The Joel on Software Discussion Group (CLOSED)

A place to discuss Joel on Software. Now closed.

This community works best when people use their real names. Please register for a free account.

Other Groups:
Joel on Software
Business of Software
Design of Software (CLOSED)
.NET Questions (CLOSED)
Fog Creek Copilot

The Old Forum

Your hosts:
Albert D. Kallal
Li-Fan Chen
Stephen Jones

Poll -who would have over source code to 3rd party just for sale

For the past 1.5 years I've been running a microISV. Sales are reasonable. Sometimes I get 3 sales a day, sometimes 19 sales a day, sometimes 10 sales a month. It's enough to form a basis while I write more software. The software sells between 50 - 80 USD.

I have about 5 other competitors, but 4 of those sell inferior products. I've had quite a few customers say they have tried out several other products but mine is the only product they purchase.

It contains one non-trivial novel algorithmn and quite a few algorithmns I wrote from scratch that are somewhere between trivial and non-trivial! It does have distinct advantages over the competition.

I posted about one issue recently in Business on Software. However I'm posting here as a Poll question.

If a HUGE company approaches you but does not say how many copies of your software they want to buy, do you do what they say and hand over your source code to an escrow service they name?They say they will pay for the escrow service.

Anyway I told them I could not reveal the source code, but if that clause could be crossed out of their agreement I could go ahead. I haven't heard back from them yet.

But anyway please send your replies as either

YES - you would agree to hand over source code to an escrow service.

NO!, you wouldn't not.

I suspect the escrow thing is just boilerplate. I should say I worked solidly on one niche area for 2.5 years (almost) and so my application was written with a specialist knowledge that can't readily be obtained from just reading 1 book.
microISV Send private email
Tuesday, May 15, 2007
Perhaps when deciding over matters like this, we should say


Hee. Hee.
microISV Send private email
Tuesday, May 15, 2007
no, I wouldn't agree to source code escrow.

is the concern that you will go out of business?  If that's the case, they can just buy the source code from you at that time.
Sassy Send private email
Tuesday, May 15, 2007
No I wouldn't.

It looks like your source has specific value, it's not any CRUD app. So NO.
Tuesday, May 15, 2007
I would not buy software for a big company from a MicroISV without a source escrow agreement or similar.
Tuesday, May 15, 2007
I've seen this before.

The company is trying to avoid the scenario whereby it becomes dependent on your program, only to find you go out of business and it has no further access to the source.

You could do one of a few things:

 - Sell the company a source code license, at a much higher price

 - Draft a legal agreement that grants the company access to the source in the event of your liquidation - perhaps at a fee at that point.

 - Or simply go with the escrow service. You might also ask the company for a fee for this but explain that only the current version will be escrowed, and no future updates.

Your best option is probably to negotiate the sale of the source code license and try and build a relationship with this client. You might also sell them support, access to upgrades etc at preferential rates (since you are dealing in volume) for being your biggest client.

However, forgetting all that there is no real reason NOT to allow your current source to be escrowed. It's not like the escrow company is going to sell it on eBay and do you out of business.
Mr Anonymous Send private email
Tuesday, May 15, 2007
For what it's worth as I have close to 0 experience in this sort of situation.  Ok, I was part of a company that dealt with a third party that decided to close.  With some reasoned discussion they gave us the source with conditions which work perfectly fine for us.

Escrow service?  They actually exist?  Can you trust them?

I wouldn't think that would be necessary.  As long as the contract has an escrow clause in the event of the death of your company, then that should be sufficient. 

To actually deal with a third party just seems shady to me.  I guess I don't trust unknowns with my money (or equivalent.)
Robbert de Groot (aka Zekaric) Send private email
Tuesday, May 15, 2007
depends how much they are offering. Let's say that on Avg you make 5 sales a day @ 50 bucks. So that's 250 a day. Let's say that there are about 20 business days in a month, so 5000 per month. And of course 12 months in a year, so 60,000 a year.  Is this your full-time job?

