Comment by skrebbel | Hacker News Reader

Comment by skrebbel | Hacker News Reader

It's an impressive sign of the times that a traditional bank publishes free & open source software. Banks are extremely risk averse by nature, and publishing open source is risky in all kinds of ways.

What if a developer copies&pastes some GPL code? What is some open source dev work gets done on a big project billed to a client? What if an external contributor contributes some code that gets merged, but it turns out to contain an obfuscated backdoor and this ends up inside our online banking apps? What if a company uses our open source code and it's broken and they sue us? (they'll have no leg to stand on, but it's still a worry for management not used to open source).

Really there are all kinds of complicated stories (sensible and not) about ownership and responsibility that need answering before an organisation like this will give off the green light to publish open source. I bet this was not a few developers asking the boss and the boss going "oh yeah sure, go ahead". Hats off.

When working at one of the other big banks in the Netherlands I had a security officer ask me: “So are we using any open source software?” I had the pleasure of seeing his face go white after I told him pretty much every bit we had from OS to framework, compilers, languages and everything in between was open source software...

It wasn’t a surprise that we couldn’t open source some of our stuff “because security”

So yeah, good to see this sentiment is changing

ING has always been a pretty open/modern/progressive business on a number of fronts. I wouldn't take this as typical. (In other words - they aren't Chase and vice-versa, not anything against Chase in this claim)

I was actually really heartbroken the day Capital One bought ING Direct -- I loved that account

It certainly wasn't modern enough to institutionally facilitate releasing open source software though, si it's great that they made progress on that front.

That might be what their American retail banking branch wants you to think, but here in NL where they're headquartered, they're Chase.

I went through the hoops of open sourcing some code in a global 50 company. The development team push for it restlessly for a year. The reality is that the culture in not there yet and I had to go through security, compliance and legal. We had to rewrite some code as one of our apache 2.0 dependency had some GPL dependencies.

We finally get the go when we cornered an exec during an off site event and he finally agreed to let us do it.

Big company are unfortunatly not ready by default to contribute back, it s not in the culture, and you get pushback from internal IT team thinking the code / architecture / documentation is not good enough yet to open source (hint : it never is) once you have clear the compliance / legal / branding / security side of things.

Hats down for the tech lead / dev / manager that convinced ING to open source this one. I hope that getting in front of HN will allow the dev team to get a little more budget to maintain this project a little longer.

hey, one of the devs that pushed for it here. Fully correct - getting everyone on board and then to actually approve it took a long time and a huge amount of effort. Even then although the code was open source we had been in a pilot phase where we have not been allowed to promote it. But now it's share it is much as you can And yes we hope to get a big community externally and internally which will improve the components overall

Given the amount of work and legal risks involved do you really blame them for being reluctant though? How many man-hours were spent on sorting out all the legal issues, doing the rewrites you mention etc?

~6 man months in my case.

Do you think the benefits of open sourcing will make that worth it? How?

I'm honestly asking, I'm curious how people do the cost/benefit analysis for things like this.

Mostly worth it for the team. Its good to be working on opensource project full time.

Also as an internaly, explaining this project have N star buy you political capital and facilitate access to extra funding to pursue the project longer.

It's an impressive sign of the times that a traditional bank publishes free & open source software

Another example: JPMorgan Chase: https://github.com/jpmorganchase

Also from JPMorgan https://perspective.finos.org/

Reply on news.ycombinator.com