12 ms·

Ground control to Major Trial

526 points by plam503711 1y ago

phkahler 1y ago
Dude, quit whining in a blog post and change your policy. Make it per-org instead of per-email. Heck, carve out an exception to block that particular org.
rvz 1y ago
Solution: Have the courage to get rid of the free trial. Job done.
deleted 1y ago
[deleted]
IshKebab 1y ago
I wonder if you can sue for breach of contract or something. Maybe not worth it... I would consider adding some actual limitations into the free trial rather than just time.
- matsemann 1y ago
  Was thinking the same. If you clearly are only meant to have access for X days, and abuse a loophole to continue indefinitely, how is that far removed from hacking/scamming/stealing/pickyourpoison?
EDEdDNEdDYFaN 1y ago
Isn't this a failure by the company to recognize free trial abuse sooner? and to not close the loophole immediately seems like even more of a weak behavior. Calling them out but not taking decisive action beyond claiming that they are acting immorally ultimately accomplishes nothing. Businesses are not beholden to your ideas about what is nice and fair, but whatever the rules and constraints are to your system. if you keep a practice like this that allows free trial abuse forever, why would they spend money?
- plam503711 1y ago
  You're absolutely right that businesses act within whatever constraints exist — and yes, we were a bit naive. We assumed that if someone had a fully functional, free, open source version available (well-documented and easy to install), nobody sane would go out of their way to abuse the trial system instead. To be clear, it’s not just trial abuse — it’s actively ignoring the better, freer option in favor of repeatedly faking evaluations just to get the “easy mode.” We’ll definitely tighten things up going forward. But in nearly a decade of doing this, they're the only ones to push it to this scale. So yeah, they've earned a spot in our open source hall of shame
  - EDEdDNEdDYFaN 1y ago
    To be fair to them - they've been doing it for 10 years without a problem!
  - russfink 1y ago
    Yes. Your pain point is the level of support you are giving on good faith to these charlatans. Maybe add a clause to your license that you reserve the right to limit the amount of technical assistance on the free download. Outside of that, if I understand this matter correctly, most of your customers are honest and you’re willing to write off this one company in the interest of keeping your own corporate sanity.
  - Propelloni 1y ago
    Ignoring an OSS option is not the crux of the issue, it only adds more stupid to the cake. They don't deserve a place on the OSS hall of shame, but on the list of shysters and fraudsters. A company is exploiting your free-trial offer, defrauding your project of resources even if it is only a buck and a half. Why are you sending them money? Just shut them down. Unless you have some really unfortunate wording in your TOS, there is nothing they can do. On Monday, send an e-mail to all accounts associated with $COMPANY and tell them in clear terms that you are going to terminate their free-trials COB EOW. Leave a special contact number to negotiate fees, wait for your phone to ring. Seriously, why are you putting up with this?
- 1y ago
matt-p 1y ago
I think the most depressing thing is how unsurprising this is. This is why free trials require credit cards upfront, as they're more difficult to fake, not because you're about to be stealth billed. It's thanks to people like this.
- rocketvole 1y ago
  it's practically trivial to bypass this if you really want to. CapitalOne in the US allows you to have virtual cards that can be verified but you can delete and block at any time for free if you have a credit card from them. I'm sure the practice discourages casuals from gaming trials, but it just feels like it's making life miserable for paying customers but doing almost nothing to stop bad actors
  - TechDebtDevin 1y ago
    privacy.com
  - sumanthvepa 1y ago
    Those types of card numbers are detectable though.
    - hiatus 1y ago
      How? Based on issuer identification number?
      - c12 1y ago
        I'm pretty sure it can be done via the IIN. Services like https://binlist.net/ https://binlist.net/ provide a convenient solution to identify if it's a prepaid card.
        deleted 1y ago
        [deleted]
      - 1y ago
Meneth 1y ago
Around 130$ million yearly revenue? Matches RocketLab. https://www.nzherald.co.nz/business/companies/rocket-lab-revenue-slips-7-as-space-company-expands-american-defence-efforts/IZVPTOFFDRHXFO63XLBHMELPTE/ https://www.nzherald.co.nz/business/companies/rocket-lab-rev...
- nickfromseattle 1y ago
  Rocket Lab did ~$123m/quarter in Q1 and ~$400m in 2024 [0], while this article claims, "Around $130 million in annual revenue." I don't think it's Rocket Lab. [0] https://www.macrotrends.net/stocks/charts/RKLB/rocket-lab-usa/revenue https://www.macrotrends.net/stocks/charts/RKLB/rocket-lab-us...
- tecleandor 1y ago
  I think Rocket Lab is ~$130M quarterly, not annually. Isn't it?
  - sundarurfriend 1y ago
    Unpaywalled archive: https://archive.is/20250509020949/https://www.nzherald.co.nz/business/companies/rocket-lab-revenue-slips-7-as-space-company-expands-american-defence-efforts/IZVPTOFFDRHXFO63XLBHMELPTE/ https://archive.is/20250509020949/https://www.nzherald.co.nz... And yeah: > The company that developed and launched rockets in New Zealand and the United States, as well as spacecraft and software systems, made US$123 million revenue in the three months to the end of March.
- millzlane 1y ago
  Starlink has launched over 4000 satellites.
  - Bengalilol 1y ago
    4000 VMs doesn't imply 4k satellites, does it? Regarding revenues, it may be correct if it is a specific division of SL. Anyways, OneWeb has 130+ millions in annual revenues (and a fleet of 400+ satellites, which would result in 10 VMs per satellite <- fwiw). I truly loved the way this article is written. To the point, sharp and quite comical. I certainly hope they achieve to clean the mess up.
florbnit 1y ago
> We’re not going to waste days chasing them. But at some point, this goes beyond saving a few bucks: it becomes performance art. Oh for the love of tech, do chase them. This absolutely has to be in void of the terms of your trial take them to court. If not, then at the very least name and shame the company, so some dumb manager orchestrating this silly theft will get fired and someone more mature can be rotated in.
- plam503711 1y ago
  I’m actually considering reaching out directly to the CEO and telling the full story. But honestly? There’s a good chance he’s fully aware — and totally fine with it. That’s part of what makes it so disappointing. We’re not rushing into legal action — it’s not worth the energy for now — but publicly calling out the behavior felt necessary. It also sends a message to others in the ecosystem about the kind of nonsense OSS maintainers sometimes face. And yes, while I’m still holding off on naming the company directly… I haven’t ruled it out.
  - TZubiri 1y ago
    Just straight to court " it’s not worth the energy for now" Not sure what the amount is, but Small Claims is pretty straightforward and energy efficient? You can get like 10K depending on jurisdiction. The whole trial is like 1 hour.
    - plam503711 1y ago
      We operate globally, and this company isn’t even on our continent. On top of that, it’s a semi state-operated entity — so you can probably imagine where any legal effort would end up: somewhere between bureaucratic limbo and /dev/null.
      - TZubiri 1y ago
        Ah I didn't consider that. International case certainly is going to be more complex. That said, I think that small cases are still worth pursuing on a matter of principle and strategy. It's better to practice pursuing payment from international clients when it's small amounts you don't care about, so that you are prepared if you have an issue with a huge client and bankruptcy is on the line.
koakuma-chan 1y ago
What's Xen Orchestra? $1800/host/year seems pretty expensive
- rounce 1y ago
  Then self-host if the volume you require means you can do it cheaper in-house.
- c16 1y ago
  $1,800 on $130,000,000 a year sounds expensive? Company dinners/outings have almost certainly cost the business more.
  - koakuma-chan 1y ago
    The article mentions 4000, so 1800*4000 = 7.2 mil
    - hocuspocus 1y ago
      4000 VMs, not hosts. More likely $3-400k a year before negotiating a volume discount. VMware enterprise tier is probably 10x more expensive.
      - koakuma-chan 1y ago
        Oh I see
kova12 1y ago
