Live data from Hacker News

Ask HN: Huge enterprise customer wants to see our source code

news.ycombinator.com

261–270 of 293 posts

Re: Ask HN: Huge enterprise customer wants to see our source code

#261

Earlier quoted context omitted.

Slightly tangential, but working for a small software company (<20 employees) who writes Line Of Business code for very large enterprise customers in the health care industry, we at times offer source code licenses, but at the very least (and this was my original point), our license as a vendor also includes source code escrow in the event of our collapse. We haven't really had anyone request a pre-sale source code r…

> our license as a vendor also includes source code escrow in the event of our collapse Wow, I've never heard of this before - it sounds great! Do you advertise this on your website, or is it just buried in the terms and conditions? I was just wondering how you might get across this info without worrying potential customers with the mere mention of collapse?

In our case it has always been something our large clients request and expect as part of any project we work on, rather than something we advertise as a feature of working with us.

Most companies will dictate that you use an escrow provider from their "preferred suppliers" list.

Re: Ask HN: Huge enterprise customer wants to see our source code

#262

Earlier quoted context omitted.

Seconding the “source code in escrow” solution as a mitigation about concerns of working with a startup. IMO enterprise customers happy to pay for it and it usually never gets asked about again

How does "code escrow" work in practice? Are you actively syncing to a private Git repo? Or is it more a case of, if we're collapsing, we'll put this in place?

> Or is it more a case of, if we're collapsing, we'll put this in place?

No-one would trust that. If you are collapsing you aren't going to care enough, or the people who do/did both care and know what to include (source, build toolchain setup, documentation) have already gone.

It is surprising, given how important it could be, how little the clients bother to check that escrow updates are happening - so even if the contract says otherwise it could often come down to this!

> Are you actively syncing to a private Git repo?

Some do that, but in my experience it is more common to provide a snapshot (a full copy of the relevant parts of your repo(s) with supporting documents), with a new snapshot uploaded with each major or minor release. Sometimes it isn't released based but instead the client dictates escrow is updated "at least once per year or X months" which to my mind shows that part of the contract was written by a legal/admin person without a lot of technical experience.

Re: Ask HN: Huge enterprise customer wants to see our source code

#263
I'm willing to be that the same company wouldn't ask Microsoft or IBM to see the source code of the software they buy from them. So I'd start by wondering why they can't treat your software, too, as the proprietary black box it is.

Is it because they're aware that you can't convincingly threaten them with litigation? Do they think you're too small to protect yourself effectively from the danger of IP theft?

If that is the case, then the answer is clear.

If the client actually has legitimate concerns- couldn't they ask you to run some specific tests, or make some experiments, and report the results to them? The amount of time spent to think of such tests should not be more than the amount of time needed to review your code and you could argue that examining the behaviour of your system can be more informative than looking at the source code.

Re: Ask HN: Huge enterprise customer wants to see our source code

#264
post #4

Answer: No. No one gets the secret sauce. They pay for your results.

And in the ML space we laugh at you and goto the next vendor. Because we paid for that model, it belongs to us. Just like how if I pay for an illustration I expect the PSDs.

> Because we paid for that model, it belongs to us. Just like how if I pay for an illustration I expect the PSDs.

What? They want "the PSD" before buying.

Re: Ask HN: Huge enterprise customer wants to see our source code

#265
post #249
post #85

Earlier quoted context omitted.

License compliance is incredibly important and unfortunately overlooked by many smaller firms. The potential liability to a GPL or other violation is just not worth it. Anecdote: We have released code under the Apache 2 License (our biggest project by far is https://github.com/sheetjs/js-xlsx ) and we've been roped into negotiations because some companies tried to take shortcuts by copying our code without proper att…

I don't understand how license compliance matters here. Why does the big customer care about whether the seller has violated licenses? The seller would be the one in trouble, not the customer.

If the seller is in violation of one or more licenses, they might get sued and be forced to discontinue or significantly alter their product. If the big customer depends heavily on the product and cannot easily replace it, they are also screwed in this scenario, even if they aren't in violation of any laws.

Re: Ask HN: Huge enterprise customer wants to see our source code

#266

Earlier quoted context omitted.

