🚀 go-pugleaf

With permission from Gary Greene, I am posting email he sent me.
He outlines steps his company is moving toward to assure legitimacy
of software installation.

- Rob


Date: Mon, 3 Aug 92 18:05:01 PDT
From: Gary Greene <garyg@zip.Convergent.COM>
To: robertw@informix.com
Subject: Re: SPA piracy raid: Call for Solutions
Newsgroups: comp.sys.mac.apps
References: <1992Jul31.220223.8875@novell.com> <1992Aug3.152921.15203@informix.com>

My appologies in advance for quoting extensively.  But I think it is 
appropriate to the discussion.

In comp.sys.mac.apps you write:

>In article <1992Jul31.220223.8875@novell.com> mwalker@novell.com (Mel Walker)  
>writes:
>> My point is that it's still easier to steal software. If I wanted to steal
>> a copy of Excel, how would a company stop me? Checking out copies wouldn't
>> work. Copy protection in any form wouldn't work (assuming that I am capable
>> of breaking copy protection, or a least making a duplicate of a disk). I
>> fail to see how a company could "guard" software. How do you effectively
>> guard software without totally restricting access to it (i.e. buying a copy
>> then not letting anyone use it)?

>Restrictions to computer access can be very uncomfortable for the work  
>environment. There are ways to allow only certain people access to writeable  
>media, modems, etc., but this would make people unhappy! 

Also, in most environments this would be unworkable.  Most jobs
(except turnkey systems for online transactions) require the worker
to make floppy copies of files for various reasons.  Take away this
ability, and one eliminates these workers' ability to do useful
work on a computer.

>A company would have  
>to weigh this against the probability of measures like the SPA raids being  
>instituted from outside.

Appropriate to Mr. Walker's comment above one way to prevent theft in a
networked environment would be to place all applications on the network 
server but with permissions set so that high level copying of files from
that volume is disallowed.  A rather complex set of permissions would be
needed to run the application from that volume (temp files would need to 
be kept on the user's volume and/or in RAM; low level loading of code
into the user's RAM so the application can run on their local network
station, etc.) but all this is done already in one form or another in
many environments anyway.  A complex application running in the background
*might* be able to watch as various parts of an application are loaded
into RAM and record the code, and a programmer could then *possibly*
run a dissassembler/assember on the code to hack together a usable copy,
but in practice this is not practicle since this is NOT a trivial task.
Man hours involved would be more expensive than simply buying a legal
copy unless we are talking about massive piracy sanctioned by the company
as policy to save themselves the purchase price.  In such a case they
wouldn't be running such a protection scheme anyway.

My work environment here is a Novell network running DOS/Windows
and Unix via using Novell's TCP/IP transport layer, aka Host
Presenter, but I use a Mac at home (and wish we did here too).  A
big issue for us is becoming ISO 9000 compliant so we can continue
our business in Europe.  One point of ISO 9000 lies in protecting
the software we run.

We are moving to a setup much as I outline above.  One of the things
which is making it easier for us to do this is the large number of
applications running under DOS and Windows which have network
versions rather than per-seat versions.  We enable more versions
by buying seat extensions ...the publisher sends us a key, either
by online transaction or snailmail which increases the number of
copies we can run virtually. (Most network based applications que
calls from the user for more application code and download it to
cache memory on the user's machine, flushing least used code still
resident in the RAM cache.  This does not result in any performance
hits from accessing the network drive since not that many people
will be accessing the drive that often for it to be an issue).

My impression is that such network versions of applications are
not common on the Mac.  It would help, at least in larger environments,
if more Mac s/w publishers supported such schemes.

>> In fact, I'd like to know which companies are the "many companies" you
>> speak of, and just how much is "fairly successful at foiling copying", and
>> how do they measure their success?

>I would think very few companies will actually broadcast the amount of copying 
>that occurs at their site, but you're right - I should gather more specifics. 

>Anyone out there know what, if any, measures have been taken at sites where  
>there have been SDA raids, or other reasons for concern about copying?

We have not been raided, and have taken strong steps to eliminate any reason
for such a raid (see above).  As for "other reasons for concern" see my
comments about ISO 9000 above.

>The SPA claims in their literature that companies can and do take measures  
>agains copying. They provide a kit that monitors at least networked systems  
>against duplicate software on-line. Software on servers can be restricted by  
>limiting access to servers to people who actually need to use the applications. 
 
You can also limit access to particular directories which contain the appli-
cations, which is a more flexible approach, on both Macs and PCs, and cer-
tainly under Unix, person by person.

>Application disks can be locked away in a drawer. Disk-drive access can be  
>provided on an "as-needed" basis, so that casual copying is a bit more  
>difficult. Of course, if a company found that it was not experiencing loss of  
>its "upgrade coupons", no such measures would be needed.

If copying is locked out, then access to drives is less an issue.  If 
permissions to access a particular directory are limited to those who 
have an assigned seat for that application then security does not need to
be quite so intrusive for other more casual users.

>Also, building a unique ID into each computer in some form might help (as is  
>already the case with many workstations), but this would be somewhat similar 
>to requiring every printing press to be registered, and this would have  
>implications for freedom of speech.

Not necessarily.  Each machine on a network already has a unique i.d.
for that network.  The Mac also maintains unique i.d.s for each machine
under LocalTalk.  Under tcp/ip this protocol is common enough that it
underlies things like the Internet where not every machine runs Unix.
The network address of a machine ought to be sufficient to establish
permissions to run a server-based application.  What is necessary to
protect freedom of speech is clear rules limiting invasion of privacy
where user communications are concerned.  A unique i.d. for machines
is no different than knowing the address for the N.Y. Times or the
Washington Post.  An i.d. is an address, not a license.  Now if there
were laws and rules restricting who could have an address you might be
correct.  But no newspaper or other publisher acts anonymously (except
samizdat publishers under a dictatorial regime).

>My concern is not with how tight an environment can be made (and how clever 
>a breaker would have to be), but with the uncomfortable situation of an 
>employee who would like to see intellectual property rights respected, but 
>finds himself in an environment that encourages copying. If a company had 
>some incentive to limit copying, as they currently have incentives to limit 
>loss of hardware, they would find some measures to promote this.

Agreed.  But my impression is that the bigest losses come from companies
who intentionally pirate software.  I once worked for a small business
who did this and expected us to actively help in the piracy.  I got the
hell out of there.  I did NOT appreciate their pressure to aid and abet
them in their crime just to save them some operating expense.  They are
thankfully out of business now, since I had real problems with the idea
of turning in my friends who remained when they were doing what they were
doing under pressure from the people who cut their paychecks.  The company
should be racked, particularly where they are pressuring their employees,
and not the workers themselves *unless* it is the workers who are doing
the piracy for their own benefit without knowledge of the company.  Even
then the company bears some responsibility for maintaining lax security
(if they have been lax).

>No-one can prevent theft of hardware or other real-world possessions, either,  
>but some measures help.

Locks are meant to keep honest people honest.  A pro can always beat them.
A company's responsibility is to maintain sufficient security so that
theft is not an attractive nuisance.  Measures beyond that ought to be
strictly based on economic feasability.

Sorry about using e-mail to respond to a public discussion, but posting
from my machine here is often broken.

Respects,

Gary Greene
Unisys, Unix Systems Group		garyg@convergent.com
San Jose, California			garyg@netcom.com (at home)



--
*********   MY OPINIONS, not those of my employer!   **************
+================================+================================+
|         Rob Weinberg           |  Workstation publications tech |
|   Email : robertw@informix.com |        Graphic designer        |
|   Voice : 415-926-6754         |     <imagine your ad here>     |
+================================+================================+