I used to work in IT in a large corporation back in the days. Amount of work necessary to procure software was so staggering, that any alternative "creative solution" would be much more preferable. And the worst thing is that the cheap software was the one that suffered most. The gazillion-dollar CISCO upgrade was no problem, it's already gazillion dollars. But to get $10 email shareware license one would spend many work-hours of many people, so who's gonna do it.
- sublinear 1y ago
  From the accounting perspective, it's likely to prevent accounts payable fraud.
- zeristor 1y ago
  Yes I am having this with trying to get some Neurodiversity software on my laptop, lots of people keen to help, government even refunds the cost, but setting up a new supplier is hard work, and then security approval too.
- e40 1y ago
  Took a meeting once with a customer who had been evaluating our product, which was not OSS. It was a nice meeting, they loved our product and seemingly they would purchase. Awkwardly the guy said their CEO had a rule: they could only use OSS. Their own product was not OSS.
ChrisMarshallNY 1y ago
> But at some point, this goes beyond saving a few bucks: it becomes performance art. Love it. I appreciate the humor and good example behind that. It's entirely likely the company is spending more money on staff time, than on the product. I also cannot even imagine running mission-critical stuff on free trials (I have heard of it, before. I think Adobe was successfully sued, once, because someone created an image in their free trial, and then, couldn't open it, after the trial expired). If I were one of that company's customers, I'd be fairly concerned.
voidUpdate 1y ago
Unhappy with AI generated contributions, but perfectly happy to have a big AI generated image at the top of their page, complete with spelling mistakes
- garrettjoecox 1y ago
  One bothers people like you, one has the potential to waste people’s time and energy. Unless your job involves critiquing the header image of people’s personal blogs I don’t think these are equivalent.
  - voidUpdate 1y ago
    The both imply a similar lack of care to me. Like, not even being bothered to check the words, and if they make no sense just click the magic "generate image" button again, or fix them in photoshop or just erase them...
    - zamadatix 1y ago
      You're probably right in that they didn't really care if the header image was top quality. The codebase or security reviews, understandably, will have a different need for quality.
caffeinatedwo 1y ago
Maybe turn off trial for some time :)
reconnecting 1y ago
You can easily prevent such trial abuse through the tirreno [0] platform, as freshly registered email accounts can be blocked almost in real time. [0] https://github.com/TirrenoTechnologies/tirreno https://github.com/TirrenoTechnologies/tirreno (creator of tirreno)
- bradleyankrom 1y ago
  ^ creator of Tirreno
  - reconnecting 1y ago
    Thank you. I'm still not sure if this should be mentioned. On the one hand, I don't want to overly promote the tirreno, but on the other hand, when I see an issue such as trial abuse that could be easily resolved, I can't resist. My bad.
    - masklinn 1y ago
      If you mention the product, even if it’s an absolutely perfect fit, you should definitely disclose the conflict of interest upfront. This is not about overly promoting the product, it’s about making clear that you are promoting your product (or project, doesn’t even have to be a product).
      - reconnecting 1y ago
        Noted with thanks. Will do.
    - deleted 1y ago
      [deleted]
- arp242 1y ago
  > freshly registered email accounts can be blocked almost in real time. How does it detect if an email account is freshly registered?
rideontime 1y ago
I got distracted a few paragraphs in by the realization that the text was AI-generated.
- plam503711 1y ago
  I first write my entire text and then after that I use a LLM to fix the grammar and have a better flow. I'm doing my best but I'm not a native US speaker. Before LLMs, people complained about the weird sentences or mistakes I made. Pick your poison ;) Anyway, I'm doing my best to keep my own "signature" in writing, but it's really hard when you see a better phrasing generated on your original more limited vocabulary. But anyway, I'll do better next time, thanks for the feedback!
  - rideontime 1y ago
    Comparing it to the LLM's previous post on your blog, it's a little better - that one's got far more of the superfluous analogies and interrupting em-dashes. I honestly think you'd be better off posting your own writing put through DeepL than letting the LLM churn it into mediocrity.
    - funki 1y ago
      Kudos for owning it so earnestly
  - rounce 1y ago
    *English speaker
  - jeffbee 1y ago
    LLMs don't have good "flow" either. Their signature style is full of clichés. Personally, I would prefer to read the quirky non-idiomatic structures of a foreign language speaker than something fixed by an LLM.
  - vsl 1y ago
    Give DeepL Writer a try.
deleted 1y ago
[deleted]
Spooky23 1y ago
Honestly, just sue them. You could probably recover enough damages to subsidize the product for non profits or others for years. Worst case, they just mysteriously stop using your product.
nodesocket 1y ago
Is this the company behind xcp-ng? This looks like a completely different interface than XOA. First I’ve ever heard of Vates.
- plam503711 1y ago
  Vates is the company doing both XCP-ng and Xen Orchestra, and now selling support for both in a single "bundle" called Vates VMS.
o_m 1y ago
At my last job (a billion dollar company) someone had set up some kind of proxy where one free user account was used by ~100 employees. We wanted some more features they didn't offer so we looked at some of their competitors. I was in the meeting where we were going to decide to keep using what we had or use the better solution (in my opinion). Both were presented fairly except for the price. The plan was to continue the piracy, not paying what it should cost, or use the other service which would have been cheaper if done legally. I voiced my concern that if we are going to compare them we should at least compare them with their actual cost. No one shared my concern and they ended up with not switching a just continue pirating, even though money wasn't really an issue. The person who set this up wasn't in the company anymore, but I guess no one wanted to deal with this issue and decided it was easier to ignore it.
- axus 1y ago
  How much money did they save over 5-10 years through this illegal or unethical behavior? If "Rocket Company" averaged 30 machines per month, max $1600 per month let's say $600k / year before discount. Maybe kept 3 million dollars over 10 years. I imagine the only way Vates will get paid for their service is if control is taken from the operational groups doing the actual work and "abstracted" to a centralized IT group.
  - JoblessWonder 1y ago
    FYI they said "hundreds of physical hosts" so it is significantly more than that.
  - elorm 1y ago
    They run 4000 VMS as a stingy aerospace company so you can definitely assume less than a 100 physical machines. Without further enterprise negotiations, it's 1800 per host/year. $180k max. I don't blame Vates for refusing to chase down the company. They'll bring you way more pain as paying clients than the shameless theft they're perpetuating.
bawana 1y ago
[flagged]
Algent 1y ago
This behavior suck. Time to disable the free trial for a month halfway into their trial and see how it goes. This is probably why most trials now request you to reach sales first (well, on top of obviously ensuring they have a way to send an offer).
e40 1y ago
Name and shame.
balls187 1y ago
As CTO, I feel pretty strongly about this type of behavior and lie the blame squarely on the Aerospace Co’s CTO. Being scrappy early on is part of the job, but when you are starting to generate revenue it’s time to convert your free tiers to starter tiers as you scale. I’m sorry that there are people in our industry who choose to behave this way.
- eb0la 1y ago
  I agree 120% with you... ... but I am wondering about how good you are using free tiers. IMHO the free tier in cloud/saas just offsets the initial costs of using the cloud/saas. So... unless you're really small free tiers won't work for you.
  - balls187 1y ago
    They’re deffo helpful when building PoC’s and building MVP’s. Once you get traction converting off free/basic tiers should be a no brainer. We were on AWS Free Tier and once we hit market adoption, our costs were fully covered by paying customers (and then some…)
robotwizard 1y ago
It's pretty straightforward to me at least what needs to be done. Add 2fa sms authentication and restrict trials to one per phone number. It's less easier to get new phone numbers.
- chii 1y ago
