Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Huge enterprise customer wants to see our source code

news.ycombinator.com

Post reply on HN
Print view View original

161–170 of 293 posts

Re: Ask HN: Huge enterprise customer wants to see our source code

#161

Post by awinder »

anonacct37 wrote: post #114
IanCal wrote: post #97

Earlier quoted context omitted.

I'm not sure what you mean here by external service, the solution you describe is just "build everything in house" which is possibly not reasonable.

If I read the comment right (a big if, I'm terrible at interpreting sentences that end in the middle with storm of dots and an implication), then he/she is implying that obviously we never considered running code asynchronously. If so, this implication was inaccurate.

I’m not saying that it wasn’t considered, I just don’t know that a one time code audit offers sufficient downtime protection for me. If you’re worried about an external service being in the critical path then taking it out of the critical path seems like the only foolproof approach.

Re: Ask HN: Huge enterprise customer wants to see our source code

#162

Post by Clubber »

valuearb wrote: post #112
Clubber wrote: post #88

Another data point, but I worked for a company that made an expensive DSS for a very lucrative industry. We showed a potential "partner" our code and how it worked and everything. They took our ideas and made their own product as a direct competitor. Reminded me of Apple and Xerox. Definitely get legal council involved. A possible way to protect yourself is print it out and put it in old fashioned binders and let the…

In Apple & Xerox case, legal council was involved. Xerox actually got paid to allow Apple to see their PARC demos. And no source code was shared. And in the end, the Macintosh was a huge leap beyond the Alto, that really didn't work much like it at all.

>the Macintosh was a huge leap beyond the Alto

I would say it was a significant iteration, not a leap. iPhone was a leap.

Re: Ask HN: Huge enterprise customer wants to see our source code

#163

Post by raverbashing »

dogma1138 wrote: post #117
patio11 wrote: post #56

I think this is a signal that you're probably underpriced by a factor of 2X to 10X. So this is a sales objection. With regards to that justification, I'd want to know a) who in the business is generating it and b) what they expect to feed your answer into. Is this just somebody who wanted to sound smart in a meeting? Then they don't need your source code; they need ~5 nice PowerPoint slides and you're done. I'd be po…

I’m a security engineer at a large financial organization and we audit all 3rd party products most of these audits include a code review. This is a compliance process and it’s controlled by the SEC. All of your suggestions would make the company that I at least work for to simply walk away from table. This has happened more than once and all of our contracts contain a clause that if the application does not get a pas…

Why would a financial product have a compliance procedure by the FCC?

> All of your suggestions would make the company that I at least work for to simply walk away from table.

Unless the company is already a customer and is paying for the development of the software, please do walk away from the table, I'm sure they have better things to do and better customers to sell to

Re: Ask HN: Huge enterprise customer wants to see our source code

#164

Post by johannes1234321 »

DoofusOfDeath wrote: post #126
provost wrote: post #96

Earlier quoted context omitted.

One thing I would note is that the individual employee might not be authorized to sign a legal document, such as "a non-compete and or a non-disclosure". My company informs us told to actively refuse to sign any legal documents (even at visitor check-in) -- we have a Legal team for that. All documents should be signed by Legal before I step on site.

Out of curiosity, are you barred from installing software on company computers, because you're either explicitly or implicitly accepting an EULA?

This is a common thing in many larger corporations. Some even lock down machines quite a lot. I have seen multiple cases where this lead to laptops for dev work which weren't connected to the company's network.

Re: Ask HN: Huge enterprise customer wants to see our source code

#165

Post by notatoad »

IanCal wrote: post #97
awinder wrote: post #80

Earlier quoted context omitted.

Are you going to audit all of their code changes from now into perpetuity as well? It seems like you kinda alluded to the thing that would actually be effective, which is not synchronously calling external services in high-uptime-requirement applications...

I'm not sure what you mean here by external service, the solution you describe is just "build everything in house" which is possibly not reasonable.

The solution is to build in-house or to acquire the vendor for any systems you need to run synchronously inside your multi-billion-dollar revenue stream. Which doesn't seem unreasonable, and seems like a good motivation to architect that stream so third-party products don't have to be run synchronously.

Re: Ask HN: Huge enterprise customer wants to see our source code

#167

Post by twotwotwo »

patio11 wrote: post #135
twotwotwo wrote: post #127

Earlier quoted context omitted.

How specifically did the request for source code signal to you that the vendor's charging too little? You suspect the customer is worried that the product is really nothing because it's priced so low? High prices from a vendor signal they mean business and ward off fiddly objections? (I'd expect the opposite, higher price => higher stakes => more interest in knowing just what you're purchasing.) That an ML product wi…

How specifically did it signal to you that they're underpriced? Because the poster is surprised by this requirement and doesn't have standardized answers to it yet. In poker, there is this thing called "assigning a range" to someone based on their actions. You can't see their cards, but their actions might give you signal where you could say "Hmm, playing like they have a middle pocket pair and not totally air nor a…

Ah, that's very helpful. As you could see from my reply I was reaching for reasons you might think their pricing was low without knowing their pricing, and this makes more sense than the ones I came up with.

Re: Ask HN: Huge enterprise customer wants to see our source code

#168

Post by rajacombinator »

patio11 wrote: post #135
twotwotwo wrote: post #127

Earlier quoted context omitted.

How specifically did the request for source code signal to you that the vendor's charging too little? You suspect the customer is worried that the product is really nothing because it's priced so low? High prices from a vendor signal they mean business and ward off fiddly objections? (I'd expect the opposite, higher price => higher stakes => more interest in knowing just what you're purchasing.) That an ML product wi…

How specifically did it signal to you that they're underpriced? Because the poster is surprised by this requirement and doesn't have standardized answers to it yet. In poker, there is this thing called "assigning a range" to someone based on their actions. You can't see their cards, but their actions might give you signal where you could say "Hmm, playing like they have a middle pocket pair and not totally air nor a…

No strat talk on hn bro ... ;)

Re: Ask HN: Huge enterprise customer wants to see our source code

#169

Post by jethro_tell »

trjordan wrote: post #118
patio11 wrote: post #56

I think this is a signal that you're probably underpriced by a factor of 2X to 10X. So this is a sales objection. With regards to that justification, I'd want to know a) who in the business is generating it and b) what they expect to feed your answer into. Is this just somebody who wanted to sound smart in a meeting? Then they don't need your source code; they need ~5 nice PowerPoint slides and you're done. I'd be po…

Another possibility is they're worried you'll go out of business. In that case, they don't need to see the code right now. You can set up a code escrow agreement in case you cease to exist.

no, every big enterprise I've worked for we do source audits on everything that is allowed to run. We check for phoning home, we check for license issues, we check for massive security vulnerabilities. It's just a cover your ass kinda thing when 100k people are going to run an app. There's a whole department for that.

Re: Ask HN: Huge enterprise customer wants to see our source code

#170

Post by Terr_ »

lsaferite wrote: post #133
dogma1138 wrote: post #117

Earlier quoted context omitted.

I’m a security engineer at a large financial organization and we audit all 3rd party products most of these audits include a code review. This is a compliance process and it’s controlled by the SEC. All of your suggestions would make the company that I at least work for to simply walk away from table. This has happened more than once and all of our contracts contain a clause that if the application does not get a pas…

> controlled by the FCC I'm guessing this is a typo?

Or perhaps bad voice-recognition for SEC?
Post reply on HN