Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Huge enterprise customer wants to see our source code

news.ycombinator.com

Post reply on HN
Print view View original

201–210 of 293 posts

Re: Ask HN: Huge enterprise customer wants to see our source code

#201

Post by dogma1138 »

patio11 wrote: post #128
dogma1138 wrote: post #117

Earlier quoted context omitted.

I’m a security engineer at a large financial organization and we audit all 3rd party products most of these audits include a code review. This is a compliance process and it’s controlled by the SEC. All of your suggestions would make the company that I at least work for to simply walk away from table. This has happened more than once and all of our contracts contain a clause that if the application does not get a pas…

Thank you for your comment. Can you add, for the benefit of the peanut gallery, what the typical cost of a one year software license you pay for is? I have a good guess but I think HNers need to hear people-other-than-me say it to internalize it.

Really depends usually in the millions especially if this is a product related to trading.

It’s also important to note that as far as I am aware contracts on this scale have multiple stages and we are paying for PoC/pilot programmes during which we usually perform our review. This usually isn’t software that a pre-sale engineer would come and setup in a few days so we are paying effectively even for a demo.

Overall we audit everything from Xerox software to custom balance sheet management products.

The process is dependent on the level of trust/confidence we have in the vendor and the risk profile of the product.

But in all cases there will be some sort of review.

For vendors that would not give us code access we request permission to pentest the product the pentest would include reverse engineering in most cases and as the vast majority of products in the financial sector are in Java the source code isn’t hard to get through reversing the byte code.

Re: Ask HN: Huge enterprise customer wants to see our source code

#202

Post by hackits »

cortesoft wrote: post #191
donatj wrote: post #154

Earlier quoted context omitted.

Developers have gone to jail for stealing code from financial companies. See: https://en.wikipedia.org/wiki/Sergey_Aleynikov Most GPL projects however don't have expensive, hateful, blood seeking lawyers behind them.

That is completely different. You don't go to jail for a license violation.

I remember in some situations that copyright infringement is cheaper than license violation. The former you can argue ignorance and pay a a fine the later you've knowing acknowledge what you've done is a violation of another person license but continued your behavior.

Re: Ask HN: Huge enterprise customer wants to see our source code

#203

Post by dboreham »

TAForObvReasons wrote: post #31
dkural wrote: post #10

I ran a SAAS company for 8 years, going from zero to double-digit million rev per year. The answer is a clear no. They can PAY YOU to make custom plots/charts/reporting or run queries if they want to understand what it does better. There is almost always a way to achieve any business goal without requiring source code. The only case I can think of source code needing formal verification by a third party is if you're…

Have you actually dealt with enterprise sales? Source code is a fairly typical request, and there are software escrow and audit companies specifically set up to address concerns. Microsoft, for example, gives source code access to paying enterprises and governments under the Shared Source Initiative specifically for security vetting and other auditing purposes. OP: Consult a lawyer who specializes in these matters.

> Have you actually dealt with enterprise sales? Source code is a fairly typical request

Not the parent, but I have done deals like this and I feel the need to counter your sentiment.

Sure, 3rd party security review, escrow, etc etc is normal.

However, this is a massive red flag for me:

>Their justification is: "we want to see how your algorithms made their decisions."

I mean this is straight out of an episode of "Silicon Valley". The OP's entire product value is in "how your algorithms made their decisions" and this is not something you want to expose to anyone unless perhaps they are about to acquire your company.

Re: Ask HN: Huge enterprise customer wants to see our source code

#204

Post by dboreham »

I've read most of the comments here and I think many of them are off track.

You need to take this approach when dealing with a large potential customer : let's not get into the weeds of what you are asking for, but rather tell me what the underlying need is. That might, for example be : "we'll rely on your code to secure our customers' sensitive data and so we need to take steps to ensure you are practicing industry best processes for security". That need could be addressed by having a third party review your code and processes, protecting your IP.

In your case they said :

"we want to see how your algorithms made their decisions."

For me this would be a "Hello no", perhaps put more politely. You're building a product that has value embodied in those algorithms. The customer is paying you for that service. Therefore you should take absolutely no steps to tell them how it works. There is only downside.

Re: Ask HN: Huge enterprise customer wants to see our source code

#205

Post by weaksauce »

lasereyes136 wrote: post #14

Well, having worked for a small software startup that did just that, I can tell you what we did. We agreed to letting them audit the code with conditions. 1. The audit happened on our computers with someone from our team in control (me). I locked the computer when I wasn't physically there to watch what they did. 2. We removed the most sensitive part of the code and told them what it did. We kept the method signature…

one thing about non-compete and non-disclosures is that if you are a small shop going up against big shops it can be costly for you to try to enforce it against a larger corp. not impossible but not cheap and without any guarantee of success.

