9 ms·

Show HN: Add license key verification to your apps

131 points by frknsn 6y ago

mikejulietbravo 6y ago
This is really cool - you should write a how-to blog on it when you have time. I think it could really help drive more adoption.
- frknsn 6y ago
  Should I write it in GitHub wiki page? Or, is there any other place that you can suggest? Thanks a lot for the feedback!
systemvoltage 6y ago
Why MongoDB?
- rooam-dev 6y ago
  Why !MongoDB?
  - jedberg 6y ago
    Because MongoDB is a document store and you really only need a key/value store for this. Also because MongoDB started life preferring speed vs durability, which is a bad look for a database. They may have fixed that now, but I cannot forgive them for that.
    - rooam-dev 6y ago
      "The best tool is the one I know".
      - jedberg 6y ago
        Except when it's not. :)
        rooam-dev 6y ago
        I don't compare HTML vs. C here, obviously I am talking about databases. All personal feelings aside, there is no technical reason to NOT use MongoDB as a key value store if one has experience with it, because after release comes maintenance and learning a new tool while fixing production problems doesn't make sense to me.
  - fareesh 6y ago
    I remember reading on here at one time that under some scenarios your data doesn't come out the way you put it in, or something to that effect.
- lykr0n 6y ago
  Because that's the database the dev picked to use?
- HideousKojima 6y ago
  Because it's webscale, duh
- gnu8 6y ago
  So app vendors can leave the database wide open on the Internet, for anyone to pull their customer list or generate their own keys.
- frknsn 6y ago
  I wanted to use a no sql database at the beginning. However, I prepared an interface first and implemented as MongoDB. We can implement the interface with PostgreSQL for example. I really appreciate PRs :) Here is the interface we can implement for other databases. https://github.com/furkansenharputlu/f-license/blob/master/storage/storage.go#L19-L27 https://github.com/furkansenharputlu/f-license/blob/master/s...
- ruffrey 6y ago
  I thought this also. SQLite as a default would have been nice.
FloatArtifact 6y ago
I much rather have a license key tied to a preferred account then to a platform like Google/Apple. That's also allows for cross-platform licensing which is rare among apps.
lukevp 6y ago
Is remote verification fully open over http with no user credential verification or rate limiting? If I were to implement remote verification in an app, I would want to have the user logged in to an account prior to adding a license key. You could accomplish this by putting the KMS behind a proxy but this seems like a likely attack surface if using this the way it’s outlined in the docs.
ddevault 6y ago
It is unethical for end-user software to be closed source, and this project is wrong for enabling this.
- koolba 6y ago
  There’s plenty of reason for end user software to be closed source. The biggest one is so that it can exist. Plenty of software would not be written if someone was not paid to do it. And plenty of those would not be paid if the source was available. If you disagree, vote with your wallet.
  - ddevault 6y ago
    No one is entitled to a business model. If you can't exist without being ethically sound, then you can't exist - period. Capitalism is not a replacement for ethics. And in any case: you can sell open-source software.
    - DrJokepu 6y ago
      Nobody is entitled to my labor either.
      - ddevault 6y ago
        Correct. But we are entitled to the source code for programs which run on our computers, or is paid for by our taxes.
        koolba 6y ago
        > Correct. But we are entitled to the source code for programs which run on our computers, ... No you're not. If you want the source code for the programs to run on your computer either write them yourself, choose FOSS ones, or pay someone to write one that supplies the source. Nobody is mandating you buy a particular piece of software or run it on your computer. You're choosing to do it. If you decide you're not going to run closed source software that's your personal choice. > ... or is paid for by our taxes. That's moving goal posts.
paypalcust83 6y ago
Be very careful with licensing. VMware early-on had licensing code that disabled a customer's app and cost them a lot of money. Licensing of enterprise features is best to have a nag screen and disable some future actions rather than drop a ban-hammer. They were forced to strip out that code and ended up with weak enforcement of licensing. Telemetry and online verification are unacceptable to some customers of on-prem software. To them, it should work even if the vendor goes out of business. Volume license keys should exist for large-scale deployment of on-prem software in concert with open sources surveillance (search engines and warez sites) of license keys and software to prevent abuse. Even then, it's better to reissue volume license keys to customers because DLP of an external entity is an essentially impossible task.. at least they will know there's a problem and may work to police themselves. Stopping all piracy is undesirable because persons who cannot afford it but are in/direct decision-makers have the ability to sabotage sales and/or acquire an unfavorable impression of the brand. Piracy and leaks are indirectly helpful to overall sales and marketing. Keep it down to a dull roar, because some people and some factions of industries are more-or-less like Fight Club. If something is used commercially at-scale from a small vendor, support their survival with licensing fees... don't be Best Buy.
- deleted 6y ago
  [deleted]
- ptx 6y ago
