5 ms·

Ask HN: Comercial software protection

6 points by ukmar 10y ago

As a side project I developed an application which update after update turned out quite nice. Since I know it fits a niche market I would like to make it comercial ($50) per license. However what bothers me is the protecion. What type of protection can I use that: 1) does not use a dongle 2) should not take more than 2 months to implement. I'd like if you pointed to materials to read and implementations examples.

dsl 10y ago
See if you can sell it first. When piracy becomes a problem, then look into software protection. Niche software rarely gets pirated because the demand is low.
azeirah 10y ago
What exactly do you want to protect against? In my personal experience, customers can be trusted and hackers don't care about your software. For my own software I've implemented an extremely basic licensing system. I've collected data about how many unique mac addresses use each unique license, so I can count what licenses are used by multiple computers. I've just done a simple filter on all my licenses to see which ones are used by over 5 mac-addresses. I expected there to be more, but the result was 13. There are 13 licenses that are being used by more than 5 computers, none of those licenses are used by over 14 computers. That's 13 out of about 3500 licenses mind you. This is just my reality, maybe your target niche is script kiddies or broke CS students, consider your target group, but I suggest you not to worry too much about it, just implement a really basic licensing system to prevent no-effort abuse and you'll be fine.
- ukmar 10y ago
  Exactly, I want to protect from multiple installation with one license. Do you have a server that you use for the licensing? How did you come up with such statistic? How do you handle if one client changes pc (MAC changes), does he really change pc?
  - azeirah 10y ago
    I have a server, yes, every time someone starts up my application, it sends a request to my server to with a (LICENSE, MAC-ADDRESS) tuple, which I store. So far, I've never acted on MAC changes. If I saw a license that was used by say 50 MAC-addresses, I would disable it and send an email to the original buyer, scoff at him and give him a new license. But so far no-one has done this, not one person out of ~3500 has shared their license with a larger group of people. Just trust your users for now, collect some statistics if you're really concerned, and act if someone is really abusing your system. Don't ever go after ambiguous cases, ever. I made this mistake in the beginning, got many MANY false flags. I think collecting the statistics is a really good idea, because it will show you that your userbase is trustable, and you will change your perspective on software protection :)
    - danieltillett 10y ago
      You do realise crackers strip out your server request code. This is trivial to do. You really have no idea of how many people are using your program.
      - azeirah 10y ago
        Oh yeah true, but I know I can't project against that anyway, pirates gonna pirate, and I'm not against that. But tbf, I don't think there are any people who even bothered cracking my program...
        danieltillett 10y ago
        You can, but it is not easy, simple, or very user friendly. It really depends on your market and software. For most software it doesn't make sense to bother with anything other than the most basic licensing system, but for some software it does. I sell quite a lot of software in China and India and I would not be able to do this unless I spent a lot of time and money on anti-cracking activities.
danieltillett 10y ago
It depends on what market you sell into. If you are selling niche software in the USA and Europe then don't worry too much about piracy. If you are planning on selling in China and India then you need to think very seriously about how to protecting your software. My company sells a lot of expensive niche software into the Chinese and Indian market and about 50% of our development effort goes into software protection. Unfortunately there is no easy solution, but if you want to contact me offline I can suggest some solutions.
- ukmar 10y ago
  Actually the thing that bothers me is not protection per se as I know that someone with enough determinism will crack it. I am curious how do you handle license revocation or when you detect if someone is using an illegal license. What about offline users? How to handle licensing?
  - danieltillett 10y ago
    Sure if someone puts enough effort into something anything can be cracked, but you can make it long and slow job. This is 99% of the job done if you have niche software. In regards what protection we use, I am not too keen to list them in public, but my basic principle is layering. Use enough different systems and layers and you are going to make life very hard for a cracker.
BjoernKW 10y ago
For Java there's License4J: http://www.license4j.com/ http://www.license4j.com/ There should be similar tools for other languages as well. My suggestion is to not overthink it. There's no perfect solution that will prevent your software from being copied in every scenario imaginable. Just use common sense. It certainly shouldn't take 2 months to implement. Your customers aren't paying for copy protection after all.
brudgers 10y ago
The best way to protect commercial software from piracy is to sell into markets where piracy is against market practice. For example, enterprise and government institutions often have license compliance policies accompanied by audits and trainings and memoranda and scoldings. Part of that means that the pricing policy should discourage piracy. An institution for which the difference between $50 per seat and $500 per seat is a big deal for a product that provides $10k+ of value is more likely to pirate as a matter of cultural ambiance. And a price of $500 per seat increases the likelihood of having the resources to provide $10k+ of value over the long term. $500 per seat also means that piracy is less likely to take food off the table even if a substantial fraction of use is unlicensed. Good luck.