  and most 2fa security dont use sms any more. It's an insecure option - forcing it sucks for the legit customers. But if you don't force it, then one can bypass the sms and thus no longer need a phone number. Or you can try force sms on first login, _then_ allow the move to use a OTP app. And even with this, what happens if the company simply shares the company phone, authenticate, then remove the phone and switch to OTP (for each time, or each user)? Unless if a phone number cannot be used twice...which means you have to keep storing it, and handle the support requests when a number is legitimately recycled (and how do you differentiate that?) Offering something that is quite full featured for free (even as a trial) will get it exploited; it's only going to increasely be the case going forward. The internet is hostile, and getting more hostile.
vessenes 1y ago
It’s probably time to channel larry ellison and shake these guys down. Or at least shake their pockets for loose change. They are stealing from you. As you point out you go out of your way to help companies with your oss options: you’re way on the right side of principled and generous. this is abuse. Don’t put up with it. Given the history, I’d suggest a short C&D recounting the 10 years(!) of theft, the measures they’ve gone to, and tell them they have 15 days to either stop or get licensed, or you will seek 10 years of back licensing, interest and penalties. I assure you that you will receive a call from someone. Especially if you have to turn the software off on day 16. Anyway this seems substantial to me, but also there’s an ethical and philosophical question of responsibilities. Do you have more responsibility to your employees and shareholders or to this space company? Even if you’re crazy rich as a company, I propose as the CEO you owe a pretty strong duty to those stakeholders to try and recover stolen assets. You don’t have to be mad at random spaceco, but I propose you might think hard before walking away. Quick edit: just to frame your head on this: If the company is in the US then this behavior likely falls under DMCA anti-circumvention laws. if it does, people would have criminal liability. Now, I believe the DMCA is terrible legislation; it lets corporations create criminal liability through license agreements. But, it is the law of the land here, and I would guess as soon as your attorney can lay this out, and their attorneys get an eye on it, you will find willing negotiation happening.
- cogman10 1y ago
  I agree. The company will almost immediately settle because this is a cut and dry theft that will cost them (literally) millions just in the recoup. More if a penalty can be applied. This won't go to court, the actions are indefensible. The only argument will be how much they have to pay the OPs company.
  - vessenes 1y ago
    “… and that’s how we ended up owning 5% of the company!”
- Animats 1y ago
  You can start by sending them a bill. Get legal advice on drafting it. Each month, a new bill, with the new charges for that month. After a few cycles, you start threatening to go to collection. It may take a while, but you'll collect eventually.
gregorvand 1y ago
It's great to call it out here. But with all due respect, if you have let this company do this for 10 years... Why not do what most profit-conscious companies would do and just say "we notice unusual activity and.."
fennecbutt 1y ago
I hope your ToS includes abuse clauses. Behaviour like that should always be responded to with force. Otherwise bullies will just keep bullying.
scosman 1y ago
I had this happen on a consumer startup with referrals. Every month like clockwork one person would fake referrals to get a free moth, which involved jumping through non trivial hoops (re-installing all, creating content in the fake account, going back). all to save $5, and when we had a free plan with almost the exact same quality. I think the thrill of beating a system and getting away with is as much a factor as anything. And I get it.
nickdothutton 1y ago
Be hard nosed about it. This advice comes from being 25 years in software as Product Manager among other things.
niam 1y ago
There has to be something cosmically funny and tragic about the number of respondents here ascribing some sort of failure to the hosting company. God bless those among us who steal the candy bowl at Halloween.
stefanos82 1y ago
> We’re not going to waste days chasing them. But at some point, this goes beyond saving a few bucks: it becomes performance art. How about creating a "Wall of Shame" page and name shaming such companies, until the get the message that they have the financial resources to pay?
- eb0la 1y ago
  How about the opposite? You're not a paying customer, don't use trials... but let us put your logo in our website as a valued user... with some praise from the CTO, please.
billy99k 1y ago
Spirit and morality don't work so well in the business world. Cut them off and make them pay. Why are you still supporting them?
bix6 1y ago
You cared enough to write a blog post so I think talking to a lawyer is worthwhile. Perhaps if you send them a legal letter threatening international action they will pony up. Writing the CEO will get you nowhere. Either way this is lame behavior and the public deserves to know the company so we can avoid doing business with them. But I understand not wanting to open yourself up for retaliation.
theginger 1y ago
Invoice them. The worst they can do is not pay it.
0x_rs 1y ago
Entirely understandable why it wouldn't be named. And that the comments section would have some people guessing. I wonder if it isn't a company named after an insect, given the revenue and timeline of their operations seems to match with that graph, but the "semi-governmental" is throwing me off.
_joel 1y ago
IANAL but sounds like you've got a solid case for going after them.
Koshima 1y ago
This is a classic case of IP abuse, and it's tough to ignore. If the company has been using your work without a license for a decade, that’s a huge liability on their side. It might be time to remind them that open source is not free labor, and they can’t just brush off 10 years of unpaid work. At the very least, they should come to the table for a serious negotiation.
ruffrey 1y ago
As a solo-founder I have experienced this on a massive scale over nearly 15 years. It's really strange how happy people are with unethical behavior, yet on my end it just doesn't feel right to cut off peoples systems. After multiple attempts to contact them, we will often disable their accounts. It is against the social contract. It is stealing. In many cases companies may have 15+ free trial accounts, the company itself absolutely dwarfs our 3-person company. The cost is beans for them. But they just don't care.
- BonoboIO 1y ago
  Let them gain accounts and shut them all down on Friday 20:00. Have a plan to block fast new creation of trials and watch them burn …
- vsl 1y ago
  Same. Large companies keep freeloading and ask for support. They buy a single personal license and share it among employees. And it’s not some small shops from poor countries, where you can understand it, it’s (often German) enterprises…
stickfigure 1y ago
Tell them that their free trial is over and their company will no longer receive free trial keys. You can do that. It doesn't require a lawyer and it doesn't require threats. Just "We're glad you like our product! Unfortunately we can no longer support you with free trials." Be polite. If they secretly keep getting free trials by pretending to be unaffiliated, then escalate to 1) blocking the fake ones when you discover them (very annoying to them, even if you don't get them all) and 2) as a very last resort, legal threats. The goal is to get them onboarded as paying customers. Every other outcome is effectively a loss. You want to be polite but firm.
- pnathan 1y ago
  If it was me, I'd have- at the least - a little routine in the trial-signup logic on the backend which would check the company name and known aliases, and return "not eligible for free, but sales would love to talk! Have a nice day!" message.
  - walterbell 1y ago
    The lucky winner of an interview with our professional services team!
ruffrey 1y ago
I have a theory this happens because for individual contributors, the effort to buy SaaS software in the era of "vendor risk assessment" is a nightmare. So you end up with grassroots avoidance of that process, at all costs, inside the company.
- cruffle_duffle 1y ago
  This is what I was thinking too. Some places make it insanely difficult to purchase anything.
ithrablip 1y ago
> And that’s what they keep pirouetting... Arr, the use of "pirouetting" is such ticklingly brilliant punnage, mematey.
stackedinserter 1y ago