  > open sources surveillance (search engines and warez sites) That's the first time I've heard "open source" used to refer to a warez site. Is this overloading of the term being seeded by someone in order to, in a roundabout way, discredit the open source movement? A few years ago there would have been an obvious suspect for such FUD, but they seem to have embraced open source these days, so that wouldn't make sense. Weird.
  - frobozz 6y ago
    Open Source surveillance means "looking for/at stuff that is openly published" - e.g. looking on warez sites for keys being shared.. I'm pretty sure the term has been in use since the 1940s
huhtenberg 6y ago
No to be harsh, but this is largely useless. The biggest issues with in-app licensing is (1) Binding licensing to the machine (or the user!) (2) Making sure that your licensing check can't be NOP'ed by a l33r haxxor within 5 minutes of the release. Tangential to that is (3) which is an ability to tolerate minor changed to the machine and OS reinstalls without invalidating the license. (1) and (3) aren't hard to solve, just need to decide which machine/OS properties a license should be to "latched on". Popular choices are MACs, HDD serials (from the ATA IDENTIFY block), SMBIOS IDs, MachineGuid on Windows, etc. Better yet, it's not a bad idea to bind to a _set_ of machine properties and then tolerate a change of _some_. (2) is a domain of its own. Basically that's an anti-reverse-engineering task. It's not terribly hard to roll out something on your own, but you do need to know what typical hacks look like. From exe patching to process training / API hooking, there is a substantial learning curve, but it's a quite interesting one. That is the biggest part of any "license key verification" is not the actual "license key verification", but rather all the nuances that make sure it actually works as designed and doesn't affect users' experience in normal-use cases.
- looping__lui 6y ago
  Not sure whether I would agree that (1) and (3) aren’t hard. I recommend checking out LimeLM with the blogs and the (very informative!) forum. Weirdly enough I would rank “make sure that the Antivirus software solutions do not go randomly crazy on your software protection” rather high (despite certificates and whitelisting). So I would wholeheartedly agree with your summary statement :-)
- rsp1984 6y ago
  True, but note that in many cases the goal is not absolute security but rather making it as inconvenient as possible for someone to circumvent the licensing. In some cases the licensing security is even weak by design, e.g. Windows 95 or the early AutoCAD. This is desirable when the size of the userbase itself is of value (which is actually true for a lot of software!).
  - huhtenberg 6y ago
    Cases like W95 and Photoshop are exceptional edge cases that worked for them as a part of a very aggressive marketing push with a very long-term market domination goal. It doesn't apply to ISV products that need to feed their devs right now. If you add licensing enforcement into your program, making it trivially breakable is just... dumb. At the very least it will pollute the heck out of native search results with all the hacked versions, because THAT will in fact be the more relevant search for a lot of people. Secondly, people won't bother actually buying a license if a hacked version works. It's a very persistent urban legend that allowing easy hacks is good for adoption, but it's a legend indeed. Making products less easily hackable results in massive increase in sales.
looping__lui 6y ago
Personally I found LimeLM offering a pretty amazing and sophisticated product at very decent prices. Personally, I would never want to suffer the pain of keeping licensing servers running etc. :-) In my experience, software licensing will just “get rid of the casual piracy” - but I could never see not having a licensing solution in software work for business... Beyond protecting software I found it similarly necessary to take down illegal software copies. There are automated tools for that luckily. Yeah, your software will be cracked sooner or later. But it is not all black and white and there are now really great sophisticated solutions out there that minimize the frustration for paying customers whilst also protecting your IP...
- toyg 6y ago
  > I could never see not having a licensing solution in software work for business The most business-y of business-y tech businesses, Oracle, doesn't use license keys. Everyone can download pretty much any of their products. When they acquired the company I worked for, the first thing they did was to release master licenses to everyone for free. Saved us peons in the support trenches the aggro of dealing with a terrible license-server we embedded, the name of which I've mercifully forgotten. How do they do it? Their audience are legitimate businesses who would rather stay on the right side of the law than save a few pennies here and there. And Oracle won't answer the phone unless you have a paid support contract. Obviously this model won't work for everyone, but IMHO businesses who sell to businesses can live happily without license keys (and the stress/costs they generate on their support operations).
  - rahimnathwani 6y ago
    Oracle does not rely on companies' good intention, or their need for ongoing support. They use contracts and audits to make sure they get what they're owed. If you can force companies to pay after they start using something, then making it as easy as possible for them to expand usage is going to maximise your revenue. Google 'Oracle License Audit' or 'Oracle LMS' to learn more.
    - toyg 6y ago
frknsn 6y ago
Should I remove remote verification entirely? Or, how can I adjust to make it more proper to use?
deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
ackbar03 6y ago
I can prob patch this over in the time it takes to finish a mug of coffee