If not, what do you get from your ISV? Is it pure enjoyment of being able to be "the boss" and make quick decisions?

I'm also curious, what is the value of your product? How much could a big company make off of it?

I guess my point is I would sell my mISV for very little. I would agree to no competes, etc. Yes, I would maintain the right to use the site for personal use, etc.  But, hey, that's just me.
Patrick From An IBank Send private email
Tuesday, May 15, 2007
Game theory:
Each side plays to minimize their losses.

Think about it.
If they agree to buy your code, you'll still have to haggle over the final price - they must have already decided the point at which they will drop out of the deal.
If they dont buy, they've still had a look at what makes your code work.

In both cases, you have little to gain. Of course, this point doesn't stand, if they've escrowed 50% of what you believe as  fair price for your work.
VR Send private email
Tuesday, May 15, 2007
> - Draft a legal agreement that grants the company access to the source in the event of your liquidation - perhaps at a fee at that point.

A legal agreement with a company that has gone out of business is hardly enforcable.
Tuesday, May 15, 2007
This is an easy one....sell the company your source code OUTRIGHT with the provision that they will not distribute the code to anyone other than those who have a valid license, nor will they hold themselves out as a seller of the product.

In addition, ensure that your contract has a no compete clause in it....meaning, you can sell your code as you've been doing.

I would have not problem selling my source code to a company under these circumstances. Hell, I'd even sell my contracting services to them for updates and approaching your business in this fashion eliminates having to try to upgrade your app in a "one size fits all" box.

Sell your consulting services to the company based on THEIR SPECIFIC business requirements. That way, over time you are literally changing the source code to fit another business model. If this approach were implemented, you would literally (over time) possess two completely different products that do similar things.

As far as who would own the source code for the updated app, have a provision in your contract that states that again, the company OWNS all source code inclusive of any upgrades but it cannot sell it, but it can change it at any time with or without your support.

A company will NOT mind signing a contract under such terms if its intention is NOT to ultimately sell the source code or attempt to make a market out of your idea. If the company gets rattled by such a contract, don't sell your code and be VERY suspect of the company's intentions....

Either way I would forget the escrow don't need just need a very solid bilateral contract.
Brice Richard Send private email
Tuesday, May 15, 2007
Work out the rest of this deal first and decide if the trouble is worth it. 

If they only buy 1 copy, then it isn't worth your trouble.  (Or they may want 100 copies at a dirt cheap rate which also isn't worth it.)
I forgot my posting name.
Tuesday, May 15, 2007
Hell yes! 

Escrow can't release your code without your permission.  You are protected.  The least of your worries are with the source code in escrow.

Focus on the sales, terms of license, support, disclosure, etc.  This can easily seque into access to markets for you, other products, or even a buy out of your company.

I worked for a company that escrowed software before.  It works great.  (One caveat - have your lawyer review the escrow agreement, just in case).
Tuesday, May 15, 2007

"Anyway I told them I could not reveal the source code..."

That is what escrow is for.  You don't real your source code.  Are they asking to see the source too?  No... the escrow obviates that.

Your source is your IP.  Don't give that up.  Escrow protects you, too.

As long as they can't see the source, my answer remains the same:

Hell Yes!
Tuesday, May 15, 2007
I required all my small software vendors to sign escrow agreements when I worked in proposal development for a major U.S. government contractor. Trust me, big companies do not want to exercise escrow agreements.  However, they are not going to make an investment in deploying a piece of software that is produced by one-man company without one.  This mindset is the reason why IT managers in large companies always seek a solution from one of the "big boys" before they look at the smaller players.  I distinctly remember having to pull a vendor’s Dunn and Bradstreet information before I could bid their products on a proposal.

Tuesday, May 15, 2007
Yes - IF they agree...
Get an attorney to hold it in escrow. In the US, it needs to be someone with legal standing.  I can appreciate a company wanting to insure itself against something happening to you.  Money is little help at a time like that.
MSHack Send private email
Tuesday, May 15, 2007
Open source it. Release it under the GPL/BSD liscense.

Tuesday, May 15, 2007
Now that last post is definitely a troll.

