C[omp]ute

From: andrew cooke <andrew@...>

Date: Fri, 4 Oct 2013 21:20:52 -0300

I've been thinking about how best to license software that is:
 - interpreted (so easy to modify)
 - low volume (and so fairly high price)
 - sold to a fairly small / closed community
 - useful (and so a free demo will help it "sell itself")

Given the above, the most obvious conclusion is that technical measures are
unlikely to work (at least, alone).  But since the market is a fairly
close-kint community "social cues" might work well.  So the general approach
would seem to be allow some kind of demo version to be run at no cost, but to
require a licence for "real use".


Consider the kind of person who might use this software.  They are probably
reasonably technical, but not in control of purchasing decisions.  They learn
about the software through word-of-mouth, install it, find it useful, and...
What happens next?

What I would like to happen is that I sell a licence to their employer.  How
do I get there?

There seem to be two routes.  First, they might contact whoever is responsible
for purchasing, or the software might be "noticed" by someone similar.  So I
need to encourage that kind of behaviour - for example, by displaying in the
user interface "Demo Use Only - Please Buy a Licence".

Second, I could make contact with the institutions that are using the
software.  But to do this, I need to know who the users are.  That suggests
some kind of "phone home" feature - perhaps registration or to retrieve
updates.


The scenario described doesn't rely on a (technically) restrictive licence.
In fact, it seems like a licence mechanism that limited functionality could do
more harm than good - people would modify the program to enable the
functionality, disabling the cues intended to push them towards purchase.

So what role does the licence play?  Is it just a file that disables the
"Please Pay" message?  That seems like it would be too easy to duplicate.
Trivial duplication could be blocked by having a signed, named user.  The
software would then either display "Licensed to XXX", whch would look bad if
XXX was another institution, or remain at "Please Pay" if the signature was
incorrect.

Of course, signature verification could be disabled by hacking the code.  But
two things mitigate against this.  First, as mentioned above, there's no other
motivation to modify the code (all functionality is available).  And second,
auto-updates (which would justify "phone home") could reset changes.


So we seem to be heading towards a self-consistent approach:
 - a "morally reasonable" message that says "Demo Only" or similar
 - a signed licence that replaces "Demo Only" with "Licensed to XXX"
 - auto-updates (and some kind of tracking of request IPs on the server)

This allows users to install and experiment with the software without any
problems.  It also gives them the social cues and support to request payment
by whoever controls purchasing.

My only real worry about this is that tracking downloads and update IP
requests seems a bit icky.  Is that OK?  Should it be more explicit?  If I
contacted an organisation saying "Hi, you seem to have demoes my software, are
you interested in buying a licence?" would that seem out of place?

Andrew

PS The above still raises a bunch of technical issues: auto-update; persistent
config outside the auto-update; interface for loading a licence; crypto
signatures.