4 ms·

If you hire an engineer, the liability is your problem. If you donate to open source, liability is still your problem. Both of these situations are patently un

If you hire an engineer, the liability is your problem. If you donate to open source, liability is still your problem. Both of these situations are patently unpalatable for most businesses. Meanwhile, if you pay someone for a support contract the liability is their problem. You see, whether a problem that comes up is fixed is actually irrelevant. The real question is how much liability you can get rid of.

bd30 3y ago
I understand the full time engineer thing. But it was never explained to me at any of the places I have been at that it was a liability thing. At every place they thought we would leak trade secrets. Was always frustrating that technically we could never even contribute the most minor of bug fixes.
- fsckboy 3y ago
  maybe it's a "blame" thing, but it's not a liability thing. Nobody ever got fired for hiring IBM*, but nobody ever got a nickel back either. *IBM is a consulting firm now
resoluteteeth 3y ago
What liability are you referring to?
- beachy 3y ago
  e.g. if you direct the engineer you have hired to build something that turns out to infringe on someone else's BS patents.
- andyst 3y ago
  in the event of an incident, the exec or departments reputational liability
- GeneralMayhem 3y ago
  Component breaks due to bug, deployment misconfiguration, scaling failure, etc., and your company loses $1M during the outage. If it's a vendor with an SLA, you can (sometimes) get them to cover the $1M. If it's in-house, you're eating it. It's often cheaper to build/run stuff yourself (unless it's so commodified that you're benefiting from amortization across the vendor's many clients), but then you have to be self-insured for problems.
  - jcrben 3y ago
    I don't think liability payments are that common. As someone who helps in analyzing software purchase decisions, it's certainly not something I hear people bring as a major factor.
    - eep_social 3y ago
      Maybe size of enterprise matters? I work in $LargeCorp and legal was very aggressive about insurance and liability redlines on the last contract I had to deal with.
      - deleted 3y ago
        [deleted]
      - jcrben 3y ago
        Why would a SaaS provider expose themselves to catastrophic risk of reimbursing a large enterprise for the enterprise's lost profits due to downtime? I think refunds of the cost of the SaaS are sort of common, but that's quite different and capped. "Oracle offers no financial compensation (e.g., credits, refunds or otherwise) in the event a Service Level Objective is missed." https://docs.oracle.com/en-us/iaas/Content/General/Reference/servicelevelobjectives.htm https://docs.oracle.com/en-us/iaas/Content/General/Reference...
        eep_social 3y ago
        Look beyond SLAs to topics like cyber security incident liability. SmallSaaS selling to BigCorp, like Oracle, are in a wildly different negotiating position than BigCorp selling SaaS to SmallCorp.
ilyt 3y ago
Good luck trying to get any actual liability out of them... Like, go try to make Oracle write you a contract where their base going down compensates your lost profits. You just won't get it, unless you throw some hideous amount of money their way (and they will just pay insurance company and pocket the rest).
- mouse_ 3y ago
  It's not about compensation, it's about finger-pointing. "WE didn't bill your card 40 times draining your bank account -- STRIPE did! Go sue them, not us!"
  - numbsafari 3y ago
    You are still getting sued.
    - jiggawatts 3y ago
      It's a theoretical benefit, not a real one, and the scenario is so rare that most people don't think of it critically. It's like buying insurance against "damage by asteroids". E.g.: "We can just sue Microsoft" is a common one. a) Their SLA literally states that they will compensate you only for the cost of the individual service they provided. The $1/month Azure DNS Zone outage caused your $100M/month business to vanish off the Internet? Here's $1 for your compensation! b) The US Government sued Microsoft and failed to get very far. Are you the US Government? Do you have a budget for dozens of the best lawyers money can buy? Have you sued a multi-trillion dollar market cap org successfully ever? No? Why do you think you can... and win? Generally this boils down to: "I haven't read the contract I signed, but I'm sure if things go bad I can just make the lawyers magically fix things for me."
      - numbsafari 3y ago
        Most customers won't sue you. They'll terminate their business with you and go elsewhere. You have to decide, as a business, if trustworthy vendors are available and select the right one. You can also decide that it's important enough to your value proposition that you want to "own" it. The real reason companies hire vendors is that you don't need some mythical "FTE" that can do all the things. For the "price of a single FTE", a vendor can provide you access to a range of FTEs that are knowledgeable and capable in different domains, and you can flex between them. Thinking about RedHat, as an example, if you pay RedHat the equivalent of a single FTE, let's say $300k/yr, is that just one FTE working on maintaining Apache? A kernel contributor? GCC? This is about fractionalization and labor specialization, not some direct 1:1 tradeoff between hiring some mythical person with commit bits in hundreds or thousands of OSS trees.
yoyohello13 3y ago
Whatever anyone else is saying this is the real reason. I’ve seen it first hand many time. The only thing that matters is being able to blame somebody else when problems arise.

