People that run an AD domain for their home lab, people that use apple configurator to create profiles for their own devices (can enable some settings/features that are otherwise gated behind using an MDM profile - like shared iPads), etc.
On the flip side, you are also missing all of the solopreneurs using your software for commercial use but obviously aren't spinning up a whole endpoint IT infrastructure to manage their own single device. Or contractors doing BYOD without MDM enrollment. Or small businesses/startups that are mostly BYOD, or don't do any kind of endpoint/device management...
I can't say much about the macOS market, but I do know that MDM-style APIs are practically the only way to write a third party control app for mobile devices. With the way Apple is moving macOS more and more towards their control, this may happen on the desktop in the future as well.
Schools also tend to use MDMs, but often in combination with Chromebooks which don't typically run third party software anyway.
For certain types of apps from the mac app store vs installed directly (mostly VPNs), they also have to use the MDM APIs and install profiles on the device to function.
So if a home user, for example, uses Tailscale and installed it via the mac app store, they'd flag as being MDM managed if the software used the code in the article.
Fonts on iPad work the same way, the font apps install an MDM profile to install the fonts on the device because Apple gates this behind that for some stupid reason.
Like you said, I suspect doing things through configuration/MDM profiles is going to become more and more common on desktop like it has on mobile.
I mean, “many” people use SaaS apps which utilize MDM on end user devices, but many parents I know who are in tech roll their own to filter the net for their kids devices and (to a much lesser extent) monitor them proactively.
People that run an AD domain for their home lab, people that use apple configurator to create profiles for their own devices (can enable some settings/features that are otherwise gated behind using an MDM profile - like shared iPads), etc.
That's a tiny minority of your user base. You'll live. They'll live.
So who are you going to catch, really?
Enterprises that are big enough to manage their fleet, but small enough to not enforce rules. Which is a good chunk of money.
If you aim for large-scale Enterprise sales (which you should if you take this step), no, the folks running home labs are not usually the ones making decisions.
The code snippets are the easy part here. Too easy to blindly deploy, because it might work for 95% of the cases. You know how these things go: KPM increased, move on to the next thing.
(Anecdotally) I don't think most big corps using commercial software without a license are doing it intentionally/maliciously at an organizational level. Most of the time it's just individual employees downloading supposedly "free" software without reading the license and not realizing it isn't free for commercial use.
Most of the time it's just individual employees downloading supposedly "free" software without reading the license and realizing it's not free for commercial use.
And chances are, that company's IT department would love to know when that's happening so they can put a stop to it.
I work in ops, that's called "shadow IT" and it's a huge problem. It's really prevalent now because most SaaS is marketed toward individuals/small teams rather than marketing toward the business itself, so you get people within an org spinning up trials and free versions, putting company data into it with zero oversight, and often IT doesn't know about it until the quarterly budget review when they find out from accounting that it's been blown on software purchased outside of the IT org, now it's "critical" to operations and we're forced to onboard/support it.
Obviously these code snippets won't work for SaaS, but a notification pop-up along the lines of "We see you're on a company device. Please contact your IT administrator to proceed with your free trial" would be great, but would kill a big sales avenue.
No joke. Oracle will (happily) sink your company in license fees and litigation if they so much as git a whiff of Oracle Java being used commercially, accidentally or not.
You have violated my license by replying to my comment. Pay me $10,000 or my lawyer will be in touch.
Obviously this is sarcasm. But what if it wasn't - would you think it was sensible? Comment writers need to get paid, so it's reasonable, yeah?
Part of Oracle's business model is tricking you into thinking you don't need to pay to use stuff, then extracting a much bigger payment in the resulting lawsuit.
I don't find this to be always the case, there's many relationships were the nature of work cannot be established beforehand and we have open accounts, if you ever received an invoice you were part of such an account.
The proposal is simple, if you ever need a service and you request it of me, I will send you an invoice. It is implied in the request of my service that I would get paid, absent any negotiation for payment, I will send my best estimation.
