3rd Party Code Review / Attestation

[vwdan]

Morning morning. As I've mentioned before, I've got a small Plan B which consists of a small, cheap and shockingly niche piece of of software. It's probably not going to make me rich unless someone desperately wants to own the rights, but now I've written it it's money for old rope really. It only has a couple of competitors in what it does, and no competitors in how it does it - hence why it sells.

Although I've sold into some fairly large companies before, including a FTSE100 financial institution, for the most part it's been considered "off the shelf" software. They test it, pay for it and that's that - I don't tend to hear much more from them.

I've now got a foreign arm of a very very big insurance firm interested but they're asking for code attestation and verification. I, unsurprisingly, do not have such things....

Which is why I'm here. Anyone had a similar request? What's the protocol - is it reasonable to agree, but state it's at their cost. What if it fails and can't pass for [Reasons]? How do I protect myself and my code?

I'm just after some general advice on where to go before I respond so I don't look stupid. I've only actually been asked once before, but they just wanted me to send my code to a company they'd engage (I actually refused at that point because I was scared for my IP, but I think that was short sighted)

[europetractor]

Morning morning. As I've mentioned before, I've got a small Plan B which consists of a small, cheap and shockingly niche piece of of software. It's probably not going to make me rich unless someone desperately wants to own the rights, but now I've written it it's money for old rope really. It only has a couple of competitors in what it does, and no competitors in how it does it - hence why it sells.

Although I've sold into some fairly large companies before, including a FTSE100 financial institution, for the most part it's been considered "off the shelf" software. They test it, pay for it and that's that - I don't tend to hear much more from them.

I've now got a foreign arm of a very very big insurance firm interested but they're asking for code attestation and verification. I, unsurprisingly, do not have such things....

Which is why I'm here. Anyone had a similar request? What's the protocol - is it reasonable to agree, but state it's at their cost. What if it fails and can't pass for [Reasons]? How do I protect myself and my code?

I'm just after some general advice on where to go before I respond so I don't look stupid. I've only actually been asked once before, but they just wanted me to send my code to a company they'd engage (I actually refused at that point because I was scared for my IP, but I think that was short sighted)

Implement encrypted component with online verification whenever the app runs.

[vwdan]

Implement encrypted component with online verification whenever the app runs.

I think they're after paperwork, rather than an ongoing system. Either way, that can't happen because it needs to be able to work without internet connectivity and half of the software "ethos" is its fire and forget simplicity. It's all code signed so they can verify it's what I released, but I think they're after more than that.

[europetractor]

I think they're after paperwork, rather than an ongoing system. Either way, that can't happen because it needs to be able to work without internet connectivity and half of the software "ethos" is its fire and forget simplicity. It's all code signed so they can verify it's what I released, but I think they're after more than that.

Is all code uncompiled ? Add a compiled component that they cant break. You probably know better.

While code and ideas do get stolen, there is nothing to gain in not distributing your software.

[vwdan]

Is all code uncompiled ? Add a compiled component that they cant break. You probably know better.

While code and ideas do get stolen, there is nothing to gain in not distributing your software.

It's already distributed as compiled (Well, managed - .NET C#) - my issue is providing some kind of proof/evidence that it's safe.

[sal]

Could you tactfully prod the potential Client, as to which attesters are acceptable for them?