Change to Patch services effective September 18, 2010

[Ian Miller.]

For AllianceOne (DSPP) members there is now a way to get access to patches.

www.hp.com/go/allianceonepatchaccess

Here is the relevant text from that web site

"If you are an AllianceONE member you can request access to patches for use on your demonstration, development, and test systems. You will be provided with a Support Agreement ID which you can use to access patches via the IT Resource Center (ITRC). Free membership in ITRC is required.

After you agree to the Terms and Conditions you will be taken to a form to request access to patches.

You must supply the serial number of one system which you use for demonstration, development, or testing purposes.

Patches obtained in this manner are only for systems used for demonstration, development, or testing purposes â not for production.

The lead time to set up a Support Agreement ID is two weeks. If your request is urgent please contact your Partner Business Manager or the AllianceONE Program Office."

[Steven Schweda]

> For AllianceOne (DSPP) members there is now
> a way to get access to patches. [...]

Does that help a non-commercial software
developer who has multiple VAX, Alpha, and
IA64 systems? As I recall, DSPP benefits for
anyone who wasn't selling something were
minimal.

[Ian Miller.]

Arrangement's for hobbyists are still unknown at this time.

[Steven Schweda]

> Arrangement's for hobbyists are still
> unknown at this time.

If you think that I'm annoyed because I can't
get patches for my free Hobbyist VMS systems,
just imagine how annoyed I must be because I
also can't get patches for my non-free
Non-Commercial Tru64 system. I shelled out
$99 for that one, plus some number of $39
updates over the past decade or so.



> Arrangement's for hobbyists [...]

Not:
Arrangements for hobbyist's [...]
or:
Arrangement's for hobbyist's [...]
?

My personal preference:
Arrangements for hobbyists [...]
Simple, consistent, even correct.

[Steven Schweda]

It took a while, but at last I got what
looks like an authoritative and definitive
reply on the question of patch access for VMS
hobbyists:

Mon, 18 Oct 2010 04:04:10 -0500 (CDT)

From: Office of OpenVMS Programs

All hobbyists are also required to buy the support pack to
ensure getting patches.

Thanks and Warm Regards
Sujatha
Global Lead- Customer & Partner Technical programs-Open VMS

I'd like to think that it's not also the
final answer, but it appears now that the
value of the VMS Hobbyist program has
officially plummeted.

[Ian Miller.]

I've seen plenty on the hobbyist programme in general.

I've yet to see many specific arguments for hobbyists having access to patches.

[Steven Schweda]

> I've yet to see many specific arguments for
> hobbyists having access to patches.

Here's one, specific to one hobbyist.

Considering the quality of unpatched VMS, if
I can't get (free/cheap) access to patches
for VMS, then there's no very strong reason
for me to continue using it as my main OS at
home, as I have since 1999.

One might reasonably infer that if (when) VMS
ceases to be my main OS, my interest in
maintaining a variety of freeware programs on
VMS will naturally decline. I'll leave it to
others to judge the value of my contributions
(like, say, Info-ZIP improvements since 2004,
and all the stuff which might be found at
"http://antinode.info/dec/index.html", plus
occasional bug reports).

HP apparently perceives little if any value
in cultivation of my interest in VMS (or
Tru64, or HP-UX).

[Richard Jordan]

Here's another. I have three VMS systems at home, two under hobby licenses, one still under its real ones. I (used to) get to install current versions on the two hobby boxes, so I get to run the newest SWS/SWB/SSL/Java/MySQL/JFP software, etc available well before anything could happen at work. I can take my boxes down, upgrade them whenever, etc. And learn the things I can't do at work because we're either too busy or more often totally buried in the noisome task of supporting more and more broken P.O.S. windows systems.

So I know I can do 'X' with an VMS server running current SWS and PHP (and hence reasonably more current VMS than I have on the work systems) like running a certain CMS or program, or using MySQL from a classic VMS program, directly run a Perl/Python/PHO program, or whatever. So when we hear a customer needs new capability 'Y' and all the natterers start plotting how many PC servers it will take, I can pop up and say "I'm doing that at home on the old DS10-L, their box is newer and has the capacity to handle it without a problem".

Of course not selling more PC servers may be a perfectly valid reason for this hobby user to be disallowed patch access in HP's eyes. But we've got websites and other services on several Alphas and one itanic that saved our customers money, provided more non-conflicting utilization of an expensive resource, potentially saved (or at least extended) their lifetime on VMS, and darned if they aren't extremely reliable too.

