OSS authors:“We need to understand your mitigation plans for this vulnerability” | Hacker News Reader

OSS authors:“We need to understand your mitigation plans for this vulnerability”

twitter.com

75 pointsjonathanzufi12 comments

I have read a good theory for this elsewhere: the company has a spreadsheet of "partners" somewhere that legal and accounting demands gets updated. It starts as companies which you pay but then someone insists developers add all the open source copyright owners.

Now someone took this spreadsheet with zero understanding of what curl/"Haxx Team" is and just emailed them a template.

Not giving excuses, clearly they are incompetent. But it is not some demand of service from freeloaders.

Yea, sounds like something compiled during an audit (or preparation for one) and now used as a stand in dependency matrix by someone down the line

> Not giving excuses, clearly they are incompetent. But it is not some demand of service from freeloaders.

I mean it definitely _is_ a demand of service from freeloaders, it just may not be intended as such.

In my mind more likely a bit in reverse for the first part, a pre-existing list of 3rd party dependencies in use (which already includes open source dependencies from the get go) is acquired by someone auditing risk and the rest is the same from there. Not only one less step but one less opportunity for anyone to catch on or explain that these dependencies are special.

I keep getting questionaires like this, usually from paying customers though. I never answer them because my licenses are way too cheap to bother with shit like this. And yet the companies keep using my software, despite the fact that I didn't answer their stupid vendor asessment forms.

At this point I wonder what these forms are good for? Why send them to vendors and waste people's time if you don't care about the answer anyway?

Personally, I would immediately offer an enterprise tier, charge 10x-100x, then promise to answer these (using some type of better marketing language, of course).

I have done exactly this in the past. I made a webpage explaining the benefits of the enterprise license (individual contracts, assistance with vendor security assessments, etc.), and asked customers politely if they wanted to upgrade to an enterprise license.

Not a single company (out of maybe a dozen companies that I made the offer to) actually took me up on my offer. When they find out that the vendor assessment would cost them money, they suddenly find a way to use my software without the vendor assessment.

Exactly this.

Except for the small caveat that 10x-100x of nothing is still nothing, of course :p

I don't think I would want my vendor responding to a form like that anyway. I want them fixing the actual problem. The appropriate place to communicate the answers to those questions is on an issue tracking system. Filling out a different set of questions for every customer is a waste of time.

CYA to demonstrate you made the attempt.

Should’ve named the company and not redacted the doc.

These kinds of emails are so common that I don't think it makes sense to shame the company. Pretty much every company that is big enough to have a legal department sends out questionnaires like that. Yes, they are a pointless nuisance. Just ignore them and go on with your life.

Reply on news.ycombinator.com