4 ms·

I hope it does. Why are researchers doomed to make their own tools from scratch?

gjsman-1000 7y ago
Instead of just Apple though, think of a bigger picture here: Let's say someone ran a service to help you hack AirBNB. Legal? Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal? Let's say someone ran a service which helped you find bugs in anti-cheat software and run those bugs on your PC. Legal? Etc. It's tough.
- zenexer 7y ago
  Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal? Microsoft outright encourages this. From https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ https://developer.microsoft.com/en-us/microsoft-edge/tools/v...: Before installing, please note: These virtual machines expire after 90 days. We recommend setting a snapshot when you first install the virtual machine which you can roll back to later. Edit: Furthermore: The Microsoft Software License Terms for the Microsoft Edge and IE VMs are included in the release notes[1] and supersede any conflicting Windows license terms included in the VMs. By downloading and using this software, you agree to these license terms. [1]: https://az792536.vo.msecnd.net/vms/release_notes_license_terms_8_1_15.pdf https://az792536.vo.msecnd.net/vms/release_notes_license_ter... From the license: NO ACTIVATION. To prevent its unlicensed use, the software contains activation enforcement technology. Because the software is licensed for testing use only, you are not licensed to activate the software for any purpose even if it prompts you to do so. Not only are you encouraged to use the software without paying for a license for testing purposes, you're outright forbidden from doing so.
  - mhw 7y ago
    Microsoft are allowed to do so in this case because they are the owners of the software - they can license the software they own under any terms they want. In this case though, I'm sure there will be terms that prevent you from offering the VMs as a service to others for a fee. Microsoft are definitely not 'someone' in the sense OP intended.
    - zenexer 7y ago
      I interpreted the analogy very differently. Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal? Here, I see "someone" as a security researcher, not someone who is reselling the VMs. The OP may have meant someone spinning them up to resell them to security researchers, but, given the ambiguity, I do think it's important to point out that you can spin up free Windows VMs for research purposes--you are explicitly licensed to do so. If the analogy is taken literally, then the answer is: yes, it's legal as long as you're not reselling them.
  - close04 7y ago
    > Microsoft outright encourages this But MS does not encourage you to sell access to those unlicensed copies. Corellium's business model isn't security research, it's taking illegal copies and "renting" them out to people for money. And people go to them because it's convenient, not because there is no other legal way.
    - zenexer 7y ago
      Of course there are key differences; however, the analogy provided by the OP doesn't really fit here. Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal? You can, in fact, legally spin up arbitrary Windows VMs for security research without a paid license. If any comparison is to be made here, it should be between Apple's licensing and Microsoft's licensing: * Microsoft will allow you to use Windows without paying for research purposes; Apple will not. * Microsoft will allow you to run Windows on hardware purchased from a third party, or even hardware you've made yourself; Apple will not. * Microsoft goes out of their way to facilitate research with the help of virtualization technology; Apple goes out of their way to impede it. As a customer of both companies, Apple's approach here really rubs me the wrong way and definitely contributes to my unwillingness to completely embrace the Apple ecosystem.