If I open source it, I will lose my source of income and have no money for food.

Anyway I have already decided. No source code escrow.

I asked the company how many copies they wanted to buy and they haven't replied yet.

There is always 1 bad employee that will leak stuff.

For example due to the Certified Partner scheme, Microsoft has my telephone number and other details. I specified no 3rd party contact, however my details did leak out from the Certified Partner scheme to 3rd parties.

So there are always leaks.
Tuesday, May 15, 2007
Here's the real question: if large companies actually want the source code - people keep posting here with the exact same question - why haven't they already worked out a sane and efficient process for dealing with it?

It keeps popping up, and always sounds weird and irrational.

Anyway, I vote for charging ten million dollars, because if you're a 1-man band that really ought to give you a more than decent standard of living for the original likely lifetime of the product.

Tuesday, May 15, 2007
What will happen is that large companies will skip over the small companies and either go with other large companies, or they choose a open source project and outsource work to India.

Tuesday, May 15, 2007
Just to make things clear, this is a shrink-wrapped product. It is a utility of use to many people. It is in a similar vein to a graphics package such as Adobe Photoshop Elements or WinZip.

Shrink-wrapped, NOT custom developed.

Hell if somebody had my source code, they would work out my copy protection/registration scheme.

Competitors could find out what I did to make the algorithms faster than their ones.

Leaks happen. All it takes is 1 bad employee and I could lose a lot. And these people never said how many copies they want.
Tuesday, May 15, 2007
yes, you should do it if they make it worthwhile.

basically just indicate that you dont have a problem with that idea in theory, and then move on to discuss the actual sale. 

once youve sorted out that, you can decide whether its worth the hassle.

Escrow is not the same as releasing the source code, so long as you use a decent provider you are protected.  hell, if you are worried about leaks, agree to give the escrow an encrypted copy of everything and to give the company the encryption key at the same time.

the key is no use to the company without the code, the code cannot be leaked from the escrow company without the key and the two will only come together once the escrow company releases the code to the company under the terms of your agreement.

either way, it seems silly to refuse to discuss the matter...indicate your willingness to go that route and focus on the actual details of the sale, once you know what they want you can decide what you want to charge.
Tuesday, May 15, 2007
Well I've already indicated escrow is an issue.

It is up to them to reply with an indication of how many sales.

I'm quite happy to pass up on this sale. It just isn't worth the risk.

I have hundreds of customers. Out of those hundreds, I've had two people scheme and tell lies to try to get a free copy of the software. You can't trust anybody.

It is silly to potentially risk tens of thousands of dollars just for a few sales and just because of a boilerplate legal agreement.

I have produced a general purpose utility. In some ways it is similar to Winzip. It is not a compression utility but my analogy is that my software is of general use.

How many people use Winzip? Do you have the right to the source code if Microsoft or the makers of Winzip go bust?

Tuesday, May 15, 2007
There is also a risk that somewhere in their 30 pages of legal agreements is a clause that allows them to grab the source code from escrow.

Their pages of agreement are in a small typeface. I've almost read their all the 30 pages. It will take ages to pick through everything looking for the less obvious catches.

It just isn't worth the time. I've sold to large companies before without this hassle. All I have to do is wait a few weeks and another big sale will come along.
Tuesday, May 15, 2007
If their IT department is a run-of-the-mill big company IT department it is a fair bet it is full of people that don't write software and have long ago stopped doing anything useful. They can stick to their bad, buggy ways of doing things.

If they want to be time-wasting jokers they can be.
Tuesday, May 15, 2007
Sure, I agree to escrow. I mean, if you get hit by a truck, they risk loosing their investment. The only thing I would change is that I would use *MY* lawyer for the escrow…not yours….

But, yes…other then the choice of who being used for escrow…no problems at all…
Albert D. Kallal
Edmonton, Alberta Canada
Albert D. Kallal Send private email
Tuesday, May 15, 2007
> The software sells between 50 - 80 USD [...] I have hundreds of customers. [...] It is silly to potentially risk tens of thousands of dollars just for a few sales

Your concern may be premature.

