Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Huge enterprise customer wants to see our source code

news.ycombinator.com

Post reply on HN
Print view View original

281–290 of 293 posts

Re: Ask HN: Huge enterprise customer wants to see our source code

#281

Post by alehul »

YeGoblynQueenne wrote: post #263

I'm willing to be that the same company wouldn't ask Microsoft or IBM to see the source code of the software they buy from them. So I'd start by wondering why they can't treat your software, too, as the proprietary black box it is. Is it because they're aware that you can't convincingly threaten them with litigation? Do they think you're too small to protect yourself effectively from the danger of IP theft? If that i…

They likely won't treat your software the same way unless they can hold you liable for damages to the same extent.

With a startup I was working on, we managed to get meetings with the CEO of the world's largest fashion company and several others with $10b+ revenue. A universal issue, however, was that we were bootstrapped and lacked the funding to insure against their losses, which for them meant unchecked liability.

Re: Ask HN: Huge enterprise customer wants to see our source code

#282

Post by rhizome »

aquadrop wrote: post #185
bonestamp2 wrote: post #108

Earlier quoted context omitted.

> I found the legal community's focus on this area out of step with their otherwise well-measured calculations of risk and reward. That seems true with pretty much any legal area. But, it's not their job to calculate risk, it's their job to tell you what is legal. It's management's job to decide if they want to take the risk or take the legal advice.

I think it's 100% their job to calculate risks and inform about legal customs/expected outcomes around something in question.

You're going to be pedaling that idea for a long time before you convince lawyers that it's in their interest to generalize on expected outcomes.

Re: Ask HN: Huge enterprise customer wants to see our source code

#283

Post by carapace »

throwaway613834 wrote: post #187
carapace wrote: post #141

Earlier quoted context omitted.

I remember the day a friend explained to me that MS Word, Internet Explorer, and MS Frontpage were the same DLL just with different entry points.

What? That seems both wrong and meaningless. You can compile as many programs as you want into a single DLL. Doesn't mean a thing.

It wasn't N programs packed into a DLL, it was one program (in a DLL) that acted like three different programs depending on how it was "started".

They were selling the same software as three different products.

Re: Ask HN: Huge enterprise customer wants to see our source code

#284

Post by throwaway613834 »

carapace wrote: post #283
throwaway613834 wrote: post #187

Earlier quoted context omitted.

What? That seems both wrong and meaningless. You can compile as many programs as you want into a single DLL. Doesn't mean a thing.

It wasn't N programs packed into a DLL, it was one program (in a DLL) that acted like three different programs depending on how it was "started". They were selling the same software as three different products.

You consider MS Word and Internet Explorer in the same DLL to be "the same software" rather than 3 different pieces of software packed in the same DLL?

Re: Ask HN: Huge enterprise customer wants to see our source code

#286

Post by kazinator »

evantahler wrote: post #75
lasereyes136 wrote: post #14

Well, having worked for a small software startup that did just that, I can tell you what we did. We agreed to letting them audit the code with conditions. 1. The audit happened on our computers with someone from our team in control (me). I locked the computer when I wasn't physically there to watch what they did. 2. We removed the most sensitive part of the code and told them what it did. We kept the method signature…

I've done this too. The question is usually a matter of compliance more than anything else. They want to check the licenses of any included packages, makes sure there's no encryption stuff that can't leave the USA, etc. Doing what OP described is great: it lets their folks do the audit with no risk of you loosing "ownership". It shows you are both a good partner and value what you do.

> The question is usually a matter of compliance more than anything else.

What would Microsoft say if a customer said "we need to see the source code for Windows, Outlook, Exchange and Office applications before we use them, just as a matter of license compliance"?

Re: Ask HN: Huge enterprise customer wants to see our source code

#287

Post by kazinator »

eps wrote: post #134
evantahler wrote: post #75

Earlier quoted context omitted.

I've done this too. The question is usually a matter of compliance more than anything else. They want to check the licenses of any included packages, makes sure there's no encryption stuff that can't leave the USA, etc. Doing what OP described is great: it lets their folks do the audit with no risk of you loosing "ownership". It shows you are both a good partner and value what you do.

License compliance is easily verified using 3rd party services like Black Duck. You basically install a scanner on your machine, feed your sources into it, it hashes them line by line and sends hashes to the mothership for analysis. It then spits out the report that file X, line Y matches something in the open source package Z. At least that's how it worked a decade ago, when we had to do a pre-acquisition source cod…

License compliance is not verified in closed source stuff, period.

When was the last time some user of Windows verified whether Microsoft Windows contains some piece of code that Microsoft shouldn't be redistributing?

Re: Ask HN: Huge enterprise customer wants to see our source code

#288

Post by carapace »

throwaway613834 wrote: post #284
carapace wrote: post #283

Earlier quoted context omitted.

It wasn't N programs packed into a DLL, it was one program (in a DLL) that acted like three different programs depending on how it was "started". They were selling the same software as three different products.

You consider MS Word and Internet Explorer in the same DLL to be "the same software" rather than 3 different pieces of software packed in the same DLL?

I'm just telling HN what my friend told me. It's not as if I've ever examined the file, y'know?

Re: Ask HN: Huge enterprise customer wants to see our source code

#289

Post by another-dave »

another-dave wrote: post #238
seehafer wrote: post #218

Earlier quoted context omitted.

Seconding the “source code in escrow” solution as a mitigation about concerns of working with a startup. IMO enterprise customers happy to pay for it and it usually never gets asked about again

How does "code escrow" work in practice? Are you actively syncing to a private Git repo? Or is it more a case of, if we're collapsing, we'll put this in place?

Haha, was thinking that wouldn't be too trusted alright! Scheduled syncing makes sense. Cheers for the replies, have never heard of the concept of code escrow before, seems like a neat solution

Re: Ask HN: Huge enterprise customer wants to see our source code

#290

Post by SyneRyder »

kazinator wrote: post #287
eps wrote: post #134

Earlier quoted context omitted.

License compliance is easily verified using 3rd party services like Black Duck. You basically install a scanner on your machine, feed your sources into it, it hashes them line by line and sends hashes to the mothership for analysis. It then spits out the report that file X, line Y matches something in the open source package Z. At least that's how it worked a decade ago, when we had to do a pre-acquisition source cod…

License compliance is not verified in closed source stuff, period. When was the last time some user of Windows verified whether Microsoft Windows contains some piece of code that Microsoft shouldn't be redistributing?

Microsoft has provided Windows source code for auditing for a long time, especially to governments. Here's an article about it from 2003:

https://www.computerworld.com/article/2580563/microsoft-wind...

And again in 2015:

https://www.petri.com/no-back-doors-microsoft-opens-windows-...

Post reply on HN