7 ms·

An employee at EpicGames wants me to fill out this questionnaire to use my OSS

85 points by memorable 4y ago

peanut_worm 4y ago
That is just insane behavior
shreyshnaccount 4y ago
crazy, unforgivable behaviour. also they kight use this to make the code proprietary and takedown the original project because why the fuck won't they do that.
- shreyshnaccount 4y ago
  turns out this was a very uninformed opinion. my bad
brendan0powers 4y ago
This looks like a form Epic would send to software vendors who have not passed one of the industry standard security certifications (SOC 2, for example). This is common practice for large enterprises when engaging with new vendors. These are super obnoxious to fill out, but usually come with very large enterprise contracts, so vendors put up with them. It's certainly not normal to send these to maintainers of open source projects... In this case I suspect the employee in question simply misunderstood the company process, and had no malicious intent.
- LilBytes 4y ago
  Yep, even with certification you'll get these from time to time. Two options: 1) point them to your existing policies and processes for SOC2, IRAP, ISO27001 and similar, the questionnaire is already filled 2) fill it out as best you can if it's going to earn you bank.
- CommieBobDole 4y ago
  Yep, somehow this project got included in a spreadsheet of vendors, and somebody told the new guy in the compliance department, "email this compliance form to all of the vendors in this spreadsheet".
GaelFG 4y ago
I'm surprised the reaction is 'how they dare'. If you are personally contacted by one of the biggest game company wich would want to use one of your tools, a better response would've be a contract offer no (without trying to be TOO greedy and ask for ridiculous amounts) ?
- benj111 4y ago
  Surely they should be offering to pay if they're one of the biggest games companies and want you to fill out a form. If someone's giving something away for free you don't ask for a guarantee, and if you want one for what ever reason you should offer to pay. You mention greed, but epic seems to be the one wanting the cake and eating it too. So yes I agree with the "how dare they".
  - GaelFG 4y ago
    Funny, probably a cultural thing, in France (in my experience, it maybe depend the context) when you have a special request from a professional entity (company or freelance), you describe your need, the professional say if he can do it, and make a quote. But the client never talk money first. They never said they would no pay a dime, just stated a request.
- gnulinux 4y ago
  Haha yeah no, Epic Games is a software company, they should have known better, period. Asking for free labor from people who already created a free product you want to use is disrespectful and clearly incompetent. It's not my responsibility to arrange your business, and make a reasonable counter-offer. I'd just want to say "no, thanks but no thanks" and risk Epic Games not utilizing my OSS project. If they think that's too bad for them, it's their responsibility to then follow up and make a $$$ offer for the labor they request.
  - GaelFG 4y ago
    In fact my point is : I don't find a citation of the mail stating they refused to pay. What I understand of the twitter feed is : - someone sent a (probably mass vendor targeted) mail asking for a form filling. - The author interpreted they wanted it for free (which is not even absurd : some open source project have commercial licences and could use both a whatever security standard compliance to gain commercial value AND the legit right to add a big company name on his website) and was outraged because the email didn't contain a commercial offer. I may be wrong, but IF the mail was really targeted at him (other comment point a believable theory : the security guy mass sent the mail to every 'vendor' lib in the folder, either by mistake or lack of caring) he just panicked and (if he wanted money) missed a business opportunity by either sending a quote for the form filing, trying to negociate an enterprise grade support/consulting or just politely responded "I'm an open source free code provider and have no financial interst in being used by you. Have a nice day." I have been requested heavy paperwork kiling to allow my work as freelance to be used with 'big client', sended bills for it, and never had a problem with it. Never the funniest part of the project, but money is money.
deepsquirrelnet 4y ago
Meet my open source pseudorandom number generator script.
nekoashide 4y ago
We blanket send these to every vendor we use, but OSS doesn't qualify and would not get one of these from me.
deleted 4y ago
[deleted]
opwieurposiu 4y ago
This is a missed opportunity. Ask epic nicely for $5k to fill the form, offer it done a week after the check clears. Worst they can say is no.
- m3047 4y ago
  This is The Way. It also inevitably comes with a written agreement. What always gives me pause with this is that my open source software comes with no warranty and I don't want to compromise the license terms. So nailing down the written agreement (what are they going to do with it, and what are they attempting to hold you liable for?) is an opportunity to address that. (Full disclosure: haven't had this come up in well over a decade.)
  - Delk 4y ago
    $5k also doesn't sound like a whole lot of money to give a guarantee about the security of your FOSS code. Unless I were already rather confident about it, it would take work for me to convince myself about it to the extent that I would be willing to answer a hundred questions on someone else's form. $5k isn't necessarily that much of a compensation for that kind of work, unless you're also gaining something from the work itself (e.g. from reviewing the security of your code for its own sake). I don't know if filling and returning these kinds of forms can have any kinds of legal implications, but if it did, even potentially, there's no way I'd do that for $5k unless I were in absolutely dire need of that money.
    - m3047 4y ago
      I'm not the person who said "$5K". But it's not about the money per se. Mooting a number is the polite way to say you're open minded to assisting them. Maybe they'll share a third party audit of your code with you. Maybe the written agreement reiterates "you agree to be bound by the license terms and FULLY UNDERSTAND AND ACCEPT ALL LIABILITY" and you still get $5K. Besides at the negotiation stage it's still plus costs. It's been a decade, but if you spend $20K on lawyers and liability insurance and they pay you $25K, you still make $5K.
  - 4y ago
nunez 4y ago
not surprising in the slightest. corporate security's gonna corporate security
hyperman1 4y ago
I really get an itchy feeling I'd love to fill this in and send it back. Q: Detailed policies blah blah management of Epic Confidential Data? A: I'll sell it to the highest bidder, unless they want me to fill in some stupid questionnaire first.
- nwallin 4y ago
  Q: Provide a detailed Data Flow Diagram. This diagram should provide a detailed, step-by-step description of how data... A: Data comes in, data goes out. You can't explain that.
BaculumMeumEst 4y ago
I don’t really understand why someone would take this to twitter instead of just replying with a quote or ignoring it.
- loudthing 4y ago
  Because Jeff Geerling is an internet personality and uses opportunities like this for publicity.
  - geerlingguy 4y ago
    lol
    - earleybird 4y ago
      For extra lulz - "I think I'll crowd source advice from teh intarwebs - what could go wrong" Seriously Jeff, you do great stuff - I always enjoy your writeups and videos. [edit] mispelt name
- Nexxxeh 4y ago
  It's of interest to his audience specifically, and to the wider internet.
dingosity 4y ago
Or you could fill out the form in such a way as to guarantee they won't pass their audit, submit it and then tell them you're available as a consultant to fix the problems they identified in the code.
zaphod12 4y ago
I've had my security team ask for this sort of thing before. I laughed at them and didn't send it because I understand the way this works, but they didn't and were following their new vendor requirements process. Get a swe in the middle who doesn't and voila
fknwnkrsz 4y ago
It's very common to ask this kind of stuff to software vendors. Probably some intern or manager with no clue about open source made a mistake there. Better take it to Twitter to get those nice re-tweets, inside of writing a simple email to explain the mistake...
phibz 4y ago
Wow who knew Red Shirt Jeff worked for Epic Games.