So they can run 4k virtual machines during trial period, and somehow transfer data between accounts? What kind of trial is this?
- BonoboIO 1y ago
  Do they setup everything at the start of every month, should be easy to block that.
kjellsbells 1y ago
OP says the offending company is quasi governmental aerospace. Sounds like a defense contractor. There will be a security officer at such a company. If I was that officer, I would be profoundly unhappy that employees, whose job (by the nature of the company) regularly takes them into classified waters, were freely giving their personal gmails to a third party overseas. I mean, you just broadened the attack surface on the employees by tying them to their presence in the Google ecosystem. Yikes.
- tecleandor 1y ago
  Could be a company that has a similar format as Airbus, where governments own a sizeable part of it. Isar Aerospace has funding from NATO, for example :P
d2bayes 1y ago
I can imagine the investors in this company would not be pleased with this kind of scrappy nonsense, especially given the industry. > We’re not going to waste days chasing them. But at some point, this goes beyond saving a few bucks: it becomes performance art. It's likely that the CEO is not aware(...hopefully); it's a good idea to reach out to them asap. Do try and point out what's going on. If anything, the sooner you reach out, you'll be doing the business (and whoever is backing it) a favor: trust has been misplaced. Somebody chose a very unprofessional path with what (one can assume) is a very critical system.
neilv 1y ago
Assuming this telling is pretty accurate, I'm wondering what the thinking was on both ends. On the freeloader end: Did they think they were within the rules? How far up was the approval to keep doing it this way? Did someone try to pay, but get blocked? Did someone tell their boss they did this all in-house, and now doesn't want to admit they outsourced and exposed the company? Did it go to the top, and a lawyer told them to put the company name and a real person each time, and that they were covered on good faith if they only did that? On the provider end: Seeing this locked-in enterprise user for 10 years, how was a salesperson not all over that that slam-dunk sale? How did they let this go on for 10 years without tweaking their policy to stop the freeloader and any others who might emulate them? What did the business people say about this over the years when it came up? Was business so good it wasn't worth the time to convert the freeloader to a paying customer?
- MarkusQ 1y ago
  For all of the above, the answer is probably shaped something like this: https://250bpm.substack.com/p/accountability-sinks https://250bpm.substack.com/p/accountability-sinks
dylan604 1y ago
Totally tangent: What's a 30-day Rial? GenAI poster art with no spell checking I guess. Yet all of the pages of paper are spelled correctly. So now I'm wondering if there was a typo in the prompt used to create the art, or if the genAI is just unaware of the same text being used repeatedly while making a slight change in one place?
- keeganpoppen 1y ago
  until openai’s recent updates, this was a very common issue with genai art… sometimes you could not even beg it to spell it correctly haha. in my experience, o3’s generation is much, much better in this regard.
slippy 1y ago
You realize that you just gave hacker news gave enough details to commit some satellite controlling backdoor into their system... It's not like some of us aren't going to be like: "Yeah, let's get 'em!" Not me. I'm the ethical type, but some people might think: Step 1: Modify OSS repository to gain control of satellites Step 2: ... Step 3: Profit!
- TheDong 1y ago
  This is simply magical thinking. Knowing the details of an open source tool a company uses does not magically give you a backdoor. By that logic, merely knowing coinbase uses the open source go language for some things would let you steal all their crypto, and I assure you if it was that simple their coffers would be empty. btw I use linux and firefox and have an unencrypted bitcoin wallet.dat on my computer, feel free to prove me wrong.
thunkingdeep 1y ago
Complete assclown behavior throughout. It would be one thing if this had been going for for a month or two, maybe a quarter or two… but ten years?! They’re clearly fucking you over out of either malice and/or incompetence, and by allowing it to go on, you’re politely enabling them to do this bad behavior to someone else’s business. If you feed stray dogs, you end up with a neighborhood full of dogshit everywhere you step. Bill them; if they don’t pay, talk to an attorney.
aorloff 1y ago
Change your terms slightly, to say that if you abuse the free trial say over 100 times, any user using the free trial agrees to a permanent irrevocable license to any of their IP EDIT Change your terms to require any usage off planet specifically prohibited by the free trial license
panzagl 1y ago
'semi-governmental company' If they're using it in prod then there are plenty of regulations that should force them to establish a real support relationship. Sometimes this type of stuff happens for a prototype that an org is trying to get funded, but not for 10 years. I'd collect all of the org email addresses they used for the initial d/ls and contact them first- maybe one of the ones from ten years ago has gotten promoted to a point where they can establish a paid relationship or approve use of the open source version.
walterbell 1y ago
You could indirectly promote this unnamed reference customer with a dedicated marketing page. This blog post is already the seed of a case study. List the top ten unnamed companies who requested trials, by industry sector, sorted in descending order by count and years and VMs, with them at top. Presumably #2 - #10 have much smaller numbers. Placed in a marketing context, this human attention could be converted to revenue from other customers. Fund a creative writing competition on VeryBigCo Procurement Anti-Patterns and Shadow IT. Prizes could be paid licenses. If you get enough entries, ask a business school to do a case study on the same subject, then organize a multi-vendor survey on the topic. Also, memes. You may also need to update the ToS on the trial. At some point, a motivated salesperson could convert the account with a multi-year license that covers both past and future usage.
etimberg 1y ago
This sounds like wire fraud ....
krisoft 1y ago
The most concerning part in this article is this: "To me, that’s a pretty blatant breach of the unwritten “moral contract” of Open Source." It talks about the breach of some unwritten contract. But surely they should have a very written, real world contract to describe the terms of that 15 day trial. And this should be a breach of that. The fact that this is not mentioned, or even entertained as a notion is concerning. Moral contracts are good for philosophy discussions. Real contracts are much better when you need to use instruments of law to get someone to something.
deleted 1y ago
[deleted]
jarland 1y ago
This is exactly why we put this as a forbidden use case in the MXroute policy: “Deceptive use against third party services by creating multiple email accounts to pretend to be multiple users of their service” Because if you want to maintain a good reputation with people, you don’t facilitate people taking advantage of them.
Henchman21 1y ago
I’m reminded of the “business ethics” scene in Billy Madison[0]. This is what capitalism has wrought in the US: People for whom ethics are anathema, or arguably worse: a completely unexamined topic. So, is the company SpaceX or what? 0: https://m.youtube.com/watch?v=xKGeHuln08A https://m.youtube.com/watch?v=xKGeHuln08A
amtre 1y ago
Amer
aaron695 1y ago
[dead]
gravity757 1y ago
Terran Orbital. A Lockheed Martin company. There are a lot of private space companies but only a few fit the “semi-governmental” description. Lockheed is one of them. Revenue numbers for 2024 fit also. For Terran Orbital that is. Obviously Lockheed does WAY more than that.
methods21 1y ago
Dealing with this right now as a consultant. Also a 'semi-govt' company, with much more in annual revenue than in this article, running a highly critical production workload, and is having problems with a ESOL version Open Source software - that they are scared to touch/upgrade, and that is available in a fully up-to-date version, for purchase, with support etc., and indirectly asking us to support it, by essentially pawning off any and all changes related to said SW to me. Well, I recommended the upgrade path (to a current/supported and paid version) and I stopped making any changes to that component. They are still hemming an hawing, its unbelievable.

