Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Huge enterprise customer wants to see our source code

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 293 posts

Re: Ask HN: Huge enterprise customer wants to see our source code

#91

Post by akoncius »

mikestew wrote: post #71
njyx wrote: post #3

This is a complete no-no. There really is no justification for this whatsoever. What does "cover their bases" mean? As them to explain what they are trying to achieve and find other ways to assuage their concerns. The only legitimate thing is to have something in case you fail and they have "banked" on you. There is a legit way to solve that. basically if they want that tell them they should pay for an Escrow service…

It's entirely unreasonable for them to demand access to source code. The government and large corporations apparently disagree, or Microsoft wouldn't have their Shared Source Initiative. And for any nay-sayers in the crowd, that should be all that need be known: Microsoft thinks it's okay, and they have a lot more to lose than you do. The only legitimate thing is to have something in case you fail and they have "bank…

well I presume that MS does not provide access to code to direct competitors. Which is OP’s concern- client is building ML team and so on and they ask access to code.

National agencies such as FBI are not threat to MS to become competitor, unlike OP’s client.

Re: Ask HN: Huge enterprise customer wants to see our source code

#92

Post by kornish »

sheetjs wrote: post #85
evantahler wrote: post #75

Earlier quoted context omitted.

I've done this too. The question is usually a matter of compliance more than anything else. They want to check the licenses of any included packages, makes sure there's no encryption stuff that can't leave the USA, etc. Doing what OP described is great: it lets their folks do the audit with no risk of you loosing "ownership". It shows you are both a good partner and value what you do.

License compliance is incredibly important and unfortunately overlooked by many smaller firms. The potential liability to a GPL or other violation is just not worth it. Anecdote: We have released code under the Apache 2 License (our biggest project by far is https://github.com/sheetjs/js-xlsx ) and we've been roped into negotiations because some companies tried to take shortcuts by copying our code without proper att…

For companies interested in addressing licensing concerns before they balloon into real problems, FOSSA builds a platform which analyzes code and automates license disclosures and legal boilerplate: https://fossa.io/

Full disclosure: founder is a friend and all around great person.

Re: Ask HN: Huge enterprise customer wants to see our source code

#94

Post by aeorgnoieang »

pcsanwald wrote: post #53

my .02 from having been CTO at a SaaS analytics company for a long time: "we want to see how your algorithms made their decisions." that's great product feedback. and a problem you need to solve. You shouldn't solve it by handing out your source code.

In ML, that's a problem lots of people want to solve!

Re: Ask HN: Huge enterprise customer wants to see our source code

#95

Post by bg4 »

The answer is no. I had huge enterprise customer do the same thing, asking lots of questions. We didn't tell them much but they were asking very detailed questions as to the how. They didn't follow through with the deal and released a competing product about a year later.

They were simply fishing us for answers on how to solve problems.

Re: Ask HN: Huge enterprise customer wants to see our source code

#96

Post by provost »

lasereyes136 wrote: post #14

Well, having worked for a small software startup that did just that, I can tell you what we did. We agreed to letting them audit the code with conditions. 1. The audit happened on our computers with someone from our team in control (me). I locked the computer when I wasn't physically there to watch what they did. 2. We removed the most sensitive part of the code and told them what it did. We kept the method signature…

One thing I would note is that the individual employee might not be authorized to sign a legal document, such as "a non-compete and or a non-disclosure". My company informs us told to actively refuse to sign any legal documents (even at visitor check-in) -- we have a Legal team for that. All documents should be signed by Legal before I step on site.

Re: Ask HN: Huge enterprise customer wants to see our source code

#97

Post by IanCal »

awinder wrote: post #80
anonacct37 wrote: post #42

I'll offer a different pov from many other comments. I work for a fortune 50 basically doing web server stuff. Right now our security team would like to run some startups code synchronously as a module in our web server. Their code could easily cost us millions off dollars (if the outage was small). I need to make sure their sdk is free of race conditions, and has proper timeouts and throttling and has proper metrics…

Are you going to audit all of their code changes from now into perpetuity as well? It seems like you kinda alluded to the thing that would actually be effective, which is not synchronously calling external services in high-uptime-requirement applications...

I'm not sure what you mean here by external service, the solution you describe is just "build everything in house" which is possibly not reasonable.
Post reply on HN