If they were thinking "holy mother of god we have to have this software" then they would talk, if they're thinking "meh, it's ok, worth a go I guess" then they'll already be buying something from your competition.

If they picked up on your fear and distrust (and apparantly small user base) they may just figure you're too difficult to deal with.

> Their pages of agreement are in a small typeface. I've almost read their all the 30 pages. It will take ages to pick through everything looking for the less obvious catches.

That's what your lawyer is for - to read contracts and find the loopholes. But I guess on your sales volume, paying a lawyer is hard. But if you are serious about there being thirty physical pages for the contract, I'ld actually bet that someone is pulling your leg.

> is the concern that you will go out of business?  If that's the case, they can just buy the source code from you at that time.

I don't know how to break this to you, but after the guy gets run over by a bus is a bad time to negotiate an agreement to purchase source code from him. Even if he merely retires, by that time it's too late to make a new purchase.

> I have produced a general purpose utility

But not one person reading here could buy it if they wanted to find out what this mysterious and vague undefined "general utility" actually is. Interesting. What're you afraid of?

Tuesday, May 15, 2007
It is up to them to reply with an indication of how many sales."

but youve already indicated that you have no interest in escrow.  unless you added '...unless you want to buy LOTS AND LOTS of licenses.." then you have screwed yourself entirely before youve found out what they were wanting.

"I'm quite happy to pass up on this sale. It just isn't worth the risk."

well, fair enough.  god knows that if there is one thing that entrepreneurs dont do its take risks.

just out of interest, how do you know whether it is worth the  risk is you haven't actually found out what they are interested in purchasing?

meh.  your funeral.
Wednesday, May 16, 2007
NO! I definitely would not.  In the long run after I am dead I will bequath my software's source to the public domain, but not now.  Anyway in the log run we are all dead...
Donald Duck
Wednesday, May 16, 2007
Use your own Escrow service, not theirs.

Alternatively, give it to their escrow but cripple your clever routine. No way in Hell are they going to compile your code and test it.
Wednesday, May 16, 2007
+1 for workingHard - entrepreneurs take risks if they want to grow. Find out the exact terms of the deal before saying yes or no.
Mark Pearce Send private email
Wednesday, May 16, 2007
To answer a previous poster's question, I haven't posted what the utility is, because in the future a potential customer could do a Google search for the name of my product or website address and come across a lot of ranting posts ;-)

I've sold to large companies before and several household names and none of them have required source code escrow.

The situation is strange. I'm given a very length agreement before these people are saying how many copies or exactly what they want.

Leaks do happen. There are dishonest people out there. There are people out there who use social engineering to get what they want. Big famous companies do have the odd bad employee.
Wednesday, May 16, 2007
I'm amazed that anyone here would hand over the source code for an application that over its lifetime will generate hundreds of thousands of dollars and contains ways to doing things that can be incorporated into other bits of software which will have a competitive advantage because of it.

All it takes is one software developer in the escrow company to realise what they have for me to lose a lot of money. Maybe this person will take a copy of the source code and then in a year or two when they have left the escrow company decide to use the source code to create a competiting product which just a different user interface.

This is like giving the keys to your house and car to a stranger you met over the Internet.
Wednesday, May 16, 2007
<shrug> so encrypt the source before you put it into escrow.
Wednesday, May 16, 2007
"do you do what they say and hand over your source code to an escrow service they name? They say they will pay for the escrow service"

They pay for the escrow, that's not negotiable. It's also standard for them to pay you an administrative cost for this escrow, which will probably be in the tens of thousands to cover your legal expenses. You, with your attorney, write the escrow agreement's terms of what circumstances they get the code, I'd make this pretty severe.