All because I get to play with my VMS boxes at home and stay up to date, thank you very much.

[Craig A Berry]

I maintain Perl on VMS, mostly alone for the last eight years or so, but I was a significant contributor for some time before that. Without the hobbyist program there would simply be no Perl on VMS.

I have heard that the world's largest database company uses Perl on VMS in their build scripts, and a very large bank in Europe runs reports written in Perl, and lots of other places small and large use it on VMS for assorted purposes.

I happen not to use Perl extensively at work, and opportunities to spend work time or resources on maintaining it are nonexistent; that's all done on my own time with my hobbyist systems. That's not a complaint, just a heads up for Ian and other folks who think that what hobbyists do is unserious or unimportant just because it's unremunerated.

I discovered a regression in the v8.4 implementation of symbolic links simply by running the Perl test suite. I spent several hours of my time boiling it down to a dead simple reproducer and reporting it; the fix for it is in update v4.0. It will be some months (maybe a year) before our work machines are ready to move to v8.4. Am I supposed to wait until then before I can re-test and see if the update really fixed the bug? That's not a very nice thank you for helping HP repair its software defects.

HP very much needs a thriving hobbyist community to keep essential bits of common infrastructure running on VMS. Why would they not want that development to take place on the latest patch level?

I also have my doubts about whether hobbyists will even be able to "buy the support pack." It's already rather difficult for SMBs to buy VMS hardware and software, so I can't imagine HP sales reps or resellers will have a clue (or any interest) in helping hobbyists buy a support pack for a product they didn't buy in the first place.

[Steven Schweda]

> HP very much needs a thriving hobbyist
> community to keep essential bits of common
> infrastructure running on VMS.

I agree.

> Why would
> they not want that development to take
> place on the latest patch level?

It's a mystery to me. Apparently, the policy
makers at HP believe that this change will
gain more for HP than it loses. Perhaps
they're right. Or, perhaps they're so
completely disconnected from the worker bees
and the victims as to be ignorant of the side
effects such a change might have. Time will
tell, I assume. If they decide to change
this policy to accommodate Hobbyist freeware
developers, I hope that they do it before I
stop caring.

[Ian Miller.]

Thank you for the good material so far - it is all being gathered and passed on in the hope this will make a difference.

[Richard J Maher]

Look, it's only my two cents but I really think people might be being a bit precious about this. I know I shoot my mouth off at the drop of the hat and antagonize people but that is because (for me) nothing is going to happen :-(

For the Steven's of this world with a track record of delivery *I know* you will get access to patch kits! Just stop bitching and moaning in public and get your DSPP/AlianceSomething profile updated for access. There are ways and the rest of the world does not need to know the details. Be an exception; try to live with your privileged status while the rest of the world goes hungry; just get on with it!

You are not a shop steward or a Gandhi but do provide a valuable service. Please assist those who are not automatically aware of your brilliance in assessing your claim.

Cheers Richard Maher

[Steven Schweda]

> [...] *I know* [...]

Apparently, _you_ know more about this than I
do. Will _you_ be providing these services?
I've had not even a suggestion from anyone at
HP that HP will.

> [...] stop bitching and moaning in public
> [...]

Our definitions must differ. I thought that
I was reporting the results of my private
inquiries back to others who may be in a
similar situation. And then complaining
about those results (which were not entirely
satisfactory).

> [...] get your DSPP/AlianceSomething
> profile updated for access [...]

Is this another service which you are
offering? My past attempts to get into DSPP
were rejected, because that program was
intended for commercial software developers,
and I was told that I didn't qualify.

> [...] Be an exception; [...]

I'd be happy to, but it's out of my control.

> [...] Please assist those who are not
> automatically aware of your brilliance
> [...]

I don't claim "brilliance", only a certain
usefulness. You seem to assume things about
my private communication with HP which lack
justification.


By the way, GnuPG 1.4.11 for VMS is now
available.

[Brad McCusker]

DFU is a freeware tool used by many of our customers on a daily basis performing critical tasks in their production environments. I don't know the current maintainer's specific situation with regards to access to patches, but that could be another example of a product that is critical to production operations that could be at risk without hobbyist patches.

I am sure there are many other freeware products out there that OpenVMS customers depend on and whose maintainers depend on the hobbyist program.

Maybe the answer is not necessarily to get hobbyists access to patches, but instead to reclassify hobbyists who maintain well known freeware tools so they can be members of AllianceOne (DSPP). Perhaps the Office of OpenVMS programs could broker the arrangement - they would be responsible for identifying the hobbyists that qualify.

