Depending on what they're reason is, it may be satisfactory to have the code looked at by a qualified 3rd party (with proper NDAs all-ways).
Ask HN: Huge enterprise customer wants to see our source code
221–230 of 293 posts
Re: Ask HN: Huge enterprise customer wants to see our source code
#222I have run into requests like these twice. First time the big gorilla company liked our product and they wanted it for a core process of their business. They knew we were a small startup and they wanted to be sure we were doing things properly. So they asked us for a full audit of the code by a third party company. This external company was a big consultancy and auditing company and they run something like a 'due dil…
> this company did not want to play fair and it was clear that they wanted to copy
Were there other signs they wanted to copy besides "asked for the source code and they wanted it all the time they needed to study it by themselves"? I'm curious about the red flags to look out for when negotiating such deals
Re: Ask HN: Huge enterprise customer wants to see our source code
#223Earlier quoted context omitted.
fantastic question. Just because the software complied with the requirements at one point doesn't mean it will in the future.
True, but I'm thinking if you can tell it was written by people who know what they're doing, odds are the company will continue to have people who know what they're doing.
In this situation at least it’s a 5 person company so the flux that they’re going to have to go through both with people and tech is gonna be pretty large. If you’re trying to gauge the future you could probably do the same / better job figuring that information out by having technical deep dives and researching their key employees and their past track record. Personally the source code is not the way I would want to gauge that information in the first place anyways, it’s a logistical nightmare and overkill.
Also to be more helpful it’s not unreasonable to ask to speak with current customers, seek proof of claims on stuff like SLAs and uptime, etc. There’s literally a million ways people do this in the real world without obtaining source code.
Re: Ask HN: Huge enterprise customer wants to see our source code
#224My partner and I met with Google ATAP after emails and conversations. Our experience if I was you is to be weary. Google just wanted to see our secret sauce and once revealed kick us to the curb. They need to pay you or you walk away!
I remember reading something about that on HN; digging it up I saw that it was indeed you who posted that: https://news.ycombinator.com/item?id=15422475
Yup just sharing my experience to help others who are so desperate to prove a market and or have the amazing opportunity to make a living building awesome tech by selling their tech to a big behemoth.
The OP says they are trying to show a market for their tech by winning this contract. After meeting with Google... all tech company's came out of the wood work and one .. Black & Decker wanted to become a customer. Though they refused to sign any type of NDA and or IP agreement yet were willing to pay a very small fee. My mentor (guy who created Xbox headphones) at the time said if they don't sign anything forget it. Ultimately I did, yet it was the crushing blow to the SpeakerBlast team and me personally for awhile.
I think the guy I met with is still the head of Chrome Audio, yet his boss at the time Regina Dugan was just in the news. She was heading up Facebook's secretive research lab, Building 8.
Re: Ask HN: Huge enterprise customer wants to see our source code
#225Earlier quoted context omitted.
One thing I would note is that the individual employee might not be authorized to sign a legal document, such as "a non-compete and or a non-disclosure". My company informs us told to actively refuse to sign any legal documents (even at visitor check-in) -- we have a Legal team for that. All documents should be signed by Legal before I step on site.
Out of curiosity, are you barred from installing software on company computers, because you're either explicitly or implicitly accepting an EULA?
My company will scan our computers every once in a while. I've gotten alerts about having software I have installed that I should not - both cases we had an enterprise license and I was using a trial. I didnt want to go through a burdensome request process to try something.
Re: Ask HN: Huge enterprise customer wants to see our source code
#226My partner and I met with Google ATAP after emails and conversations. Our experience if I was you is to be weary. Google just wanted to see our secret sauce and once revealed kick us to the curb. They need to pay you or you walk away!
Edit: Pay you and sign an rock solid IP agreement and or just pay you a tons of money!
Re: Ask HN: Huge enterprise customer wants to see our source code
#227I think this is a signal that you're probably underpriced by a factor of 2X to 10X. So this is a sales objection. With regards to that justification, I'd want to know a) who in the business is generating it and b) what they expect to feed your answer into. Is this just somebody who wanted to sound smart in a meeting? Then they don't need your source code; they need ~5 nice PowerPoint slides and you're done. I'd be po…
This advice is generally very sound but misses the mark slightly.
> underpriced by a factor of 2X to 10X.
The OP never asked about price, so this is pure speculation. Why is the conclusion that this is a sales objection?
> It's going to cost you $20k and some legal wrangling regarding non-disclosure and non-competes
It sounds like they haven't even gotten through procurement yet, which means they can't even suggest charging $20k for NDA's etc.
> Is this just somebody who wanted to sound smart in a meeting?
This absolutely does happen, but it doesn't happen when the company is discussing POC plans.
> We know that they have lots of resources and are building up internal data science team. And yet it was pointed out to me that their goal might not necessarily be to outright steal our IP, but rather to cover their bases. But we are still worried they might be "inspired" by the parts they see and get their internal teams to replicate across other sites or use cases. And we don't have the resources to litigate, nor any way of knowing they do this.
> Is this a business unit head sniffing for new things to build?
These are both hypotheses based on observations, but they are not conclusions to the situation.
The OP's company needs someone who has experience in this realm (a "grey haired enterprise software sales guy") and help them come to a conclusion before they make decisions to move this forward. There's way too many variables and open questions to offer any real sound advice.
TL;DR - for situations this complex and high stakes, relying on a HN comments will not bode well.
For the record since someone asked in another comment, I have navigated a procurement process with a financial services company with $1T in AUM, working on a $50M/year software project, as an example of experience.
Re: Ask HN: Huge enterprise customer wants to see our source code
#228Earlier quoted context omitted.
I’m a security engineer at a large financial organization and we audit all 3rd party products most of these audits include a code review. This is a compliance process and it’s controlled by the SEC. All of your suggestions would make the company that I at least work for to simply walk away from table. This has happened more than once and all of our contracts contain a clause that if the application does not get a pas…
Thank you for your comment. Can you add, for the benefit of the peanut gallery, what the typical cost of a one year software license you pay for is? I have a good guess but I think HNers need to hear people-other-than-me say it to internalize it.
Anecdotal - for a large publicly traded financial services who wants to manage their book of record software (i.e. the software that holds the truth of "dear client you hold this many assets"), you're looking at $3-5M/year in license costs.
Depending on the business context of a ML solution for a company like the OP describes, you're likely looking at $500k+, but this is pure speculation and requires more information about the customer situation (e.g. is the ML solution going to save the company money or help them sell more).
Re: Ask HN: Huge enterprise customer wants to see our source code
#229Earlier quoted context omitted.
License compliance is easily verified using 3rd party services like Black Duck. You basically install a scanner on your machine, feed your sources into it, it hashes them line by line and sends hashes to the mothership for analysis. It then spits out the report that file X, line Y matches something in the open source package Z. At least that's how it worked a decade ago, when we had to do a pre-acquisition source cod…
BD still works that way. The lawyers love making us use it. https://www.blackducksoftware.com/solutions/mergers-and-acqu...
GPL in my source? You'd be surprised.
Re: Ask HN: Huge enterprise customer wants to see our source code
#230Is this the business side asking?
They're implicitly giving you product guidance here.
I'm also in the DS/ML space, and there is an absolute dearth of explainability in our models. It's atrocious given the decision that are based on these models to not be able to explain why they come up with what they did.
Get back to them and tell them you'll add explainability to your models. Even if it's just something simple like LIME (vary each input to a model, measure the change it produces - works for any model).