5 ms·
Kevin from FOSSA here -- I hope it's clear that this would be completely against our policies and business model. However, if you're truly worried about this,
by XiZhao 9y ago
Kevin from FOSSA here -- I hope it's clear that this would be completely against our policies and business model. However, if you're truly worried about this, you can install a fully on-prem version of FOSSA. Use of app.fossa.io with fossa-cli is also an opt-in feature, so by default you're not sending us any data.
Secondly, we deal entirely with 3rd-party code, so the licensing issues and risks are already completely public. If there was truly a malicious actor, they would just scan popular third party modules and reach out to companies that had job postings or github pages that were active in those environments (i.e. scan npm packages and target JS developers).
But in the spirit of good development practices, "security by obscurity" hasn't proved to be an effective strategy. We'd prefer not to promote "legal by obscurity" either. :)
- johnnyo 9y agoI don’t see that as against your business model at all. You could build up a large database of say, violations of Oracle licenses, then get Oracle to buy out your company. You’d make a quick buck, and your users would be left holding the bag. How do you mitigate against these type of threats to your users?
- XiZhao 9y agoI think it's pretty clear that extorting your customers is an awful business idea. ;)
- johnnyo 9y agoThat doesn’t answer the question at all. What’s stopping a big IP firm from buying your company for the database of license violations?
- handbanana 9y agoNothing I guess, but its opt-in...
- ilikebits 9y agoYou can run an on-premises instance.
- scrollaway 9y agoUnless you want to get acquired by Oracle, that is.
- aidenn0 9y agoTell that to Larry Ellison ;)
- deleted 9y ago[deleted]