Re: CRIME Computers vulnerable at Oregon department

From: Greg Jorgensen (gregj@private)
Date: Tue Sep 24 2002 - 17:48:57 PDT

  • Next message: Greg Jorgensen: "Re: CRIME Computers vulnerable at Oregon department"

    On Tuesday, September 24, 2002, at 04:46  PM, Crispin Cowan wrote:
    
    > In an industry where source code availability is rare, it does not 
    > surprise me that ability to make use of source code is also rare.
    
    For desktop apps and relatively low-cost commodity software source code 
    is rarely given to customers or VARs. At the high end, where a vendor 
    is paid to develop a custom solution, or to adapt an existing package 
    (a la Portland Water Bureau) source code is often given to the 
    customer, after sufficient lawyer time is billed. Typical arrangements 
    include NDAs, waivers of support (or by the hour support charges) if 
    the customer changes the code, and all kinds of other contractual 
    terms. The terms are negotiable. Sometimes the software vendors work 
    with VARs they trust who have access to source, or VARs who can be 
    covered by the customer's NDA.
    
    If a government agency buys or contracts for high-end software and 
    fails to negotiate for access to the source code that's a failure of 
    their procurement and contract negotiation process. One could also 
    argue that failure to take precautions against the software vendor 
    going out of business is a dangerous waste of public money and a 
    negligent risk.
    
    The big company I referred to before--the Oracle shop--did not have 
    source code to Oracle 9i. They did have source code to the Oracle-owned 
    business modules and APIs they used. Anything we changed in house 
    Oracle refused to support, though we could install the approved Oracle 
    version to get that support back. I have never heard of anyone getting 
    a source license to Oracle, but that doesn't mean they don't do it. But 
    source access to applications built on top of Oracle, even those sold 
    by Oracle, are common. I've seen that several times. I also know that 
    H-P had source to the big-name CRM and ERP packages they bought because 
    they had modified the source to integrate with their Java-based web 
    applications.
    
    --
    Greg Jorgensen
    PDXperts LLC, Portland, Oregon, USA
    



    This archive was generated by hypermail 2b30 : Tue Sep 24 2002 - 18:35:11 PDT