  - zenexer 7y ago
    To clarify, these are images that you have to download and host yourself. This isn’t a service offered by Microsoft; they’re providing the free license and tools, but you still have to have your own hardware to run the VM.
- gjsman-1000 7y ago
  @zenexer Those expire after 90 days. You are doing it within Microsoft's boundaries. Now imagine circumventing Microsoft's boundaries and the 90 day limitation for convenience.
  - zenexer 7y ago
    It explicitly encourages you to circumvent it so you can run it for more than 90 days. Edit: To be clear, this part: These virtual machines expire after 90 days. We recommend setting a snapshot when you first install the virtual machine which you can roll back to later. If you set a snapshot and roll back to it later, you get another 90 days. Rinse and repeat.
    - 0x0 7y ago
      Using snapshots to roll back and lose 89 days of work/system changes is quite an inconvenience though. Circumventing the need for snapshots/rollbacks is still not ok
      - zenexer 7y ago
        Well, the need to take a snapshot--or rather, the activation issue--is described at one point in the license as a "bug". It's a little confusing, but from talking to the maintainer of the VMs on GitHub, it sounds as though they just don't want to dedicate time to "fixing" the activation system. The workaround is to take snapshots. There are actually instructions on the repo for extending the trial without reverting to a snapshot, if I recall correctly, but it's been a while since I've looked into it.
    - close04 7y ago
      You are completely missing the point with your example and it's in no way similar to what's happening here. Free to use and free to sell are completely different concepts. Just because someone gave you the right to use for free something that belongs to them doesn't mean you are allowed to sell that right or that "something", or even pass it on for free.
mlindner 7y ago
They're not doomed to make their own tools from scratch. If researchers set up open source tools on how to spin up their own VM on their own system that's an entirely different situation.
lokedhs 7y ago
Isn't this exactly the same restrictions that IBM imposes on licensees of the z/OS operating system? You can run z/OS just fine on Hercules (mainframe emulator) but IBM does not allow it, and for this reason no one does it. Given the potential profit in providing emulated z/OS hardware, the fact that no one provides this is quite telling.
- pankajdoharey 7y ago
  Well no one can make illegal copies of Windows, its the same with iOS.
- Aloha 7y ago
  Lots of folks do it, no one is tries to make money off of it (or at least stops trying after the initial letters from IBM legal arrives). Hercules is an interesting case because it's widely rumored to be used inside IBM to run modern System Z releases. In this case however the company in question isn't just making and selling an emulator you can run iOS on, its selling hosted iOS as a service, which is a clear license violation - just making the emulator and instructions for use available for sale would be quite legal.
  - fragmede 7y ago
    The Psystar case (or at least, my read of Apple's opinion of that situation), implies that Apple (circa early 2000s) considers making such an emulator available would not legal.
    - Aloha 7y ago
      The issue with the Psystar people was they were selling configured systems loaded with software, not a kit the end user would assemble themselves.