131 points by frknsn 6y ago

This is really cool - you should write a how-to blog on it when you have time. I think it could really help drive more adoption.

frknsn 6y ago
Should I write it in GitHub wiki page? Or, is there any other place that you can suggest? Thanks a lot for the feedback!

systemvoltage 6y ago

Why MongoDB?

rooam-dev 6y ago
Why !MongoDB?
- jedberg 6y ago
  Because MongoDB is a document store and you really only need a key/value store for this. Also because MongoDB started life preferring speed vs durability, which is a bad look for a database. They may have fixed that now, but I cannot forgive them for that.
  - rooam-dev 6y ago
    "The best tool is the one I know".
    - jedberg 6y ago
      Except when it's not. :)
      - rooam-dev 6y ago
        I don't compare HTML vs. C here, obviously I am talking about databases. All personal feelings aside, there is no technical reason to NOT use MongoDB as a key value store if one has experience with it, because after release comes maintenance and learning a new tool while fixing production problems doesn't make sense to me.
- fareesh 6y ago
  I remember reading on here at one time that under some scenarios your data doesn't come out the way you put it in, or something to that effect.
lykr0n 6y ago
Because that's the database the dev picked to use?
HideousKojima 6y ago
Because it's webscale, duh
gnu8 6y ago
So app vendors can leave the database wide open on the Internet, for anyone to pull their customer list or generate their own keys.
frknsn 6y ago
I wanted to use a no sql database at the beginning. However, I prepared an interface first and implemented as MongoDB. We can implement the interface with PostgreSQL for example. I really appreciate PRs :) Here is the interface we can implement for other databases. https://github.com/furkansenharputlu/f-license/blob/master/storage/storage.go#L19-L27 https://github.com/furkansenharputlu/f-license/blob/master/s...
ruffrey 6y ago
I thought this also. SQLite as a default would have been nice.

FloatArtifact 6y ago

I much rather have a license key tied to a preferred account then to a platform like Google/Apple. That's also allows for cross-platform licensing which is rare among apps.

lukevp 6y ago

Is remote verification fully open over http with no user credential verification or rate limiting? If I were to implement remote verification in an app, I would want to have the user logged in to an account prior to adding a license key. You could accomplish this by putting the KMS behind a proxy but this seems like a likely attack surface if using this the way it’s outlined in the docs.

ddevault 6y ago

It is unethical for end-user software to be closed source, and this project is wrong for enabling this.

koolba 6y ago
There’s plenty of reason for end user software to be closed source. The biggest one is so that it can exist. Plenty of software would not be written if someone was not paid to do it. And plenty of those would not be paid if the source was available. If you disagree, vote with your wallet.
- ddevault 6y ago
  No one is entitled to a business model. If you can't exist without being ethically sound, then you can't exist - period. Capitalism is not a replacement for ethics. And in any case: you can sell open-source software.
  - DrJokepu 6y ago
    Nobody is entitled to my labor either.
    - ddevault 6y ago
      Correct. But we are entitled to the source code for programs which run on our computers, or is paid for by our taxes.
      - koolba 6y ago
        > Correct. But we are entitled to the source code for programs which run on our computers, ... No you're not. If you want the source code for the programs to run on your computer either write them yourself, choose FOSS ones, or pay someone to write one that supplies the source. Nobody is mandating you buy a particular piece of software or run it on your computer. You're choosing to do it. If you decide you're not going to run closed source software that's your personal choice. > ... or is paid for by our taxes. That's moving goal posts.

paypalcust83 6y ago

Be very careful with licensing. VMware early-on had licensing code that disabled a customer's app and cost them a lot of money. Licensing of enterprise features is best to have a nag screen and disable some future actions rather than drop a ban-hammer. They were forced to strip out that code and ended up with weak enforcement of licensing. Telemetry and online verification are unacceptable to some customers of on-prem software. To them, it should work even if the vendor goes out of business. Volume license keys should exist for large-scale deployment of on-prem software in concert with open sources surveillance (search engines and warez sites) of license keys and software to prevent abuse. Even then, it's better to reissue volume license keys to customers because DLP of an external entity is an essentially impossible task.. at least they will know there's a problem and may work to police themselves. Stopping all piracy is undesirable because persons who cannot afford it but are in/direct decision-makers have the ability to sabotage sales and/or acquire an unfavorable impression of the brand. Piracy and leaks are indirectly helpful to overall sales and marketing. Keep it down to a dull roar, because some people and some factions of industries are more-or-less like Fight Club. If something is used commercially at-scale from a small vendor, support their survival with licensing fees... don't be Best Buy.

