions, and has proper timeouts and throttling and has proper metrics…

After my first skim of your post, I thought you might have had a huge misunderstanding of what a "race condition" was.

Re: Ask HN: Huge enterprise customer wants to see our source code

#146

Earlier quoted context omitted.

I’m a security engineer at a large financial organization and we audit all 3rd party products most of these audits include a code review. This is a compliance process and it’s controlled by the SEC. All of your suggestions would make the company that I at least work for to simply walk away from table. This has happened more than once and all of our contracts contain a clause that if the application does not get a pas…

Thank you for your comment. Can you add, for the benefit of the peanut gallery, what the typical cost of a one year software license you pay for is? I have a good guess but I think HNers need to hear people-other-than-me say it to internalize it.

Not OP, but we were in the same situation and required source review. We negotiated escrow, the whole shebang. License costs for our enterprise was multi-year and ran over $15 million for the project for this one app. It's not an odd or rare request.

Re: Ask HN: Huge enterprise customer wants to see our source code

#147
Give them a test: if they are reasonable they will respond to anything reasonable in a reasonable way. So ask them in detail why they want to do this, how they want to do it, are there alternatives. If they answer in a fair and honest fashion, then propose some way to solve their problem in a way that is fair to you. There are lots of good suggestions here: third party, at your site, hiding the secret sauce, etc.

If they are bullies, irrational, arrogant or silly, then save yourself lots of headaches and very nicely say its not something you can do.

Re: Ask HN: Huge enterprise customer wants to see our source code

#148

Well, having worked for a small software startup that did just that, I can tell you what we did. We agreed to letting them audit the code with conditions. 1. The audit happened on our computers with someone from our team in control (me). I locked the computer when I wasn't physically there to watch what they did. 2. We removed the most sensitive part of the code and told them what it did. We kept the method signature…

Slightly tangential, but working for a small software company (<20 employees) who writes Line Of Business code for very large enterprise customers in the health care industry, we at times offer source code licenses, but at the very least (and this was my original point), our license as a vendor also includes source code escrow in the event of our collapse. We haven't really had anyone request a pre-sale source code r…

> our license as a vendor also includes source code escrow in the event of our collapse

Wow, I've never heard of this before - it sounds great!

Do you advertise this on your website, or is it just buried in the terms and conditions? I was just wondering how you might get across this info without worrying potential customers with the mere mention of collapse?

Re: Ask HN: Huge enterprise customer wants to see our source code

#149
post #10

I ran a SAAS company for 8 years, going from zero to double-digit million rev per year. The answer is a clear no. They can PAY YOU to make custom plots/charts/reporting or run queries if they want to understand what it does better. There is almost always a way to achieve any business goal without requiring source code. The only case I can think of source code needing formal verification by a third party is if you're…

Have you actually dealt with enterprise sales? Source code is a fairly typical request, and there are software escrow and audit companies specifically set up to address concerns. Microsoft, for example, gives source code access to paying enterprises and governments under the Shared Source Initiative specifically for security vetting and other auditing purposes. OP: Consult a lawyer who specializes in these matters.

Exactly, software escrow is for this type of need. Your legal team should know how to handle.

Re: Ask HN: Huge enterprise customer wants to see our source code

#150
I have run into requests like these twice.

First time the big gorilla company liked our product and they wanted it for a core process of their business. They knew we were a small startup and they wanted to be sure we were doing things properly. So they asked us for a full audit of the code by a third party company. This external company was a big consultancy and auditing company and they run something like a 'due diligence' process on us and our code. Extremely professional and clear. They never had access to the full source code, only access to pieces they requested and 'only for their eyes' during a short period of time and always supervised by us. Since we wanted to close the deal, everybody worked hard to pass this test. Later on, we signed a source code escrow agreement.

Several years later, I was a working partner for a different company and same situation with a big Telco company. Since I had the experience I was involved in the deal, but this time this company did not want to play fair and it was clear that they wanted to copy the 'magic' of our solution. Their R&D division asked for the source code and they wanted it all the time they needed to study it by themselves. It was crystal clear from the early beginning they wanted to copy us, so we did not sign the deal. Then they tried to hire the core members of our development team for their R&D division.

So the lesson here is any company can screw you if they want and you don't protect yourself. You have to take risks when you are a small company, but your code and core team are sacred. I think most companies prefer to be nice guys rather than being a gang of bastards, but it's good to be cautious.

Find a good lawyer, or better get a good advisor on your board in your company to assess you on how to deal with this kind of negotiations. And never say 'no'; say 'yes, but we would like to do it under our conditions'.

Good luck!

Post reply on HN