but [link|http://www.palamida.com|http://www.palamida.com] is a company that makes a tool that audits your source code and identifies open source components and tells you your exposure to various licenses.

The company is most of the same people I worked for prior to leaving for France. The problem they've chosen to solve seems important to them because their CTO (I'll call him bob) and their lead developer nearly sank the previous company (it sank for different reasons in the end) because they couldn't stop downloading crap from jakarta.apache.org and adding it to the product (or gnu, or whatever). In other words, they think this is a problem because they constantly create it wherever they go. I worked quite hard to keep them in line but it was a full time battle.

To complicate matters even more, there was a fairly clueless project manager who thought Bob walked on water because he got stuff done. It was always the wrong stuff but Bob was incredibly industrious. He can crank vast volumes of pointless code encumbered by dependencies on software with licenses we can't live with in no time at all.

I reckon the new venture will fold now that you can buy insurance to cover suits for misuse of open source software. Furthermore, it only takes a bit of discipline and clarity of thought to avoid the problem in the first place.

Anyhow, there's one example. I have many more. Successful people must be well rounded and possess decent inter-personal skills to make it. The top software companies are largely built around vision sharing and self organizing teams. If you can't think outside the box (computer), we don't need you.

Consider it from the point of view of the client. If I think I may have a problem, then I have two options - take on the risk myself and do an internal audit, or spend money on a tool to automate the audit. Neither is free.

Am I safe? Not necessarily. The tool could be buggy or my auditors could miss the problem. Given that this is something I've decided to throw money at, I could just write a check to the insurance company. Now I *know* I'm safe because I have a contract with someone who will guarantee that this won't come back to bite me.

It took no time or effort apart from writing a check.

Taking insurance company out of it, I don't know much about blackduck, but I'd bet against my former co-workers if they were faced with any remotely capable company.