[anonymous_sorry]

The main benefit of using open source in a corporate environment is that there is usually zero paperwork involved. As long as the licence is approved, have at it! As soon as you pay money for something, either a fee or a donation, you've got to email someone. Almost certainly someone outside your team.

Companies don't make decisions on individual OSS dependencies. Individual engineers and engineering teams do. That's if anyone actually spares a thought at all (eek)!

[IshKebab]

This 1000%.

It's not my money. Why would I particularly care if we have to pay for some software?

But it is my time and effort. If I have to go through a lot of red tape and politics just to use some library then ... screw that. Doesn't matter how much it costs.

That's one of the reasons it generally makes no sense to offer enterprise software for a low cost. Even if it only costs $1, your users still have the red tape to deal with. You may as well make it cost $1k, so you actually make some money from the few users who fight the tape.

[pjmlp]

Only if they don't care about liability.

Those that care, CI/CD only fetches from internal repos, and stuff is only uploaded into them after an audit.

[FridgeSeal]

> Those that care, CI/CD only fetches from internal repos, and stuff is only uploaded into them after an audit.

It would be really interesting to do a survey about this, so that we can get some stats and breakdown by industry, language, size, etc about where this happens. I gather some places do this, but I’ve never met anyone, or worked anywhere that does this.

[bee_rider]

One way to not include any unaudited open source code is not to include any open source code!

I think when people point it out—that open source code is great, but comes with no strings attached and no guarantees, so you need to audit it to use it safely—they are often trying to say something about the ecosystem. That dependency growth is out of control. That it isn’t really as simple as git pulling the code in.

[pjmlp]

Relatively common in industries whose main purpose is not to sell software, and tend to have restrictions in place that fortunelly are coming to everyone via the cybersecurity bills of several governments.

[astrobe_]

Also proprietary software often is has protections (DRM/NDA/License keys) which add their own hassle.