Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Huge enterprise customer wants to see our source code

news.ycombinator.com

Post reply on HN
Print view View original

191–200 of 293 posts

Re: Ask HN: Huge enterprise customer wants to see our source code

#191

Post by cortesoft »

donatj wrote: post #154
SwellJoe wrote: post #125

Earlier quoted context omitted.

Jail for copyright violation? I guess people who've distributed pirated goods, like movies or music, have gone to jail, but I've never heard of it happening to a software developer. Fines are plausible, but I'm having a hard time imagining a scenario that leads to jail time.

Developers have gone to jail for stealing code from financial companies. See: https://en.wikipedia.org/wiki/Sergey_Aleynikov Most GPL projects however don't have expensive, hateful, blood seeking lawyers behind them.

That is completely different. You don't go to jail for a license violation.

Re: Ask HN: Huge enterprise customer wants to see our source code

#192

Post by bhollan »

Sam Ritchie from Stripe was a guest on This-Week-in-Machine-Learning/AI (TWiMLAI) (podcast) talking about explaining black box predictions.

https://twimlai.com/twiml-talk-73-exploring-black-box-predic...

TL; DR is basically you keep a decision tree in parallel to your model that carries with it long/short-form text that "explains" why the model does what it does.

Re: Ask HN: Huge enterprise customer wants to see our source code

#193

Post by bduerst »

pacetherace wrote: post #189

If they require proof that your models are working, you should be able to show them simulations to that effect. If it is a matter of due diligence, then it should be something that is discussed between your lawyers and the company's lawyers. If this ask is coming from the engineering side of the company then that is a red flag. You should also think of the impact in terms of acquiring other customers once you have op…

Yep - third party code reviews for compliance or security purposes are not unheard of.

The "we want to see how your algorithms made their decisions" justification is a little weird, since that is effectively your secret sauce and just math equations.

Are they worried you're joining in illegally- or unethically-obtained data in making your recommendations? Large enterprise companies have brand reputations that they factor into vendor decisions, and they may not trust you as a startup just yet.

Re: Ask HN: Huge enterprise customer wants to see our source code

#194

Post by exikyut »

nugget wrote: post #90
sheetjs wrote: post #85

Earlier quoted context omitted.

License compliance is incredibly important and unfortunately overlooked by many smaller firms. The potential liability to a GPL or other violation is just not worth it. Anecdote: We have released code under the Apache 2 License (our biggest project by far is https://github.com/sheetjs/js-xlsx ) and we've been roped into negotiations because some companies tried to take shortcuts by copying our code without proper att…

What exactly is the potential liability for a GPL violation? I've gone 12 rounds with IP lawyers over these theoretical violations (static vs dynamic links). But I found it odd that I could never find a single case of significant liability due to infringement. The nature of damages is unclear and the landscape of counter-parties (with an incentive to sue) is amorphous. It seemed like worst-case, a proven infringer ju…

> What exactly is the potential liability for a GPL violation?

An anecdote from 2001:

http://web.archive.org/web/20061106184219/http://docs.gnu-de...

Re: Ask HN: Huge enterprise customer wants to see our source code

#195

Post by kod »

nugget wrote: post #90
sheetjs wrote: post #85

Earlier quoted context omitted.

License compliance is incredibly important and unfortunately overlooked by many smaller firms. The potential liability to a GPL or other violation is just not worth it. Anecdote: We have released code under the Apache 2 License (our biggest project by far is https://github.com/sheetjs/js-xlsx ) and we've been roped into negotiations because some companies tried to take shortcuts by copying our code without proper att…

What exactly is the potential liability for a GPL violation? I've gone 12 rounds with IP lawyers over these theoretical violations (static vs dynamic links). But I found it odd that I could never find a single case of significant liability due to infringement. The nature of damages is unclear and the landscape of counter-parties (with an incentive to sue) is amorphous. It seemed like worst-case, a proven infringer ju…

> otherwise well-measured calculations of risk and reward

Where do you work that attorneys generally make well-measured calculations of risk? And are you hiring?

Re: Ask HN: Huge enterprise customer wants to see our source code

#197

Post by dogma1138 »

jonathankoren wrote: post #177
raverbashing wrote: post #163

Earlier quoted context omitted.

Why would a financial product have a compliance procedure by the FCC? > All of your suggestions would make the company that I at least work for to simply walk away from table. Unless the company is already a customer and is paying for the development of the software, please do walk away from the table, I'm sure they have better things to do and better customers to sell to

I'm thinking it's a typo for SEC.

That’s correct.

Re: Ask HN: Huge enterprise customer wants to see our source code

#198

Post by brudgers »

patio11 wrote: post #135
twotwotwo wrote: post #127

Earlier quoted context omitted.

How specifically did the request for source code signal to you that the vendor's charging too little? You suspect the customer is worried that the product is really nothing because it's priced so low? High prices from a vendor signal they mean business and ward off fiddly objections? (I'd expect the opposite, higher price => higher stakes => more interest in knowing just what you're purchasing.) That an ML product wi…

How specifically did it signal to you that they're underpriced? Because the poster is surprised by this requirement and doesn't have standardized answers to it yet. In poker, there is this thing called "assigning a range" to someone based on their actions. You can't see their cards, but their actions might give you signal where you could say "Hmm, playing like they have a middle pocket pair and not totally air nor a…

At the flea market they call it "looking at the customer's shoes."

Re: Ask HN: Huge enterprise customer wants to see our source code

#199

Post by dogma1138 »

lsaferite wrote: post #133
dogma1138 wrote: post #117

Earlier quoted context omitted.

I’m a security engineer at a large financial organization and we audit all 3rd party products most of these audits include a code review. This is a compliance process and it’s controlled by the SEC. All of your suggestions would make the company that I at least work for to simply walk away from table. This has happened more than once and all of our contracts contain a clause that if the application does not get a pas…

> controlled by the FCC I'm guessing this is a typo?

Brain typo :)

Re: Ask HN: Huge enterprise customer wants to see our source code

#200

Post by dboreham »

GordonS wrote: post #148
FireBeyond wrote: post #115

Earlier quoted context omitted.

Slightly tangential, but working for a small software company (<20 employees) who writes Line Of Business code for very large enterprise customers in the health care industry, we at times offer source code licenses, but at the very least (and this was my original point), our license as a vendor also includes source code escrow in the event of our collapse. We haven't really had anyone request a pre-sale source code r…

> our license as a vendor also includes source code escrow in the event of our collapse Wow, I've never heard of this before - it sounds great! Do you advertise this on your website, or is it just buried in the terms and conditions? I was just wondering how you might get across this info without worrying potential customers with the mere mention of collapse?

You don't advertise it. You say nothing until a customer expresses concern about your long term survival then you say "Oh yeah this comes up from time to time and the solution is code escrow, we've done it for customer Y and X so we know the drill".
Post reply on HN