bd30 3y ago

I understand the full time engineer thing. But it was never explained to me at any of the places I have been at that it was a liability thing. At every place they thought we would leak trade secrets. Was always frustrating that technically we could never even contribute the most minor of bug fixes.

fsckboy 3y ago
maybe it's a "blame" thing, but it's not a liability thing. Nobody ever got fired for hiring IBM*, but nobody ever got a nickel back either. *IBM is a consulting firm now

resoluteteeth 3y ago

What liability are you referring to?

beachy 3y ago
e.g. if you direct the engineer you have hired to build something that turns out to infringe on someone else's BS patents.
andyst 3y ago
in the event of an incident, the exec or departments reputational liability
GeneralMayhem 3y ago
Component breaks due to bug, deployment misconfiguration, scaling failure, etc., and your company loses $1M during the outage. If it's a vendor with an SLA, you can (sometimes) get them to cover the $1M. If it's in-house, you're eating it. It's often cheaper to build/run stuff yourself (unless it's so commodified that you're benefiting from amortization across the vendor's many clients), but then you have to be self-insured for problems.
- jcrben 3y ago
  I don't think liability payments are that common. As someone who helps in analyzing software purchase decisions, it's certainly not something I hear people bring as a major factor.
  - eep_social 3y ago
    Maybe size of enterprise matters? I work in $LargeCorp and legal was very aggressive about insurance and liability redlines on the last contract I had to deal with.
    - deleted 3y ago
      [deleted]
    - jcrben 3y ago
      Why would a SaaS provider expose themselves to catastrophic risk of reimbursing a large enterprise for the enterprise's lost profits due to downtime? I think refunds of the cost of the SaaS are sort of common, but that's quite different and capped. "Oracle offers no financial compensation (e.g., credits, refunds or otherwise) in the event a Service Level Objective is missed." https://docs.oracle.com/en-us/iaas/Content/General/Reference/servicelevelobjectives.htm https://docs.oracle.com/en-us/iaas/Content/General/Reference...
      - eep_social 3y ago
        Look beyond SLAs to topics like cyber security incident liability. SmallSaaS selling to BigCorp, like Oracle, are in a wildly different negotiating position than BigCorp selling SaaS to SmallCorp.

ilyt 3y ago

Good luck trying to get any actual liability out of them... Like, go try to make Oracle write you a contract where their base going down compensates your lost profits. You just won't get it, unless you throw some hideous amount of money their way (and they will just pay insurance company and pocket the rest).

mouse_ 3y ago
It's not about compensation, it's about finger-pointing. "WE didn't bill your card 40 times draining your bank account -- STRIPE did! Go sue them, not us!"
- numbsafari 3y ago
  You are still getting sued.
  - jiggawatts 3y ago
    It's a theoretical benefit, not a real one, and the scenario is so rare that most people don't think of it critically. It's like buying insurance against "damage by asteroids". E.g.: "We can just sue Microsoft" is a common one. a) Their SLA literally states that they will compensate you only for the cost of the individual service they provided. The $1/month Azure DNS Zone outage caused your $100M/month business to vanish off the Internet? Here's $1 for your compensation! b) The US Government sued Microsoft and failed to get very far. Are you the US Government? Do you have a budget for dozens of the best lawyers money can buy? Have you sued a multi-trillion dollar market cap org successfully ever? No? Why do you think you can... and win? Generally this boils down to: "I haven't read the contract I signed, but I'm sure if things go bad I can just make the lawyers magically fix things for me."
    - numbsafari 3y ago
      Most customers won't sue you. They'll terminate their business with you and go elsewhere. You have to decide, as a business, if trustworthy vendors are available and select the right one. You can also decide that it's important enough to your value proposition that you want to "own" it. The real reason companies hire vendors is that you don't need some mythical "FTE" that can do all the things. For the "price of a single FTE", a vendor can provide you access to a range of FTEs that are knowledgeable and capable in different domains, and you can flex between them. Thinking about RedHat, as an example, if you pay RedHat the equivalent of a single FTE, let's say $300k/yr, is that just one FTE working on maintaining Apache? A kernel contributor? GCC? This is about fractionalization and labor specialization, not some direct 1:1 tradeoff between hiring some mythical person with commit bits in hundreds or thousands of OSS trees.

yoyohello13 3y ago

Whatever anyone else is saying this is the real reason. I’ve seen it first hand many time. The only thing that matters is being able to blame somebody else when problems arise.