Live data from Hacker News

Ask HN: Huge enterprise customer wants to see our source code

news.ycombinator.com

251–260 of 293 posts

Re: Ask HN: Huge enterprise customer wants to see our source code

#251
This is the untold story about Nothing Real (the original Shake developers), Apple, Steve Jobs, Disney, and the shake[1] source code...

NR developed shake, and when bigger studios started using it, they wanted access to the source code. Disney was one customer who paid to put shake's source code into escrow, with a stipulation that if NR ever went under or got acquired, they could pull it out of escrow and build shake (on Linux) themselves.

Enter Steve Jobs and Apple, who viewed shake as an asset that could help push studios towards Mac OS X, and away from SGI and upstart Linux which was steadily taking SGI's high-end CG market. When Apple acquired Nothing Real, Steve wasn't at all happy with the animation studio's CTO who decided to exercise their contract and pull the shake code out of escrow.

Disney ported shake to amd64 Linux and continued to use and extend it all the way until Tangled (2008), and while it's not their main workhorse compositor these days, shake still runs today, despite Apple's best efforts to kill it ;-). To Apple's credit, they eventually realized that shake's source code was not really that big of an asset, so they offered a deal at one point where studios could pay (50k+?) to get access to the source code. Many studios payed.

Having compared the NR sources to the Apple sources, quite a bit of work was done to put in PPC-specific assembly and performance optimizations (e.g. optimizing for G5's cache sizes) into Darwin-specific #ifdefs.

One takeaway from this story is that the "big" customer (Disney) in this case was not at all interested in stealing IP. They were an animation studio and their core product was something not-software. If the customer in your case is in a closer space, it's a different calculus.

The customer's viewpoint was more of being able to decide their own fate in the event of the company going away. And it turns out, those things did happen, so having the deal in place was a good thing for the customer. Likewise, Nothing Real made out very well in all of this, as they got paid by Disney (among others), and later acquired by Apple who really didn't care enough about the pre-existing contracts to not acquire them.

One protection in the contract was that it only allowed for the studio to produce binaries for themselves, but not distribute them. A practical consequence of this is that Disney could not share shake binaries with Pixar, and while Pixar had also purchased a source license from Apple, Disney could only share (git format-patch) patches with Disney's changes. I really wish we could have open sourced the shake source code, even for historical purposes[2]. Apple still can.

Make sure the deal is reasonable and there shouldn't be any problems. If you don't trust the company then maybe you shouldn't take them on as a client, but otherwise a reputable company will be very willing to keep things as friendly as your lawyers can get them to be. Having a good lawyer is key.

Regarding copy-pasting your code -- in shake's case, having the source code was really helpful for plugin development. Maybe consider ways to help customers leverage actually having the source code. Making the system plugin-able is a great way to do that, as customers mostly want to customize stuff, and plugins are a great way to get customers "deeply integrated" (aka locked) into your ecosystem.

[1] https://en.wikipedia.org/wiki/Shake_(software)#History

[2] https://www.flickr.com/photos/ronbrinkmann/sets/721576179728...

Re: Ask HN: Huge enterprise customer wants to see our source code

#252
post #155

Earlier quoted context omitted.

Jail for copyright violation? I guess people who've distributed pirated goods, like movies or music, have gone to jail, but I've never heard of it happening to a software developer. Fines are plausible, but I'm having a hard time imagining a scenario that leads to jail time.

The plausible situation is no criminal case, just a civil case, and probably settling for what amounts to a fine / delayed purchase, e.g. the "$10k donation" alluded to. But the worst case possibility, even if very unlikely, should include jail time (somehow -- I too don't know exactly how that would work out or who exactly would go to jail, manager or dev).

Just curious here... It's a license violation, then, not a copyright (law) violation. So isn't it more like breach of contract, i.e. a civil matter between parties, rather than a criminal case? And one does not go to jail for civil cases, do they?

Re: Ask HN: Huge enterprise customer wants to see our source code

#253

Earlier quoted context omitted.

Why would a financial product have a compliance procedure by the FCC? > All of your suggestions would make the company that I at least work for to simply walk away from table. Unless the company is already a customer and is paying for the development of the software, please do walk away from the table, I'm sure they have better things to do and better customers to sell to

Typo, too many acronyms. As for the second part I wont comment really I’m not in a place to make decisions on procurement I just brake things. I would just say that size/volume wise as far as clearings go there isn’t a better/bigger client. And everyone is the same.

Ah your other comment makes the procedure and why it's needed clearer

Re: Ask HN: Huge enterprise customer wants to see our source code

#254

Earlier quoted context omitted.

Seconding the “source code in escrow” solution as a mitigation about concerns of working with a startup. IMO enterprise customers happy to pay for it and it usually never gets asked about again

How does "code escrow" work in practice? Are you actively syncing to a private Git repo? Or is it more a case of, if we're collapsing, we'll put this in place?

Correct there's some (not necessarily daily or weekly) amount of sync frequency that you negotiate.

Re: Ask HN: Huge enterprise customer wants to see our source code

#256
post #155

Earlier quoted context omitted.