Re: Ask HN: Huge enterprise customer wants to see our source code

#206

Post by dogma1138 »

raverbashing wrote: post #163
dogma1138 wrote: post #117

Earlier quoted context omitted.

I’m a security engineer at a large financial organization and we audit all 3rd party products most of these audits include a code review. This is a compliance process and it’s controlled by the SEC. All of your suggestions would make the company that I at least work for to simply walk away from table. This has happened more than once and all of our contracts contain a clause that if the application does not get a pas…

Why would a financial product have a compliance procedure by the FCC? > All of your suggestions would make the company that I at least work for to simply walk away from table. Unless the company is already a customer and is paying for the development of the software, please do walk away from the table, I'm sure they have better things to do and better customers to sell to

Typo, too many acronyms.

As for the second part I wont comment really I’m not in a place to make decisions on procurement I just brake things. I would just say that size/volume wise as far as clearings go there isn’t a better/bigger client. And everyone is the same.

Re: Ask HN: Huge enterprise customer wants to see our source code

#207

Post by mikekchar »

emilfihlman wrote: post #178
nugget wrote: post #90

Earlier quoted context omitted.

What exactly is the potential liability for a GPL violation? I've gone 12 rounds with IP lawyers over these theoretical violations (static vs dynamic links). But I found it odd that I could never find a single case of significant liability due to infringement. The nature of damages is unclear and the landscape of counter-parties (with an incentive to sue) is amorphous. It seemed like worst-case, a proven infringer ju…

They are just that: theoretical violations and even they are touted just by the FSF: no one else agrees that linking against source code taints your own code.

It really depends what you mean by "linking" and what you mean by "taints".

Linking GPL code to incompatible code is against the license terms and since you can't copy/distribute the code without a license you violate copyright if you distribute that code. Nobody, not even the FSF, believes that this means that your code must be under the GPL at that point -- it's just the remedy that the GPL explicitly allows. Other remedies are usually possible from the copyright holder (usually just "stop infringing our copyright"), or imposed by a court.

IANAL, but the act of a user linking GPL code to incompatible code without distribution is not copyright infringement IFAICT. I believe the FSF also agrees with that. In fact the GPL specifically states that you may run the code for any purpose. This leaves a kind of grey area where you could write code that can link to GPL code, but that you leave the end user to do the final linking. In the extreme these are the so-called "binary blobs" in things like the Linux kernel. My understanding is that the FSF thinks that these are an infringement but that other people disagree. I don't think it's ever been tested in court.

Edit: I should point out that the reasoning for it being an infringement is that by intentionally writing code that can link to the GPL code, you are creating a derived work of the GPL code. Whether this argument holds water is anybody's guess and I would love to see it tested in court.

Re: Ask HN: Huge enterprise customer wants to see our source code

#208

Post by OliverJones »

A point to make:

The company asking to see your code has deep pockets. That means they have a whole lot to lose if they breach a contract and steal your intellectual property.

So, if you put together a well-crafted non-disclosure and non-compete contract their risk is high if they mess with you. It'll cost you something to get a solid contract, but it may be worth it if you also get the business.

Re: Ask HN: Huge enterprise customer wants to see our source code

#209

Post by emacsgifs »

mikekchar wrote: post #207
emilfihlman wrote: post #178

Earlier quoted context omitted.

They are just that: theoretical violations and even they are touted just by the FSF: no one else agrees that linking against source code taints your own code.

It really depends what you mean by "linking" and what you mean by "taints". Linking GPL code to incompatible code is against the license terms and since you can't copy/distribute the code without a license you violate copyright if you distribute that code. Nobody, not even the FSF, believes that this means that your code must be under the GPL at that point -- it's just the remedy that the GPL explicitly allows. Other…

IFAICT ?

Re: Ask HN: Huge enterprise customer wants to see our source code

#210

Post by pcl »

dogma1138 wrote: post #201
patio11 wrote: post #128

Earlier quoted context omitted.

Thank you for your comment. Can you add, for the benefit of the peanut gallery, what the typical cost of a one year software license you pay for is? I have a good guess but I think HNers need to hear people-other-than-me say it to internalize it.

Really depends usually in the millions especially if this is a product related to trading. It’s also important to note that as far as I am aware contracts on this scale have multiple stages and we are paying for PoC/pilot programmes during which we usually perform our review. This usually isn’t software that a pre-sale engineer would come and setup in a few days so we are paying effectively even for a demo. Overall w…

Do you use SaaS products at all? If so, do you audit source for them too, or just products that run on your hardware / network?
Post reply on HN