4 ms·

It's possible, but not very ideal to have all the operations done on the server, and just serve interface stuff, maybe even as a streaming video, to the client.

It's possible, but not very ideal to have all the operations done on the server, and just serve interface stuff, maybe even as a streaming video, to the client. When people paint, they want it responsive, no stream lag, no server hiccups. I must allow people to install the software on their computer. I would still like to protect the work I've done, because I'm just one guy making software, and I don't have marketing money. What would stop big companies from taking my source and spending more on advertising? I need source protection.

kuschku 9y ago
> What would stop big companies from taking my source and spending more on advertising? I need source protection. If your threat model is a company with billions in of dollars in revenue, then source protection is useless. NW.js protection can be cracked, too, requiring maybe one or two man-months more. For a student reversing it, this is annoying, but not a problem. For GoogleAppleAdobeZon? They dont even notice the cost difference. You can be Snapchat, have unique features, and have it all obfuscated — and Facebook can still copy it all in weeks. The question isn't "will Adobe be able to copy my app" — the answer to that is always yes.
- danschumann 9y ago
  Sure it's possible, but I'm trying to make it as hard as possible. Currently I think NW.js source protection is the hardest. I think there are times when open source isn't the best. I never would have spent so much time making art software if I didn't think I could make it reasonably hard to crack. Eh, maybe I would have anyway, but I might have just made another mindless web app that wasn't difficult to code. I think there are definitely cases where closed source works, especially when certain algorithms are easy to read but hard to contrive.
  - kuschku 9y ago
    Well, NW.js is the strongest on the web. For native binaries, such as games, currently the strongest solution is Denuvo, from a team that formerly implemented copy protection for Sony. Decades of engineering went into it, at the risk of significantly slowing down the game, using several layers of obfuscation (including VMProtect), all wrapped around the existing, older obfuscation schemes, for a native binary. The first version of it took a few hobbyists 6 months to break, by now games protected with it get usually broken within of one week or less by hobbyists. That’s hobbyists. If, as you truly say, your threat model is Adobe, or a similar corporation, your obfuscation is basically useless. If determined individuals can break some of the most advanced obfuscation schemes in days, how long do you think will it take Adobe to break yours, if they actually see you as competitor? > I think there are definitely cases where closed source works, especially when certain algorithms are easy to read but hard to contrive. They work short-term, but as soon as someone extracts the algorithm once, everyone has it. Especially considering that in most places algorithms are neither protected by copyright nor patents (including the EU).
    - Fifer82 9y ago
      Denuvo... I can't remember the game (it was shite) but it got cracked 6 hours before release. You have to laugh especially because it actually did create low FPS so all the actual customers were pissed off. Same story since the Amiga Days
  - esrauch 9y ago
    Do you believe that Adobe would lift algorithms from your non-open source JS if not for NS.js? Or are you worried about some other tiny company? As someone who worked for a while on painting tech at a BigCo, the truth is that the chance that a BigCo would steal an algorithm from your one-man-paint-app's minimally obfuscated JS is extremely close to zero (excluding if it was MIT/BSD OSS license, and even then I would be pretty surprised if it happened). Anything half as novel as you are describing would be better leveraged by talking about some of it as siggraph and then acqui-hire selling your company for millions to a Adobe/Microsoft/Apple type. It makes perfect sense to not open source it, but if you are trying to build this as a business any amount of time you second you spend trying harden your source from some hypothetical reverse engineering boogeyman (that is likely to never even be trivially attempted) is time that would be much better spent on marketing or improving your product.
imtringued 9y ago
>What would stop big companies from taking my source and spending more on advertising? Almost every country on this planet has copyright laws. If you're worried about them ignoring the law and taking your source code why are you not worried about them ignoring the law and physically stealing your computers?

kuschku 9y ago

> What would stop big companies from taking my source and spending more on advertising? I need source protection. If your threat model is a company with billions in of dollars in revenue, then source protection is useless. NW.js protection can be cracked, too, requiring maybe one or two man-months more. For a student reversing it, this is annoying, but not a problem. For GoogleAppleAdobeZon? They dont even notice the cost difference. You can be Snapchat, have unique features, and have it all obfuscated — and Facebook can still copy it all in weeks. The question isn't "will Adobe be able to copy my app" — the answer to that is always yes.

danschumann 9y ago
Sure it's possible, but I'm trying to make it as hard as possible. Currently I think NW.js source protection is the hardest. I think there are times when open source isn't the best. I never would have spent so much time making art software if I didn't think I could make it reasonably hard to crack. Eh, maybe I would have anyway, but I might have just made another mindless web app that wasn't difficult to code. I think there are definitely cases where closed source works, especially when certain algorithms are easy to read but hard to contrive.
- kuschku 9y ago
  Well, NW.js is the strongest on the web. For native binaries, such as games, currently the strongest solution is Denuvo, from a team that formerly implemented copy protection for Sony. Decades of engineering went into it, at the risk of significantly slowing down the game, using several layers of obfuscation (including VMProtect), all wrapped around the existing, older obfuscation schemes, for a native binary. The first version of it took a few hobbyists 6 months to break, by now games protected with it get usually broken within of one week or less by hobbyists. That’s hobbyists. If, as you truly say, your threat model is Adobe, or a similar corporation, your obfuscation is basically useless. If determined individuals can break some of the most advanced obfuscation schemes in days, how long do you think will it take Adobe to break yours, if they actually see you as competitor? > I think there are definitely cases where closed source works, especially when certain algorithms are easy to read but hard to contrive. They work short-term, but as soon as someone extracts the algorithm once, everyone has it. Especially considering that in most places algorithms are neither protected by copyright nor patents (including the EU).
  - Fifer82 9y ago
    Denuvo... I can't remember the game (it was shite) but it got cracked 6 hours before release. You have to laugh especially because it actually did create low FPS so all the actual customers were pissed off. Same story since the Amiga Days
- esrauch 9y ago
  Do you believe that Adobe would lift algorithms from your non-open source JS if not for NS.js? Or are you worried about some other tiny company? As someone who worked for a while on painting tech at a BigCo, the truth is that the chance that a BigCo would steal an algorithm from your one-man-paint-app's minimally obfuscated JS is extremely close to zero (excluding if it was MIT/BSD OSS license, and even then I would be pretty surprised if it happened). Anything half as novel as you are describing would be better leveraged by talking about some of it as siggraph and then acqui-hire selling your company for millions to a Adobe/Microsoft/Apple type. It makes perfect sense to not open source it, but if you are trying to build this as a business any amount of time you second you spend trying harden your source from some hypothetical reverse engineering boogeyman (that is likely to never even be trivially attempted) is time that would be much better spent on marketing or improving your product.

imtringued 9y ago

>What would stop big companies from taking my source and spending more on advertising? Almost every country on this planet has copyright laws. If you're worried about them ignoring the law and taking your source code why are you not worried about them ignoring the law and physically stealing your computers?