85 points by memorable 4y ago

That is just insane behavior

crazy, unforgivable behaviour. also they kight use this to make the code proprietary and takedown the original project because why the fuck won't they do that.

shreyshnaccount 4y ago
turns out this was a very uninformed opinion. my bad

brendan0powers 4y ago

This looks like a form Epic would send to software vendors who have not passed one of the industry standard security certifications (SOC 2, for example). This is common practice for large enterprises when engaging with new vendors. These are super obnoxious to fill out, but usually come with very large enterprise contracts, so vendors put up with them. It's certainly not normal to send these to maintainers of open source projects... In this case I suspect the employee in question simply misunderstood the company process, and had no malicious intent.

LilBytes 4y ago
Yep, even with certification you'll get these from time to time. Two options: 1) point them to your existing policies and processes for SOC2, IRAP, ISO27001 and similar, the questionnaire is already filled 2) fill it out as best you can if it's going to earn you bank.
CommieBobDole 4y ago
Yep, somehow this project got included in a spreadsheet of vendors, and somebody told the new guy in the compliance department, "email this compliance form to all of the vendors in this spreadsheet".

GaelFG 4y ago

I'm surprised the reaction is 'how they dare'. If you are personally contacted by one of the biggest game company wich would want to use one of your tools, a better response would've be a contract offer no (without trying to be TOO greedy and ask for ridiculous amounts) ?

