Live data from Hacker News

Ask HN: Huge enterprise customer wants to see our source code

news.ycombinator.com

231–240 of 293 posts

Re: Ask HN: Huge enterprise customer wants to see our source code

#231
post #122

Earlier quoted context omitted.

Your no answers reminds me of an experiment I read about where they determined people were more likely to accept a request if you included pretty much any justification, even when totally self evident. E.g people are more likely to cut in line at the copier if you say 'can I cut in line, because I need to make a copy'. Even with an inane excuse like that (everyone else there also needs to make a copy) people are more…

To be honest I might be at the copy machine to make a copy but I might not actually need to make it then and there. I might be able to re-print it, or do it later. When someone tells me he needs to do that then I think maybe it's more urgent than mine. I wonder if there are subtleties like this that explain these in reality.

But that is the case for almost anything. Exceedingly few things are things you need to do right then, right there, or even at all.

For some it is more important, and they won't yield, but some proportion will doing something because the cost of doing it is low enough that there's no reason not to.

In that case giving a reason creates a cost in persisting in that you need to consciously think through whether or not it's worth arguing over, and if so what to respond. And sometimes that is enough that you'll just shift your focus to something else and not bother.

I have no doubt the effectiveness will vary greatly depending on type of action, and that it will vary greatly depending on other factors tied to why people wanted to carry out a given action in the first case, of course, but I also think people ask for or do a lot of things where they have not really made a conscious decision that they need it, just decided on a whim that there's no reason not to ask.

Especially with group dynamics involved, it might have been as simple as someone asking a question in a meeting ("do we need the source?" for example) and someone deciding "might as well ask for it, just in case", with nobody actually caring enough to defend it i you stand up to the demand. In that case the need is low enough that even a totally inane excuse for saying no might stand up even if it on the surface looks like a big, important question.

Re: Ask HN: Huge enterprise customer wants to see our source code

#233

Earlier quoted context omitted.

Another possibility is they're worried you'll go out of business. In that case, they don't need to see the code right now. You can set up a code escrow agreement in case you cease to exist.

no, every big enterprise I've worked for we do source audits on everything that is allowed to run. We check for phoning home, we check for license issues, we check for massive security vulnerabilities. It's just a cover your ass kinda thing when 100k people are going to run an app. There's a whole department for that.

Yes, the calculus is completely different when you are a 5k midsize company vs a 50k+ behemoth. There are strict, multi-layered processes for everything in larger companies, especially software procurement (including yearly upgrades!), and legal attends every meeting.

Re: Ask HN: Huge enterprise customer wants to see our source code

#234
(Customer has $50+bn in revenue) tells us nothing. How good is it going to be for YOU? Because that should be the main data point for this decision. You might want to charge them 10X-50X the usual price if their request involves trade secret disclosure.

Insofar as their motives are concerned, you should assume the worst; that that they will steal your IP and force you into endless litigation. From a game theoretic min/max perspective this is a sound way to think about it. It's also reasonably likely. There is a good chance they want you to get them started on a problem they don't know how to solve and then they will iterate off your solution. Happens all the time. Imo, if you are building a business in this space, you shouldn't let them do this to you.

Other options: Offer to add some explainable AI visualization stuff into the app. Hide the best parts behind a web service and only agree to give them the source code for the gui. It sounds crazy but people will agree to compromises like this all the time.

Re: Ask HN: Huge enterprise customer wants to see our source code

#235
post #10

I ran a SAAS company for 8 years, going from zero to double-digit million rev per year. The answer is a clear no. They can PAY YOU to make custom plots/charts/reporting or run queries if they want to understand what it does better. There is almost always a way to achieve any business goal without requiring source code. The only case I can think of source code needing formal verification by a third party is if you're…

Have you actually dealt with enterprise sales? Source code is a fairly typical request, and there are software escrow and audit companies specifically set up to address concerns. Microsoft, for example, gives source code access to paying enterprises and governments under the Shared Source Initiative specifically for security vetting and other auditing purposes. OP: Consult a lawyer who specializes in these matters.

Yes, including accounts > $1M.

Re: Ask HN: Huge enterprise customer wants to see our source code

#236
post #154

Earlier quoted context omitted.

