Slashdot Mirror
Protecting Your Code While Allowing Source Access?
foo_48120 asks: "My small development shop, myself and four employees, is taking on a fairly large job that will run a substantial part of the clients business. To protect themselves they want the source code to the project. Frankly I don't blame them. We bid aggressively to get them to underwrite our own efforts to build this code, which we plan to resell again and again. That is the basis for our company.
I have no problem with them holding the source but need to make it clear that we own the code and that they have a license to use it in their business. They may at their discretion hire others to modify the code, but would still be required to pay their maintenance contract and be prohibited from reselling it or using it to run an additional business. How do you provide open source without escrow, yet protect what we are documenting up front as out intellectual property rights in the ownership of this code?"
Of course third party developers may break things and we would not be responsible for that or for fixing it without further renumeration.
Ideally, if we make them happy then we will do all future upgrades and add on modules as well. I am not worried about that. I do want to know if anyone has experience in the writing of such a licensing agreement? Perhaps they could provide me with a sample copy of their text?
Let's leave aside for now the issue of totally open source vs. closed source. There are times when you want the product to be proprietary as we do, however I want them to feel comfortable using our code so that if a proverbial plane were to fly into our building and wipe us all out then they don't go down the tubes with us."
Seriously, why are you even bothering to "Ask Slashdot?".
This is a legal issue, you'll need legal contracts and agreements, all of that.
Talk to a fucking lawyer.
When it comes to selling source code, that's the only method that works.
... How do you provide open source without escrow, yet protect what we are documenting up front as out intellectual property rights in the ownership of this code?"
First off, find out that what you are talking about is not open source. If it was open source, or a compatible license, than your client company would be free to redistribute.
Second, it's called a contract. And lawyers. Slashdot is neither. Just (have a lawyer) draft a contract specifying exactly what can be done and saying anything not listed is expressly forbidden unless written permission is granted.
Dacels Jewelers can't be trusted.
Well, for one thing, the model of selling a product doesn't work in the software development industry. Programmers are morally obligated to give the code to their users and allow their users to freely modify and redistribute the code.
The real money in software is in the services industry. If your company writes the software, it doesn't necessarily have to document it. And, if you write the software, who else knows it as well as you do? You could make a fortune on writing extensions and ironing out bugs that existed in the original project. Just look at Redhat: they are actually making a profit through selling improvements to something that is buggy and hard to use otherwise.
Believe me, businesses pay big bucks for someone else to deal with their problems. Just look at how much your average consultant makes.
Software piracy is victimless theft.
They may at their discretion hire others to modify the code, but would still be required to pay their maintenance contract and be prohibited from reselling it or using it to run an additional business
So, you've got the possibility that you'll be responsible for supporting the product even though other people are modifying it? How are your people going to have expertise in the work being done by these others?
This sig has been temporarily disconnected or is no longer in service
A) This is not open source you're talking about at all. You don't understand the term, obviously, or are abusing it to somehow seem relevant to Slashdot.
B) This is purely a legal question. Ask a lawyer. It's all a matter of the contracts. The first company I worked for did exactly the same thing for one of their product lines, a COBOL-based transaction processing system. You got the code, but if you wanted support, you had to pay us. You couldn't resell the code without getting your ass sued off. It's just that simple. There is no technical solution to it. You just make it very clear that you can take them for all they're worth if they resell your code.
Get a lawyer. Leave the work to them.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
That's not a very good answer to the "How do you provide open source without escrow" question, now is it?
Patrick Doyle
I mod down every jackass who puts his moderation policy in his sig. Oh, wait a sec....
They are paying you to code something for them. You are a contract firm. What you code for them is their property. Would you get to keep your code if you worked for a company? No, the code would belong to them. This company is paying you for the code, and so, when you are done, then the code belongs to them. They lose their monetary investment if you get to keep the code and resell it to their competitors.
While I'm sure you intended to be funny, showing a customer bad code is a bad idea. It risks making them wonder how reliable and safe your code is, for one thing. This will make them consider someone else.
C//
Assuming you are in the United States, your work is still covered under US Copyright law. Just because you are giving them access to the source code, does not give them redistribution rights, or the right to make a derivative without expressed permission.
So, all you should need is an (C) Your Co.
All Rights Reserved.
If that doesn't work, a handy lawsuit works wonders.
Black and grey are both shades of white.
Go read the license agreement for Microsoft's Shared Source. I'm guessing they've got the legalities of something like this worked out fairly well. :)
That would totally negate them having the code to begin with.
It sounds like they want the code so that they can make changes to their business software when and how they want it.
If you intentionally make it difficult or impossible to do what they're entitled to do (it sounds like they're wanting to basically buy a copy of the code, like a book or something), then you're in violation of the spirit, if not the terms, of the contract.
Plus, if you're not nice to the people who are paying you lots of money, you're less likely to get repeat business from them.