6 points by ukmar 10y ago

dsl 10y ago

See if you can sell it first. When piracy becomes a problem, then look into software protection. Niche software rarely gets pirated because the demand is low.

azeirah 10y ago

What exactly do you want to protect against? In my personal experience, customers can be trusted and hackers don't care about your software. For my own software I've implemented an extremely basic licensing system. I've collected data about how many unique mac addresses use each unique license, so I can count what licenses are used by multiple computers. I've just done a simple filter on all my licenses to see which ones are used by over 5 mac-addresses. I expected there to be more, but the result was 13. There are 13 licenses that are being used by more than 5 computers, none of those licenses are used by over 14 computers. That's 13 out of about 3500 licenses mind you. This is just my reality, maybe your target niche is script kiddies or broke CS students, consider your target group, but I suggest you not to worry too much about it, just implement a really basic licensing system to prevent no-effort abuse and you'll be fine.

ukmar 10y ago
Exactly, I want to protect from multiple installation with one license. Do you have a server that you use for the licensing? How did you come up with such statistic? How do you handle if one client changes pc (MAC changes), does he really change pc?
- azeirah 10y ago
  I have a server, yes, every time someone starts up my application, it sends a request to my server to with a (LICENSE, MAC-ADDRESS) tuple, which I store. So far, I've never acted on MAC changes. If I saw a license that was used by say 50 MAC-addresses, I would disable it and send an email to the original buyer, scoff at him and give him a new license. But so far no-one has done this, not one person out of ~3500 has shared their license with a larger group of people. Just trust your users for now, collect some statistics if you're really concerned, and act if someone is really abusing your system. Don't ever go after ambiguous cases, ever. I made this mistake in the beginning, got many MANY false flags. I think collecting the statistics is a really good idea, because it will show you that your userbase is trustable, and you will change your perspective on software protection :)
  - danieltillett 10y ago
    You do realise crackers strip out your server request code. This is trivial to do. You really have no idea of how many people are using your program.
    - azeirah 10y ago
      Oh yeah true, but I know I can't project against that anyway, pirates gonna pirate, and I'm not against that. But tbf, I don't think there are any people who even bothered cracking my program...
      - danieltillett 10y ago
        You can, but it is not easy, simple, or very user friendly. It really depends on your market and software. For most software it doesn't make sense to bother with anything other than the most basic licensing system, but for some software it does. I sell quite a lot of software in China and India and I would not be able to do this unless I spent a lot of time and money on anti-cracking activities.

danieltillett 10y ago

It depends on what market you sell into. If you are selling niche software in the USA and Europe then don't worry too much about piracy. If you are planning on selling in China and India then you need to think very seriously about how to protecting your software. My company sells a lot of expensive niche software into the Chinese and Indian market and about 50% of our development effort goes into software protection. Unfortunately there is no easy solution, but if you want to contact me offline I can suggest some solutions.

ukmar 10y ago
Actually the thing that bothers me is not protection per se as I know that someone with enough determinism will crack it. I am curious how do you handle license revocation or when you detect if someone is using an illegal license. What about offline users? How to handle licensing?
- danieltillett 10y ago
  Sure if someone puts enough effort into something anything can be cracked, but you can make it long and slow job. This is 99% of the job done if you have niche software. In regards what protection we use, I am not too keen to list them in public, but my basic principle is layering. Use enough different systems and layers and you are going to make life very hard for a cracker.

BjoernKW 10y ago

For Java there's License4J: http://www.license4j.com/ http://www.license4j.com/ There should be similar tools for other languages as well. My suggestion is to not overthink it. There's no perfect solution that will prevent your software from being copied in every scenario imaginable. Just use common sense. It certainly shouldn't take 2 months to implement. Your customers aren't paying for copy protection after all.

brudgers 10y ago

The best way to protect commercial software from piracy is to sell into markets where piracy is against market practice. For example, enterprise and government institutions often have license compliance policies accompanied by audits and trainings and memoranda and scoldings. Part of that means that the pricing policy should discourage piracy. An institution for which the difference between $50 per seat and $500 per seat is a big deal for a product that provides $10k+ of value is more likely to pirate as a matter of cultural ambiance. And a price of $500 per seat increases the likelihood of having the resources to provide $10k+ of value over the long term. $500 per seat also means that piracy is less likely to take food off the table even if a substantial fraction of use is unlicensed. Good luck.