> our license as a vendor also includes source code escrow in the event of our collapse Wow, I've never heard of this before - it sounds great! Do you advertise this on your website, or is it just buried in the terms and conditions? I was just wondering how you might get across this info without worrying potential customers with the mere mention of collapse?

In our case it has always been something our large clients request and expect as part of any project we work on, rather than something we advertise as a feature of working with us. Most companies will dictate that you use an escrow provider from their "preferred suppliers" list.

Any suggestions for that “preferred suppliers” list?

Re: Ask HN: Huge enterprise customer wants to see our source code

#268
post #10

I ran a SAAS company for 8 years, going from zero to double-digit million rev per year. The answer is a clear no. They can PAY YOU to make custom plots/charts/reporting or run queries if they want to understand what it does better. There is almost always a way to achieve any business goal without requiring source code. The only case I can think of source code needing formal verification by a third party is if you're…

Have you actually dealt with enterprise sales? Source code is a fairly typical request, and there are software escrow and audit companies specifically set up to address concerns. Microsoft, for example, gives source code access to paying enterprises and governments under the Shared Source Initiative specifically for security vetting and other auditing purposes. OP: Consult a lawyer who specializes in these matters.

you could also give them source code but on printed paper so they don't outright steal the source, and also make them sign an NDA for a free with a much larger fee if they break it.

Re: Ask HN: Huge enterprise customer wants to see our source code

#270
post #257

Earlier quoted context omitted.

It really depends what you mean by "linking" and what you mean by "taints". Linking GPL code to incompatible code is against the license terms and since you can't copy/distribute the code without a license you violate copyright if you distribute that code. Nobody, not even the FSF, believes that this means that your code must be under the GPL at that point -- it's just the remedy that the GPL explicitly allows. Other…

> Linking GPL code to incompatible code is against the license terms and since you can't copy/distribute the code without a license you violate copyright if you distribute that code. Nobody, not even the FSF, believes that this means that your code must be under the GPL at that point Except as I understand it, this is the position pushed by WordPress and other GPL CMS's (Drupal?). They say that because a theme or a p…

There are 2 issues here and it's important to keep them separate.

1: If you are in violation of the license, must you put your code under the GPL? The answer is definitely no. If you are in violation of the GPL you may license your code under the GPL to become compliant (though in V2 and below you also have to be forgiven by the copyright holder(s)). This is an option that you have in addition to the options you have for any other copyright infringement (i.e. going to court). You never have to relicense your code. It's just a way to avoid court. There are definitely people who misunderstand this point, but I don't think you'll find anybody in an official capacity at the FSF who doesn't agree with the above.

2: If you write code that complies with an API in an GPL project, do you need a license? Like I said near the bottom of my other post, that's the grey area. Some people will say yes and some will say no. The idea is that complying with the API necessarily means that you are creating a derived work and are therefore infringing copyright if you don't have a license.

Like you, I initially found this idea to be very strange. However, the Oracle vs. Google court case lends considerable credence to it. In that case Google was found to have infringed on Oracle's copyright by implementing a published API. The judge ruled that it was fair use, though. I suspect (IANAL, remember) that if this was ever ruled upon you would probably get a similar judgement. The situation is fairly different, though, so you never know.

Now, the reason you don't find people challenging this stuff is (I think) mainly because the copyright holders are clear how they stand on the issue. I don't know anything about it, but I'll take your word that this applies to WordPress plugins/themes. You can just go against their wishes, but it's kind of a jerk move. Will anybody sue you if you do it? Will you win a court case? Maybe, maybe not, but you will certainly upset a lot of people so why do it? With the Linux kernel and binary blobs, it's all good as long as you stick with certain APIs. People do it knowing that nobody is going to sue them. NVidia steps over the boundaries, gets yelled at by Linus, but still nobody sues them.

I mean, you can also look at the really weird interpretation of the AGPL that projects like Mongo DB have. Their attitude is way more liberal than the license seems to state (to the point where I frequently wonder if they have actually read the license). But who is going to complain? It's their code -- they can do what they like. They don't have to sue anybody if they don't want to.

Post reply on HN