Open Source Compliance Insurance - more evidence of maturing market
I found this very interesting indeed.
Basically the insurance company will underwrite you and cover various types of 'direct loss' if/when you pass their compliance audit. From the article;
The team comes in and makes sure you are not currently in violation of the licenses of FOSS your company is using then provides coverage if you pass (and I would guess would give you points on how to pass if you currently don't). This makes me wonder what happens over time. Would something like Black Duck provide the on-going protection to keep your code in complainace? Not sure what the insurance company would require for the ongoing nature of development and the possibility of violations sneaking in. Later in the article though it says to get $10M worth of coverage will cost about $200K per year. Perhaps at that rate the insurance company could afford to send in someone from time to time to do a follow on assessment.
I'm not sure how I feel about insurance though. With insurance comes lawyers and with lawyers comes complexity. It will be interesting to see how many takers this type of insurance has.
