4 ms·

These all seem accurate and I'd add even moreso than security (which can be prioritized for other reasons) a focus on buttoning up open source licensing / IP ow

These all seem accurate and I'd add even moreso than security (which can be prioritized for other reasons) a focus on buttoning up open source licensing / IP ownership is a dead giveaway that a sale is close. Also the hiring and retention thing is probably less about distraction and more about not taking on additional expenses in the middle of due diligence - generally the acquirer will want to have more of a say in staffing strategy.

pianoben 3y ago
100% - OSS IP licensing is exclusively the provenance of public companies, companies about to go public, and companies about to be purchased.
- jamestimmins 3y ago
  I don't actually know what "buttoning up open source licensing / IP ownership" means. Is that making sure you have a license for all software you're using?
  - jll29 3y ago
    You make sure that employees don't own what they write, but sign it over to the company (usually language to that effect in the employment contract, if there is none). Also running tools like Black Duck over your source code tree to check open source license types or use of unlicensed code snippets from the Web. NDAs can be given to people who know how something is done, knowledge that they could use to re-create the product or service elsewhere, which the acquired does not want. In some cases (that I have not personally seen) making people sign non-compete agreements, meaning if they quit they cannot work on the same thing for some time (not legal everywhere).
  - bunabhucan 3y ago
    If "BigCorp" buys "CoolIdea" for their nifty piece of software "SecretSauce" they do not want to find out later that "BigCorp"/"CoolIdea" is required to publish source code for "SecretSauce" because it's based on "GNUOpenSauce" or that "CoolIdea" was selling something based on "FSFSauce."
  - swiftcoder 3y ago
    Big companies are very allergic to GPL-like copyleft licenses. You generally have to go over the entire dependency tree with a fine tooth comb and make sure that nothing is going to get you sued to released the source code (inside a big company there are processes to ensure this on an ongoing basis)
- phamilton 3y ago
  FWIW, I've had to track down licensing and proof of IP assignment for fundraising rounds too.
totetsu 3y ago
On a tangent , can anyone point me to resources on solving the problem of distributing docker images with oss licensed software inside them?
- koolba 3y ago
  What’s the problem that’s specific to container images? It’s no different than distributing software binaries that include FOSS.
  - totetsu 3y ago
    Sometimes the lower layers of the image fs can have binaries in there that are not used or even accessible to the running container.
    - eichin 3y ago
      They're still accessible by inspect and hash (maybe start with "docker history".) You may find it easier to use that to get enough info to build your own images from scratch, so you have control of what's going in (since you already have responsibility.) "mmdebstrap | docker import" gets you surprisingly far.
- withinboredom 3y ago
  It’s not a problem per-se. You just have to document them and their license. Whether you actually have to do that is another question since most believe that that would fall on the base image publisher, not the final image. Further, a proper base image will already include licenses in the base image because most OSS licenses require distributing the software with the license available. The only thing you would have to document are the things you specifically added. At least, that’s been my experience.
  - totetsu 3y ago
    If the license says I must make the source code available, don’t I also have to have some mechanism to provide that code if asked?
agos 3y ago
this is how I guessed we were being acquired - a request to compile a list of the licenses of the dependencies of our mobile app, out of the blue and without further explanation

pianoben 3y ago

100% - OSS IP licensing is exclusively the provenance of public companies, companies about to go public, and companies about to be purchased.

jamestimmins 3y ago
I don't actually know what "buttoning up open source licensing / IP ownership" means. Is that making sure you have a license for all software you're using?
- jll29 3y ago
  You make sure that employees don't own what they write, but sign it over to the company (usually language to that effect in the employment contract, if there is none). Also running tools like Black Duck over your source code tree to check open source license types or use of unlicensed code snippets from the Web. NDAs can be given to people who know how something is done, knowledge that they could use to re-create the product or service elsewhere, which the acquired does not want. In some cases (that I have not personally seen) making people sign non-compete agreements, meaning if they quit they cannot work on the same thing for some time (not legal everywhere).
- bunabhucan 3y ago
  If "BigCorp" buys "CoolIdea" for their nifty piece of software "SecretSauce" they do not want to find out later that "BigCorp"/"CoolIdea" is required to publish source code for "SecretSauce" because it's based on "GNUOpenSauce" or that "CoolIdea" was selling something based on "FSFSauce."
- swiftcoder 3y ago
  Big companies are very allergic to GPL-like copyleft licenses. You generally have to go over the entire dependency tree with a fine tooth comb and make sure that nothing is going to get you sued to released the source code (inside a big company there are processes to ensure this on an ongoing basis)
phamilton 3y ago
FWIW, I've had to track down licensing and proof of IP assignment for fundraising rounds too.

totetsu 3y ago

On a tangent , can anyone point me to resources on solving the problem of distributing docker images with oss licensed software inside them?

koolba 3y ago
What’s the problem that’s specific to container images? It’s no different than distributing software binaries that include FOSS.
- totetsu 3y ago
  Sometimes the lower layers of the image fs can have binaries in there that are not used or even accessible to the running container.
  - eichin 3y ago
    They're still accessible by inspect and hash (maybe start with "docker history".) You may find it easier to use that to get enough info to build your own images from scratch, so you have control of what's going in (since you already have responsibility.) "mmdebstrap | docker import" gets you surprisingly far.
withinboredom 3y ago
It’s not a problem per-se. You just have to document them and their license. Whether you actually have to do that is another question since most believe that that would fall on the base image publisher, not the final image. Further, a proper base image will already include licenses in the base image because most OSS licenses require distributing the software with the license available. The only thing you would have to document are the things you specifically added. At least, that’s been my experience.
- totetsu 3y ago
  If the license says I must make the source code available, don’t I also have to have some mechanism to provide that code if asked?

agos 3y ago

this is how I guessed we were being acquired - a request to compile a list of the licenses of the dependencies of our mobile app, out of the blue and without further explanation