If you don't feel comfortable with their escrow company, you're free to suggest your own as well.
Meghraj Reddy
Wednesday, May 16, 2007
"30 pages of legal agreements"

This is a different issue. Under no circumstances should you agree to a 30 page contract in return for selling shrink wrapped software unless the sale represents $1 million or more. Even then I'd be cautious. You'll need a good IP attorney to review it and draft and amended version. If he's any good, he'll charge you around $3000 to review an IP contract that long (an unheard of length), then it'll be $600/hr to draft revisions and do negotiation over terms. You'll have to be present in their offices most likely for this since their board, or someone who speaks legally for them, will have to approve the changes.
Meghraj Reddy
Wednesday, May 16, 2007
In reply to Meghraj Reddy, you have hit the nail on the head. The agreement is unusually long in size. I started reading it one morning and stopped before I got to the end.

The whole thing seems strange. The email was very terse. Just sign the attachement agreement before we can offer your software to people in the company.

Reviewing the agreement will cost thousands of dollars. The software only costs tens of dollars. Even if a company effectively buys a site license the cost only goes up to 1000 USD.

My reply to them asked how many copies they expect to purchase. I haven't heard back from them for over a day now. Maybe they realise what they were asking is inappropriate now.
Wednesday, May 16, 2007
Yeah when you're talking about making a sale in the tens of dollars and the customer is talking about drawing up 30 page contracts, that's just not a reasonable request. However, you do see this sort of thing from time to time.

For custom software that is priced in the hundreds of thousands or millions or tens of millions, this sort of thing is reasonable, but not for off the shelf shrink software.

If you want, you can have an enterprise edition of the software that allows for this sort of customization, including custom contracts. But that edition should be priced no lower than $20,000 per seat.
Meghraj Reddy
Wednesday, May 16, 2007
While I agree the whole thing sounds fishy and you should probably stay away from it, I believe you attribute too much value to your source code.

It's not that the algorithms don't matter; It's that they can be recovered from the executable by someone knowledgable. It's not an easy task, but it's not exceptionally hard for someone "skilled in th art" of reverse engineering.
Ori Berger
Thursday, May 17, 2007
YES - you seem to misunderstand what "escrow" means:

* It *doesn't* mean that you give your source to the customer and hope they don't read/distribute it.

* It *does* mean that you give your source to a trusted 3rd party (e.g. a lawyer or a specialized escrow service), who doesn't open it, and who won't give it to the customer except in the event of some carefully-, legally-specifed condition (e.g. your going out of business).
Christopher Wells Send private email
Thursday, May 17, 2007
Ori, I've taken steps to prevent reverse engineering.

One of my algorithmns in unique to my software product.

Anything can be done given enough time, but if anyone was so skilled in reverse-engineering and had enough time to do it, perhaps that person could be able to write the algorithmn from scratch.
Thursday, May 17, 2007
Thanks Christoper, but I did a search yesterday for escrow and I read the number of conditions in which the source code can be released is being increased.

The scenario played out below could happen:

1) Big corporate sends me 30 pages of legal agreement. They ask me to sign it before they can make my software available to people in the company. No mention of how many purchases or when.

2) I naively sign and return it thinking all the strange and convoluted clauses won't be strictly enforced.

3) The corporate wants a custom modification for 500 USD and within a month.

4) I complain that the modification they want done is virtually impossible to do, let alone within a month. I complain the price is too low.

5) The agreement contains clauses related to price and if I want to charge a higher price I need to show evidence of previous charging to other customers.

6) The corporate then complains to the escrow agency I am not providing good support for the software product. They show the agreement I signed. Then the escrow company hands over the source code.


As a previous poster said, the whole thing seems fishy. It is not the escrow it is the long agreement without an explanation on the part of the corporate as to why it is so long or how many copies of the software they want.
Thursday, May 17, 2007
You're making it sound as the terms of the escrow agreement are, "They can have the source code if and/or when they want it."

In which case the question isn't whether you'd escrow the software: instead it's whether (and for how much, and for what purpose and under what kind of license) you'd be willing to sell the the source code (or, at a minimum, sell the portions of the source code that they might want to alter, e.g. the UI).

Another possibility might be to sell them a library with an API.
Christopher Wells Send private email
Thursday, May 17, 2007
Christoper, it is already possible to call my software product programmatically. I've already put all the details about this on my website and in help files. One company already makes use of my product programmatically and has paid for it with no problems.