526 points by plam503711 1y ago

Dude, quit whining in a blog post and change your policy. Make it per-org instead of per-email. Heck, carve out an exception to block that particular org.

rvz 1y ago

Solution: Have the courage to get rid of the free trial. Job done.

deleted 1y ago

[deleted]

IshKebab 1y ago

I wonder if you can sue for breach of contract or something. Maybe not worth it... I would consider adding some actual limitations into the free trial rather than just time.

matsemann 1y ago
Was thinking the same. If you clearly are only meant to have access for X days, and abuse a loophole to continue indefinitely, how is that far removed from hacking/scamming/stealing/pickyourpoison?

EDEdDNEdDYFaN 1y ago

Isn't this a failure by the company to recognize free trial abuse sooner? and to not close the loophole immediately seems like even more of a weak behavior. Calling them out but not taking decisive action beyond claiming that they are acting immorally ultimately accomplishes nothing. Businesses are not beholden to your ideas about what is nice and fair, but whatever the rules and constraints are to your system. if you keep a practice like this that allows free trial abuse forever, why would they spend money?

plam503711 1y ago
You're absolutely right that businesses act within whatever constraints exist — and yes, we were a bit naive. We assumed that if someone had a fully functional, free, open source version available (well-documented and easy to install), nobody sane would go out of their way to abuse the trial system instead. To be clear, it’s not just trial abuse — it’s actively ignoring the better, freer option in favor of repeatedly faking evaluations just to get the “easy mode.” We’ll definitely tighten things up going forward. But in nearly a decade of doing this, they're the only ones to push it to this scale. So yeah, they've earned a spot in our open source hall of shame
- EDEdDNEdDYFaN 1y ago
  To be fair to them - they've been doing it for 10 years without a problem!
- russfink 1y ago
  Yes. Your pain point is the level of support you are giving on good faith to these charlatans. Maybe add a clause to your license that you reserve the right to limit the amount of technical assistance on the free download. Outside of that, if I understand this matter correctly, most of your customers are honest and you’re willing to write off this one company in the interest of keeping your own corporate sanity.
- Propelloni 1y ago
  Ignoring an OSS option is not the crux of the issue, it only adds more stupid to the cake. They don't deserve a place on the OSS hall of shame, but on the list of shysters and fraudsters. A company is exploiting your free-trial offer, defrauding your project of resources even if it is only a buck and a half. Why are you sending them money? Just shut them down. Unless you have some really unfortunate wording in your TOS, there is nothing they can do. On Monday, send an e-mail to all accounts associated with $COMPANY and tell them in clear terms that you are going to terminate their free-trials COB EOW. Leave a special contact number to negotiate fees, wait for your phone to ring. Seriously, why are you putting up with this?
1y ago

matt-p 1y ago

I think the most depressing thing is how unsurprising this is. This is why free trials require credit cards upfront, as they're more difficult to fake, not because you're about to be stealth billed. It's thanks to people like this.

rocketvole 1y ago
it's practically trivial to bypass this if you really want to. CapitalOne in the US allows you to have virtual cards that can be verified but you can delete and block at any time for free if you have a credit card from them. I'm sure the practice discourages casuals from gaming trials, but it just feels like it's making life miserable for paying customers but doing almost nothing to stop bad actors
- TechDebtDevin 1y ago
  privacy.com
- sumanthvepa 1y ago
  Those types of card numbers are detectable though.
  - hiatus 1y ago
    How? Based on issuer identification number?
    - c12 1y ago
      I'm pretty sure it can be done via the IIN. Services like https://binlist.net/ https://binlist.net/ provide a convenient solution to identify if it's a prepaid card.
      - deleted 1y ago
        [deleted]
    - 1y ago

Meneth 1y ago

Around 130$ million yearly revenue? Matches RocketLab. https://www.nzherald.co.nz/business/companies/rocket-lab-revenue-slips-7-as-space-company-expands-american-defence-efforts/IZVPTOFFDRHXFO63XLBHMELPTE/ https://www.nzherald.co.nz/business/companies/rocket-lab-rev...

nickfromseattle 1y ago
Rocket Lab did ~$123m/quarter in Q1 and ~$400m in 2024 [0], while this article claims, "Around $130 million in annual revenue." I don't think it's Rocket Lab. [0] https://www.macrotrends.net/stocks/charts/RKLB/rocket-lab-usa/revenue https://www.macrotrends.net/stocks/charts/RKLB/rocket-lab-us...
tecleandor 1y ago
I think Rocket Lab is ~$130M quarterly, not annually. Isn't it?
- sundarurfriend 1y ago
  Unpaywalled archive: https://archive.is/20250509020949/https://www.nzherald.co.nz/business/companies/rocket-lab-revenue-slips-7-as-space-company-expands-american-defence-efforts/IZVPTOFFDRHXFO63XLBHMELPTE/ https://archive.is/20250509020949/https://www.nzherald.co.nz... And yeah: > The company that developed and launched rockets in New Zealand and the United States, as well as spacecraft and software systems, made US$123 million revenue in the three months to the end of March.
millzlane 1y ago
Starlink has launched over 4000 satellites.
- Bengalilol 1y ago
  4000 VMs doesn't imply 4k satellites, does it? Regarding revenues, it may be correct if it is a specific division of SL. Anyways, OneWeb has 130+ millions in annual revenues (and a fleet of 400+ satellites, which would result in 10 VMs per satellite <- fwiw). I truly loved the way this article is written. To the point, sharp and quite comical. I certainly hope they achieve to clean the mess up.

florbnit 1y ago

> We’re not going to waste days chasing them. But at some point, this goes beyond saving a few bucks: it becomes performance art. Oh for the love of tech, do chase them. This absolutely has to be in void of the terms of your trial take them to court. If not, then at the very least name and shame the company, so some dumb manager orchestrating this silly theft will get fired and someone more mature can be rotated in.

plam503711 1y ago
I’m actually considering reaching out directly to the CEO and telling the full story. But honestly? There’s a good chance he’s fully aware — and totally fine with it. That’s part of what makes it so disappointing. We’re not rushing into legal action — it’s not worth the energy for now — but publicly calling out the behavior felt necessary. It also sends a message to others in the ecosystem about the kind of nonsense OSS maintainers sometimes face. And yes, while I’m still holding off on naming the company directly… I haven’t ruled it out.
- TZubiri 1y ago
  Just straight to court " it’s not worth the energy for now" Not sure what the amount is, but Small Claims is pretty straightforward and energy efficient? You can get like 10K depending on jurisdiction. The whole trial is like 1 hour.
  - plam503711 1y ago
    We operate globally, and this company isn’t even on our continent. On top of that, it’s a semi state-operated entity — so you can probably imagine where any legal effort would end up: somewhere between bureaucratic limbo and /dev/null.
    - TZubiri 1y ago
      Ah I didn't consider that. International case certainly is going to be more complex. That said, I think that small cases are still worth pursuing on a matter of principle and strategy. It's better to practice pursuing payment from international clients when it's small amounts you don't care about, so that you are prepared if you have an issue with a huge client and bankruptcy is on the line.