Developers have gone to jail for stealing code from financial companies. See: https://en.wikipedia.org/wiki/Sergey_Aleynikov Most GPL projects however don't have expensive, hateful, blood seeking lawyers behind them.

That is completely different. You don't go to jail for a license violation.

Honest question:

Is a license violation not equivalent to unlicensed use of code?

I mean, if you don't meet the terms of a license, you're not eligible to use the code under that license. That means you have no license to the code, and therefore are in breach of copyright, no?

How is that different from just using someone else's code outright - you're breaching copyright and you're not licensed, no?

Re: Ask HN: Huge enterprise customer wants to see our source code

#238

Earlier quoted context omitted.

Slightly tangential, but working for a small software company (<20 employees) who writes Line Of Business code for very large enterprise customers in the health care industry, we at times offer source code licenses, but at the very least (and this was my original point), our license as a vendor also includes source code escrow in the event of our collapse. We haven't really had anyone request a pre-sale source code r…

Seconding the “source code in escrow” solution as a mitigation about concerns of working with a startup. IMO enterprise customers happy to pay for it and it usually never gets asked about again

How does "code escrow" work in practice? Are you actively syncing to a private Git repo?

Or is it more a case of, if we're collapsing, we'll put this in place?

Re: Ask HN: Huge enterprise customer wants to see our source code

#239

Most of the people in this thread clearly don't understand the situation as Analytics/ML is quite different to normal IT. 1) The company is not going to acquire you nor will they sue you. 2) They absolutely want to replicate what you've done. It's not so that they can build their own startup and compete with you. It's because they genuinely want to understand how you got the results. Companies are increasingly basing…

What happens if they have their own scientists take a look at the model and decide to replicate it internally without paying a cent?

Knowing the sorts of decisions that were made around what types of algorithms and features to use (obvious after a cursory examination of the code) would give them a huge leg-up in developing a similar model.

Re: Ask HN: Huge enterprise customer wants to see our source code

#240
1) yes but was more than algorithms 2) If you're not realistic and being stupid with yourself and look at the amount of money that the industry has there's ($50bn) no legitimate way if I were to see your code would not steal it because I have "UNLIMITED RESOURCES". I'll first try using scare tactics of pulling out of the contract then if it's not good and I really want it I'll try putting you in a binding contract and litigated out of court and three by the time you realize all the shit that's happened to you you'll be with your head stuck up in to you know where writing a pity log post. Whining about how the deal of a lifetime got away. 3) If a lawyer tells you that they can find a way to bind them in the contract they must have actual software experience must be experienced for 10+ years and must know IP patent law. (Last I checked you're not KKR). If you don't want to believe what I'm telling you just look at the cases Java oracle case comes to mind so that the android source code and so does. Plenty of others.

SOLUTION: 1) DON'T BE A CUCKMINDED i.e. not Antifragile. 2) There's five of you so some of you might agree some of you might not you have to be joint in your decision and equally around because if you're not that's a weak link. THE ANSWER MUST BE NO AND SAID ASTUTELY. "NO" COMING FROM ALL OF YOU IN DIFFERENT WAYS THAT YOU'RE ABLE TO COMMUNICATE. Where's case scenario if the industry has 50 billion I don't think you should have a hard time finding another potential even bigger customer in this field. (Speculation You're in the insurance business)

Other legal criteria: They may try coercing you as far as compliance and legal statutory, regulatory factors are concerned to say that they want to see the source code. In that case you can find a third-party which you should do a lot of homework on unbiased arbitrator To have a look at. By the way you should put this in the contract if it ever arises and by the size of the company that you're referring to it sounds like that would be something I would do. If it's your crown jewel protect it simple.

Historical relevance: Look at how the shell company was formed in order to compete with standard oil and how Rockefellers ROSE there was no sharing going on.

PS your welcome, pass it on.

And the only thing you need to know about the law is if I have enough resources the law doesn't matter and that's a fact in this country particularly when it comes to huge sums of money & tech. It's nascent and it's not really understood by a bunch of 80-year-old judges.

With regards to the following comments please save that shit for your grandma I really don't care I don't even want an opinion and no I'm not gonna be answering to this comment.

GodSpeed

ProTip

All five must be on board with this decision

Post reply on HN