Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Huge enterprise customer wants to see our source code

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 293 posts

Re: Ask HN: Huge enterprise customer wants to see our source code

#131

Post by unpythonic »

When I worked for a very large networking company, we wanted to bring in a small company's only product which would have been central to the day-to-day running of engineering. Because they were so small with so little track record, we wanted to make sure that we could get their source code should they ever go out of business.

I can't think of a good reason to require code inspection prior to purchase. Testing, measuring, and generally trying to break the code during evaluation seems fair game though.

Re: Ask HN: Huge enterprise customer wants to see our source code

#133

Post by lsaferite »

dogma1138 wrote: post #117
patio11 wrote: post #56

I think this is a signal that you're probably underpriced by a factor of 2X to 10X. So this is a sales objection. With regards to that justification, I'd want to know a) who in the business is generating it and b) what they expect to feed your answer into. Is this just somebody who wanted to sound smart in a meeting? Then they don't need your source code; they need ~5 nice PowerPoint slides and you're done. I'd be po…

I’m a security engineer at a large financial organization and we audit all 3rd party products most of these audits include a code review. This is a compliance process and it’s controlled by the SEC. All of your suggestions would make the company that I at least work for to simply walk away from table. This has happened more than once and all of our contracts contain a clause that if the application does not get a pas…

> controlled by the FCC

I'm guessing this is a typo?

Re: Ask HN: Huge enterprise customer wants to see our source code

#134

Post by eps »

evantahler wrote: post #75
lasereyes136 wrote: post #14

Well, having worked for a small software startup that did just that, I can tell you what we did. We agreed to letting them audit the code with conditions. 1. The audit happened on our computers with someone from our team in control (me). I locked the computer when I wasn't physically there to watch what they did. 2. We removed the most sensitive part of the code and told them what it did. We kept the method signature…

I've done this too. The question is usually a matter of compliance more than anything else. They want to check the licenses of any included packages, makes sure there's no encryption stuff that can't leave the USA, etc. Doing what OP described is great: it lets their folks do the audit with no risk of you loosing "ownership". It shows you are both a good partner and value what you do.

License compliance is easily verified using 3rd party services like Black Duck.

You basically install a scanner on your machine, feed your sources into it, it hashes them line by line and sends hashes to the mothership for analysis. It then spits out the report that file X, line Y matches something in the open source package Z. At least that's how it worked a decade ago, when we had to do a pre-acquisition source code audit.

Re: Ask HN: Huge enterprise customer wants to see our source code

#135

Post by patio11 »

twotwotwo wrote: post #127
patio11 wrote: post #56

I think this is a signal that you're probably underpriced by a factor of 2X to 10X. So this is a sales objection. With regards to that justification, I'd want to know a) who in the business is generating it and b) what they expect to feed your answer into. Is this just somebody who wanted to sound smart in a meeting? Then they don't need your source code; they need ~5 nice PowerPoint slides and you're done. I'd be po…

How specifically did the request for source code signal to you that the vendor's charging too little? You suspect the customer is worried that the product is really nothing because it's priced so low? High prices from a vendor signal they mean business and ward off fiddly objections? (I'd expect the opposite, higher price => higher stakes => more interest in knowing just what you're purchasing.) That an ML product wi…

How specifically did it signal to you that they're underpriced?

Because the poster is surprised by this requirement and doesn't have standardized answers to it yet.

In poker, there is this thing called "assigning a range" to someone based on their actions. You can't see their cards, but their actions might give you signal where you could say "Hmm, playing like they have a middle pocket pair and not totally air nor a monster." If sophistication with regards to enterprise sales is a spectrum like poker hands, surprise about certain parts of the process causes me to adjust my range accordingly, and that plus experience working with software people colors my estimate of pricing sophistication.

Re: Ask HN: Huge enterprise customer wants to see our source code

#136

Post by rimliu »

threeseed wrote: post #37
njyx wrote: post #3

This is a complete no-no. There really is no justification for this whatsoever. What does "cover their bases" mean? As them to explain what they are trying to achieve and find other ways to assuage their concerns. The only legitimate thing is to have something in case you fail and they have "banked" on you. There is a legit way to solve that. basically if they want that tell them they should pay for an Escrow service…

I work for an enterprise company and we demand the source code for machine learning models from vendors all the time. This isn't like asking for the code to Excel. It's a model derived from our data that has likely no use for anyone but us and is highly susceptible to misunderstandings of the data. We absolutely need to verify your work. Models are the output of the process. It's like going to graphic designer for wo…

By this logic the said designer should also get Photoshop source code from Adobe.

Re: Ask HN: Huge enterprise customer wants to see our source code

#137

Post by nerflad »

IanCal wrote: post #97
awinder wrote: post #80

Earlier quoted context omitted.

Are you going to audit all of their code changes from now into perpetuity as well? It seems like you kinda alluded to the thing that would actually be effective, which is not synchronously calling external services in high-uptime-requirement applications...

I'm not sure what you mean here by external service, the solution you describe is just "build everything in house" which is possibly not reasonable.

Not if it really is responsible for keeping billions of dollars flowing.

Re: Ask HN: Huge enterprise customer wants to see our source code

#138

Post by jrochkind1 »

pdgonzalez872 wrote: post #89
awinder wrote: post #80

Earlier quoted context omitted.

Are you going to audit all of their code changes from now into perpetuity as well? It seems like you kinda alluded to the thing that would actually be effective, which is not synchronously calling external services in high-uptime-requirement applications...

fantastic question. Just because the software complied with the requirements at one point doesn't mean it will in the future.

True, but I'm thinking if you can tell it was written by people who know what they're doing, odds are the company will continue to have people who know what they're doing.

Re: Ask HN: Huge enterprise customer wants to see our source code

#140

Post by provost »

DoofusOfDeath wrote: post #126
provost wrote: post #96

Earlier quoted context omitted.

One thing I would note is that the individual employee might not be authorized to sign a legal document, such as "a non-compete and or a non-disclosure". My company informs us told to actively refuse to sign any legal documents (even at visitor check-in) -- we have a Legal team for that. All documents should be signed by Legal before I step on site.

Out of curiosity, are you barred from installing software on company computers, because you're either explicitly or implicitly accepting an EULA?

There is a list of pre-approved apps, and a method to request approval if it is not on the list. Also, there is a list of approved licenses for open source software.
Post reply on HN