deleted 6y ago
[deleted]
ptx 6y ago
> open sources surveillance (search engines and warez sites) That's the first time I've heard "open source" used to refer to a warez site. Is this overloading of the term being seeded by someone in order to, in a roundabout way, discredit the open source movement? A few years ago there would have been an obvious suspect for such FUD, but they seem to have embraced open source these days, so that wouldn't make sense. Weird.
- frobozz 6y ago
  Open Source surveillance means "looking for/at stuff that is openly published" - e.g. looking on warez sites for keys being shared.. I'm pretty sure the term has been in use since the 1940s

huhtenberg 6y ago

No to be harsh, but this is largely useless. The biggest issues with in-app licensing is (1) Binding licensing to the machine (or the user!) (2) Making sure that your licensing check can't be NOP'ed by a l33r haxxor within 5 minutes of the release. Tangential to that is (3) which is an ability to tolerate minor changed to the machine and OS reinstalls without invalidating the license. (1) and (3) aren't hard to solve, just need to decide which machine/OS properties a license should be to "latched on". Popular choices are MACs, HDD serials (from the ATA IDENTIFY block), SMBIOS IDs, MachineGuid on Windows, etc. Better yet, it's not a bad idea to bind to a _set_ of machine properties and then tolerate a change of _some_. (2) is a domain of its own. Basically that's an anti-reverse-engineering task. It's not terribly hard to roll out something on your own, but you do need to know what typical hacks look like. From exe patching to process training / API hooking, there is a substantial learning curve, but it's a quite interesting one. That is the biggest part of any "license key verification" is not the actual "license key verification", but rather all the nuances that make sure it actually works as designed and doesn't affect users' experience in normal-use cases.

looping__lui 6y ago
Not sure whether I would agree that (1) and (3) aren’t hard. I recommend checking out LimeLM with the blogs and the (very informative!) forum. Weirdly enough I would rank “make sure that the Antivirus software solutions do not go randomly crazy on your software protection” rather high (despite certificates and whitelisting). So I would wholeheartedly agree with your summary statement :-)
rsp1984 6y ago
True, but note that in many cases the goal is not absolute security but rather making it as inconvenient as possible for someone to circumvent the licensing. In some cases the licensing security is even weak by design, e.g. Windows 95 or the early AutoCAD. This is desirable when the size of the userbase itself is of value (which is actually true for a lot of software!).
- huhtenberg 6y ago
  Cases like W95 and Photoshop are exceptional edge cases that worked for them as a part of a very aggressive marketing push with a very long-term market domination goal. It doesn't apply to ISV products that need to feed their devs right now. If you add licensing enforcement into your program, making it trivially breakable is just... dumb. At the very least it will pollute the heck out of native search results with all the hacked versions, because THAT will in fact be the more relevant search for a lot of people. Secondly, people won't bother actually buying a license if a hacked version works. It's a very persistent urban legend that allowing easy hacks is good for adoption, but it's a legend indeed. Making products less easily hackable results in massive increase in sales.

looping__lui 6y ago

Personally I found LimeLM offering a pretty amazing and sophisticated product at very decent prices. Personally, I would never want to suffer the pain of keeping licensing servers running etc. :-) In my experience, software licensing will just “get rid of the casual piracy” - but I could never see not having a licensing solution in software work for business... Beyond protecting software I found it similarly necessary to take down illegal software copies. There are automated tools for that luckily. Yeah, your software will be cracked sooner or later. But it is not all black and white and there are now really great sophisticated solutions out there that minimize the frustration for paying customers whilst also protecting your IP...

toyg 6y ago
> I could never see not having a licensing solution in software work for business The most business-y of business-y tech businesses, Oracle, doesn't use license keys. Everyone can download pretty much any of their products. When they acquired the company I worked for, the first thing they did was to release master licenses to everyone for free. Saved us peons in the support trenches the aggro of dealing with a terrible license-server we embedded, the name of which I've mercifully forgotten. How do they do it? Their audience are legitimate businesses who would rather stay on the right side of the law than save a few pennies here and there. And Oracle won't answer the phone unless you have a paid support contract. Obviously this model won't work for everyone, but IMHO businesses who sell to businesses can live happily without license keys (and the stress/costs they generate on their support operations).
- rahimnathwani 6y ago
  Oracle does not rely on companies' good intention, or their need for ongoing support. They use contracts and audits to make sure they get what they're owed. If you can force companies to pay after they start using something, then making it as easy as possible for them to expand usage is going to maximise your revenue. Google 'Oracle License Audit' or 'Oracle LMS' to learn more.
  - toyg 6y ago

frknsn 6y ago

Should I remove remote verification entirely? Or, how can I adjust to make it more proper to use?

deleted 6y ago

[deleted]

deleted 6y ago

[deleted]

ackbar03 6y ago

I can prob patch this over in the time it takes to finish a mug of coffee