1

I develop software and release it under a simple license that allows people a free copy as long as it remains for personal use only. I was thinking of setting up a registration server where the software would connect, obtain a license and then proceed on. By having the user do this, I could log the IP address of the registrant and based on the amount of registrations I receive from a particular IP address, I could gauge if they were using it for personal or commercial use. I know logging IP addresses can be controversial as some people believe it's as good as a real name or home address on the Internet, or get scared if you say you have their IP address, but frankly the moment the connect to my website, Apache logs their IP address in the main log. Would logging the IP addresses of users for registration purposes contradict most privacy policies? Would this method be non-appealing to users?

If there is an alternative method for enforcing non-commercial use of a product without making legal threats or other unpleasant statements, I'd love to hear about it. This idea just came off the top of my head.

1
1

In my opinion, there is nothing wrong as far as figuring out things based on IP addresses. Many organizations do that for their analysis, evaluations and security. For example, Google puts up the local Google search based on IP addresses. Google Analytics does all kinds of analysis based on IP address origins. IP is an identifier for a user and is available for a web server to do the evaluations. There are even services like IP2Location (http://www.ip2location.com/) that takes an IP address and lets you know where it originated from.

However, note that most of these analysis are generic or aggregative in nature. I don't think it's a technically sound idea to permanently link an IP address with a user. Static IPs are not very common now and generally every time we connect to internet, we are assigned a new IP (though it would be in a fixed range of IP addresses).

So bottom line, you should be okay using an IP address to do your evaluations (e.g. evaluate license abuse) but don't assume that the same user will always have the same IP address every time he visits your software.

All the best.

1
  • +1 for highlighting the fact the IP address is not a robust verification approach. – Samuel Slade Dec 8 '11 at 8:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.