5 ms·

At this level (govt, 6 figure+ deals) I would at least consider if this problem should have a non-tech solution, and instead have a legal/lawyer solution. In my

At this level (govt, 6 figure+ deals) I would at least consider if this problem should have a non-tech solution, and instead have a legal/lawyer solution. In my experience (not US based though) the govt contracts are under compliance programmes as well so the govt agency’s legal/contract mgmt team would probably follow up internally on expiring contracts (ie licences) and require the owning stakeholder to either renew the contract or abandon the software. Meaning the customer would supervise itself regarding licence. But even if you don’t want to rely on self-supervision then having your lawyer spend 1 hour reaching out with a “do you need to renew your licence” at the end of a licence term would probably be much cheaper than building and maintaining an air-gapped licence solution.

bobmcnamara 1y ago
Years back a friend of mine's startup failed when USAF pirated their software and the original customer org stopped paying for it. Feds are DMCA immune, so no real recourse.
- bigfatkitten 1y ago
  Sounds like having only one paying customer was the real cause of the business’s failure.
  - bobmcnamara 1y ago
    They've mentioned that was a valuable lesson.
- atonse 1y ago
  This seems very suspect. Usually you do have recourse via procurement channels and reps. If you file a complaint with that agency stating that they’re using a license without paying for it, it will result in at least an investigation.
  - michaelt 1y ago
    If you got to hire the cops to investigate your own mistakes, would you hire competent, motivated folks who'd leave no stone unturned and get access to every classified, air-gapped network in search of license infringements? I wouldn't. I'd hire some Peter Gibbons type, who only does about 15 minutes of real, actual work in a typical week. Then I'd tell them they can finish early if all their pending cases are closed.
    - bobmcnamara 1y ago
      Practically the federal government shouted, Neener neener neener! Rules for thee but not for meeeeeee! https://arstechnica.com/tech-policy/2008/08/air-force-cracks-software-carpet-bombs-dmca/ https://arstechnica.com/tech-policy/2008/08/air-force-cracks...
    - atonse 1y ago
      The acquisition and procurement departments in many government agencies are often “independent” in that they don’t directly report to the agency. They’re more like compliance people that make sure you’re completing with the procurement laws and regulations. And unpaid software licenses are a violation. Now maybe the client in this case may have had some kind if ownership clause, etc. but in general, procurement people tend to be pretty neutral in my experience. Then again, over only dealt with small contracts (< $500k)
    - GabeIsko 1y ago
      If enterprise corporations actually did a throughout investigation, they would probably find that a lot of their license deals have gone unfulfilled. They are really bad about this kind of stuff. It became super complicated to buy this kind of software once companies realized that they could force everything though a deal desk and try to extract as much money out of the government as possible. We have had companies outright refuse to even give us a price when we told them we wanted to investigate buying a license. Such a PITA.
  - bobmcnamara 1y ago
    https://arstechnica.com/tech-policy/2008/08/air-force-cracks-software-carpet-bombs-dmca/ https://arstechnica.com/tech-policy/2008/08/air-force-cracks... Hopefully this was fixed, but this was the standing precedent at the time.
- Cthulhu_ 1y ago
  Surely that would fail any kind of security or compliance audit?
  - bobmcnamara 1y ago
    This was the precedent at the time: https://arstechnica.com/tech-policy/2008/08/air-force-cracks-software-carpet-bombs-dmca/ https://arstechnica.com/tech-policy/2008/08/air-force-cracks...
fc417fc802 1y ago
Largely agree but I want to challenge this bit at the end. > probably be much cheaper than building and maintaining an air-gapped licence solution I think this is an unwise attitude to take. There's something to be said for a simple picket fence. Even though someone could easily hop it if they wanted to, they lose plausible deniability and in most cases that's all that really matters at the end of the day.

bobmcnamara 1y ago

Years back a friend of mine's startup failed when USAF pirated their software and the original customer org stopped paying for it. Feds are DMCA immune, so no real recourse.

bigfatkitten 1y ago
Sounds like having only one paying customer was the real cause of the business’s failure.
- bobmcnamara 1y ago
  They've mentioned that was a valuable lesson.
atonse 1y ago
This seems very suspect. Usually you do have recourse via procurement channels and reps. If you file a complaint with that agency stating that they’re using a license without paying for it, it will result in at least an investigation.
- michaelt 1y ago
  If you got to hire the cops to investigate your own mistakes, would you hire competent, motivated folks who'd leave no stone unturned and get access to every classified, air-gapped network in search of license infringements? I wouldn't. I'd hire some Peter Gibbons type, who only does about 15 minutes of real, actual work in a typical week. Then I'd tell them they can finish early if all their pending cases are closed.
  - bobmcnamara 1y ago
    Practically the federal government shouted, Neener neener neener! Rules for thee but not for meeeeeee! https://arstechnica.com/tech-policy/2008/08/air-force-cracks-software-carpet-bombs-dmca/ https://arstechnica.com/tech-policy/2008/08/air-force-cracks...
  - atonse 1y ago
    The acquisition and procurement departments in many government agencies are often “independent” in that they don’t directly report to the agency. They’re more like compliance people that make sure you’re completing with the procurement laws and regulations. And unpaid software licenses are a violation. Now maybe the client in this case may have had some kind if ownership clause, etc. but in general, procurement people tend to be pretty neutral in my experience. Then again, over only dealt with small contracts (< $500k)
  - GabeIsko 1y ago
    If enterprise corporations actually did a throughout investigation, they would probably find that a lot of their license deals have gone unfulfilled. They are really bad about this kind of stuff. It became super complicated to buy this kind of software once companies realized that they could force everything though a deal desk and try to extract as much money out of the government as possible. We have had companies outright refuse to even give us a price when we told them we wanted to investigate buying a license. Such a PITA.
- bobmcnamara 1y ago
  https://arstechnica.com/tech-policy/2008/08/air-force-cracks-software-carpet-bombs-dmca/ https://arstechnica.com/tech-policy/2008/08/air-force-cracks... Hopefully this was fixed, but this was the standing precedent at the time.
Cthulhu_ 1y ago
Surely that would fail any kind of security or compliance audit?
- bobmcnamara 1y ago
  This was the precedent at the time: https://arstechnica.com/tech-policy/2008/08/air-force-cracks-software-carpet-bombs-dmca/ https://arstechnica.com/tech-policy/2008/08/air-force-cracks...

fc417fc802 1y ago

Largely agree but I want to challenge this bit at the end. > probably be much cheaper than building and maintaining an air-gapped licence solution I think this is an unwise attitude to take. There's something to be said for a simple picket fence. Even though someone could easily hop it if they wanted to, they lose plausible deniability and in most cases that's all that really matters at the end of the day.