koakuma-chan 1y ago

What's Xen Orchestra? $1800/host/year seems pretty expensive

rounce 1y ago
Then self-host if the volume you require means you can do it cheaper in-house.
c16 1y ago
$1,800 on $130,000,000 a year sounds expensive? Company dinners/outings have almost certainly cost the business more.
- koakuma-chan 1y ago
  The article mentions 4000, so 1800*4000 = 7.2 mil
  - hocuspocus 1y ago
    4000 VMs, not hosts. More likely $3-400k a year before negotiating a volume discount. VMware enterprise tier is probably 10x more expensive.
    - koakuma-chan 1y ago
      Oh I see

kova12 1y ago

I used to work in IT in a large corporation back in the days. Amount of work necessary to procure software was so staggering, that any alternative "creative solution" would be much more preferable. And the worst thing is that the cheap software was the one that suffered most. The gazillion-dollar CISCO upgrade was no problem, it's already gazillion dollars. But to get $10 email shareware license one would spend many work-hours of many people, so who's gonna do it.

sublinear 1y ago
From the accounting perspective, it's likely to prevent accounts payable fraud.
zeristor 1y ago
Yes I am having this with trying to get some Neurodiversity software on my laptop, lots of people keen to help, government even refunds the cost, but setting up a new supplier is hard work, and then security approval too.
e40 1y ago
Took a meeting once with a customer who had been evaluating our product, which was not OSS. It was a nice meeting, they loved our product and seemingly they would purchase. Awkwardly the guy said their CEO had a rule: they could only use OSS. Their own product was not OSS.

ChrisMarshallNY 1y ago

> But at some point, this goes beyond saving a few bucks: it becomes performance art. Love it. I appreciate the humor and good example behind that. It's entirely likely the company is spending more money on staff time, than on the product. I also cannot even imagine running mission-critical stuff on free trials (I have heard of it, before. I think Adobe was successfully sued, once, because someone created an image in their free trial, and then, couldn't open it, after the trial expired). If I were one of that company's customers, I'd be fairly concerned.

voidUpdate 1y ago

Unhappy with AI generated contributions, but perfectly happy to have a big AI generated image at the top of their page, complete with spelling mistakes

garrettjoecox 1y ago
One bothers people like you, one has the potential to waste people’s time and energy. Unless your job involves critiquing the header image of people’s personal blogs I don’t think these are equivalent.
- voidUpdate 1y ago
  The both imply a similar lack of care to me. Like, not even being bothered to check the words, and if they make no sense just click the magic "generate image" button again, or fix them in photoshop or just erase them...
  - zamadatix 1y ago
    You're probably right in that they didn't really care if the header image was top quality. The codebase or security reviews, understandably, will have a different need for quality.

caffeinatedwo 1y ago

Maybe turn off trial for some time :)

reconnecting 1y ago

You can easily prevent such trial abuse through the tirreno [0] platform, as freshly registered email accounts can be blocked almost in real time. [0] https://github.com/TirrenoTechnologies/tirreno https://github.com/TirrenoTechnologies/tirreno (creator of tirreno)

bradleyankrom 1y ago
^ creator of Tirreno
- reconnecting 1y ago
  Thank you. I'm still not sure if this should be mentioned. On the one hand, I don't want to overly promote the tirreno, but on the other hand, when I see an issue such as trial abuse that could be easily resolved, I can't resist. My bad.
  - masklinn 1y ago
    If you mention the product, even if it’s an absolutely perfect fit, you should definitely disclose the conflict of interest upfront. This is not about overly promoting the product, it’s about making clear that you are promoting your product (or project, doesn’t even have to be a product).
    - reconnecting 1y ago
      Noted with thanks. Will do.
  - deleted 1y ago
    [deleted]
arp242 1y ago
> freshly registered email accounts can be blocked almost in real time. How does it detect if an email account is freshly registered?

rideontime 1y ago

I got distracted a few paragraphs in by the realization that the text was AI-generated.

plam503711 1y ago
I first write my entire text and then after that I use a LLM to fix the grammar and have a better flow. I'm doing my best but I'm not a native US speaker. Before LLMs, people complained about the weird sentences or mistakes I made. Pick your poison ;) Anyway, I'm doing my best to keep my own "signature" in writing, but it's really hard when you see a better phrasing generated on your original more limited vocabulary. But anyway, I'll do better next time, thanks for the feedback!
- rideontime 1y ago
  Comparing it to the LLM's previous post on your blog, it's a little better - that one's got far more of the superfluous analogies and interrupting em-dashes. I honestly think you'd be better off posting your own writing put through DeepL than letting the LLM churn it into mediocrity.
  - funki 1y ago
    Kudos for owning it so earnestly
- rounce 1y ago
  *English speaker
- jeffbee 1y ago
  LLMs don't have good "flow" either. Their signature style is full of clichés. Personally, I would prefer to read the quirky non-idiomatic structures of a foreign language speaker than something fixed by an LLM.
- vsl 1y ago
  Give DeepL Writer a try.

deleted 1y ago

[deleted]

Spooky23 1y ago

Honestly, just sue them. You could probably recover enough damages to subsidize the product for non profits or others for years. Worst case, they just mysteriously stop using your product.

nodesocket 1y ago

Is this the company behind xcp-ng? This looks like a completely different interface than XOA. First I’ve ever heard of Vates.

plam503711 1y ago
Vates is the company doing both XCP-ng and Xen Orchestra, and now selling support for both in a single "bundle" called Vates VMS.

o_m 1y ago

At my last job (a billion dollar company) someone had set up some kind of proxy where one free user account was used by ~100 employees. We wanted some more features they didn't offer so we looked at some of their competitors. I was in the meeting where we were going to decide to keep using what we had or use the better solution (in my opinion). Both were presented fairly except for the price. The plan was to continue the piracy, not paying what it should cost, or use the other service which would have been cheaper if done legally. I voiced my concern that if we are going to compare them we should at least compare them with their actual cost. No one shared my concern and they ended up with not switching a just continue pirating, even though money wasn't really an issue. The person who set this up wasn't in the company anymore, but I guess no one wanted to deal with this issue and decided it was easier to ignore it.

axus 1y ago
How much money did they save over 5-10 years through this illegal or unethical behavior? If "Rocket Company" averaged 30 machines per month, max $1600 per month let's say $600k / year before discount. Maybe kept 3 million dollars over 10 years. I imagine the only way Vates will get paid for their service is if control is taken from the operational groups doing the actual work and "abstracted" to a centralized IT group.
- JoblessWonder 1y ago
  FYI they said "hundreds of physical hosts" so it is significantly more than that.
- elorm 1y ago
  They run 4000 VMS as a stingy aerospace company so you can definitely assume less than a 100 physical machines. Without further enterprise negotiations, it's 1800 per host/year. $180k max. I don't blame Vates for refusing to chase down the company. They'll bring you way more pain as paying clients than the shameless theft they're perpetuating.

bawana 1y ago

[flagged]

Algent 1y ago

This behavior suck. Time to disable the free trial for a month halfway into their trial and see how it goes. This is probably why most trials now request you to reach sales first (well, on top of obviously ensuring they have a way to send an offer).

e40 1y ago

Name and shame.

balls187 1y ago

As CTO, I feel pretty strongly about this type of behavior and lie the blame squarely on the Aerospace Co’s CTO. Being scrappy early on is part of the job, but when you are starting to generate revenue it’s time to convert your free tiers to starter tiers as you scale. I’m sorry that there are people in our industry who choose to behave this way.

