Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Huge enterprise customer wants to see our source code

news.ycombinator.com

Post reply on HN
Print view View original

211–220 of 293 posts

Re: Ask HN: Huge enterprise customer wants to see our source code

#211

Post by dogma1138 »

pcl wrote: post #210
dogma1138 wrote: post #201

Earlier quoted context omitted.

Really depends usually in the millions especially if this is a product related to trading. It’s also important to note that as far as I am aware contracts on this scale have multiple stages and we are paying for PoC/pilot programmes during which we usually perform our review. This usually isn’t software that a pre-sale engineer would come and setup in a few days so we are paying effectively even for a demo. Overall w…

Do you use SaaS products at all? If so, do you audit source for them too, or just products that run on your hardware / network?

SaaS is usually just a pentest some we get/request code access for.

Overall it depends on the risk profile of the product SaaS products tend to have a lower risk profile becuase they don’t deal with trades/contracts directly.

It’s all about managing risks. One of the products we use is Salesforce. Penetesting Salesforce would be a waste of time for us because Salesforce has a good application security team and is a trusted vendor. However we did perform a review of apps/plug-ins that run on the Salesforce platform which we use but have much less confidence in.

Re: Ask HN: Huge enterprise customer wants to see our source code

#212

Post by mikekchar »

emacsgifs wrote: post #209
mikekchar wrote: post #207

Earlier quoted context omitted.

It really depends what you mean by "linking" and what you mean by "taints". Linking GPL code to incompatible code is against the license terms and since you can't copy/distribute the code without a license you violate copyright if you distribute that code. Nobody, not even the FSF, believes that this means that your code must be under the GPL at that point -- it's just the remedy that the GPL explicitly allows. Other…

IFAICT ?

Typo. As far as I can tell. Sorry!

Re: Ask HN: Huge enterprise customer wants to see our source code

#214

Post by dogma1138 »

heartbreak wrote: post #181
dogma1138 wrote: post #117

Earlier quoted context omitted.

I’m a security engineer at a large financial organization and we audit all 3rd party products most of these audits include a code review. This is a compliance process and it’s controlled by the SEC. All of your suggestions would make the company that I at least work for to simply walk away from table. This has happened more than once and all of our contracts contain a clause that if the application does not get a pas…

I’ve had a financial product audited by an independent firm the client and I agreed on. In fact they still audit it on a regular basis despite the product no longer being maintained.

This also can be acceptable based on the risk; sometimes we get a full pentest report from an independent security vendor.

Re: Ask HN: Huge enterprise customer wants to see our source code

#215

Post by FireBeyond »

GordonS wrote: post #148
FireBeyond wrote: post #115

Earlier quoted context omitted.

Slightly tangential, but working for a small software company (<20 employees) who writes Line Of Business code for very large enterprise customers in the health care industry, we at times offer source code licenses, but at the very least (and this was my original point), our license as a vendor also includes source code escrow in the event of our collapse. We haven't really had anyone request a pre-sale source code r…

> our license as a vendor also includes source code escrow in the event of our collapse Wow, I've never heard of this before - it sounds great! Do you advertise this on your website, or is it just buried in the terms and conditions? I was just wondering how you might get across this info without worrying potential customers with the mere mention of collapse?

Given the nature of the product we sell (where implementations are in the six-seven digit range, with sometimes over a year of prep work), it tends to come up in discussion most times, and I think may even be in our boilerplate contract (which is signed by both parties, it's not 'order online, enter credit card' purchasing).

Re: Ask HN: Huge enterprise customer wants to see our source code

#216

Post by FireBeyond »

bluGill wrote: post #40
skmurphy wrote: post #21

Earlier quoted context omitted.

Even source code escrow should be resisted. "Out of Business" is not always clear and if you are trying to get acquired your value drops dramatically if major customers have your source.

True, the code escrow needs to be written correctly. Done correctly it only kicks in if the code goes unsupported. You can be acquired so long as the company buying you continues to support it at a "reasonable price". If they don't support the code for a "reasonable price" they didn't buy you for the code anyway so it won't matter. If they do support it, then the escrow doesn't come into play.

I had a customer ask (we have an escrow clause), "What's to stop us not paying your bills (for support and licensing) until you go out of business and then getting the source code?"

We pointed to (one of many) conditions that said that escrow would be only released to customers who were in good standing with us -before- the escrow event (and that wasn't transferable, as in they couldn't settle accounts with trustees, acquirers or the like - similar to 'not being able to buy retroactive insurance').

Re: Ask HN: Huge enterprise customer wants to see our source code

#217

Post by nh2 »

paul7986 wrote: post #132

My partner and I met with Google ATAP after emails and conversations. Our experience if I was you is to be weary. Google just wanted to see our secret sauce and once revealed kick us to the curb. They need to pay you or you walk away!

I remember reading something about that on HN; digging it up I saw that it was indeed you who posted that:

https://news.ycombinator.com/item?id=15422475

Re: Ask HN: Huge enterprise customer wants to see our source code

#218

Post by seehafer »

FireBeyond wrote: post #115
lasereyes136 wrote: post #14

Well, having worked for a small software startup that did just that, I can tell you what we did. We agreed to letting them audit the code with conditions. 1. The audit happened on our computers with someone from our team in control (me). I locked the computer when I wasn't physically there to watch what they did. 2. We removed the most sensitive part of the code and told them what it did. We kept the method signature…

Slightly tangential, but working for a small software company (<20 employees) who writes Line Of Business code for very large enterprise customers in the health care industry, we at times offer source code licenses, but at the very least (and this was my original point), our license as a vendor also includes source code escrow in the event of our collapse. We haven't really had anyone request a pre-sale source code r…

Seconding the “source code in escrow” solution as a mitigation about concerns of working with a startup. IMO enterprise customers happy to pay for it and it usually never gets asked about again

Re: Ask HN: Huge enterprise customer wants to see our source code

#219

Post by cgio »

GordonS wrote: post #148
FireBeyond wrote: post #115

Earlier quoted context omitted.

Slightly tangential, but working for a small software company (<20 employees) who writes Line Of Business code for very large enterprise customers in the health care industry, we at times offer source code licenses, but at the very least (and this was my original point), our license as a vendor also includes source code escrow in the event of our collapse. We haven't really had anyone request a pre-sale source code r…

> our license as a vendor also includes source code escrow in the event of our collapse Wow, I've never heard of this before - it sounds great! Do you advertise this on your website, or is it just buried in the terms and conditions? I was just wondering how you might get across this info without worrying potential customers with the mere mention of collapse?

Even big vendors do source code escrow for very big contracts (e.g. government).

Re: Ask HN: Huge enterprise customer wants to see our source code

#220

Post by ggm »

If you were selling, you would be obliged to do this, under enforcable contract terms which penalize theft of the IPR.

I think the onus would be similar for the single customer model. In effect, if you are coding to deliver to them, and they are bankrolling your deployment, they're buying you in all but name. So, the conditionality on their checking of your IPR, should be the same as selling your IPR.

Post reply on HN