Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Huge enterprise customer wants to see our source code

news.ycombinator.com

Post reply on HN
Print view View original

151–160 of 293 posts

Re: Ask HN: Huge enterprise customer wants to see our source code

#151

Post by Majora320 »

kornish wrote: post #92
sheetjs wrote: post #85

Earlier quoted context omitted.

License compliance is incredibly important and unfortunately overlooked by many smaller firms. The potential liability to a GPL or other violation is just not worth it. Anecdote: We have released code under the Apache 2 License (our biggest project by far is https://github.com/sheetjs/js-xlsx ) and we've been roped into negotiations because some companies tried to take shortcuts by copying our code without proper att…

For companies interested in addressing licensing concerns before they balloon into real problems, FOSSA builds a platform which analyzes code and automates license disclosures and legal boilerplate: https://fossa.io/ Full disclosure: founder is a friend and all around great person.

I don't own a company, but I'd like to try this out myself. Is there any possibility of having a "personal" trial mode instead of having to enter a company name?

Re: Ask HN: Huge enterprise customer wants to see our source code

#153

Post by [deleted] »

valuearb wrote: post #112
Clubber wrote: post #88

Another data point, but I worked for a company that made an expensive DSS for a very lucrative industry. We showed a potential "partner" our code and how it worked and everything. They took our ideas and made their own product as a direct competitor. Reminded me of Apple and Xerox. Definitely get legal council involved. A possible way to protect yourself is print it out and put it in old fashioned binders and let the…

In Apple & Xerox case, legal council was involved. Xerox actually got paid to allow Apple to see their PARC demos. And no source code was shared. And in the end, the Macintosh was a huge leap beyond the Alto, that really didn't work much like it at all.

[deleted]

Re: Ask HN: Huge enterprise customer wants to see our source code

#154

Post by donatj »

SwellJoe wrote: post #125
Jach wrote: post #113

Earlier quoted context omitted.

I have no idea what lawyers actually think but the fears I hear about generally don't come from lawyers. The most common fear I think is "we'll be forced to release our closed code!" But no, my intuition is that even with willful violation of something licensed under e.g. the AGPL which is supposed to force such a thing on a SaaS company, the worst case is something like: the company is hit with the maximum penalty f…

Jail for copyright violation? I guess people who've distributed pirated goods, like movies or music, have gone to jail, but I've never heard of it happening to a software developer. Fines are plausible, but I'm having a hard time imagining a scenario that leads to jail time.

Developers have gone to jail for stealing code from financial companies.

See: https://en.wikipedia.org/wiki/Sergey_Aleynikov

Most GPL projects however don't have expensive, hateful, blood seeking lawyers behind them.

Re: Ask HN: Huge enterprise customer wants to see our source code

#155

Post by Jach »

SwellJoe wrote: post #125
Jach wrote: post #113

Earlier quoted context omitted.

I have no idea what lawyers actually think but the fears I hear about generally don't come from lawyers. The most common fear I think is "we'll be forced to release our closed code!" But no, my intuition is that even with willful violation of something licensed under e.g. the AGPL which is supposed to force such a thing on a SaaS company, the worst case is something like: the company is hit with the maximum penalty f…

Jail for copyright violation? I guess people who've distributed pirated goods, like movies or music, have gone to jail, but I've never heard of it happening to a software developer. Fines are plausible, but I'm having a hard time imagining a scenario that leads to jail time.

The plausible situation is no criminal case, just a civil case, and probably settling for what amounts to a fine / delayed purchase, e.g. the "$10k donation" alluded to. But the worst case possibility, even if very unlikely, should include jail time (somehow -- I too don't know exactly how that would work out or who exactly would go to jail, manager or dev).

Re: Ask HN: Huge enterprise customer wants to see our source code

#156

Post by mcbain »

eps wrote: post #134
evantahler wrote: post #75

Earlier quoted context omitted.

I've done this too. The question is usually a matter of compliance more than anything else. They want to check the licenses of any included packages, makes sure there's no encryption stuff that can't leave the USA, etc. Doing what OP described is great: it lets their folks do the audit with no risk of you loosing "ownership". It shows you are both a good partner and value what you do.

License compliance is easily verified using 3rd party services like Black Duck. You basically install a scanner on your machine, feed your sources into it, it hashes them line by line and sends hashes to the mothership for analysis. It then spits out the report that file X, line Y matches something in the open source package Z. At least that's how it worked a decade ago, when we had to do a pre-acquisition source cod…

BD still works that way. The lawyers love making us use it.

https://www.blackducksoftware.com/solutions/mergers-and-acqu...

Re: Ask HN: Huge enterprise customer wants to see our source code

#158

Post by amorphid »

nugget wrote: post #90
sheetjs wrote: post #85

Earlier quoted context omitted.

License compliance is incredibly important and unfortunately overlooked by many smaller firms. The potential liability to a GPL or other violation is just not worth it. Anecdote: We have released code under the Apache 2 License (our biggest project by far is https://github.com/sheetjs/js-xlsx ) and we've been roped into negotiations because some companies tried to take shortcuts by copying our code without proper att…

What exactly is the potential liability for a GPL violation? I've gone 12 rounds with IP lawyers over these theoretical violations (static vs dynamic links). But I found it odd that I could never find a single case of significant liability due to infringement. The nature of damages is unclear and the landscape of counter-parties (with an incentive to sue) is amorphous. It seemed like worst-case, a proven infringer ju…

Not trying to troll here... The biggest violation might simply be the size of the attorney bills related to using GPL licensed dependencies in your code. There's simply no great way that I've found to get attorneys to give you a checklist of how to comply with licenses that aren't on a short list of reasonably well understood licenses. Saying "no GPL" is easier in many cases for practical reasons that kind of stink. To say it differently, how much time would you like to dedicate to getting GPL blessed when doing so is competing with all of your other priorities?

Re: Ask HN: Huge enterprise customer wants to see our source code

#159

Post by matchagaucho »

Clarify if the concern is Chapter 11 motivated.

We've put source code in escrow to address concerns of going out of business.

But if they really just want to see IP (which is fluid and changes every 90 days), then I'd only provide abstract diagrams and maybe decision tree outputs from the ML.

Re: Ask HN: Huge enterprise customer wants to see our source code

#160

Post by brudgers »

This is a simple case of "Big clients expect to own their little consultants,"

What do you do if they ask for customizations? What do you do if they request features that are not on your roadmap? What do you do if they ask for a large discount?

How you decide those cases determines how much your business is like a startup moving fast and not negotiating over source code disclosure and how much your business is like an enterprise consultancy that prices out each request for one off work by their clients. There's no right answer. But clarity about how a particular client affects your business model and whether or not that client is worth having right now is important. Are there other potential customers who are easier to service?

It is not clear from the question whether this request is part of ongoing contract negotiations or presented as a prelude to negotiation. If the former, put a price on it. If the latter, it smells a bit like a "no" in the form of a "maybe" or window shopping without much intent or someone higher up with purchasing authority putting on the brakes. Figure out an expected value of the client by assigning probabilities to various size contracts closing at different points in time.

Good luck.

Post reply on HN