5 ms·

For anyone else wondering about the license, it's standard signing with an ec (sect239k1) key https://github.com/postalsys/emailengine/blob/master/lib/tools.js#

• daemin 3y ago
  Could you elaborate on this, not necessarily the code itself, but about signing and "an ec". I'm new to this and will be wanting to provide licences for software in the future.
  • scosman 3y ago
    Ecliptic curve signing. You can produce a message body like “valid_until=2025-02-25” then sign it and distribute it as an api key that’s body+sig. Client can verify signature using public key without a server call (sig validation). EC beats other signatures because signature is muuuuuch shorter, so it can still look like an API key.
  • evgpbfhnr 3y ago
    "an ec key" (elliptic curve) is just a detail, this can be done with any crypto library or utility - for example directly with the openssl command: https://stackoverflow.com/questions/15686821/generate-ec-keypair-from-openssl-command-line/51179147#51179147 https://stackoverflow.com/questions/15686821/generate-ec-key... embed the public part in your application and you can verify that something signed with the 'dgst' command and the private key really has been signed with the private key (which you obviously shouldn't publish) (Note if using plain commands there is more friendly than openssl, minify/signify are much harder to get wrong, but I'm not sure they're as easy to use programmatically in as many languages there are for libcrypto/sodium/etc; this is really just an example)
  • semireg 3y ago
    I use jwt for my app’s licensing. It works great.
    • victor106 3y ago
      Any resources you can provide that will help in understanding how this works?
      • piyh 3y ago
        https://jwt.io/ https://jwt.io/
• evrimoztamur 3y ago
  Can't a user generate a fake license? Is there another layer of integrity checking, or can users simply patch in a fake checkLicense (which is apparently referred back to in four other spots in the code).
  • notpushkin 3y ago
    Well, you sure can patch it if you want :^) I think there isn't really a reason to add more than a simple license check though, as enterprise users are generally scared of using pirated software.
    • slashdev 3y ago
      Also keep in mind pirated software doesn't cost the author anything if the user wasn't going to buy it anyway. If a company is willing to risk all that effort and liability to crack and maintaining the patches across changes to avoid paying for your software, they were not likely to pay for it in the first place. Nothing lost.
      • alex_suzuki 3y ago
        This. Any licensing schema that protects locally running software can be circumvented by a reasonably crafty individual – but there is simply no overlap in the Venn diagram of Paying Customers /\ These Crafty Individuals.
        • klabb3 3y ago
          Yeah, or more specifically a company might have the competence but will not waste their engineers time, because the reason they’re using the service in the first place is to not have to focus on their core business. Not random accessories. A lot of time, circumventing a license check would be more work than - say - implementing sending email on their own. Depending on what the service is. Developers think they’re selling fancy tech. Most often, what we’re selling/providing is convenience - something boring that just works.
  • 3y ago
• psnehanshu 3y ago
  So all I have to do is generate my own private-public key pair, replace the hardcoded public key in the code you linked, then generate a license key with my private key. But yeah, I don't know what should be the payload of the signature.
  • account42 3y ago
    If you're going to edit the source code you can just short-circuit the license check.
  • sowbug 3y ago
    You can actually walk right past most "no trespassing" signs as well. Signs, locks, and copyrights keep honest people honest. They don't change anyone else's behavior.
  • throwaway11460 3y ago
    Add "face the angry company lawyers" to the todo list