10 ms·

Keygen: Open-Source Software Licensing

13 points by serhack_ 2y ago

wonger_ 2y ago
Took me a bit to realize it's licensing as in managing enterprise license keys 'C1B6DE-39A6E3...', not licensing as in MIT/GPL/etc. https://keygen.sh/ https://keygen.sh/ Does anyone know a minimal, alternative licensing solution appropriate for a tiny startup? One where the license key is the only form of user authentication. Is there a cheap service available? Or is it easy to roll a custom solution.
- serhack_ 2y ago
  > One where the license key is the only form of user authentication. I think it's the exact thing we have here, the problem is that you need a little bit of code to automatize all the stuff keygen presents to you.
- sakjur 2y ago
  JWTs validated against the public component of asymmetrical keys (ECDSA or RSA) can work if you want something that is client-side only and where the license key contains all information about the license without having to look it up in a remote database. It won’t be particularly tamper resistant, but it should be sufficient to ‘keep the honest honest’ and (IANAL) might help your case in court if need be. Arguably, you can spend millions and still be in that position — though probably having managed to make a more customer hostile solution without significantly bothering those looking to circumvent your DRM.
- rubenfiszel 2y ago
  We use this for generation: https://hub.windmill.dev/scripts/helper/1508/generate-a-license-key-using-rsa-pss-for-a-customer-helper https://hub.windmill.dev/scripts/helper/1508/generate-a-lice... and this for client-side checking (https://hub.windmill.dev/scripts/helper/1510/verify-a-license-key-helper https://hub.windmill.dev/scripts/helper/1510/verify-a-licens...) actually the real one is in rust but same algorithm.
dns_snek 2y ago
This project is source-available (Elastic License), not open source: > You may not move, change, disable, or circumvent the license key functionality in the software, and you may not remove or obscure any functionality in the software that is protected by the license key.
- serhack_ 2y ago
  Ah yes, you're right

13 points by serhack_ 2y ago

Took me a bit to realize it's licensing as in managing enterprise license keys 'C1B6DE-39A6E3...', not licensing as in MIT/GPL/etc. https://keygen.sh/ https://keygen.sh/ Does anyone know a minimal, alternative licensing solution appropriate for a tiny startup? One where the license key is the only form of user authentication. Is there a cheap service available? Or is it easy to roll a custom solution.

serhack_ 2y ago
> One where the license key is the only form of user authentication. I think it's the exact thing we have here, the problem is that you need a little bit of code to automatize all the stuff keygen presents to you.
sakjur 2y ago
JWTs validated against the public component of asymmetrical keys (ECDSA or RSA) can work if you want something that is client-side only and where the license key contains all information about the license without having to look it up in a remote database. It won’t be particularly tamper resistant, but it should be sufficient to ‘keep the honest honest’ and (IANAL) might help your case in court if need be. Arguably, you can spend millions and still be in that position — though probably having managed to make a more customer hostile solution without significantly bothering those looking to circumvent your DRM.
rubenfiszel 2y ago
We use this for generation: https://hub.windmill.dev/scripts/helper/1508/generate-a-license-key-using-rsa-pss-for-a-customer-helper https://hub.windmill.dev/scripts/helper/1508/generate-a-lice... and this for client-side checking (https://hub.windmill.dev/scripts/helper/1510/verify-a-license-key-helper https://hub.windmill.dev/scripts/helper/1510/verify-a-licens...) actually the real one is in rust but same algorithm.

dns_snek 2y ago

This project is source-available (Elastic License), not open source: > You may not move, change, disable, or circumvent the license key functionality in the software, and you may not remove or obscure any functionality in the software that is protected by the license key.

serhack_ 2y ago
Ah yes, you're right