4 ms·

What is the state of the art in shareware for drop in payment / piracy protection?

by mapmap 5y ago

giantrobot 5y ago
Why bother with piracy "protection"? You're not going to keep ahead of dedicated pirates. Focus on features and bug fixes rather than going after non-customers. Every iota of effort spent going after pirates is effort not going into servicing existing customers or getting new ones.
- eps 5y ago
  99.9% of pirates can only nop ifs. The remaining percentage are the pros that either work on paid basis or go after high-profile apps that give them visibility and status. A mildly well-protected battery indicator will remain intact for a very long time, simply because people who'd want to crack it, can't, and people who can crack it, won't. PS. Having cracked versions floating around affects SEO ranking of the master website, it affects sales and overall perrception of the product and, as importantly, it also hits support with a lot of bogus bullshit from people that aren't even customers. So for every iota one may "save" by not adding protection, they would spend multiple iotas dealing with the consequences.
eps 5y ago
Re: payments - it depends on the country, but generally Stripe + PayPal + bank wires for larger/enterprise purchases. Alternatively, Braintree. An altogether different option is to pay 2x the commission and use "full-service" reseller frontends like Digital River, PayProGlobal, etc. These are referred to as "registrators" and they used to be useful, because getting a merchant account and processing cards was a royal pain the ass. But now there's Stripe, so virtually no value in them. In fact, they tend to make thing more difficult to the clients than needed to justify their own existence (like requiring phone numbers, calling customers back to "verify" purchases and other artificial b/s like that). Re: piracy protection - wildly depends on whom you ask. There is a camp of people that put minimum effort (literally a a single "if" check in the code) and embrace having their stuff cracked and hacked. The logic is that this acts as extra marketing and helps converting pirates (lol). There are also people who use packaged solutions like VMprotect and (previously) Armadillo. This tends to nip piracy in a bud, but creates issues with antivirus false positives. It also makes the software heavier and more fragile. There's also a middle ground of custom protection schemes that, if deployed wisely, can create 100x more headaches to crackers vs the effort spent on coding them in. Not that hard to do, but these aren't drop-ins, obviously. Also, closely related, is the question of how the licensing works. Previously, most of the shareware used completely offline licensing using "keys" that were either hardcoded into the program or verified algorithmically (read, with elaborate checksums and such). This caused an emergence of keygens and it also fed credit card fraud with people smash-n-grabbing keys in bulk and then published them for the street cred. Surprisingly, a lot of shareware still uses this method and they still bitch and moan about the consequences. The alternative, obviously, is to use online activation. That is, what is sold is an activation token that can be swapped for a machine-specific license, via an exchange with the licensing server. This nearly completely eliminates the CC fraud and it allows for finer control over licensing. There are some drop-in solutions for this, but all of them are really quite basic and almost universally suck. However, the good news is that is fairly simple to roll out your own online licensing scheme in a matter of few work-days (assuming you know a bit of web backend and frontend).
- hermitcrab 5y ago
  Handling taxes (VAT, sales tax) when you are selling worldwide is a nightmare. That is why many vendors pay the extra to use 'full fat' payment processors, rather than Stripe.
  - eps 5y ago
    Stripe can handle sales taxes. Also, it's worth checking with the accountants first before taking on a role of a tax collector. When yet another random country demands a sales tax on purchases made by its citizens, it's just a spherical pony in a vacuum. Best to first check if their demands have merit.
    - hermitcrab 5y ago
      >Stripe can handle sales taxes. if so, that is a recent development.
- ezekg 5y ago
  > There are some drop-in solutions for this, but all of them are really quite basic and almost universally suck. However, the good news is that is fairly simple to roll out your own online licensing scheme in a matter of few work-days (assuming you know a bit of web backend and frontend). I wouldn't say all of them suck. But that's because I built one [0] for the sole reason that, back in 2016, I too thought all of other ones sucked. [0]: https://keygen.sh/build-vs-buy/ https://keygen.sh/build-vs-buy/
  - asfarley 5y ago
    If you’re the developer, I repeatedly tried to contact you to ask some questions. Since i never heard back, and I didn’t like the other options, I too ended up rolling my own.
    - ezekg 5y ago
      I am. That’s very atypical for my support, and I sincerely apologize for that. Searching for your emails landed me in early 2020. And it looks like I forgot to respond to you. That was a busy time. After 4 years, I was in the process of quitting my full-time job to go full-time on Keygen, and I was in the middle of moving all support from Intercom to email. So my email was kind of flooded and I often forgot to respond to some discovery emails. It’s no excuse, but I figured I’d share. Again, sorry for the poor experience.
semireg 5y ago
As an electron developer I used NodeJS to implement a custom licensing system on top of JWT. My app "registers" a computer (fingerprint) with the server. The server can grant licenses where it signs a JWT with a secret key, and the client can verify using the public key. The client will enable features based on the JWT payload. Again... it's crackable, but it's serviceable and I make my software affordable through either a one-time license ($147) or a monthly subscription ($14.99/month). I try my best to make it "worth it" to purchase the app. Label LIVE is a super- boring business label printer app so it takes a "special" person to 1) need the app and then 2) decide that they'd save more money by cracking it than just paying for it. If I 10x my pricing (as my competition does), then I would fully expect users would find it worthwhile to crack and distribute.
grujicd 5y ago
There are payment services which were originally made for desktop apps, with built in support for license files, downloads after payment, etc. I'm using MyCommerce (ex ShareIt), but also had good experience with Avangate - which was later purchased by 2checkout, and now renamed to Verifone.
Melatonic 5y ago
Shareware (at least back in the day) almost always had a free component. For a game that might mean levels 1-3 are free and then you buy the full game for the whole thing.
RantyDave 5y ago
Probably not the answer you're looking for, but the Mac AppStore is the only thing at ever truly worked for me.
- chadcmulligan 5y ago
  Thats nice to hear, seems like a big market to me and under serviced, I'm just about to release an app on there so fingers crossed.
netr0ute 5y ago
Why not eliminate that and just make it FOSS?

