Comment by zenexer | Hacker News Reader

Comment by zenexer | Hacker News Reader

Parent Full thread

Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal?

Microsoft outright encourages this. From https://developer.microsoft.com/en-us/microsoft-edge/tools/v...:

Before installing, please note:

These virtual machines expire after 90 days. We recommend setting a snapshot when you first install the virtual machine which you can roll back to later.

Edit: Furthermore:

The Microsoft Software License Terms for the Microsoft Edge and IE VMs are included in the release notes[1] and supersede any conflicting Windows license terms included in the VMs. By downloading and using this software, you agree to these license terms.

[1]: https://az792536.vo.msecnd.net/vms/release_notes_license_ter...

From the license:

NO ACTIVATION. To prevent its unlicensed use, the software contains activation enforcement technology. Because the software is licensed for testing use only, you are not licensed to activate the software for any purpose even if it prompts you to do so.

Not only are you encouraged to use the software without paying for a license for testing purposes, you're outright forbidden from doing so.

Microsoft are allowed to do so in this case because they are the owners of the software - they can license the software they own under any terms they want. In this case though, I'm sure there will be terms that prevent you from offering the VMs as a service to others for a fee.

Microsoft are definitely not 'someone' in the sense OP intended.

I interpreted the analogy very differently.

Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal?

Here, I see "someone" as a security researcher, not someone who is reselling the VMs. The OP may have meant someone spinning them up to resell them to security researchers, but, given the ambiguity, I do think it's important to point out that you can spin up free Windows VMs for research purposes--you are explicitly licensed to do so.

If the analogy is taken literally, then the answer is: yes, it's legal as long as you're not reselling them.

> Microsoft outright encourages this

But MS does not encourage you to sell access to those unlicensed copies. Corellium's business model isn't security research, it's taking illegal copies and "renting" them out to people for money. And people go to them because it's convenient, not because there is no other legal way.

Of course there are key differences; however, the analogy provided by the OP doesn't really fit here.

Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal?

You can, in fact, legally spin up arbitrary Windows VMs for security research without a paid license.

If any comparison is to be made here, it should be between Apple's licensing and Microsoft's licensing:

* Microsoft will allow you to use Windows without paying for research purposes; Apple will not.

* Microsoft will allow you to run Windows on hardware purchased from a third party, or even hardware you've made yourself; Apple will not.

* Microsoft goes out of their way to facilitate research with the help of virtualization technology; Apple goes out of their way to impede it.

As a customer of both companies, Apple's approach here really rubs me the wrong way and definitely contributes to my unwillingness to completely embrace the Apple ecosystem.

To clarify, these are images that you have to download and host yourself. This isn’t a service offered by Microsoft; they’re providing the free license and tools, but you still have to have your own hardware to run the VM.

Reply on news.ycombinator.com