I do strongly suspect in this case, the company isn't at all interested in purchasing my software.

There are two possibilites:

1) I looked up prices for escrow and it can be several hundreds dollars per year, every year. Perhaps someone in this company has a friend working in the escrow company and he wants to put money their way.

2) They realise my software is selling well enough to want to rip it off.

The whole thing is very suspicious. The legal agreement is far too long and came with no explanation, nor any indication of how large their purchase will be.
Thursday, May 17, 2007
Been there & done this.

I don't get a lot of comments on this; it is a perfectly reasonable and (I thought) common requirement and you should agree with it. Certainly I won't incorporate a 3rd party component into our C++ app's without access to source  (other than MS Windows components - even then I try to minimise dependency on MS components).

We are a smallish company which has sold to several multi-nationals. They have purchasing officers that do make getting the sale more difficult in the first place as they have QA purchasing procedures, but once you have the foot in the door then they tend to be good profitable clients.

Big companies plan on being in business for a long time. When buying any software from a company where there is a perceived risk of the company stopping development or not being around in a few years, they want to protect their interests. Escrowed access to source-code, in particular dates from some companies finding that pre-2000 they had expensive software with no source & nobody to check it or mod it for date compliance. So access to source is in the QA check-list. They are not interested in the source code, or getting into the software development business - they just want to tick the 'we are protected' box.

So we handed over our source to a 3rd party that we both agreed on & who seemed very professional in checking that they had all source & had certification for security. For one client that was over 5 years ago - the source is now woefully out of date & would have been difficult to build anyway (they would have to have the right compiler & 3rd party components) but we are still happily doing lots of business with the company, offering yearly upgrades for good money.
Grant Black Send private email
Friday, May 18, 2007
My software isn't really something that you would normally want to incorporate in other software.

So far out of 800 customers, only one has wanted to incorporate it in other software. They managed it without any problems.

If it was a library I can understand people wanting the source code, but it is not.

I can't say what it is (people Google`ing in the future) but it is a utility much like Winzip or Adobe Photoshop Elements. It is something lots of business could potentially need and for which there are at least 5 active competitors.

Do you use Winzip? I bet you use it at least once a month.

Do you use a graphics program?

Do you have the source code for any of these?


What happends if Adobe or WinZip go bust? Well you can continue using their software. Probably for the next 5 - 10 years before the next version of Windows breaks them too much (if at all).

What happens in 10 years time. Well you will have plenty of warning and it will be easy enough to get another company to provide the functionality as there are always competitors for compression utilities and graphics programs.

I don`t believe for my product there is a real need for escrow. I have a software product that is heads and shoulders above 4 of the competition and at least comparable to another one. Even if I go bankcrupt they can move on to another provider. The area is such there will be always another company offering a similar product.

If they had a real reason for escrow there should have described it to me rather than being obscure and not saying anything at all in their initial email other than a 30 pages of legal agreement.

What they are doing is suspicious.

Anyone that has been in business in a competitive area for 2 years will know there are the odd people out there that want to rip you off. For the first couple of times you might get fooled and afterwards you will go D`OH.
Friday, May 18, 2007
The Last Word

Thanks for the replies. I now know other people have been asked to escrow software and so that it is not usual.

However I will never escrow my software product. The fact is for the last 1.5 years and for the forseeable future, for the niche I am in I have found a way to write a software product that does things a much nicier way than most of my competition.

When someone does a Google search for my product about 5 other companies appear. The only reason I get sales is because my product is better than the other ones out there.

I am not saying this because I think I am great. I am saying this because I have unique knowledge just because of the work I have done in the past.

At the moment I`m getting several sales a day. I can`t risk this for one sale to one company. Even if they buy 20 copies of my software it is not worth it. I just have to wait a week or two and I`ll get another 20 sales.

If my product was library code releasing source code would be appropriate. But it is not.
Friday, May 18, 2007

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics
Powered by FogBugz