8 ms·
Well, having worked for a small software startup that did just that, I can tell you what we did. We agreed to letting them audit the code with conditions. 1.
by lasereyes136 9y ago
Well, having worked for a small software startup that did just that, I can tell you what we did.
We agreed to letting them audit the code with conditions.
1. The audit happened on our computers with someone from our team in control (me). I locked the computer when I wasn't physically there to watch what they did.
2. We removed the most sensitive part of the code and told them what it did. We kept the method signature.
3. All of the source code remained on my laptop and my laptop was never attached to their network.
4. We could tell them that we would not answer any question they asked.
5. They paid for expenses and time. It lead to a decent sized contract.
It lasted about 2 days for a medium sized Java application. They asked one or two questions I wasn't allowed to answer and took it well when I told them so.
I am not a lawyer but you can also ask for a non-compete and or a non-disclosure from their individual employees that will conduct the review. Get your lawyer on that before you do it.
It is up to you or your company to decide what to do. No one can tell you if it a good or bad decision for you. At least for me and my company, it worked out. As far as I know the auditing company never developed a competitor and was a customer of my company for a long time to come.
- FireBeyond 9y agoSlightly tangential, but working for a small software company (<20 employees) who writes Line Of Business code for very large enterprise customers in the health care industry, we at times offer source code licenses, but at the very least (and this was my original point), our license as a vendor also includes source code escrow in the event of our collapse. We haven't really had anyone request a pre-sale source code review.
- GordonS 9y ago> our license as a vendor also includes source code escrow in the event of our collapse Wow, I've never heard of this before - it sounds great! Do you advertise this on your website, or is it just buried in the terms and conditions? I was just wondering how you might get across this info without worrying potential customers with the mere mention of collapse?
- dboreham 9y agoYou don't advertise it. You say nothing until a customer expresses concern about your long term survival then you say "Oh yeah this comes up from time to time and the solution is code escrow, we've done it for customer Y and X so we know the drill".
- FireBeyond 9y agoGiven the nature of the product we sell (where implementations are in the six-seven digit range, with sometimes over a year of prep work), it tends to come up in discussion most times, and I think may even be in our boilerplate contract (which is signed by both parties, it's not 'order online, enter credit card' purchasing).
- cgio 9y agoEven big vendors do source code escrow for very big contracts (e.g. government).
- dspillett 9y agoIn our case it has always been something our large clients request and expect as part of any project we work on, rather than something we advertise as a feature of working with us. Most companies will dictate that you use an escrow provider from their "preferred suppliers" list.
- matt_the_bass 9y agoAny suggestions for that “preferred suppliers” list?
- dspillett 9y agoIf there is a preferred suppliers list in operation, you don't pick those suppliers your client does. And it will often be relatively local, at least country local, companies in my experience, presumably for legal jurisdiction reasons. So what our clients dictate is probably irrelevant to your needs.
- seehafer 9y agoSeconding the “source code in escrow” solution as a mitigation about concerns of working with a startup. IMO enterprise customers happy to pay for it and it usually never gets asked about again
- another-dave 9y agoHow does "code escrow" work in practice? Are you actively syncing to a private Git repo? Or is it more a case of, if we're collapsing, we'll put this in place?
- seehafer 9y agoCorrect there's some (not necessarily daily or weekly) amount of sync frequency that you negotiate.
- dspillett 9y ago> Or is it more a case of, if we're collapsing, we'll put this in place? No-one would trust that. If you are collapsing you aren't going to care enough, or the people who do/did both care and know what to include (source, build toolchain setup, documentation) have already gone. It is surprising, given how important it could be, how little the clients bother to check that escrow updates are happening - so even if the contract says otherwise it could often come down to this! > Are you actively syncing to a private Git repo? Some do that, but in my experience it is more common to provide a snapshot (a full copy of the relevant parts of your repo(s) with supporting documents), with a new snapshot uploaded with each major or minor release. Sometimes it isn't released based but instead the client dictates escrow is updated "at least once per year or X months" which to my mind shows that part of the contract was written by a legal/admin person without a lot of technical experience.