Similarly if you download my software, absent any license, I have the right to send you an invoice. The fact that there's a license that explicitly mentions this is a nail on the coffin on the part of Oracle, but even without it there's quantum meruit.
Yea, this seems to be sort of analogous to companies who check whether you have a rooted device in order to take some kind of action (usually preventing the software from running). If that's a shitty thing to do, then this is, too.
Software should not be in the business of trying to (badly) guess whether the user is the right sort of user, based on inexact signals from the operating system. As others pointed out, the false positives will be annoyed, and the true positives will sidestep your efforts.
I don't think you will ever see this normalized, because it's a really dumb idea.
You certainly can observe a correlation between a "corporate customer" and MDM/GPO and use that as a heuristic. But it's like relying on the color of the sky to determine temperature: "Is it grey? Well then it's obviously cold." It's a leaky abstraction.
How so? You think big corps would pressure corporate device management providers into making their services stealthier in order to avoid paying appropriate license fees for software that does this detection?
I'd always assume the worst of corporations but I think it's a little far fetched, probably doesn't affect their bottom line to just pay for the software.
I don't think so - most organisations and employees don't actively try to violate licenses, but if the path of least resistance is "eh" then individual employees definitely aren't going to bother. I bet there are thousands of people using the free version of MSVC commercially for example.
Depending on what action you take with this, I'd say it has a pretty good chance of tipping people into emailing IT to get a license.
You can already easily pirate the software by running it on your personal device for free, and the software would never know you were also working for a corporation that was supposed to buy a license.
Comments
Normalizing this would start a game of cat & mouse, no?
That, and a lot of false positives.
People that run an AD domain for their home lab, people that use apple configurator to create profiles for their own devices (can enable some settings/features that are otherwise gated behind using an MDM profile - like shared iPads), etc.
On the flip side, you are also missing all of the solopreneurs using your software for commercial use but obviously aren't spinning up a whole endpoint IT infrastructure to manage their own single device. Or contractors doing BYOD without MDM enrollment. Or small businesses/startups that are mostly BYOD, or don't do any kind of endpoint/device management...
So who are you going to catch, really?
A lot of people use MDM for managing their kids devices (pinning DNS for filtering etc.)
First time I've seen "a lot of people" used to mean "practically nobody."
Just joking, but seriously, I've never heard of anyone doing this, and I think maybe 1 in 100 people would even know that it's possible.
I can't say much about the macOS market, but I do know that MDM-style APIs are practically the only way to write a third party control app for mobile devices. With the way Apple is moving macOS more and more towards their control, this may happen on the desktop in the future as well.
Schools also tend to use MDMs, but often in combination with Chromebooks which don't typically run third party software anyway.
For certain types of apps from the mac app store vs installed directly (mostly VPNs), they also have to use the MDM APIs and install profiles on the device to function.
So if a home user, for example, uses Tailscale and installed it via the mac app store, they'd flag as being MDM managed if the software used the code in the article.
Fonts on iPad work the same way, the font apps install an MDM profile to install the fonts on the device because Apple gates this behind that for some stupid reason.
Like you said, I suspect doing things through configuration/MDM profiles is going to become more and more common on desktop like it has on mobile.
I mean, “many” people use SaaS apps which utilize MDM on end user devices, but many parents I know who are in tech roll their own to filter the net for their kids devices and (to a much lesser extent) monitor them proactively.
That's a tiny minority of your user base. You'll live. They'll live.
Enterprises that are big enough to manage their fleet, but small enough to not enforce rules. Which is a good chunk of money.
The minority are typically also enthusiasts who serve as a multiplier. Alienating them isn’t the best strategy.
If you aim for large-scale Enterprise sales (which you should if you take this step), no, the folks running home labs are not usually the ones making decisions.
Below the code snippets the post states this is not a silver bullet, but only a starting point.
The code snippets are the easy part here. Too easy to blindly deploy, because it might work for 95% of the cases. You know how these things go: KPM increased, move on to the next thing.