Here's a question for you:
You said "for their protection". Protection from what, precisely?
If they are concerned that you, as a company will cease to exist, and they will no longer be able to modify their code, then the previously mentioned escrow service should be perfectly fine with both of you. If this is another issue, the question of relevance comes to mind. If they want it to be sure that the software is "secure" from buffer overflows, etc, then you will need to hire a lawyer and write some sort of ironclad document to make sure they can't steal it, sell it, or claim any royalty fees on it. If they want it for any other purpose, I don't see them having a ligitimate claim to the software. I mean, sure, they're your employers, but unless there was something funny in the bid documents, they probably don't have any "right" to see the code.
hmmmm?
I don't mean to sound flippant.. but i'm in a line of work where, when i work during the day, i assume that that work is done, and that tomorrow, i'm going to get paid for working tomorrow.. and not to keep getting paid and repaid for the work i did last week.
.i give it freely to the companies, and their use of it is what they will of it, except that they must reference the writer - me - when they use the data. They are not allowed to say "this analysis was done by us" I only ask that they say "this analysis was done by gsfprez".
Is the concept of "pay me for work" completely dead? Must everything be "pay me for work, and keep paying me for years later too?"
Why do you not just simply charge them for getting a job accomplished, and then, if they want you to come back, tell them it will cost them more money?
If you think that there is something to your work, and if the source code get distributed, then you may see that others will want to pay to have you come and work for them to help them integrate whatever it is that is so wonderful that you wrote up.
What you sound like you want is "pay us now, but we want to hold our code hostage so that any time someone uses it, you want to get paid."
If you were to ask 3 times as much for your work, and they got an unlimited use of your code, would that be sufficient?
IANACIAAA (I am not a coder, i am an analyst), so please, this is not a "you suck" post.. this is an honest question.... where does my idea fall flat, if it does, please tell me, i want to be educated.
So that you can get a sense of where i'm coming from.... what i do every day is i sell out my brain power (and those of my partners here) by the hour.
I get paid to give someone a analysis of this, or an analysis of that... and i tell them "that will take 6 months and cost you $100,000". My reputation is good, so i get more people to come back to me and keep hiring me to do more work for them.
I do not hold my output hostage..
What else they do with the data, i don't care, and its not my business....I have gotten plenty of work simply from others seeing my output, and they were impressed.
My customers always have new problems, and i'm here to help them when those problems come up. They also have partners, and so, they come to us for help because they saw what were were able to accomplish.
When they do, they ask me how much it will cost.... they pay us then....
rinse, lather, repeat.
guns kill people like spoons make Rosie O'Donnell fat.
First off there are other companies that "license" their source code, like ICS. You could always find one of these companies and ask them how they do it.
Second, this does simply sound like a licensing issue. You trust your customers not to hack the license keys for the binary form of your product, or to redistribute it. So perhaps it's all about trust....
"Not knowing when the dawn will come, I open every door." - Emily Dickinson
Keeping it in some sort of off-site (for both) lockbox (a bank?). Something that allows you to both get to it, but at the same time, logs any access to it so you can make sure people don't just go get it.
This is assuming that they want the code in case of a disaster where the code is otherwise lost. If they just want it so they don't have to pay you for upgrades (and have their in-house people do half-assed upgrades to it) they will not want this option, so you'll know right off the bat that they are trying to purchase a one-time license to use the code any time they want.
Add a few zero's to the price tag if they want a one time purchase of a license to the code because you might as well get paid up front since you'll never, otherwise, see any money from updates / tech. support.
You just need to write an obfuscator then, something that takes the inhouse code and changes variable names and adds bogus modules and subroutines.
And I suppose you bill the client for the time it takes to obfuscate and confuse the code? Or you eat the cost?
Trusted relationships are enforced by contracts all of the time. Comfort yourself with some analogies from other industries, then define the terms of the contract and call your lawyer.
That reduces your problem to catching them if they break ranks with the agreement. Rich comments and the occasional random readme in the source tree (e.g., Java package.html files, copyright headers/footers) help give your code a signature.
Something else just came to mind here. What about splitting the code into libraries versus their proprietary code (unique to their project) and only give the source to the latter? It doesn't sound applicable for your current project, but you may find yourself with an opportunity to reduce your risk later by doing this.
You are checking your backups, aren't you?
If I'm an architect and design a house for you, you get to live in the house. But if an architecture magazine publishes an article on it, I get the royalties, not you. And it's my reputation as an architect that is improved.
The actual issue here is, "How much is the client paying for?" Are they buying use of the end product? of course. Are they buying all rights to and use of the design or source? Probably not all rights and use. So, therefore, the challenge is to work out an equitable and profitable distribution of rights and use between the original client and the artist/programmer.
This post is asking, "What are the methods that are established for describing who gets which uses and rights on a piece of software that was part of a custom contract?"