eb0la 1y ago
I agree 120% with you... ... but I am wondering about how good you are using free tiers. IMHO the free tier in cloud/saas just offsets the initial costs of using the cloud/saas. So... unless you're really small free tiers won't work for you.
- balls187 1y ago
  They’re deffo helpful when building PoC’s and building MVP’s. Once you get traction converting off free/basic tiers should be a no brainer. We were on AWS Free Tier and once we hit market adoption, our costs were fully covered by paying customers (and then some…)

robotwizard 1y ago

It's pretty straightforward to me at least what needs to be done. Add 2fa sms authentication and restrict trials to one per phone number. It's less easier to get new phone numbers.

chii 1y ago
and most 2fa security dont use sms any more. It's an insecure option - forcing it sucks for the legit customers. But if you don't force it, then one can bypass the sms and thus no longer need a phone number. Or you can try force sms on first login, _then_ allow the move to use a OTP app. And even with this, what happens if the company simply shares the company phone, authenticate, then remove the phone and switch to OTP (for each time, or each user)? Unless if a phone number cannot be used twice...which means you have to keep storing it, and handle the support requests when a number is legitimately recycled (and how do you differentiate that?) Offering something that is quite full featured for free (even as a trial) will get it exploited; it's only going to increasely be the case going forward. The internet is hostile, and getting more hostile.

vessenes 1y ago

It’s probably time to channel larry ellison and shake these guys down. Or at least shake their pockets for loose change. They are stealing from you. As you point out you go out of your way to help companies with your oss options: you’re way on the right side of principled and generous. this is abuse. Don’t put up with it. Given the history, I’d suggest a short C&D recounting the 10 years(!) of theft, the measures they’ve gone to, and tell them they have 15 days to either stop or get licensed, or you will seek 10 years of back licensing, interest and penalties. I assure you that you will receive a call from someone. Especially if you have to turn the software off on day 16. Anyway this seems substantial to me, but also there’s an ethical and philosophical question of responsibilities. Do you have more responsibility to your employees and shareholders or to this space company? Even if you’re crazy rich as a company, I propose as the CEO you owe a pretty strong duty to those stakeholders to try and recover stolen assets. You don’t have to be mad at random spaceco, but I propose you might think hard before walking away. Quick edit: just to frame your head on this: If the company is in the US then this behavior likely falls under DMCA anti-circumvention laws. if it does, people would have criminal liability. Now, I believe the DMCA is terrible legislation; it lets corporations create criminal liability through license agreements. But, it is the law of the land here, and I would guess as soon as your attorney can lay this out, and their attorneys get an eye on it, you will find willing negotiation happening.

cogman10 1y ago
I agree. The company will almost immediately settle because this is a cut and dry theft that will cost them (literally) millions just in the recoup. More if a penalty can be applied. This won't go to court, the actions are indefensible. The only argument will be how much they have to pay the OPs company.
- vessenes 1y ago
  “… and that’s how we ended up owning 5% of the company!”
Animats 1y ago
You can start by sending them a bill. Get legal advice on drafting it. Each month, a new bill, with the new charges for that month. After a few cycles, you start threatening to go to collection. It may take a while, but you'll collect eventually.

gregorvand 1y ago

It's great to call it out here. But with all due respect, if you have let this company do this for 10 years... Why not do what most profit-conscious companies would do and just say "we notice unusual activity and.."

fennecbutt 1y ago

I hope your ToS includes abuse clauses. Behaviour like that should always be responded to with force. Otherwise bullies will just keep bullying.

scosman 1y ago

I had this happen on a consumer startup with referrals. Every month like clockwork one person would fake referrals to get a free moth, which involved jumping through non trivial hoops (re-installing all, creating content in the fake account, going back). all to save $5, and when we had a free plan with almost the exact same quality. I think the thrill of beating a system and getting away with is as much a factor as anything. And I get it.

nickdothutton 1y ago

Be hard nosed about it. This advice comes from being 25 years in software as Product Manager among other things.

niam 1y ago

There has to be something cosmically funny and tragic about the number of respondents here ascribing some sort of failure to the hosting company. God bless those among us who steal the candy bowl at Halloween.

stefanos82 1y ago

> We’re not going to waste days chasing them. But at some point, this goes beyond saving a few bucks: it becomes performance art. How about creating a "Wall of Shame" page and name shaming such companies, until the get the message that they have the financial resources to pay?

eb0la 1y ago
How about the opposite? You're not a paying customer, don't use trials... but let us put your logo in our website as a valued user... with some praise from the CTO, please.

billy99k 1y ago

Spirit and morality don't work so well in the business world. Cut them off and make them pay. Why are you still supporting them?

bix6 1y ago

You cared enough to write a blog post so I think talking to a lawyer is worthwhile. Perhaps if you send them a legal letter threatening international action they will pony up. Writing the CEO will get you nowhere. Either way this is lame behavior and the public deserves to know the company so we can avoid doing business with them. But I understand not wanting to open yourself up for retaliation.

theginger 1y ago

Invoice them. The worst they can do is not pay it.

0x_rs 1y ago

Entirely understandable why it wouldn't be named. And that the comments section would have some people guessing. I wonder if it isn't a company named after an insect, given the revenue and timeline of their operations seems to match with that graph, but the "semi-governmental" is throwing me off.

_joel 1y ago

IANAL but sounds like you've got a solid case for going after them.

Koshima 1y ago

This is a classic case of IP abuse, and it's tough to ignore. If the company has been using your work without a license for a decade, that’s a huge liability on their side. It might be time to remind them that open source is not free labor, and they can’t just brush off 10 years of unpaid work. At the very least, they should come to the table for a serious negotiation.

ruffrey 1y ago

As a solo-founder I have experienced this on a massive scale over nearly 15 years. It's really strange how happy people are with unethical behavior, yet on my end it just doesn't feel right to cut off peoples systems. After multiple attempts to contact them, we will often disable their accounts. It is against the social contract. It is stealing. In many cases companies may have 15+ free trial accounts, the company itself absolutely dwarfs our 3-person company. The cost is beans for them. But they just don't care.

BonoboIO 1y ago
Let them gain accounts and shut them all down on Friday 20:00. Have a plan to block fast new creation of trials and watch them burn …
vsl 1y ago
Same. Large companies keep freeloading and ask for support. They buy a single personal license and share it among employees. And it’s not some small shops from poor countries, where you can understand it, it’s (often German) enterprises…

stickfigure 1y ago

Tell them that their free trial is over and their company will no longer receive free trial keys. You can do that. It doesn't require a lawyer and it doesn't require threats. Just "We're glad you like our product! Unfortunately we can no longer support you with free trials." Be polite. If they secretly keep getting free trials by pretending to be unaffiliated, then escalate to 1) blocking the fake ones when you discover them (very annoying to them, even if you don't get them all) and 2) as a very last resort, legal threats. The goal is to get them onboarded as paying customers. Every other outcome is effectively a loss. You want to be polite but firm.

pnathan 1y ago
If it was me, I'd have- at the least - a little routine in the trial-signup logic on the backend which would check the company name and known aliases, and return "not eligible for free, but sales would love to talk! Have a nice day!" message.
- walterbell 1y ago
  The lucky winner of an interview with our professional services team!

ruffrey 1y ago

I have a theory this happens because for individual contributors, the effort to buy SaaS software in the era of "vendor risk assessment" is a nightmare. So you end up with grassroots avoidance of that process, at all costs, inside the company.

cruffle_duffle 1y ago
This is what I was thinking too. Some places make it insanely difficult to purchase anything.

ithrablip 1y ago

> And that’s what they keep pirouetting... Arr, the use of "pirouetting" is such ticklingly brilliant punnage, mematey.

stackedinserter 1y ago

So they can run 4k virtual machines during trial period, and somehow transfer data between accounts? What kind of trial is this?