The plausible situation is no criminal case, just a civil case, and probably settling for what amounts to a fine / delayed purchase, e.g. the "$10k donation" alluded to. But the worst case possibility, even if very unlikely, should include jail time (somehow -- I too don't know exactly how that would work out or who exactly would go to jail, manager or dev).

Just curious here... It's a license violation, then, not a copyright (law) violation. So isn't it more like breach of contract, i.e. a civil matter between parties, rather than a criminal case? And one does not go to jail for civil cases, do they?

GPL is a license to use copyrighted code, not a contract. If you violate the terms, your license is revoked. If you then continue to distribute the code in question without a license, then you may be liable for copyright infringement.

The first consequence of this is that only the copyright holder has standing to sue you, not anyone else who thinks they have a right to your code because you violated the GPL terms. They’re just wrong.

The second consequence is that the only remedies for copyright infringement are an injunction and damages related to the copyrighted code. So a court could force you to stop distributing the copyrighted code, requiring you to either (1) remove the GPL code from your product and use a substitute, or (2) pay for a commercial license from the owner. But you would not be forced to release your proprietary code under a GPL license.

Regarding jail for civil cases, no. In the US, we eliminated debtors’ prisons many years ago.

Re: Ask HN: Huge enterprise customer wants to see our source code

#257

Earlier quoted context omitted.

They are just that: theoretical violations and even they are touted just by the FSF: no one else agrees that linking against source code taints your own code.

It really depends what you mean by "linking" and what you mean by "taints". Linking GPL code to incompatible code is against the license terms and since you can't copy/distribute the code without a license you violate copyright if you distribute that code. Nobody, not even the FSF, believes that this means that your code must be under the GPL at that point -- it's just the remedy that the GPL explicitly allows. Other…

> Linking GPL code to incompatible code is against the license terms and since you can't copy/distribute the code without a license you violate copyright if you distribute that code. Nobody, not even the FSF, believes that this means that your code must be under the GPL at that point

Except as I understand it, this is the position pushed by WordPress and other GPL CMS's (Drupal?).

They say that because a theme or a plugin uses WordPress's functions and these are GPL licensed, then you're 'linking' with it and your PHP code has to be GPL licensed too.

To me this is crazy, but no one has challenged it yet.

Re: Ask HN: Huge enterprise customer wants to see our source code

#258
> 1) Has anybody run into a request like this? How would you respond?

Yes. Satisfy their justification without showing code. It is possible to show how algorithms made their decisions. Make this part of your product. You already noticed there is a demand for it and that delivering a black box can be a deal-breaker. So read up on LIME, decision paths, interpretable models on black box output, etc. and give them the capability to see how an algo made its decision.

> 2) How likely do you think their goal is to genuinely "see what happens under the hood" as opposed to replicate in the future?

Unlikely they'll replicate. It would set them up for legal problems. Depending on how deep your moat is (training data, novel optimization techniques, encoded domain expertise), they probably wouldn't even need to see source to replicate in-house. It may be more about not being hood-winked, paying top dollar for a product that does a few imports from open source libraries.

> 3) Are there any legal protections we can put in place to prevent them from not just copy-pasting our code, but also from "learning from it" or so?

Not that I know of. Perhaps you could charge extra for the code review, so in the case of "learning from it" they'll at least pay for it. A thought exercise: did you learn from open source/open research/commercial solutions before building your Proof-of-Concept? If no, then they don't need to either (provided they can hire the talent), if yes, you are like a thief who is worried they will steal from you :).

Re: Ask HN: Huge enterprise customer wants to see our source code

#259
post #90
post #85

Earlier quoted context omitted.

License compliance is incredibly important and unfortunately overlooked by many smaller firms. The potential liability to a GPL or other violation is just not worth it. Anecdote: We have released code under the Apache 2 License (our biggest project by far is https://github.com/sheetjs/js-xlsx ) and we've been roped into negotiations because some companies tried to take shortcuts by copying our code without proper att…

What exactly is the potential liability for a GPL violation? I've gone 12 rounds with IP lawyers over these theoretical violations (static vs dynamic links). But I found it odd that I could never find a single case of significant liability due to infringement. The nature of damages is unclear and the landscape of counter-parties (with an incentive to sue) is amorphous. It seemed like worst-case, a proven infringer ju…

Cease and desist selling your core product until you replace the GPL bits, or else make your core produt open source.

Re: Ask HN: Huge enterprise customer wants to see our source code

#260
post #154

Earlier quoted context omitted.

Jail for copyright violation? I guess people who've distributed pirated goods, like movies or music, have gone to jail, but I've never heard of it happening to a software developer. Fines are plausible, but I'm having a hard time imagining a scenario that leads to jail time.

Developers have gone to jail for stealing code from financial companies. See: https://en.wikipedia.org/wiki/Sergey_Aleynikov Most GPL projects however don't have expensive, hateful, blood seeking lawyers behind them.

Aleynikov was charged with stealing trade secrets, which does not apply to GPL software.
Post reply on HN