People who maintain these freeware products are functionally extensions of VMS engineering. Maybe VMS engineering can find a way to provide for their needs?

Brad McCusker

[Jan van den Ende]

Brad,

he also maintains LDDRIVER. And AFAIK, _THAT_ is essential to Engineering itself...

Go figure.

Proost.

Have one on me.

jpe

[tsgdavid]

This whole issue seems ironic to me in light of the fact that HP is spending so much effort to provide tools on OpenVMS so that public domain software will port easier.

Does HP really want to capitalize on the availability of public domain software for OpenVMS? How can we encourage this kind of activity and yet say you must sign a contract to get patches?

[Graham Burley]

It's been suggested an number of times in this thread that security patches would still be publicly available - I'd just like to point out that they're not, at least the ones that where made available via ITRC ftp, e.g.

SMGRTL patches (HPSBOV02364).

June 2010 SYS MUPS (HPSBOV02539), e.g. VMS83A_SYS_MUP-V1700, which I would also like to note depends on VMS83A_UPDATE-V1300 and VMS83A_PCSI-V0200.

[Ian Miller.]

Note that for porting opensource there are systems available if you contact openvms.programs at hp

[Jur van der Burg]

It's true that I maintain DFU and LDdriver, and that the lack of the latest patches may influence that. And yes, without LD there's no VMS as it's used heavily in the VMS build. This is yet another stupid HP upper management decision.

Sadly there's no patch for stupidity.

Jur.

[Steven Schweda]

> Note that for porting opensource there are
> systems available if you contact
> openvms.programs at hp

Please elaborate. Do these systems include
Alpha, IA64, and VAX systems at various VMS
versions, on which I'd have full privileges?
Tru64?


> Sadly there's no patch for stupidity.

There might be one, but it'd probably be for
the BRAIN product, so it might easily have
been overlooked. And it might have gotten an
inappropriate Installation Rating. I suspect
something like:

[...]
2 KIT DESCRIPTION:

2.1 Installation Rating:

INSTALL_2 : To be installed by all customers using the
following feature(s):

- BRAIN
[...]

INSTALL_1 might have been better.

[Doug Phillips]

I find nothing that changes the restrictions on the patches themselves; only "a change in the way that Patch content is accessed."

Since I can no longer access the patches, I can't see if the patch copyright notices have been changed to restrict the application of patches to support contract customers. The copyrights on the patches I have say "Valid license from HP and/or its subsidiaries required for possession, use, or copying."

IANAL but I would think having a valid OpenVMS license should satisfy the legal question about whether one is or is not entitled to patch a buggy system so that it works as advertised.

I still see no official statement from HP that actually details this policy change or states that security patches will continue to be publicly available. And, as Graham Burley has pointed out, security patches are often dependent upon other patches.

Looking at the apparent depth of planning that went into this new policy, and how thoughtfully it has been executed, I wonder if HP might have put their SAPS conversion team in charge of this conversion, too. :)

[Graham Burley]

> I can't see if the patch copyright notices have been changed

They haven't.

[Jeffrey Goodwin]

>IANAL but I would think having a valid OpenVMS license should satisfy the legal question about whether one is or is not entitled to patch a buggy system so that it works as advertised.

HP software comes with a 90 day warranty. I know many people equate the license language in the patch to having a license PAK, but I've never read it that way.

It is possible that you might be entitled to fixes based on an implied warranty that would supercede the express warranty. These warranty laws differ greatly in various jurisdictions. For example, my state in the US only allows an implied warranty on consumer goods.

-Jeff

[Doug Phillips]

>> HP software comes with a 90 day warranty.

This is *full* support, beyond just patches.

>> I know many people equate the license language in the patch to having a license PAK, but I've never read it that way.
<<
Since patches are not individually licensed, it would be reasonable to believe the wording says that the product being patched must be licensed since the patch becomes a part of that product.

>> It is possible that you might be entitled to fixes based on an implied warranty that would supercede the express warranty. These warranty laws differ greatly in various jurisdictions. For example, my state in the US only allows an implied warranty on consumer goods.
<<
It would be more possible that one would be entitled to patches based on the policy in effect at the time the software (license) was purchased. Since the official legalize regarding updates that I've found talks about dash versus dot updates, and doesn't address bug fixes, precedent should rule.

The dearth of detailed policy statements and HP's apparent lack of planning prior to making this change is underwhelming.

[Ian Miller.]

If you email openvms.programs at hp asking about the opensource porting systems they can tell you more.