Instead of just Apple though, think of a bigger picture here: Let's say someone ran a service to help you hack AirBNB. Legal? Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal? Let's say someone ran a service which helped you find bugs in anti-cheat software and run those bugs on your PC. Legal? Etc. It's tough.

zenexer 7y ago
Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal? Microsoft outright encourages this. From https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ https://developer.microsoft.com/en-us/microsoft-edge/tools/v...: Before installing, please note: These virtual machines expire after 90 days. We recommend setting a snapshot when you first install the virtual machine which you can roll back to later. Edit: Furthermore: The Microsoft Software License Terms for the Microsoft Edge and IE VMs are included in the release notes[1] and supersede any conflicting Windows license terms included in the VMs. By downloading and using this software, you agree to these license terms. [1]: https://az792536.vo.msecnd.net/vms/release_notes_license_terms_8_1_15.pdf https://az792536.vo.msecnd.net/vms/release_notes_license_ter... From the license: NO ACTIVATION. To prevent its unlicensed use, the software contains activation enforcement technology. Because the software is licensed for testing use only, you are not licensed to activate the software for any purpose even if it prompts you to do so. Not only are you encouraged to use the software without paying for a license for testing purposes, you're outright forbidden from doing so.
- mhw 7y ago
  Microsoft are allowed to do so in this case because they are the owners of the software - they can license the software they own under any terms they want. In this case though, I'm sure there will be terms that prevent you from offering the VMs as a service to others for a fee. Microsoft are definitely not 'someone' in the sense OP intended.
  - zenexer 7y ago
    I interpreted the analogy very differently. Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal? Here, I see "someone" as a security researcher, not someone who is reselling the VMs. The OP may have meant someone spinning them up to resell them to security researchers, but, given the ambiguity, I do think it's important to point out that you can spin up free Windows VMs for research purposes--you are explicitly licensed to do so. If the analogy is taken literally, then the answer is: yes, it's legal as long as you're not reselling them.
- close04 7y ago
  > Microsoft outright encourages this But MS does not encourage you to sell access to those unlicensed copies. Corellium's business model isn't security research, it's taking illegal copies and "renting" them out to people for money. And people go to them because it's convenient, not because there is no other legal way.
  - zenexer 7y ago
    Of course there are key differences; however, the analogy provided by the OP doesn't really fit here. Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal? You can, in fact, legally spin up arbitrary Windows VMs for security research without a paid license. If any comparison is to be made here, it should be between Apple's licensing and Microsoft's licensing: * Microsoft will allow you to use Windows without paying for research purposes; Apple will not. * Microsoft will allow you to run Windows on hardware purchased from a third party, or even hardware you've made yourself; Apple will not. * Microsoft goes out of their way to facilitate research with the help of virtualization technology; Apple goes out of their way to impede it. As a customer of both companies, Apple's approach here really rubs me the wrong way and definitely contributes to my unwillingness to completely embrace the Apple ecosystem.
- zenexer 7y ago
  To clarify, these are images that you have to download and host yourself. This isn’t a service offered by Microsoft; they’re providing the free license and tools, but you still have to have your own hardware to run the VM.
gjsman-1000 7y ago
@zenexer Those expire after 90 days. You are doing it within Microsoft's boundaries. Now imagine circumventing Microsoft's boundaries and the 90 day limitation for convenience.
- zenexer 7y ago
  It explicitly encourages you to circumvent it so you can run it for more than 90 days. Edit: To be clear, this part: These virtual machines expire after 90 days. We recommend setting a snapshot when you first install the virtual machine which you can roll back to later. If you set a snapshot and roll back to it later, you get another 90 days. Rinse and repeat.
  - 0x0 7y ago
    Using snapshots to roll back and lose 89 days of work/system changes is quite an inconvenience though. Circumventing the need for snapshots/rollbacks is still not ok
    - zenexer 7y ago
      Well, the need to take a snapshot--or rather, the activation issue--is described at one point in the license as a "bug". It's a little confusing, but from talking to the maintainer of the VMs on GitHub, it sounds as though they just don't want to dedicate time to "fixing" the activation system. The workaround is to take snapshots. There are actually instructions on the repo for extending the trial without reverting to a snapshot, if I recall correctly, but it's been a while since I've looked into it.
  - close04 7y ago
    You are completely missing the point with your example and it's in no way similar to what's happening here. Free to use and free to sell are completely different concepts. Just because someone gave you the right to use for free something that belongs to them doesn't mean you are allowed to sell that right or that "something", or even pass it on for free.

mlindner 7y ago

They're not doomed to make their own tools from scratch. If researchers set up open source tools on how to spin up their own VM on their own system that's an entirely different situation.

lokedhs 7y ago

Isn't this exactly the same restrictions that IBM imposes on licensees of the z/OS operating system? You can run z/OS just fine on Hercules (mainframe emulator) but IBM does not allow it, and for this reason no one does it. Given the potential profit in providing emulated z/OS hardware, the fact that no one provides this is quite telling.

pankajdoharey 7y ago
Well no one can make illegal copies of Windows, its the same with iOS.
Aloha 7y ago
Lots of folks do it, no one is tries to make money off of it (or at least stops trying after the initial letters from IBM legal arrives). Hercules is an interesting case because it's widely rumored to be used inside IBM to run modern System Z releases. In this case however the company in question isn't just making and selling an emulator you can run iOS on, its selling hosted iOS as a service, which is a clear license violation - just making the emulator and instructions for use available for sale would be quite legal.
- fragmede 7y ago
  The Psystar case (or at least, my read of Apple's opinion of that situation), implies that Apple (circa early 2000s) considers making such an emulator available would not legal.
  - Aloha 7y ago
    The issue with the Psystar people was they were selling configured systems loaded with software, not a kit the end user would assemble themselves.