Step One: Get low level developers to upload evidence of major corporate license violations to your server.
Step Two: Sell evidence to legal firms.
Step Three: Profit.
This seems very risky from a company perspective.
Step Two: Sell evidence to legal firms.
Step Three: Profit.
This seems very risky from a company perspective.
Secondly, we deal entirely with 3rd-party code, so the licensing issues and risks are already completely public. If there was truly a malicious actor, they would just scan popular third party modules and reach out to companies that had job postings or github pages that were active in those environments (i.e. scan npm packages and target JS developers).
But in the spirit of good development practices, "security by obscurity" hasn't proved to be an effective strategy. We'd prefer not to promote "legal by obscurity" either. :)
You could build up a large database of say, violations of Oracle licenses, then get Oracle to buy out your company.
You’d make a quick buck, and your users would be left holding the bag.
How do you mitigate against these type of threats to your users?
Disclaimer: I work for FOSSA.
It’s a very real risk of using the service.