Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Huge enterprise customer wants to see our source code

news.ycombinator.com

Post reply on HN
Print view View original

171–180 of 293 posts

Re: Ask HN: Huge enterprise customer wants to see our source code

#171

Post by ng12 »

dkural wrote: post #10

I ran a SAAS company for 8 years, going from zero to double-digit million rev per year. The answer is a clear no. They can PAY YOU to make custom plots/charts/reporting or run queries if they want to understand what it does better. There is almost always a way to achieve any business goal without requiring source code. The only case I can think of source code needing formal verification by a third party is if you're…

Isn't security a potential concern? If they're selling analytics software ostensibly they have access to a lot of the customer's data.

Re: Ask HN: Huge enterprise customer wants to see our source code

#172

Post by CyberFonic »

raverbashing wrote: post #163
dogma1138 wrote: post #117

Earlier quoted context omitted.

I’m a security engineer at a large financial organization and we audit all 3rd party products most of these audits include a code review. This is a compliance process and it’s controlled by the SEC. All of your suggestions would make the company that I at least work for to simply walk away from table. This has happened more than once and all of our contracts contain a clause that if the application does not get a pas…

Why would a financial product have a compliance procedure by the FCC? > All of your suggestions would make the company that I at least work for to simply walk away from table. Unless the company is already a customer and is paying for the development of the software, please do walk away from the table, I'm sure they have better things to do and better customers to sell to

Seems like FUD to me ! Maybe Sarbanes Oxley.

Re: Ask HN: Huge enterprise customer wants to see our source code

#173

Post by billforsternz »

I am a little surprised by many of the answers here. I thought the conventional wisdom here was, essentially, "Your source code is not as valuable as you think it is". For what it's worth (literally 2c probably), my $0.02 is that I agree with that conventional wisdom. Don't be anal about this, nobody wants to steal your source code.

Re: Ask HN: Huge enterprise customer wants to see our source code

#176

Post by anonacct37 »

devit wrote: post #111
anonacct37 wrote: post #42

I'll offer a different pov from many other comments. I work for a fortune 50 basically doing web server stuff. Right now our security team would like to run some startups code synchronously as a module in our web server. Their code could easily cost us millions off dollars (if the outage was small). I need to make sure their sdk is free of race conditions, and has proper timeouts and throttling and has proper metrics…

Just run it in a separate process with a seccomp sandbox, using pipe/socket IPC with a timeout (if it's some anti-DoS/intrusion thing, just fail allowing the request, since it's going to have false negatives anyway). The IPC cost should not be significant compared to the rest of the web server code. Can also ask them to do the work and provide a small open source in-process shim that sets up and talks to the sandboxe…

I'm surprised your comment is showing up grey (downvoted). It' a perfectly reasonable solution. I'm considering adding a new "remote" plugin type to our server for running hooks in sidecar processes. It wouldn't be my first or second choice but it makes lots of sense if you have to talk to something that might have bad p99 response times.

Please feel free to reach out to me (info in profile) if you ever want to have a chat or are looking for some fun work.

Re: Ask HN: Huge enterprise customer wants to see our source code

#177

Post by jonathankoren »

raverbashing wrote: post #163
dogma1138 wrote: post #117

Earlier quoted context omitted.

I’m a security engineer at a large financial organization and we audit all 3rd party products most of these audits include a code review. This is a compliance process and it’s controlled by the SEC. All of your suggestions would make the company that I at least work for to simply walk away from table. This has happened more than once and all of our contracts contain a clause that if the application does not get a pas…

Why would a financial product have a compliance procedure by the FCC? > All of your suggestions would make the company that I at least work for to simply walk away from table. Unless the company is already a customer and is paying for the development of the software, please do walk away from the table, I'm sure they have better things to do and better customers to sell to

I'm thinking it's a typo for SEC.

Re: Ask HN: Huge enterprise customer wants to see our source code

#178

Post by emilfihlman »

nugget wrote: post #90
sheetjs wrote: post #85

Earlier quoted context omitted.

License compliance is incredibly important and unfortunately overlooked by many smaller firms. The potential liability to a GPL or other violation is just not worth it. Anecdote: We have released code under the Apache 2 License (our biggest project by far is https://github.com/sheetjs/js-xlsx ) and we've been roped into negotiations because some companies tried to take shortcuts by copying our code without proper att…

What exactly is the potential liability for a GPL violation? I've gone 12 rounds with IP lawyers over these theoretical violations (static vs dynamic links). But I found it odd that I could never find a single case of significant liability due to infringement. The nature of damages is unclear and the landscape of counter-parties (with an incentive to sue) is amorphous. It seemed like worst-case, a proven infringer ju…

They are just that: theoretical violations and even they are touted just by the FSF: no one else agrees that linking against source code taints your own code.

Re: Ask HN: Huge enterprise customer wants to see our source code

#179

Post by CyberFonic »

d--b wrote: post #25

If their justification is "we want to see how your algorithm made its decision", you should perhaps have your model output more stats and infos about that. As a user of data tools myself, I am generally suspicious of any black box model, and would like to understand the model well before using it. For instant if your model is a deep neural network, I'd like to know the structure of the network and the activation of t…

That is the very problem with ML, it comes up with answers but provides no insight as to how. For example, you teach a vision ML to detect balls of various colours in pictures, then give it pictures of battleships - it might see the bubbles in the wake as balls, but won't tell you there is a great big hulking grey thing in the picture.

Escrow arrangements are common to protect clients from software vendors going bust.

Re: Ask HN: Huge enterprise customer wants to see our source code

#180

Post by rock_hard »

hoodoof wrote: post #52

This is just politics. Find a way to say "yes", which satisfies their need to hear you say "yes", but your "yes" conditions mean they need to spend money (which they won't want to do), and further conditions, even if they do, as other commenters have suggested, make the process dysfunctional. Watch our politicians in government handle any issue. They are masters of saying "yes" and delivering "no", which makes people…

Fully agree!

I used to run a enterprise software business for many years and we learned quickly to always just answer “Yes”.

Specially with requirement lists clients would send us...much of that stuff didn’t make any practical sense and it was clear that who ever wrote them had no clue what they where doing...answering “Yes” got us into the door and we always ended up delivering what they actually needed at the end.

Just make sure to charge for every Yes they make you deliver :)

Post reply on HN