- another-dave 9y agoHaha, was thinking that wouldn't be too trusted alright! Scheduled syncing makes sense. Cheers for the replies, have never heard of the concept of code escrow before, seems like a neat solution
- tootie 9y agoYou mean to say that you reserved the right to not answer certain questions or that you refused any questions?
- lasereyes136 9y agoWe reserved the right to not answer certain questions. I answered most of their questions, only 1 or 2 were in areas where I wasn't suppose to give them answers.
- evantahler 9y agoI've done this too. The question is usually a matter of compliance more than anything else. They want to check the licenses of any included packages, makes sure there's no encryption stuff that can't leave the USA, etc. Doing what OP described is great: it lets their folks do the audit with no risk of you loosing "ownership". It shows you are both a good partner and value what you do.
- eps 9y agoLicense compliance is easily verified using 3rd party services like Black Duck. You basically install a scanner on your machine, feed your sources into it, it hashes them line by line and sends hashes to the mothership for analysis. It then spits out the report that file X, line Y matches something in the open source package Z. At least that's how it worked a decade ago, when we had to do a pre-acquisition source code audit.
- mcbain 9y agoBD still works that way. The lawyers love making us use it. https://www.blackducksoftware.com/solutions/mergers-and-acquisitions https://www.blackducksoftware.com/solutions/mergers-and-acqu...
- foota 9y agoGPL in my source? You'd be surprised.
- kazinator 9y agoLicense compliance is not verified in closed source stuff, period. When was the last time some user of Windows verified whether Microsoft Windows contains some piece of code that Microsoft shouldn't be redistributing?
- SyneRyder 9y agoMicrosoft has provided Windows source code for auditing for a long time, especially to governments. Here's an article about it from 2003: https://www.computerworld.com/article/2580563/microsoft-windows/microsoft-opens-source-code-to-governments.html https://www.computerworld.com/article/2580563/microsoft-wind... And again in 2015: https://www.petri.com/no-back-doors-microsoft-opens-windows-source-code-to-eu-governments https://www.petri.com/no-back-doors-microsoft-opens-windows-...
- provost 9y agoOne thing I would note is that the individual employee might not be authorized to sign a legal document, such as "a non-compete and or a non-disclosure". My company informs us told to actively refuse to sign any legal documents (even at visitor check-in) -- we have a Legal team for that. All documents should be signed by Legal before I step on site.
- DoofusOfDeath 9y agoOut of curiosity, are you barred from installing software on company computers, because you're either explicitly or implicitly accepting an EULA?
- provost 9y agoThere is a list of pre-approved apps, and a method to request approval if it is not on the list. Also, there is a list of approved licenses for open source software.
- johannes1234321 9y agoThis is a common thing in many larger corporations. Some even lock down machines quite a lot. I have seen multiple cases where this lead to laptops for dev work which weren't connected to the company's network.
- fma 9y agoMy company will scan our computers every once in a while. I've gotten alerts about having software I have installed that I should not - both cases we had an enterprise license and I was using a trial. I didnt want to go through a burdensome request process to try something.
- sonium 9y agoThere is also a very fine difference in the exact wording. You might even have the choice to decide the location where the physical copy of the code is located (E.g. your office, not theirs / on the north pole) and they actually might never actually bother to show up. Does the source code even need to be humanly readable or are the actually more happy with a schematic diagram?
- bonestamp2 9y agoFor many reasons, always choose your office as the location. Even if they're paying expenses, it makes your employees available for other things that may come up at your site. All the security benefits are obvious, but lastly... from a sales standpoint, it allows you to treat them like a welcomed guest and win them over on your turf. Either way, get the review done fast. As they say, time kills all deals.
- weaksauce 9y agoone thing about non-compete and non-disclosures is that if you are a small shop going up against big shops it can be costly for you to try to enforce it against a larger corp. not impossible but not cheap and without any guarantee of success.