4 ms·

If I could figure out for certain which big companies were using my software, I might try the invoice idea for fun. I expect it would be ignored, but I would se

by daenz 5y ago

If I could figure out for certain which big companies were using my software, I might try the invoice idea for fun. I expect it would be ignored, but I would send it anyways to prove the idea one way or the other.

josteink 5y ago
If you hosted the package/library yourself instead of in closed silos/package repos, you could directly check the IPs of whoever regularly pulls your stuff. We all opted for centralized package repos though, so now only they know. And they’re not telling us. Just another “free” opportunity lost to centralization, I guess.
- javajosh 5y ago
  > We all opted for centralized package repos though, so now only they know. And they’re not telling us. I'm sympathetic to the view, but there really are some things that are better centralizing. Reducing code into binaries is something that a "fair" 3rd party is going to be better at than the 1st party. Why? The 3rd party central source is (presumably) mechanically cloning and building, whereas the 1st party is doing much much more. Effectively the 3rd party offers a better guarantee to the end user that this binary corresponds to that particular source. Also, the Way to measure who's using your code is to put runtime telemetry in there. Distasteful, but so common now with every kind of software, it's crazy. Yes, even OSS CLI programs phone home now (heck, ohmyzsh phones home every time I open a terminal!). For a generic server library, you'd add a check to make sure it's the most recent version and print that out to stdout on startup. See, it's not user hostile it's to keep them informed of updates! /s
  - oauea 5y ago
    > ohmyzsh phones home every time I open a terminal are you talking about the update check that by default runs once every 14 days[1], or is there something else? [1]: https://github.com/ohmyzsh/ohmyzsh#getting-updates https://github.com/ohmyzsh/ohmyzsh#getting-updates
    - javajosh 5y ago
      I did some double checking and it looks like I had a bad interaction between little snitch and zsh.
gumby 5y ago
Big companies don't just pay random invoices;* you need to indicate what project and account (usually IDs from their CRM). So it would merely be chucked out. * In really big companies it's possible for admins to buy routine stuff below a threshold just to save on paperwork. So there's a scam in which someone sends out a bunch of $100 invoices for "printer paper" -- account payable assumes the department code was left off by the vendor but it seems legit so they pay it. Seems like a hard way to collect money.
- jsmith99 5y ago
  It's called a Purchase to Pay system - whoever makes an order supplies a Purchase Order number from their internal system, which the supplier will reference on their invoice so the accounts team can look it up before paying it. In terms HN would understand, it's a stateful firewall for invoices that prevents paying orders that didn't originate from your company.

by daenz 5y ago

josteink 5y ago

If you hosted the package/library yourself instead of in closed silos/package repos, you could directly check the IPs of whoever regularly pulls your stuff. We all opted for centralized package repos though, so now only they know. And they’re not telling us. Just another “free” opportunity lost to centralization, I guess.

javajosh 5y ago
> We all opted for centralized package repos though, so now only they know. And they’re not telling us. I'm sympathetic to the view, but there really are some things that are better centralizing. Reducing code into binaries is something that a "fair" 3rd party is going to be better at than the 1st party. Why? The 3rd party central source is (presumably) mechanically cloning and building, whereas the 1st party is doing much much more. Effectively the 3rd party offers a better guarantee to the end user that this binary corresponds to that particular source. Also, the Way to measure who's using your code is to put runtime telemetry in there. Distasteful, but so common now with every kind of software, it's crazy. Yes, even OSS CLI programs phone home now (heck, ohmyzsh phones home every time I open a terminal!). For a generic server library, you'd add a check to make sure it's the most recent version and print that out to stdout on startup. See, it's not user hostile it's to keep them informed of updates! /s
- oauea 5y ago
  > ohmyzsh phones home every time I open a terminal are you talking about the update check that by default runs once every 14 days[1], or is there something else? [1]: https://github.com/ohmyzsh/ohmyzsh#getting-updates https://github.com/ohmyzsh/ohmyzsh#getting-updates
  - javajosh 5y ago
    I did some double checking and it looks like I had a bad interaction between little snitch and zsh.

gumby 5y ago

Big companies don't just pay random invoices;* you need to indicate what project and account (usually IDs from their CRM). So it would merely be chucked out. * In really big companies it's possible for admins to buy routine stuff below a threshold just to save on paperwork. So there's a scam in which someone sends out a bunch of $100 invoices for "printer paper" -- account payable assumes the department code was left off by the vendor but it seems legit so they pay it. Seems like a hard way to collect money.

jsmith99 5y ago
It's called a Purchase to Pay system - whoever makes an order supplies a Purchase Order number from their internal system, which the supplier will reference on their invoice so the accounts team can look it up before paying it. In terms HN would understand, it's a stateful firewall for invoices that prevents paying orders that didn't originate from your company.