3 ms·
License compliance is easily verified using 3rd party services like Black Duck. You basically install a scanner on your machine, feed your sources into it, it
by eps 9y ago
License compliance is easily verified using 3rd party services like Black Duck.
You basically install a scanner on your machine, feed your sources into it, it hashes them line by line and sends hashes to the mothership for analysis. It then spits out the report that file X, line Y matches something in the open source package Z. At least that's how it worked a decade ago, when we had to do a pre-acquisition source code audit.
- mcbain 9y agoBD still works that way. The lawyers love making us use it. https://www.blackducksoftware.com/solutions/mergers-and-acquisitions https://www.blackducksoftware.com/solutions/mergers-and-acqu...
- foota 9y agoGPL in my source? You'd be surprised.
- kazinator 9y agoLicense compliance is not verified in closed source stuff, period. When was the last time some user of Windows verified whether Microsoft Windows contains some piece of code that Microsoft shouldn't be redistributing?
- SyneRyder 9y agoMicrosoft has provided Windows source code for auditing for a long time, especially to governments. Here's an article about it from 2003: https://www.computerworld.com/article/2580563/microsoft-windows/microsoft-opens-source-code-to-governments.html https://www.computerworld.com/article/2580563/microsoft-wind... And again in 2015: https://www.petri.com/no-back-doors-microsoft-opens-windows-source-code-to-eu-governments https://www.petri.com/no-back-doors-microsoft-opens-windows-...