What is the state of the art in shareware for drop in payment / piracy protection?

by mapmap 5y ago

What is the state of the art in shareware for drop in payment / piracy protection?

Why bother with piracy "protection"? You're not going to keep ahead of dedicated pirates. Focus on features and bug fixes rather than going after non-customers. Every iota of effort spent going after pirates is effort not going into servicing existing customers or getting new ones.

eps 5y ago
99.9% of pirates can only nop ifs. The remaining percentage are the pros that either work on paid basis or go after high-profile apps that give them visibility and status. A mildly well-protected battery indicator will remain intact for a very long time, simply because people who'd want to crack it, can't, and people who can crack it, won't. PS. Having cracked versions floating around affects SEO ranking of the master website, it affects sales and overall perrception of the product and, as importantly, it also hits support with a lot of bogus bullshit from people that aren't even customers. So for every iota one may "save" by not adding protection, they would spend multiple iotas dealing with the consequences.

eps 5y ago

Re: payments - it depends on the country, but generally Stripe + PayPal + bank wires for larger/enterprise purchases. Alternatively, Braintree. An altogether different option is to pay 2x the commission and use "full-service" reseller frontends like Digital River, PayProGlobal, etc. These are referred to as "registrators" and they used to be useful, because getting a merchant account and processing cards was a royal pain the ass. But now there's Stripe, so virtually no value in them. In fact, they tend to make thing more difficult to the clients than needed to justify their own existence (like requiring phone numbers, calling customers back to "verify" purchases and other artificial b/s like that). Re: piracy protection - wildly depends on whom you ask. There is a camp of people that put minimum effort (literally a a single "if" check in the code) and embrace having their stuff cracked and hacked. The logic is that this acts as extra marketing and helps converting pirates (lol). There are also people who use packaged solutions like VMprotect and (previously) Armadillo. This tends to nip piracy in a bud, but creates issues with antivirus false positives. It also makes the software heavier and more fragile. There's also a middle ground of custom protection schemes that, if deployed wisely, can create 100x more headaches to crackers vs the effort spent on coding them in. Not that hard to do, but these aren't drop-ins, obviously. Also, closely related, is the question of how the licensing works. Previously, most of the shareware used completely offline licensing using "keys" that were either hardcoded into the program or verified algorithmically (read, with elaborate checksums and such). This caused an emergence of keygens and it also fed credit card fraud with people smash-n-grabbing keys in bulk and then published them for the street cred. Surprisingly, a lot of shareware still uses this method and they still bitch and moan about the consequences. The alternative, obviously, is to use online activation. That is, what is sold is an activation token that can be swapped for a machine-specific license, via an exchange with the licensing server. This nearly completely eliminates the CC fraud and it allows for finer control over licensing. There are some drop-in solutions for this, but all of them are really quite basic and almost universally suck. However, the good news is that is fairly simple to roll out your own online licensing scheme in a matter of few work-days (assuming you know a bit of web backend and frontend).

