Hacker News Reader

Comment by josh_fyi | Hacker News Reader

IBM products have no license-checking built in, on purpose. They want you to make more copies than your negotiated license agreement allows. Then, when the auditor comes in, they charge you the sky-high list price, backdating it as well.

View on HN

I have some employees in India and apparently, Adobe does this there. They will just randomly show up and ask to look at all your systems and see if you are using pirated Adobe products.

I have no idea what the laws are there, but the companies they show up at don't even necessarily have any license with Adobe. I can't imagine that is legal in India, but apparently it happens unabetted.

welcome to licensing by companies in the Business Software Aliance:

notorious for using disgruntled former employees for starting audits. (they did to my friends company a decade ago and found nothing..)

https://en.wikipedia.org/wiki/BSA_(The_Software_Alliance)

lots of major companies: (apple/adobe....)

https://www.bsa.org/membership

The trick? They tell to fuck off and file a lawsuit if they want to audit. They back off. Unless the former employee has actual proof other than a statement they won't bother.

That trick does not work in countries where they come along with the police department responsible for checking if business activities are in accordance with the law.

Here is the Portuguese variant of such police department.

https://www.asae.gov.pt/cooperacao-nacional-e-internacional/...

It is legal in many countries, because usually there is a police department that validates business activities are following the law as they should, and they tend to come along with a couple of officers.

But RedHat is painfully license driven. So much so, that even if you pay for RH, you would be tempted to use CentOS just to avoid the annoying tooling and infrastructure that RH has built to do license checks.

That's a little over-cynical, IMHO. They don't have licensing in the products because it's an overhead, it complicates development, and their enterprise customers are supposed to be trustworthy and in communication with IBM about ongoing requirements.

But yes, they have auditors to enforce this stuff.

Not exactly. Keep in mind the people using the products in a large enterprise are not, generally, the people who have to pay for it. If you break these two people into their respective, high level, org groups it will generally be: procurement and engineering.

IMO it's not that the engineering group is trying to not be trustworthy. It's that they have a job to do and IBM knows that this is their goal. So if we let engineering do their job, uninhibited, then there's a high chance that if the product is useful to do that they'll keep expanding it's reach internally (land and expand). This is just a slightly different spin on how the vendor allows the end user client to use their product. It's very likely the agreement between IBM and the enterprise client clearly spells this out. However, since the client is bound to pay for overages in arrears they are now at the mercy of not having as much leverage in price negotiations. A smart customer will predefine usage level bands as it pertains to discounts. For example if we're using 10k seats of RHEL we get 10% off list, 20k seats @ 20%, etc.

The disconnect is that procurement is likely disconnected from engineering for the better part between audits and they're not well prepared to have the after-the-fact negotiation to true up licensing. IBM, and others, bank on this by selling the value the customer is receiving from said products in use. The disconnect here is that had IBM enforced hard license limits the organization may say that the product is too expensive and look for an alternative because the customer is forced to buy more licensing mid-budget cycle. It's harder to rip out or change 20k installations of RHEL than it is 10k. Vendors know this and leverage this consequence of using this approach to keep the customer on the ball and chain.

So we have an enterprise that doesn't plan or communicate with itself very well and a vendor who puts out the all you can eat buffet to the hungry engineers. It's not technically wrong, and if an enterprise gets burned by it technically it's their own fault. Is it by design? For sure and my guess is that this type of model pays dividends all while being on the up and up.

> The disconnect here is that had IBM enforced hard license limits the organization may say that the product is too expensive and look for an alternative because the customer is forced to buy more licensing mid-budget cycle.

Also, things can go wrong with automated license enforcement, and at large enterprise scale, that would be costly to the customer (and therefore IBM as they'd be summarily replaced). I can already imagine the HN headlines: "Flights grounded due to BGP mishap knocking IBMs license servers offline", "HDD failure costs $CORP $8.6M/day after IBM DRM prevents installation of replacement cluster"

Most enterprise products today have a grace period when they enforce licensing (soft vs hard). So if a licensing server is unavailable it will start into a countdown mode of days, weeks etc before the product changes it's state for this exact reason. On the flip side most licensing servers will alert when check-ins go offline for two, general, situations: operational product that become isolated (your example) or decommissioned environments.

I don't know of any large scale products that don't approach it like this today simply because the vendor doesn't want to be responsible. I'm sure some smaller products might do this, that is until they lose a customer over one of those bad situations where a customer is trying to renew a contract and they get cut off before the PO clears the backend on the vendor side.

But agreed, automated licensing does have it's fair share of pitfalls. Then again, it's like taxes. You should know, at any point in time, where you stand over the course of a year as it pertains to your over/under. The old school manual audits seem to be kept in place to keep the overages out of sight.

On the enterprise software I worked on, when you wanted to roll out more you tended to involve IBM to help you plan it anyway, so this whole argument is moot for much of what they do.

Too expensive "overhead" for IBM to develop? So rather, they employ 1000s of humans for the work? The math don't check out for me

I didn't say too expensive, I said it's an overhead, which it is. They have hundreds of thousands of people working for them, a few auditors is a drop in the ocean compared to making every software engineer cater for licensing.

The exact same technique is used by Oracle.

Yes. And look at how they operate every company they buy. This will end poorly for everyone at RedHat except their auditors.

What if... you don’t let them inside?

IBM would take you to court for breach of contract.

Most likely they'd be violating their contract.

Ah, reminds me of Oracle.

A common conspiracy theory floated at a previous dayjob was that Oracle does no license checking because you're not going to get far into the operation and maintenance without Oracle DBAs/engineers around anyways.

After seeing how clunky some of the tooling is (sqlplus is downright byzantine for no good reason), I have to wonder...

I agree & I add:

- some components of their EPM-software-suite have miserable error/warning/info messages (cryptic, misleading, etc) or even no message at all (making you erroneously think that doing something went well even if it did not).

- opening a "service request" (a support ticket) with Oracle when you have a real technical problem that needs active digging by them is often something that might make you regret having chosen IT as your work area.

Compared to that, once I'm done working and I go back home and start using Linux apps and/or submitting questions&bugs on github/linuxquestions/stackoverflow/etc and getting relatively good replies within minutes I get the feeling that I'm living in the year 3000 :)

Yeah, thought I heard Oracle's install media let's you install just about anything, regardless of license, for the same reasons.

This is not my experience. I didn't have to set up the satellite server, so maybe that's a pain, but it only has to happen once. Then it's one command on each client to register it with the satellite.

I worked in a shop that had something like this happen with Oracle. They audited is and hit us will a $1 million bill. This was a huge bill for the fairly small shop. People had to be let go.

Reply on news.ycombinator.com