benj111 4y ago
Surely they should be offering to pay if they're one of the biggest games companies and want you to fill out a form. If someone's giving something away for free you don't ask for a guarantee, and if you want one for what ever reason you should offer to pay. You mention greed, but epic seems to be the one wanting the cake and eating it too. So yes I agree with the "how dare they".
- GaelFG 4y ago
  Funny, probably a cultural thing, in France (in my experience, it maybe depend the context) when you have a special request from a professional entity (company or freelance), you describe your need, the professional say if he can do it, and make a quote. But the client never talk money first. They never said they would no pay a dime, just stated a request.
gnulinux 4y ago
Haha yeah no, Epic Games is a software company, they should have known better, period. Asking for free labor from people who already created a free product you want to use is disrespectful and clearly incompetent. It's not my responsibility to arrange your business, and make a reasonable counter-offer. I'd just want to say "no, thanks but no thanks" and risk Epic Games not utilizing my OSS project. If they think that's too bad for them, it's their responsibility to then follow up and make a $$$ offer for the labor they request.
- GaelFG 4y ago
  In fact my point is : I don't find a citation of the mail stating they refused to pay. What I understand of the twitter feed is : - someone sent a (probably mass vendor targeted) mail asking for a form filling. - The author interpreted they wanted it for free (which is not even absurd : some open source project have commercial licences and could use both a whatever security standard compliance to gain commercial value AND the legit right to add a big company name on his website) and was outraged because the email didn't contain a commercial offer. I may be wrong, but IF the mail was really targeted at him (other comment point a believable theory : the security guy mass sent the mail to every 'vendor' lib in the folder, either by mistake or lack of caring) he just panicked and (if he wanted money) missed a business opportunity by either sending a quote for the form filing, trying to negociate an enterprise grade support/consulting or just politely responded "I'm an open source free code provider and have no financial interst in being used by you. Have a nice day." I have been requested heavy paperwork kiling to allow my work as freelance to be used with 'big client', sended bills for it, and never had a problem with it. Never the funniest part of the project, but money is money.

deepsquirrelnet 4y ago

Meet my open source pseudorandom number generator script.

nekoashide 4y ago

We blanket send these to every vendor we use, but OSS doesn't qualify and would not get one of these from me.

deleted 4y ago

[deleted]

opwieurposiu 4y ago

This is a missed opportunity. Ask epic nicely for $5k to fill the form, offer it done a week after the check clears. Worst they can say is no.

m3047 4y ago
This is The Way. It also inevitably comes with a written agreement. What always gives me pause with this is that my open source software comes with no warranty and I don't want to compromise the license terms. So nailing down the written agreement (what are they going to do with it, and what are they attempting to hold you liable for?) is an opportunity to address that. (Full disclosure: haven't had this come up in well over a decade.)
- Delk 4y ago
  $5k also doesn't sound like a whole lot of money to give a guarantee about the security of your FOSS code. Unless I were already rather confident about it, it would take work for me to convince myself about it to the extent that I would be willing to answer a hundred questions on someone else's form. $5k isn't necessarily that much of a compensation for that kind of work, unless you're also gaining something from the work itself (e.g. from reviewing the security of your code for its own sake). I don't know if filling and returning these kinds of forms can have any kinds of legal implications, but if it did, even potentially, there's no way I'd do that for $5k unless I were in absolutely dire need of that money.
  - m3047 4y ago
    I'm not the person who said "$5K". But it's not about the money per se. Mooting a number is the polite way to say you're open minded to assisting them. Maybe they'll share a third party audit of your code with you. Maybe the written agreement reiterates "you agree to be bound by the license terms and FULLY UNDERSTAND AND ACCEPT ALL LIABILITY" and you still get $5K. Besides at the negotiation stage it's still plus costs. It's been a decade, but if you spend $20K on lawyers and liability insurance and they pay you $25K, you still make $5K.
- 4y ago

nunez 4y ago

not surprising in the slightest. corporate security's gonna corporate security

hyperman1 4y ago

I really get an itchy feeling I'd love to fill this in and send it back. Q: Detailed policies blah blah management of Epic Confidential Data? A: I'll sell it to the highest bidder, unless they want me to fill in some stupid questionnaire first.

nwallin 4y ago
Q: Provide a detailed Data Flow Diagram. This diagram should provide a detailed, step-by-step description of how data... A: Data comes in, data goes out. You can't explain that.

BaculumMeumEst 4y ago

I don’t really understand why someone would take this to twitter instead of just replying with a quote or ignoring it.

loudthing 4y ago
Because Jeff Geerling is an internet personality and uses opportunities like this for publicity.
- geerlingguy 4y ago
  lol
  - earleybird 4y ago
    For extra lulz - "I think I'll crowd source advice from teh intarwebs - what could go wrong" Seriously Jeff, you do great stuff - I always enjoy your writeups and videos. [edit] mispelt name
Nexxxeh 4y ago
It's of interest to his audience specifically, and to the wider internet.

dingosity 4y ago

Or you could fill out the form in such a way as to guarantee they won't pass their audit, submit it and then tell them you're available as a consultant to fix the problems they identified in the code.

zaphod12 4y ago

I've had my security team ask for this sort of thing before. I laughed at them and didn't send it because I understand the way this works, but they didn't and were following their new vendor requirements process. Get a swe in the middle who doesn't and voila

fknwnkrsz 4y ago

It's very common to ask this kind of stuff to software vendors. Probably some intern or manager with no clue about open source made a mistake there. Better take it to Twitter to get those nice re-tweets, inside of writing a simple email to explain the mistake...

phibz 4y ago

Wow who knew Red Shirt Jeff worked for Epic Games.