hermitcrab 5y ago
Handling taxes (VAT, sales tax) when you are selling worldwide is a nightmare. That is why many vendors pay the extra to use 'full fat' payment processors, rather than Stripe.
- eps 5y ago
  Stripe can handle sales taxes. Also, it's worth checking with the accountants first before taking on a role of a tax collector. When yet another random country demands a sales tax on purchases made by its citizens, it's just a spherical pony in a vacuum. Best to first check if their demands have merit.
  - hermitcrab 5y ago
    >Stripe can handle sales taxes. if so, that is a recent development.
ezekg 5y ago
> There are some drop-in solutions for this, but all of them are really quite basic and almost universally suck. However, the good news is that is fairly simple to roll out your own online licensing scheme in a matter of few work-days (assuming you know a bit of web backend and frontend). I wouldn't say all of them suck. But that's because I built one [0] for the sole reason that, back in 2016, I too thought all of other ones sucked. [0]: https://keygen.sh/build-vs-buy/ https://keygen.sh/build-vs-buy/
- asfarley 5y ago
  If you’re the developer, I repeatedly tried to contact you to ask some questions. Since i never heard back, and I didn’t like the other options, I too ended up rolling my own.
  - ezekg 5y ago
    I am. That’s very atypical for my support, and I sincerely apologize for that. Searching for your emails landed me in early 2020. And it looks like I forgot to respond to you. That was a busy time. After 4 years, I was in the process of quitting my full-time job to go full-time on Keygen, and I was in the middle of moving all support from Intercom to email. So my email was kind of flooded and I often forgot to respond to some discovery emails. It’s no excuse, but I figured I’d share. Again, sorry for the poor experience.

semireg 5y ago

As an electron developer I used NodeJS to implement a custom licensing system on top of JWT. My app "registers" a computer (fingerprint) with the server. The server can grant licenses where it signs a JWT with a secret key, and the client can verify using the public key. The client will enable features based on the JWT payload. Again... it's crackable, but it's serviceable and I make my software affordable through either a one-time license ($147) or a monthly subscription ($14.99/month). I try my best to make it "worth it" to purchase the app. Label LIVE is a super- boring business label printer app so it takes a "special" person to 1) need the app and then 2) decide that they'd save more money by cracking it than just paying for it. If I 10x my pricing (as my competition does), then I would fully expect users would find it worthwhile to crack and distribute.

grujicd 5y ago

There are payment services which were originally made for desktop apps, with built in support for license files, downloads after payment, etc. I'm using MyCommerce (ex ShareIt), but also had good experience with Avangate - which was later purchased by 2checkout, and now renamed to Verifone.

Melatonic 5y ago

Shareware (at least back in the day) almost always had a free component. For a game that might mean levels 1-3 are free and then you buy the full game for the whole thing.

RantyDave 5y ago

Probably not the answer you're looking for, but the Mac AppStore is the only thing at ever truly worked for me.

chadcmulligan 5y ago
Thats nice to hear, seems like a big market to me and under serviced, I'm just about to release an app on there so fingers crossed.

netr0ute 5y ago

Why not eliminate that and just make it FOSS?