Standardized Software File Headers

Assuming some standard already existed, what would be the cost/benefit analysis from a software publisher's perspective to add this checking to their existing release management process? Would a release management tool assist in the adoption of such a standard? What do existing SAM software tool developers have to say about this?

The biggest frustration I run into with discovery data is when the registry headers of the evaluation-only and fully-licensed versions of a desktop application are identical....

I think this issue is simply not on the radar of the development teams at most publishers. This is not a difficult thing to fix, and can provide SAM people with much more valid reporting.

Industry standards would be nice, but in the meantime I'd suggest telling your vendor reps what you need to effectively manage their product. There's no better time for this than before you have signed a VLA with them....

-br

Interesting post. During 2003 and early 2004 I placed nearly 100 calls to software publishers asking how they would like business consumers to act proactively to improve compliance discovery processes. My questions were met with the telephonic version of a blank stare. It seems that the anti-piracy lines are not "prevent piracy" lines. They are reporting lines and any proactive cosumer questions are quickly buried in carefully read scripts. Caution: I have worked with multiple companies who literally set themselves up for a piracy audit by proactively contacting publishers to request help straightening out license issues.

The reason I bring all this up is that I have constantly requested precisely the information you mention in your post. The reply I received from two enforcement entities and one software publisher was essentially: "If we told the consumer, then the people pirating software will know how to fake the system."

Interesting catch-22, isn't it? The bottom line seems to be that the majority of copyright holders that believe in confrontational license compliance assurance methods are almost wholly focused on enforcement, not prevention. Making it easy for the consumer to identify products is simply not on the list of "things to do today."

By the way, you are absolutely correct: The time to place all of these issues on the table is prior to closing a license negotiation--before you hand over a single dollar, euro, or brick of pure gold.

Questions? Feel free to contact me. Rita is also well ahead of these issues and is a great resource.

The project of a file header standardization in another organization was proposed. There was even a committee formed. Then it just vanished. No lack of my trying from yours truly, you understand, but it just went off the radar.

There are a number of benefits to the consumer if the headers were standardized. Discovery tools would be much more efficient in their locating and identifying software on a PC. Even software that not would necessarily be in the discovery tools software ID database.

By being able to more readily identify rouge software, instead of wasting tons of time trying to figure out all the unidentified software, how much time would be saved??? And remember, "time = money".

As part of standardization, it would be easier to figure out what the "primary" components of a software package are. Where this is a benefit is instead of, again, wasting time trying to figure out things like, is a piece of software we need to track? You know, things like hardware drivers, secondary components, etc. Again, saving time.

And then there is this bogus argument of "If we told the consumer, then the people pirating software will know how to fake the system." Excuse me, but isn't that the problem now, piracy??? If IT Asset Managers could more easily make themselves compliant, would that not enable the software police to be able to better use their resources to go after the real pirates??? But then, I forget about the revenue generated from compliance actions against companies who are doing their level best to be compliant.

I think there is a really good cost/benefit analysis that could be done from the consumer point of view for standardized headers. But, the revenue stream for software publishers may take a hit. So, just from that perspective, I don't expect software publishers to buy into the idea of software header standardization.

I guess I should step down from my soapbox now.

Thomas A. Wills, CSM, CITAM
Information Systems Manager, Software Compliance
Tucson, AZ