5 ms·
Step One: Get low level developers to upload evidence of major corporate license violations to your server. Step Two: Sell evidence to legal firms. Step Thr
by johnnyo 9y ago
Step One: Get low level developers to upload evidence of major corporate license violations to your server.
Step Two: Sell evidence to legal firms.
Step Three: Profit.
This seems very risky from a company perspective.
- XiZhao 9y agoKevin from FOSSA here -- I hope it's clear that this would be completely against our policies and business model. However, if you're truly worried about this, you can install a fully on-prem version of FOSSA. Use of app.fossa.io with fossa-cli is also an opt-in feature, so by default you're not sending us any data. Secondly, we deal entirely with 3rd-party code, so the licensing issues and risks are already completely public. If there was truly a malicious actor, they would just scan popular third party modules and reach out to companies that had job postings or github pages that were active in those environments (i.e. scan npm packages and target JS developers). But in the spirit of good development practices, "security by obscurity" hasn't proved to be an effective strategy. We'd prefer not to promote "legal by obscurity" either. :)
- johnnyo 9y agoI don’t see that as against your business model at all. You could build up a large database of say, violations of Oracle licenses, then get Oracle to buy out your company. You’d make a quick buck, and your users would be left holding the bag. How do you mitigate against these type of threats to your users?
- XiZhao 9y agoI think it's pretty clear that extorting your customers is an awful business idea. ;)
- johnnyo 9y agoThat doesn’t answer the question at all. What’s stopping a big IP firm from buying your company for the database of license violations?
- handbanana 9y agoNothing I guess, but its opt-in...
- ilikebits 9y agoYou can run an on-premises instance.
- scrollaway 9y agoUnless you want to get acquired by Oracle, that is.
- aidenn0 9y agoTell that to Larry Ellison ;)
- deleted 9y ago[deleted]
- ilikebits 9y agoI get that cynicism is sort of an HN thing, but this (building a SaaS company and then building and open sourcing a developer tool) seems like an incredibly expensive way to be an IP troll. There are way lower hanging fruit for IP trolling. Disclaimer: I work for FOSSA.
- johnnyo 9y agoEven if it wasn’t the initial goal of the company, it certainly would be a potential path forward, if the SaaS offerings ended up being unprofitable and the company was winding down. It’s a very real risk of using the service.
- ilikebits 9y agoIf this is a serious concern for you, you can do an on-premises installation instead. In that case, none of your data ever leaves your intranet.