Hacker News Reader

Comment by bluGill | Hacker News Reader

It would cost them millons to find and package everything. This is assuming they have everything in source control and have nothing to hide (that is no code that isn't public anyway) sure you can do a git to tar.gz easy, but GNU is likely to demand the hash everything was built from which means people need to figure that out.

if they have a monorepo with non GPL code (which doesn't link to anything GPL) stripping it all out will cost a lot more.

View on HN

It costs nowhere near that much to find all your third party dependencies. It's not pleasant work, to be sure, but it's not rocket science either.

Time adds up faster than you think. a few people double checking that it was done right...

I think for a case like this they would assign a low level employee to make a best effort attempt at this, probably taking some sources from GitHub to match the approximate version of what they released, maybe give it a good shot for a week or two. That would probably placate the SFC at least until they realize.

If they are lucky that works out and they can maybe get by with that and the cost would be in the mid tens of thousands. However if they get caught it will come out in court, the judge will not be impressed with a half hearted effort - so a million to defend in court, plus what they lose in court which could well be forcing all their code opened as GPL.

Remember, a small meeting will cost over $1000/hour when you add in all the time for each person in this. There will be several small meetings needed to decide on course of action. There is also the opportunity cost of the employees who are doing this (or just in the meetings) instead of something that more obviously brings value.

This 1000$ meeting assumes SV programmer salaries. I can assure you that many places in the world have much smaller salaries.

Also, they are already planning to go to court to prevent releasing any code, so finding a way to spend a few thousand dollars or even a few tens of thousands to avoid court entirely would be a no-brainer.

Going to court and saying "we made an effort to appease them but these people just want too much" is much better than going to court and saying "let's settle a new area of law to determine if this people have a right to sue us for very obviously ignoring the terms of this software license".

No one in these days of cyber attacks should be shipping unknown third party dependencies. How could you fix unknown dependencies in case of severe CVE's in them ? Unknown third party dependencies are a sign of utter amateur incompetence in product development.

Once you have all third party dependencies cataloged, licence compliance should just shake out in the wash.

Reply on news.ycombinator.com