(Anecdotally) I don't think most big corps using commercial software without a license are doing it intentionally/maliciously at an organizational level. Most of the time it's just individual employees downloading supposedly "free" software without reading the license and not realizing it isn't free for commercial use.
And chances are, that company's IT department would love to know when that's happening so they can put a stop to it.
I work in ops, that's called "shadow IT" and it's a huge problem. It's really prevalent now because most SaaS is marketed toward individuals/small teams rather than marketing toward the business itself, so you get people within an org spinning up trials and free versions, putting company data into it with zero oversight, and often IT doesn't know about it until the quarterly budget review when they find out from accounting that it's been blown on software purchased outside of the IT org, now it's "critical" to operations and we're forced to onboard/support it.
Obviously these code snippets won't work for SaaS, but a notification pop-up along the lines of "We see you're on a company device. Please contact your IT administrator to proceed with your free trial" would be great, but would kill a big sales avenue.
It sounds great from a sales and marketing perspective.
Instead of convincing the guys with the wallets to shell something out. Just convince the devs to npm install solution, and then send an invoice.
Win/win
Ah, the Oracle and Broadcom model - Java, Virtualbox, VMware, etc.
Woe betide thee who doesn't notice the difference between Oracle Java and OpenJDK.
No joke. Oracle will (happily) sink your company in license fees and litigation if they so much as git a whiff of Oracle Java being used commercially, accidentally or not.
As a software dev, that looks good to me. Software devs need to get paid.
You have violated my license by replying to my comment. Pay me $10,000 or my lawyer will be in touch.
Obviously this is sarcasm. But what if it wasn't - would you think it was sensible? Comment writers need to get paid, so it's reasonable, yeah?
Part of Oracle's business model is tricking you into thinking you don't need to pay to use stuff, then extracting a much bigger payment in the resulting lawsuit.
Purchases should be consensual. Including the ones that pay for software devs.
I don't find this to be always the case, there's many relationships were the nature of work cannot be established beforehand and we have open accounts, if you ever received an invoice you were part of such an account.
The proposal is simple, if you ever need a service and you request it of me, I will send you an invoice. It is implied in the request of my service that I would get paid, absent any negotiation for payment, I will send my best estimation.
Similarly if you download my software, absent any license, I have the right to send you an invoice. The fact that there's a license that explicitly mentions this is a nail on the coffin on the part of Oracle, but even without it there's quantum meruit.
Oracle makes it very easy to hit by accident and charges way too much when it happens. It's bad behavior.
They are not charging based on benefit or use, or triple that.
Yea, this seems to be sort of analogous to companies who check whether you have a rooted device in order to take some kind of action (usually preventing the software from running). If that's a shitty thing to do, then this is, too.
Software should not be in the business of trying to (badly) guess whether the user is the right sort of user, based on inexact signals from the operating system. As others pointed out, the false positives will be annoyed, and the true positives will sidestep your efforts.
I don't think you will ever see this normalized, because it's a really dumb idea.
You certainly can observe a correlation between a "corporate customer" and MDM/GPO and use that as a heuristic. But it's like relying on the color of the sky to determine temperature: "Is it grey? Well then it's obviously cold." It's a leaky abstraction.
How so? You think big corps would pressure corporate device management providers into making their services stealthier in order to avoid paying appropriate license fees for software that does this detection?
I'd always assume the worst of corporations but I think it's a little far fetched, probably doesn't affect their bottom line to just pay for the software.
I don't think so - most organisations and employees don't actively try to violate licenses, but if the path of least resistance is "eh" then individual employees definitely aren't going to bother. I bet there are thousands of people using the free version of MSVC commercially for example.
Depending on what action you take with this, I'd say it has a pretty good chance of tipping people into emailing IT to get a license.
You can already easily pirate the software by running it on your personal device for free, and the software would never know you were also working for a corporation that was supposed to buy a license.