3 ms·
I was working at a company that was acquired a few years ago, and part of the deal was them doing a source-level audit of code, mainly looking at licenses and o
by gregmac 5y ago
I was working at a company that was acquired a few years ago, and part of the deal was them doing a source-level audit of code, mainly looking at licenses and open-source. They used some software which could detect copy-pasted source code, and had Stack Overflow indexed.
The Stack Overflow stuff was a massive, massive pain, for several reasons.
For one, it's not clear how CC-BY-SA applies to code[1]. This involved many long meetings with copyright lawyers. They ended up asking for all this to be removed, which our C-level people eventuality agreed to.
We had to then go through several hundred "flagged" things (in a hundreds of thousands of lines codebase) and fix or justify everything.
Only a few cases were outright copy+paste of a big function or class, and those were at least straightforward: rewrite. Usually it was old code anyway, and replaced with newer style, much more concise code.
Tons were one- or two-line things, which involved lots of arguments along the lines of "that is the way to open a file in append mode in this language, and logFile is the appropriate variable name in this case!" This is really a failing of the tool they were using, but it still required answering.
The funniest was a handful that were our answers: they were copy+paste our team had done from our code to SO! (Nothing proprietary, just a few lines of an algorithm or solving whatever random problem).
Anyway, this experience left me extremely cautious about introducing any external code (as opposed to libraries) into a codebase. OSS libraries with permissive licenses (MIT, BSD, etc) are easy to deal with: it's straightforward to comply and being a library means the code is nicely compartmentalized if you need to replace/remove it.
[1] https://opensource.stackexchange.com/q/1717 https://opensource.stackexchange.com/q/1717
- hootbootscoot 5y agoThat tool sounds properly dodgy too. Wouldn't their indexing of S.O. answers be itself an IP issue?
- smitop 5y agoUsing SO data for purposes like that is allowed under the CC licence used. You don't even need to do any scraping, since you can download an offical data dump of all SO answers at https://archive.org/details/stackexchange https://archive.org/details/stackexchange
- fomine3 5y agoIt's great that they officially releases data dump to IA.
- smabie 5y agoI feel like the experience should make you extremely cautious of using stupid tools to analyze your codebase, not the introduction of external code.
- wjertyj 5y agoYeah, they definitely should have bailed on the acquisition when the acquiring company asked for proof they weren't using code they didn't have a license to....
- open0 5y agoIt gives the impression that they don't trust their other more standard testing and analysis tools, and also that they don't trust their developers to use discretion when selecting online resources. And it seems the software itself reflects a misunderstanding about how programming code is actually manifested. It's very possible to read the official docs or use an IDE and end up writing the same lines of code in some Stack Overflow answer, as many here have said already.
- zvr 5y agoChecking the origin of the code is a standard step in any acquisition process (I have been involved in several). It's reasonable that people do not want to pay for some code that they later discover has to be released as source. The general attitude is "trust, but verify". As you say, there might be a case where two independent implementations came up with the exact same code, although the probability of this is reduced exponentially with the size of the exact match. Keep in mind, we do not talk about "i = 0;" here, but something longer. And we do not discuss examples matching the official documentation, because then you can point to it as origin, instead of SO -- and it would probably be under a better license. The questions are: even if you wrote it yourself, do you justify the costs of potentially going to court to defend the case and are you sure you will convince a judge, who will be the person making the decision?
- zvr 5y agoThis. The CC-BY-SA default license on Stack Overflow makes whatever is posted there unsuitable to be copy-pasted in a proprietary-licensed software. It takes a lot of effort to train people not to do that.