Hacker News Reader

Comment by Dalewyn | Hacker News Reader

If you hire an engineer, the liability is your problem. If you donate to open source, liability is still your problem.

Both of these situations are patently unpalatable for most businesses.

Meanwhile, if you pay someone for a support contract the liability is their problem.

You see, whether a problem that comes up is fixed is actually irrelevant. The real question is how much liability you can get rid of.

View on HN

Good luck trying to get any actual liability out of them...

Like, go try to make Oracle write you a contract where their base going down compensates your lost profits. You just won't get it, unless you throw some hideous amount of money their way (and they will just pay insurance company and pocket the rest).

It's not about compensation, it's about finger-pointing.

"WE didn't bill your card 40 times draining your bank account -- STRIPE did! Go sue them, not us!"

You are still getting sued.

It's a theoretical benefit, not a real one, and the scenario is so rare that most people don't think of it critically. It's like buying insurance against "damage by asteroids".

E.g.: "We can just sue Microsoft" is a common one.

a) Their SLA literally states that they will compensate you only for the cost of the individual service they provided. The $1/month Azure DNS Zone outage caused your $100M/month business to vanish off the Internet? Here's $1 for your compensation!

b) The US Government sued Microsoft and failed to get very far. Are you the US Government? Do you have a budget for dozens of the best lawyers money can buy? Have you sued a multi-trillion dollar market cap org successfully ever? No? Why do you think you can... and win?

Generally this boils down to: "I haven't read the contract I signed, but I'm sure if things go bad I can just make the lawyers magically fix things for me."

Most customers won't sue you. They'll terminate their business with you and go elsewhere.

You have to decide, as a business, if trustworthy vendors are available and select the right one. You can also decide that it's important enough to your value proposition that you want to "own" it.

The real reason companies hire vendors is that you don't need some mythical "FTE" that can do all the things. For the "price of a single FTE", a vendor can provide you access to a range of FTEs that are knowledgeable and capable in different domains, and you can flex between them. Thinking about RedHat, as an example, if you pay RedHat the equivalent of a single FTE, let's say $300k/yr, is that just one FTE working on maintaining Apache? A kernel contributor? GCC?

This is about fractionalization and labor specialization, not some direct 1:1 tradeoff between hiring some mythical person with commit bits in hundreds or thousands of OSS trees.

And their lawyers will point to the thing you signed saying they are only liable to the amount you pay them.

Risk Mitigation

I understand the full time engineer thing. But it was never explained to me at any of the places I have been at that it was a liability thing. At every place they thought we would leak trade secrets. Was always frustrating that technically we could never even contribute the most minor of bug fixes.

maybe it's a "blame" thing, but it's not a liability thing. Nobody ever got fired for hiring IBM*, but nobody ever got a nickel back either.

*IBM is a consulting firm now

What liability are you referring to?

Component breaks due to bug, deployment misconfiguration, scaling failure, etc., and your company loses $1M during the outage. If it's a vendor with an SLA, you can (sometimes) get them to cover the $1M. If it's in-house, you're eating it. It's often cheaper to build/run stuff yourself (unless it's so commodified that you're benefiting from amortization across the vendor's many clients), but then you have to be self-insured for problems.

I don't think liability payments are that common. As someone who helps in analyzing software purchase decisions, it's certainly not something I hear people bring as a major factor.

Maybe size of enterprise matters? I work in $LargeCorp and legal was very aggressive about insurance and liability redlines on the last contract I had to deal with.

Why would a SaaS provider expose themselves to catastrophic risk of reimbursing a large enterprise for the enterprise's lost profits due to downtime? I think refunds of the cost of the SaaS are sort of common, but that's quite different and capped.

"Oracle offers no financial compensation (e.g., credits, refunds or otherwise) in the event a Service Level Objective is missed." https://docs.oracle.com/en-us/iaas/Content/General/Reference...

Look beyond SLAs to topics like cyber security incident liability. SmallSaaS selling to BigCorp, like Oracle, are in a wildly different negotiating position than BigCorp selling SaaS to SmallCorp.

I usually find a derivative of this in the fine print for software contracts: "No Warranty on Software. You and your end users use the Software and any derivative works you may create based on the Software at your own risk."

The entire software stack from the bios up generally offers little guarantee, and if it does, it's often:

"The sole remedy shall be a refund up to the original purchase price."

in the event of an incident, the exec or departments reputational liability

e.g. if you direct the engineer you have hired to build something that turns out to infringe on someone else's BS patents.

Whatever anyone else is saying this is the real reason. I’ve seen it first hand many time. The only thing that matters is being able to blame somebody else when problems arise.

Reply on news.ycombinator.com