271–280 of 293 posts
Another data point, but I worked for a company that made an expensive DSS for a very lucrative industry. We showed a potential "partner" our code and how it worked and everything. They took our ideas and made their own product as a direct competitor. Reminded me of Apple and Xerox. Definitely get legal council involved. A possible way to protect yourself is print it out and put it in old fashioned binders and let the…
1. Everyone involved signs an NDA. 2. No property of the bank is allowed to leave the premises at any point in time. Any supporting documentation was printed out and they were allowed to review it in certain designated rooms. The documents were not allowed to leave that room and they were reviewed to make sure nothing was missing at the end. 3. Any questions must be provided in writing so there is a record of the question and response.
Most of the people in this thread clearly don't understand the situation as Analytics/ML is quite different to normal IT. 1) The company is not going to acquire you nor will they sue you. 2) They absolutely want to replicate what you've done. It's not so that they can build their own startup and compete with you. It's because they genuinely want to understand how you got the results. Companies are increasingly basing…
Best answer here. I am in the exact same situation BUT I actually share the code from the get go because of the need to understand decisions (and GDPR is going to make that even more important). If the OP company is doing something that is not possible elsewhere then fine but if they are just allowing them to goto market faster then the effort to re-engineer and get working (particularly in the AI/ML space) is pretty…
Earlier quoted context omitted.
In our case it has always been something our large clients request and expect as part of any project we work on, rather than something we advertise as a feature of working with us. Most companies will dictate that you use an escrow provider from their "preferred suppliers" list.
Any suggestions for that “preferred suppliers” list?
So what our clients dictate is probably irrelevant to your needs.
Earlier quoted context omitted.
License compliance is incredibly important and unfortunately overlooked by many smaller firms. The potential liability to a GPL or other violation is just not worth it. Anecdote: We have released code under the Apache 2 License (our biggest project by far is https://github.com/sheetjs/js-xlsx ) and we've been roped into negotiations because some companies tried to take shortcuts by copying our code without proper att…
I don't understand how license compliance matters here. Why does the big customer care about whether the seller has violated licenses? The seller would be the one in trouble, not the customer.
I'll offer a different pov from many other comments. I work for a fortune 50 basically doing web server stuff. Right now our security team would like to run some startups code synchronously as a module in our web server. Their code could easily cost us millions off dollars (if the outage was small). I need to make sure their sdk is free of race conditions, and has proper timeouts and throttling and has proper metrics…
Just run it in a separate process with a seccomp sandbox, using pipe/socket IPC with a timeout (if it's some anti-DoS/intrusion thing, just fail allowing the request, since it's going to have false negatives anyway). The IPC cost should not be significant compared to the rest of the web server code. Can also ask them to do the work and provide a small open source in-process shim that sets up and talks to the sandboxe…
It's a question of devops- if this thing dies, or changes in negative ways, do I have the power to fix it internally? Or am I calling an outside company during business hours only to request that they please look at my problem?
That's the danger large companies face when deciding if they should depend on an external vs build it internal.
Everyone in here is generally giving you the right advice. If you want someone to help specifically advise, guide you through the process, and potentially represent you in negotiations, feel free to get in touch and I can probably help. By way of background, I primarily work with investors who are selling middle-market software companies to larger companies (over 80 or so personally and oversaw another 80 or so, over…
To me it’s clear that there are lots of possible scenarios with lots of possible “right” decisions. Without more info, i doubt anyone can give better advice than what’s on this forum.
Certainly a professional should be able to give better advice but only after they get more info on the specifics.
Good luck!
Earlier quoted context omitted.
I’m a security engineer at a large financial organization and we audit all 3rd party products most of these audits include a code review. This is a compliance process and it’s controlled by the SEC. All of your suggestions would make the company that I at least work for to simply walk away from table. This has happened more than once and all of our contracts contain a clause that if the application does not get a pas…
Why would a financial product have a compliance procedure by the FCC? > All of your suggestions would make the company that I at least work for to simply walk away from table. Unless the company is already a customer and is paying for the development of the software, please do walk away from the table, I'm sure they have better things to do and better customers to sell to
>Unless the company is already a customer and is paying for the development of the software, please do walk away from the table, I'm sure they have better things to do and better customers to sell to
This sentiment is similar to things I hear all of the time working in health care / biotech. The fact is you have no domain knowledge and not a clue as to how things work in the real world. If your company just ignores the way things are done and the requirements of the domain you're simply going to go out of business.
When the stakes are high (e.g. death/harm, massive financial losses, etc.) the business process changes accordingly.
> How would you respond? In these situations it's best to ask yourself a simple question: what would Coca-cola do if they asked to see the formula.
Bad analogy. Better one is: If you hired a photographer would you expect the RAW files ? I would.
Earlier quoted context omitted.
Any suggestions for that “preferred suppliers” list?
If there is a preferred suppliers list in operation, you don't pick those suppliers your client does. And it will often be relatively local, at least country local, companies in my experience, presumably for legal jurisdiction reasons. So what our clients dictate is probably irrelevant to your needs.