Software goes extinct

I AM ADJUSTING to the idea that I cannot own a piece of software.

Free IT resource Hear how top CIOs turn change into a competitive advantage. Sponsored by HP Free IT resource Attend the SOA Executive Forum: Breaking SOA Bottlenecks SOAExecForum.com/may2007 Sponsored by InfoWorld

The "right to use" license has been standard issue for many years now. In 99 paragraphs, your company releases, holds harmless, and grants the perpetual right of unrestricted search and seizure to the vendor that wrote the spreadsheet. In return, the vendor says it might replace a scratched CD-ROM at your expense.

Same old, same old. Just click Accept.

I send up a periodic flare encouraging IT managers to read the license agreements that they and their employees are signing. Contrary to some rumors, these idiotic documents do hold up in court. A recent case slapped a vendor for an abbreviated license, a sticker that said, "By opening this box, you agree to the license terms on our Web site." The judge said parties can't be bound to agreements they're unable to read at the time. Score one for justice. But the same ruling affirmed that a click-through agreement listing the full license terms, even if those terms are incomprehensible, is valid.

Everyone is on the lookout for hardware-enforced digital rights management, but that's a distraction. While we're watching for Palladium, vendors are arming software with the ability to defend itself. Licenses granting vendors the right to do this went out over the past year, and they didn't stir up much controversy.

Through incremental license tweaks, many vendor-supplied updates are now blind and mandatory. You have no idea what's in the new code being pushed to your systems. You waived your right to refuse its delivery.

Besides, tack a security fix onto any update, regardless of its true purpose, and everyone has to install it.

It's ironic that the hackers who say they're fighting for freedom are giving vendors the means to blackmail users into accepting untenable terms. It's the price of protection from evildoers.

Software, as IT has known it for years, now only exists in open-source format. That format is not inherently more secure, and some open-source licenses have onerous terms. But it's much harder to sneak a remote detonator into code that capable users can examine and change. Eventually, the ability to push a button in California that wipes out files in New York is going to be as standard as the unreadable click-through license, and you can be sure that vendors will claim the right to nuke your apps for any reason.

A year ago, I'd have said you need to get some lawyers to explain your licenses to you. Now I think it's time to trade those lawyers for some hardcore programmers who can do a line-by-line analysis of every piece of software that's added to your production systems.

I realize a shift like that will take years if it's practical at all. But clicking I Do Not Accept, even on a small (but visible) scale, is the only way to take control back from vendors who see no limits to what they can force customers to do.