BonoboIO 1y ago
Do they setup everything at the start of every month, should be easy to block that.

kjellsbells 1y ago

OP says the offending company is quasi governmental aerospace. Sounds like a defense contractor. There will be a security officer at such a company. If I was that officer, I would be profoundly unhappy that employees, whose job (by the nature of the company) regularly takes them into classified waters, were freely giving their personal gmails to a third party overseas. I mean, you just broadened the attack surface on the employees by tying them to their presence in the Google ecosystem. Yikes.

tecleandor 1y ago
Could be a company that has a similar format as Airbus, where governments own a sizeable part of it. Isar Aerospace has funding from NATO, for example :P

d2bayes 1y ago

I can imagine the investors in this company would not be pleased with this kind of scrappy nonsense, especially given the industry. > We’re not going to waste days chasing them. But at some point, this goes beyond saving a few bucks: it becomes performance art. It's likely that the CEO is not aware(...hopefully); it's a good idea to reach out to them asap. Do try and point out what's going on. If anything, the sooner you reach out, you'll be doing the business (and whoever is backing it) a favor: trust has been misplaced. Somebody chose a very unprofessional path with what (one can assume) is a very critical system.

neilv 1y ago

Assuming this telling is pretty accurate, I'm wondering what the thinking was on both ends. On the freeloader end: Did they think they were within the rules? How far up was the approval to keep doing it this way? Did someone try to pay, but get blocked? Did someone tell their boss they did this all in-house, and now doesn't want to admit they outsourced and exposed the company? Did it go to the top, and a lawyer told them to put the company name and a real person each time, and that they were covered on good faith if they only did that? On the provider end: Seeing this locked-in enterprise user for 10 years, how was a salesperson not all over that that slam-dunk sale? How did they let this go on for 10 years without tweaking their policy to stop the freeloader and any others who might emulate them? What did the business people say about this over the years when it came up? Was business so good it wasn't worth the time to convert the freeloader to a paying customer?

MarkusQ 1y ago
For all of the above, the answer is probably shaped something like this: https://250bpm.substack.com/p/accountability-sinks https://250bpm.substack.com/p/accountability-sinks

dylan604 1y ago

Totally tangent: What's a 30-day Rial? GenAI poster art with no spell checking I guess. Yet all of the pages of paper are spelled correctly. So now I'm wondering if there was a typo in the prompt used to create the art, or if the genAI is just unaware of the same text being used repeatedly while making a slight change in one place?

keeganpoppen 1y ago
until openai’s recent updates, this was a very common issue with genai art… sometimes you could not even beg it to spell it correctly haha. in my experience, o3’s generation is much, much better in this regard.

slippy 1y ago

You realize that you just gave hacker news gave enough details to commit some satellite controlling backdoor into their system... It's not like some of us aren't going to be like: "Yeah, let's get 'em!" Not me. I'm the ethical type, but some people might think: Step 1: Modify OSS repository to gain control of satellites Step 2: ... Step 3: Profit!

TheDong 1y ago
This is simply magical thinking. Knowing the details of an open source tool a company uses does not magically give you a backdoor. By that logic, merely knowing coinbase uses the open source go language for some things would let you steal all their crypto, and I assure you if it was that simple their coffers would be empty. btw I use linux and firefox and have an unencrypted bitcoin wallet.dat on my computer, feel free to prove me wrong.

thunkingdeep 1y ago

Complete assclown behavior throughout. It would be one thing if this had been going for for a month or two, maybe a quarter or two… but ten years?! They’re clearly fucking you over out of either malice and/or incompetence, and by allowing it to go on, you’re politely enabling them to do this bad behavior to someone else’s business. If you feed stray dogs, you end up with a neighborhood full of dogshit everywhere you step. Bill them; if they don’t pay, talk to an attorney.

aorloff 1y ago

Change your terms slightly, to say that if you abuse the free trial say over 100 times, any user using the free trial agrees to a permanent irrevocable license to any of their IP EDIT Change your terms to require any usage off planet specifically prohibited by the free trial license

panzagl 1y ago

'semi-governmental company' If they're using it in prod then there are plenty of regulations that should force them to establish a real support relationship. Sometimes this type of stuff happens for a prototype that an org is trying to get funded, but not for 10 years. I'd collect all of the org email addresses they used for the initial d/ls and contact them first- maybe one of the ones from ten years ago has gotten promoted to a point where they can establish a paid relationship or approve use of the open source version.

walterbell 1y ago

You could indirectly promote this unnamed reference customer with a dedicated marketing page. This blog post is already the seed of a case study. List the top ten unnamed companies who requested trials, by industry sector, sorted in descending order by count and years and VMs, with them at top. Presumably #2 - #10 have much smaller numbers. Placed in a marketing context, this human attention could be converted to revenue from other customers. Fund a creative writing competition on VeryBigCo Procurement Anti-Patterns and Shadow IT. Prizes could be paid licenses. If you get enough entries, ask a business school to do a case study on the same subject, then organize a multi-vendor survey on the topic. Also, memes. You may also need to update the ToS on the trial. At some point, a motivated salesperson could convert the account with a multi-year license that covers both past and future usage.

etimberg 1y ago

This sounds like wire fraud ....

krisoft 1y ago

The most concerning part in this article is this: "To me, that’s a pretty blatant breach of the unwritten “moral contract” of Open Source." It talks about the breach of some unwritten contract. But surely they should have a very written, real world contract to describe the terms of that 15 day trial. And this should be a breach of that. The fact that this is not mentioned, or even entertained as a notion is concerning. Moral contracts are good for philosophy discussions. Real contracts are much better when you need to use instruments of law to get someone to something.

deleted 1y ago

[deleted]

jarland 1y ago

This is exactly why we put this as a forbidden use case in the MXroute policy: “Deceptive use against third party services by creating multiple email accounts to pretend to be multiple users of their service” Because if you want to maintain a good reputation with people, you don’t facilitate people taking advantage of them.

Henchman21 1y ago

I’m reminded of the “business ethics” scene in Billy Madison[0]. This is what capitalism has wrought in the US: People for whom ethics are anathema, or arguably worse: a completely unexamined topic. So, is the company SpaceX or what? 0: https://m.youtube.com/watch?v=xKGeHuln08A https://m.youtube.com/watch?v=xKGeHuln08A

amtre 1y ago

Amer

aaron695 1y ago

[dead]

gravity757 1y ago

Terran Orbital. A Lockheed Martin company. There are a lot of private space companies but only a few fit the “semi-governmental” description. Lockheed is one of them. Revenue numbers for 2024 fit also. For Terran Orbital that is. Obviously Lockheed does WAY more than that.

methods21 1y ago

Dealing with this right now as a consultant. Also a 'semi-govt' company, with much more in annual revenue than in this article, running a highly critical production workload, and is having problems with a ESOL version Open Source software - that they are scared to touch/upgrade, and that is available in a fully up-to-date version, for purchase, with support etc., and indirectly asking us to support it, by essentially pawning off any and all changes related to said SW to me. Well, I recommended the upgrade path (to a current/supported and paid version) and I stopped making any changes to that component. They are still hemming an hawing, its unbelievable.