Hacker News Reader

Hacker News

Comment by MuffinFlavored | Hacker News Reader

Parent Full thread

MuffinFlavored

if it's on-prem, can't you just edit it to not phone home?

View on HN

You wouldn't need to.

JIRA Server licenses are perpetual. You only pay if you want upgrades.

I've seen companies running JIRA from 2009.

1. You'd be violating a contract by doing so, and putting yourself/company at risk of incurring significant monetary damages specified in the contract (or having your license terminated);

2. You might be committing criminal copyright violation;

3. The most obvious countermeasure is to write something to detect whether the software stops phoning home and use it to trigger an investigation.

Securing server internet access using outbound firewall can easily stop calling home without modifying the code or affecting any valid licence terms.

Without knowing the license terms, it’s impossible to say either way.

You'd need to reverse-engineer the built java files, which probably isn't so easy and that a company will do this

Can’t you just firewall it? I imagine you’d lose support though.

Depends on what kind of check it's doing. I doubt it fails open and if it does you're violating the license and open to big damages from Atlassian.

I imagine reverse engineering it to not phone home would violate the license in the same way.

Yeah I meant even if it does fail open such that you could hack it to keep using it, doing so would definitely violate the license.

Not for a company, just for my own testing, but I did this several years back.

It was ridiculously easy assuming you know how a java decompiler works. One JAR needed to be patched and re-compiled, which is a trivial process if you know how classpaths work.

You don't even need to patch any files - you can patch classes at runtime using a "-javaagent" library.

There are plenty of libraries out there to facilitate this such as Javassist or Apache BCEL, and lots of legitimate uses (AOP, instrumentation, etc).

It'd be weird to have access to the command line but not to the jars themselves, I think. Creating a jar is simple if you have a zip program.

Reply on news.ycombinator.com