Hacker News Reader

Comment by blazespin | Hacker News Reader

I hope it does. Why are researchers doomed to make their own tools from scratch?

They're not doomed to make their own tools from scratch. If researchers set up open source tools on how to spin up their own VM on their own system that's an entirely different situation.

Isn't this exactly the same restrictions that IBM imposes on licensees of the z/OS operating system?

You can run z/OS just fine on Hercules (mainframe emulator) but IBM does not allow it, and for this reason no one does it.

Given the potential profit in providing emulated z/OS hardware, the fact that no one provides this is quite telling.

Well no one can make illegal copies of Windows, its the same with iOS.

Lots of folks do it, no one is tries to make money off of it (or at least stops trying after the initial letters from IBM legal arrives).

Hercules is an interesting case because it's widely rumored to be used inside IBM to run modern System Z releases.

In this case however the company in question isn't just making and selling an emulator you can run iOS on, its selling hosted iOS as a service, which is a clear license violation - just making the emulator and instructions for use available for sale would be quite legal.

The Psystar case (or at least, my read of Apple's opinion of that situation), implies that Apple (circa early 2000s) considers making such an emulator available would not legal.

The issue with the Psystar people was they were selling configured systems loaded with software, not a kit the end user would assemble themselves.

Instead of just Apple though, think of a bigger picture here:

Let's say someone ran a service to help you hack AirBNB. Legal?

Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal?

Let's say someone ran a service which helped you find bugs in anti-cheat software and run those bugs on your PC. Legal?

Etc. It's tough.

Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal?

Microsoft outright encourages this. From https://developer.microsoft.com/en-us/microsoft-edge/tools/v...:

Before installing, please note:

These virtual machines expire after 90 days. We recommend setting a snapshot when you first install the virtual machine which you can roll back to later.

Edit: Furthermore:

The Microsoft Software License Terms for the Microsoft Edge and IE VMs are included in the release notes[1] and supersede any conflicting Windows license terms included in the VMs. By downloading and using this software, you agree to these license terms.

[1]: https://az792536.vo.msecnd.net/vms/release_notes_license_ter...

From the license:

NO ACTIVATION. To prevent its unlicensed use, the software contains activation enforcement technology. Because the software is licensed for testing use only, you are not licensed to activate the software for any purpose even if it prompts you to do so.

Not only are you encouraged to use the software without paying for a license for testing purposes, you're outright forbidden from doing so.

Microsoft are allowed to do so in this case because they are the owners of the software - they can license the software they own under any terms they want. In this case though, I'm sure there will be terms that prevent you from offering the VMs as a service to others for a fee.

Microsoft are definitely not 'someone' in the sense OP intended.

I interpreted the analogy very differently.

Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal?

Here, I see "someone" as a security researcher, not someone who is reselling the VMs. The OP may have meant someone spinning them up to resell them to security researchers, but, given the ambiguity, I do think it's important to point out that you can spin up free Windows VMs for research purposes--you are explicitly licensed to do so.

If the analogy is taken literally, then the answer is: yes, it's legal as long as you're not reselling them.

> Microsoft outright encourages this

But MS does not encourage you to sell access to those unlicensed copies. Corellium's business model isn't security research, it's taking illegal copies and "renting" them out to people for money. And people go to them because it's convenient, not because there is no other legal way.

Of course there are key differences; however, the analogy provided by the OP doesn't really fit here.

Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal?

You can, in fact, legally spin up arbitrary Windows VMs for security research without a paid license.

If any comparison is to be made here, it should be between Apple's licensing and Microsoft's licensing:

* Microsoft will allow you to use Windows without paying for research purposes; Apple will not.

* Microsoft will allow you to run Windows on hardware purchased from a third party, or even hardware you've made yourself; Apple will not.

* Microsoft goes out of their way to facilitate research with the help of virtualization technology; Apple goes out of their way to impede it.

As a customer of both companies, Apple's approach here really rubs me the wrong way and definitely contributes to my unwillingness to completely embrace the Apple ecosystem.

To clarify, these are images that you have to download and host yourself. This isn’t a service offered by Microsoft; they’re providing the free license and tools, but you still have to have your own hardware to run the VM.

@zenexer Those expire after 90 days. You are doing it within Microsoft's boundaries. Now imagine circumventing Microsoft's boundaries and the 90 day limitation for convenience.

It explicitly encourages you to circumvent it so you can run it for more than 90 days.

Edit: To be clear, this part:

These virtual machines expire after 90 days. We recommend setting a snapshot when you first install the virtual machine which you can roll back to later.

If you set a snapshot and roll back to it later, you get another 90 days. Rinse and repeat.

Using snapshots to roll back and lose 89 days of work/system changes is quite an inconvenience though. Circumventing the need for snapshots/rollbacks is still not ok

Well, the need to take a snapshot--or rather, the activation issue--is described at one point in the license as a "bug". It's a little confusing, but from talking to the maintainer of the VMs on GitHub, it sounds as though they just don't want to dedicate time to "fixing" the activation system. The workaround is to take snapshots. There are actually instructions on the repo for extending the trial without reverting to a snapshot, if I recall correctly, but it's been a while since I've looked into it.

You are completely missing the point with your example and it's in no way similar to what's happening here. Free to use and free to sell are completely different concepts.

Just because someone gave you the right to use for free something that belongs to them doesn't mean you are allowed to sell that right or that "something", or even pass it on for free.

I'm countering the analogy, not the case of Corellium. You're right: the analogy used here misses the point; it's not the same as what Corellium was doing.

The analogy is harmful because it implies that it's unreasonable to expect that like Microsoft and Apple would allow their software to be used for free for research purposes; it doesn't mention resale of the software. I don't see that as an unreasonable expectation; Microsoft does it without issue.

Edit: Just to be clear, Microsoft is not offering these VMs as a service. You are required to download the image and run it yourself. It’s basically just a license to use Windows for free as long as it’s for a specific kind of research.

It's a rolling 90 days...

Reply on news.ycombinator.com