5 ms·
OSS authors:“We need to understand your mitigation plans for this vulnerability”
- deleted 5y ago[deleted]
- progbits 5y agoI have read a good theory for this elsewhere: the company has a spreadsheet of "partners" somewhere that legal and accounting demands gets updated. It starts as companies which you pay but then someone insists developers add all the open source copyright owners. Now someone took this spreadsheet with zero understanding of what curl/"Haxx Team" is and just emailed them a template. Not giving excuses, clearly they are incompetent. But it is not some demand of service from freeloaders.
- deleted 5y ago[deleted]
- bravetraveler 5y agoYea, sounds like something compiled during an audit (or preparation for one) and now used as a stand in dependency matrix by someone down the line
- zamadatix 5y agoIn my mind more likely a bit in reverse for the first part, a pre-existing list of 3rd party dependencies in use (which already includes open source dependencies from the get go) is acquired by someone auditing risk and the rest is the same from there. Not only one less step but one less opportunity for anyone to catch on or explain that these dependencies are special.
- kadoban 5y ago> Not giving excuses, clearly they are incompetent. But it is not some demand of service from freeloaders. I mean it definitely _is_ a demand of service from freeloaders, it just may not be intended as such.
- toomuchtodo 5y agoShould’ve named the company and not redacted the doc.
- newaccount74 5y agoThese kinds of emails are so common that I don't think it makes sense to shame the company. Pretty much every company that is big enough to have a legal department sends out questionnaires like that. Yes, they are a pointless nuisance. Just ignore them and go on with your life.
- newaccount74 5y agoI keep getting questionaires like this, usually from paying customers though. I never answer them because my licenses are way too cheap to bother with shit like this. And yet the companies keep using my software, despite the fact that I didn't answer their stupid vendor asessment forms. At this point I wonder what these forms are good for? Why send them to vendors and waste people's time if you don't care about the answer anyway?
- hbrav 5y agoI don't think I would want my vendor responding to a form like that anyway. I want them fixing the actual problem. The appropriate place to communicate the answers to those questions is on an issue tracking system. Filling out a different set of questions for every customer is a waste of time.
- toomuchtodo 5y agoCYA to demonstrate you made the attempt.
- mox1 5y agoPersonally, I would immediately offer an enterprise tier, charge 10x-100x, then promise to answer these (using some type of better marketing language, of course).
- tpoacher 5y agoExactly this. Except for the small caveat that 10x-100x of nothing is still nothing, of course :p
- newaccount74 5y agoI have done exactly this in the past. I made a webpage explaining the benefits of the enterprise license (individual contracts, assistance with vendor security assessments, etc.), and asked customers politely if they wanted to upgrade to an enterprise license. Not a single company (out of maybe a dozen companies that I made the offer to) actually took me up on my offer. When they find out that the vendor assessment would cost them money, they suddenly find a way to use my software without the vendor assessment.