3 ms·

> First, WOW. In can't imagine any sector (except indeed academia) where a "keep your filthy hands off my code" attitude like that is remotely acceptable. Actu

> First, WOW. In can't imagine any sector (except indeed academia) where a "keep your filthy hands off my code" attitude like that is remotely acceptable. Actually, keeping code "close to your chest" is pretty common in the security industry. You'll see fuzzer frameworks get released all the time, but fuzzers which find "real bugs worth money" tend to get hoarded. If you work for a consultancy and have private tools, you are not expected to hand those over to the company. They will appreciate it if you release some results with their name on it (as well as yours) every now and then though.

tripzilch 14y ago
I see your point. I was actually trying to think of a counterexample where "keep your hands off my code" would indeed be a valid attitude, and the first that came to mind was the security industry (because what you describe indeed makes sense). But then I remembered the way copyrights work under employment, making it a bit of a convoluted (countercounter) example, sorry about that. What you describe, however, is if someone already has developed these tools and then joins a security consultancy company. Wouldn't it be very different if one developed the tools while under employment of a certain company (and it was your job to develop such type of tools)? Cause that's the whole point of the way copyright works here, if you develop this tool on company time, I really doubt they'd let you walk away with that IP. Especially because they are worth that money. And even if you develop it in your own spare evenings, law is pretty specific that doesn't matter, for one reason that it's impossible to prove (and often quite unlikely) that you didn't use any company resources or knowledge to do so. There is a good possibility that university contracts have different rules about the IP you produce while doing research though.
- xyzzy123 14y ago
  > Wouldn't it be very different if one developed the tools while under employment of a certain company Basically, yes, stuff done on company time is definitely theirs under 'work for hire'. Totally agree with you. A lot of projects are done as evening/weekend work which is on shaky legal ground - similar to bootstrapping a company while employed. If you have a side activity which is making money, it's simplest to stay quiet about it. Among the limited sample set of "people I know", it's considered extremely crass for a company to try to pull an undeserved IP grab. Such a company would find it really hard to get self-motivated people after pulling a move like that. Because everyone has side projects. Although some are diligent about getting "my stuff versus your stuff" spelled out in contract, it's often a "gentleman's agreement"... As an aside, I wanted to point out that it's really common for security companies (or simply, "groups") to keep internal tools and only release them to the public when they've wrung all the "juice" out of them - e.g. publicity value exceeds the value of the results. I think this model is not too far off what was described originally.

tripzilch 14y ago

I see your point. I was actually trying to think of a counterexample where "keep your hands off my code" would indeed be a valid attitude, and the first that came to mind was the security industry (because what you describe indeed makes sense). But then I remembered the way copyrights work under employment, making it a bit of a convoluted (countercounter) example, sorry about that. What you describe, however, is if someone already has developed these tools and then joins a security consultancy company. Wouldn't it be very different if one developed the tools while under employment of a certain company (and it was your job to develop such type of tools)? Cause that's the whole point of the way copyright works here, if you develop this tool on company time, I really doubt they'd let you walk away with that IP. Especially because they are worth that money. And even if you develop it in your own spare evenings, law is pretty specific that doesn't matter, for one reason that it's impossible to prove (and often quite unlikely) that you didn't use any company resources or knowledge to do so. There is a good possibility that university contracts have different rules about the IP you produce while doing research though.

xyzzy123 14y ago
> Wouldn't it be very different if one developed the tools while under employment of a certain company Basically, yes, stuff done on company time is definitely theirs under 'work for hire'. Totally agree with you. A lot of projects are done as evening/weekend work which is on shaky legal ground - similar to bootstrapping a company while employed. If you have a side activity which is making money, it's simplest to stay quiet about it. Among the limited sample set of "people I know", it's considered extremely crass for a company to try to pull an undeserved IP grab. Such a company would find it really hard to get self-motivated people after pulling a move like that. Because everyone has side projects. Although some are diligent about getting "my stuff versus your stuff" spelled out in contract, it's often a "gentleman's agreement"... As an aside, I wanted to point out that it's really common for security companies (or simply, "groups") to keep internal tools and only release them to the public when they've wrung all the "juice" out of them - e.g. publicity value exceeds the value of the results. I think this model is not too far off what was described originally.