Open source implies that they have all the rights you specifically say that they will not be granted. Your scheme is closer to Microsoft's Shared Source scheme, or what we often refer to as "source under glass" - Look, but don't touch. Source, yes; open, no.
I'm sure there will be those here who will take an activistic viewpoint and urge you to do something different. I will not. You have every right to release code under any terms and conditions you may legally obtain, and more power to you. But my opinion is that you ought not use the phrase "open source" unless it meets the OSI mark requirements (which your plan most certainly would not).
Oh...wait...you mean that wasn't sarcasm? You actually wrote that with a straight face? Now *that* is funny.
Let's see how your opinion of free software changes after Mommy and Daddy stop paying for school and you have to get a job. Your tune will change when you realize that people who give away software won't be hiring you, because....they have no money to pay salaries! Hell, where does Linus get his paychecks? Not from a company releasing its intellectual property for free. As for consulting...you want to add up all the dollars spent on software (binaries) compared to consulting services? It isn't remotely close. Nice try.
This whole "all source code should be free" crap is only popular among people who don't work for a living (and, somehow, Stallman). When you own your code, and make a living off of it, it's amazing how your views tend to change. It's kind of like how the hippies of the 60's became the 80's Me-generation - money and power (and closed source code!) is only bad when someone ELSE is controlling it.
But thanks for the troll, that was a good one!
-Looking for a job as a materials chemist or multivariat
And their company isn't the first to happen upon this situation.
You always ask your friends about similar situations they may have encountered before you go into some situation. Fools would go ahead and get a lawyer without first discussing it with people who might have had experience with the situation.
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.
You cannot collect punitive damages for breach of contract.
This is the only post so far to actually answer the original Ask Slashdot question. Instead of the fifty redundant posts saying "Get a lawyer", and the other ten saying "That's not open source", RudeDude actually gave a relevant response. Good grief, what was he thinking? That's not the way to karma whore.
No, but /. is the place for him to get ideas as to what to tell the lawyer to put into the license.
A lawyer is like a complier. You write code in English, he compilies it into airtight Legalese. However, if you give him a bug in the unput, his contract can still crash.
You mean when you only want to eat a piece of the cake and not the whole thing? He just wants to give his customers a few extra rights without giving up ALL of his. It's just like all of those documents you see that say you can distribute them but not modify them. Except in his case it's the other way around.
The only thing I know is that I don't know anything; and I'm not even sure about that.
+1 Funny.
-1 Unemployable.
Dave
I write a blog now, you should be afraid.
We're not talking about The Open Source Definition (OSD) here, we're talking about giving a client access to the source code, and stopping them from distributing. Technical measures will fail (you could make it more difficult, but without legal backing you're screwed anyway), so you need legal. I'd remove the Open Source terminology from it entirely and get a lawyer to draft up a contract. Put in something that says they have to follow certain procedures when using the source code to lower the risk of it getting out, and that they have to pay damages if the source code is leaked.
This is a very common issue at the company I work for. Any company that does custom engineering work (we do computer hardware, electrical design, installation, and of course software) for more than a single customer MUST retain ownership of their code simply because you can't afford to rewrite all of your software every time you get a contract with a different company.
When we quote a project, we do it based on the amount of work it will take to accomplish it, but we don't sell them hours of engineering work. We sell them a working system. If we budget 500 hours and it takes 1000 hours to write some custom piece of software, the customer doesn't have to pay us twice as much for the project. We sell them a system, with the license to use the software, and we give them a copy of the code as a deliverable for them to modify and use for the specific system we sold them.
Most people think companies like ours try to retain ownership so that the customer has to pay us royalties, but the fact is, we rarely, if ever, charge for maintenance. We sell a warranty with the system, so we fix any bugs that arise. If we do a good job, they hire us back to make changes to the system, which we do get to charge for. However, our customer can just as easily go to a different company and hire them to make the change, because our software license permits that.
The real reason we have to retain ownership is so that we can freely copy portions of code from previous projects to use in future projects. Say, for instance, we wrote a code module that abstracts a certain piece of hardware. If we used that same piece of hardware on another project, we would want to use the same code module to make our life easier. Unfortunately, if our previous customer owned the software, we would have to pay THEM royalties to use that software!!! The fact is, retaining ownership of that code gives us a competitive advantage in future projects, because some of our development is already done, so we can try to under-bid our competition (who are doing the same thing we are, by the way).
In fact, writing software today is rarely a case of writing code from the ground up, and selling it to someone. Now our job is to take existing pieces and put them together to form a system. That's why companies in our industry are called "Systems Integrators".
"I have never let my schooling interfere with my education." - Mark Twain
Guess what... you just talked yourself out of the contract. No company is going to put up any of its own assets to put your mind at ease. They'll just go with the next highest bidder who doesn't want them to jump through so many hoops.
Doug
Venn ist das nurnstuck git und Slotermeyer? Ya! Beigerhund das oder die Flipperwaldt gersput!