Hacker News Reader

Comment by dijit | Hacker News Reader

I have long since believed this to be legal, though I'd like to understand if it is.

Effectively: Software mechanisms are not the litmus of legality, as if you buy a working key, it may not be legal to use since there are country restrictions.

So I would surmise the opposite stance: if you have a license sitting on a shelf and you "assign" it to a system; using a keygen at that point is fine, since you do own a license and you are not oversubscribing it.

IANAL, but one or the other must be true.

View on HN

I have heard/read that should be audited by Microsoft or any of the other large software houses that do that, they don't care for any certificate of authenticity or license keys, or anything.

They want to see a valid purchase order for the SKU of the license.

So, I think using a keygen might raise some red flags if the auditing software reports back the key even if it's the same SKU you paid for (and it had better be) but the proof of a paid order is what determines if you are licensed.

I've experienced multiple MSFT compliance audits at small business Customers in the 2004-2020 timeframe. MSFT only ever cared about reconciling what was in use with what was paid-for. I've been asked for photos of OEM key stickers attached to hardware but never asked to retrieve keys from installed software.

I assume keys are another facet of keeping specific details around licenses vague enough that there's always room for MSFT to argue or bargain.

My experience was similar at a medium size business. We had reusable keys that we used as needed. Once a year, we would run their audit tool and pay the difference.

I never got the impression they cared where the keys came from. We knew exactly when they were coming every year. They were easy to deal with and I don’t recall ever having any issues.

We also had an ELA with VMware and they were awful. We only stuck with them because the software fulfilled a need. They treat you like dirt during the sale and every renewal. In between, they act as if they’re the ones doing you a favor by allowing you to be a customer. The support was terrible.

But oddly enough, they always gave us more licenses than we paid for. Every time, they would throw in products we didn’t purchase and weren’t cheap about it either. It was always like 100+ seats and one time it was 1000.

I worked at enterprise software companies, and I have seen them usually give 25% “buffer” where software keys restrict usage to account for growth, with a reconciliation at renewal.

> MSFT only ever cared about reconciling what was in use with what was paid-for. I've been asked for photos of OEM key stickers attached to hardware but never asked to retrieve keys from installed software.

If I recall correctly, CALs don't really get 'installed', so my guess is that going off of 'provable licenses' keeps the audit process more uniform and streamlined.

So if you're using the same SKU(s) and are not oversubscribed, it should still be fine shouldn't it? If you buy SKU A and get Key 1, then use keygen to get Key 2 which is for SKU A, I'm not seeing where the audit will come back against you as long as you're only using one instance of SKU A.

I thing the biggest risk with this comes from the DMCA, a stupidly heavy-handed piece of legislation that doesn't care at all about the consumers.

Certainly an interesting one.

IANAL, but I believe the terms of the purchased license would be to use the product with only the license key provided. Therefore using an alternative key would be a breach of the license terms, meaning you're using unlicensed software and subject to all relevant laws.

I can see an argument that the vendor is in breach of contract by failing to provide a valid key with the license, and therefore the contract is void and the vendor should refund.

And yet again, I can see an argument that the license has been paid for, and a different key is used in the interim to access the paid for software, therefore no loss has occurred to either party rendering the whole argument moot.

Would be interested to know if this has been tested in the court system.

Depending on jurisdiction there may be rules or case law related to re-engineering and patching of purchased software to keep it working. This is again a reminder how important the right to repair is.

It’s only a problem if you want to maintain support. If you’re ready to sever your Broadcom relationship, keygen away. I am not a lawyer, and am probably wrong.

> but one or the other must be true.

they are neither mutually exclusive, nor even related.

You have a key that opens a door to a house you dont own. Do you have permission, just because you got a key, to go in?

You lost a key to a house you have already been given permission to go in. You found out that there's actually a master key that you can get in the black market, which you buy to open that door to go into the house.

Alternatively: I lost the key to my home (which is rented) and someone is able to fashion a functioning key.

That's actually legal.

Reply on news.ycombinator.com