7 ms·

I've done this too. The question is usually a matter of compliance more than anything else. They want to check the licenses of any included packages, makes sur

I've done this too. The question is usually a matter of compliance more than anything else. They want to check the licenses of any included packages, makes sure there's no encryption stuff that can't leave the USA, etc. Doing what OP described is great: it lets their folks do the audit with no risk of you loosing "ownership". It shows you are both a good partner and value what you do.

eps 9y ago
License compliance is easily verified using 3rd party services like Black Duck. You basically install a scanner on your machine, feed your sources into it, it hashes them line by line and sends hashes to the mothership for analysis. It then spits out the report that file X, line Y matches something in the open source package Z. At least that's how it worked a decade ago, when we had to do a pre-acquisition source code audit.
- mcbain 9y ago
  BD still works that way. The lawyers love making us use it. https://www.blackducksoftware.com/solutions/mergers-and-acquisitions https://www.blackducksoftware.com/solutions/mergers-and-acqu...
  - foota 9y ago
    GPL in my source? You'd be surprised.
- kazinator 9y ago
  License compliance is not verified in closed source stuff, period. When was the last time some user of Windows verified whether Microsoft Windows contains some piece of code that Microsoft shouldn't be redistributing?
  - SyneRyder 9y ago
    Microsoft has provided Windows source code for auditing for a long time, especially to governments. Here's an article about it from 2003: https://www.computerworld.com/article/2580563/microsoft-windows/microsoft-opens-source-code-to-governments.html https://www.computerworld.com/article/2580563/microsoft-wind... And again in 2015: https://www.petri.com/no-back-doors-microsoft-opens-windows-source-code-to-eu-governments https://www.petri.com/no-back-doors-microsoft-opens-windows-...
sheetjs 9y ago
License compliance is incredibly important and unfortunately overlooked by many smaller firms. The potential liability to a GPL or other violation is just not worth it. Anecdote: We have released code under the Apache 2 License (our biggest project by far is https://github.com/sheetjs/js-xlsx https://github.com/sheetjs/js-xlsx) and we've been roped into negotiations because some companies tried to take shortcuts by copying our code without proper attribution.
- nugget 9y ago
  What exactly is the potential liability for a GPL violation? I've gone 12 rounds with IP lawyers over these theoretical violations (static vs dynamic links). But I found it odd that I could never find a single case of significant liability due to infringement. The nature of damages is unclear and the landscape of counter-parties (with an incentive to sue) is amorphous. It seemed like worst-case, a proven infringer just had to re-write the offending module and make a $10k donation to an open source foundation. I've never knowingly infringed GPL and am not advocating that anyone should; it's just as I said, I found the legal community's focus on this area out of step with their otherwise well-measured calculations of risk and reward.
  - GFischer 9y ago
    Usually, when doing due diligence, anything that might conceivably be a lawsuit or ongoing lawsuits results in a lower price or funds in escrow or similar agreements. So, even if there never was a big payoff, the mere potential is a big red flag for the due diligence team (and leverage for negotiations as well). They can add indemnification clauses on contracts (they won't do that for a small company like the OP I guess).
  - bonestamp2 9y ago
    > I found the legal community's focus on this area out of step with their otherwise well-measured calculations of risk and reward. That seems true with pretty much any legal area. But, it's not their job to calculate risk, it's their job to tell you what is legal. It's management's job to decide if they want to take the risk or take the legal advice.
kazinator 9y ago
> The question is usually a matter of compliance more than anything else. What would Microsoft say if a customer said "we need to see the source code for Windows, Outlook, Exchange and Office applications before we use them, just as a matter of license compliance"?

eps 9y ago

License compliance is easily verified using 3rd party services like Black Duck. You basically install a scanner on your machine, feed your sources into it, it hashes them line by line and sends hashes to the mothership for analysis. It then spits out the report that file X, line Y matches something in the open source package Z. At least that's how it worked a decade ago, when we had to do a pre-acquisition source code audit.

mcbain 9y ago
BD still works that way. The lawyers love making us use it. https://www.blackducksoftware.com/solutions/mergers-and-acquisitions https://www.blackducksoftware.com/solutions/mergers-and-acqu...
- foota 9y ago
  GPL in my source? You'd be surprised.
kazinator 9y ago
License compliance is not verified in closed source stuff, period. When was the last time some user of Windows verified whether Microsoft Windows contains some piece of code that Microsoft shouldn't be redistributing?
- SyneRyder 9y ago
  Microsoft has provided Windows source code for auditing for a long time, especially to governments. Here's an article about it from 2003: https://www.computerworld.com/article/2580563/microsoft-windows/microsoft-opens-source-code-to-governments.html https://www.computerworld.com/article/2580563/microsoft-wind... And again in 2015: https://www.petri.com/no-back-doors-microsoft-opens-windows-source-code-to-eu-governments https://www.petri.com/no-back-doors-microsoft-opens-windows-...

sheetjs 9y ago

License compliance is incredibly important and unfortunately overlooked by many smaller firms. The potential liability to a GPL or other violation is just not worth it. Anecdote: We have released code under the Apache 2 License (our biggest project by far is https://github.com/sheetjs/js-xlsx https://github.com/sheetjs/js-xlsx) and we've been roped into negotiations because some companies tried to take shortcuts by copying our code without proper attribution.

nugget 9y ago
What exactly is the potential liability for a GPL violation? I've gone 12 rounds with IP lawyers over these theoretical violations (static vs dynamic links). But I found it odd that I could never find a single case of significant liability due to infringement. The nature of damages is unclear and the landscape of counter-parties (with an incentive to sue) is amorphous. It seemed like worst-case, a proven infringer just had to re-write the offending module and make a $10k donation to an open source foundation. I've never knowingly infringed GPL and am not advocating that anyone should; it's just as I said, I found the legal community's focus on this area out of step with their otherwise well-measured calculations of risk and reward.
- GFischer 9y ago
  Usually, when doing due diligence, anything that might conceivably be a lawsuit or ongoing lawsuits results in a lower price or funds in escrow or similar agreements. So, even if there never was a big payoff, the mere potential is a big red flag for the due diligence team (and leverage for negotiations as well). They can add indemnification clauses on contracts (they won't do that for a small company like the OP I guess).
- bonestamp2 9y ago
  > I found the legal community's focus on this area out of step with their otherwise well-measured calculations of risk and reward. That seems true with pretty much any legal area. But, it's not their job to calculate risk, it's their job to tell you what is legal. It's management's job to decide if they want to take the risk or take the legal advice.

kazinator 9y ago

> The question is usually a matter of compliance more than anything else. What would Microsoft say if a customer said "we need to see the source code for Windows, Outlook, Exchange and Office applications before we use them, just as a matter of license compliance"?