SOX is about Financial Controls Not IP and copyright law.

Posted Jan 20, 2006 16:32 UTC (Fri) by Spike (guest, #14160)
Parent article: A new FUD angle: securities laws

This is such a joke. "Even if an executive thinks the company is complying, s/he may still be breaking the law if adequate control measures are not in place. What that means is unclear - but, at a minimum, it requires a lawyer." This alone says We're spreading FUD cause we have no real idea what SOX is about. I work in corp. IT and we are working on SOX compliance. The key to SOX compliance as we have been told is providing "control Practices" that make changes to Accounting/Financial data have an audit trail. Some Examples are.

Who logged in with what ID when.

Who updated what data in the ERP system.

Were changes properly authorized ....etc

All around proper accounting practices. One could easily comply with SOX and not the GPL or vise versa because one is a proper use license and the other is Corp. Financial Law. Possibly related in some ways but, certainly not directly. This is total bunk.

SOX is about Financial Controls Not IP and copyright law.

Posted Jan 20, 2006 17:17 UTC (Fri) by Ross (guest, #4065) [Link] (1 responses)

I also work in IT security. The other major flaw in this paper is that most of the supposed "GPL" problems are actually issues which would happen any time license violations occur. If that's their primary worry, they should only use and write software in the public domain.

SOX is about Financial Controls Not IP and copyright law.

Posted Jan 20, 2006 22:14 UTC (Fri) by gdt (subscriber, #6284) [Link]

Even that's not safe. You could still be in trouble for misrepresenting the origin of the source code -- saying "we wrote it" when someone else did.

The bottom line is that companies need to trust their programmers to do what they are paid for. This is hardly unique to programming and it why dishonest people are such a nightmare to employ. It is also why companies have audit procedures. We are seeing the beginning of audit procedures for source code -- simply reflecting the maturation of business use of computer programming.

And just like in other audit fields, there are companies that are willing to mis-state or exagerate the risks to promote their products.