Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is the sensible way to sell offline desktop applications?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 20 posts

Re: Ask HN: What is the sensible way to sell offline desktop applications?

#11

Post by eterm »

g_p wrote: post #10
eterm wrote: post #6

I think you can solve this with public key cryptography, your public key ships with the program. Then you sign (HMAC) something unique to the user (such as email address) along with an expiry date. That signed message becomes the 'key' they enter. The software validates the message at the same time as parsing out their email address and the key expiry date from the message. This doesn't require any phoning home. This…

You shouldn't use an HMAC here, since that's symmetric and the key sits inside the app. You should use public key crypto as you suggested - sign the serialised per-user information (technically you generally sign the hash of it, but don't roll your own crypto, use a proven library), and give the user that signature (along with the message that's signed) as a "license file". Patching this requires modifying every futu…

Thanks for the correction, I didn't realise HMAC was only symmetric and thought it generally covered signing of hashed messages.

Re: Ask HN: What is the sensible way to sell offline desktop applications?

#13

Post by ezekg »

I’m the founder of https://keygen.sh. Like many of the comments here mention, Keygen can help generate cryptographically signed license keys and license files for offline use. Lots of code examples to dig into via our docs and GitHub if you’re curious. Happy to answer any questions.

Re: Ask HN: What is the sensible way to sell offline desktop applications?

#14

Post by binarynate »

You could make a website where customers can sign in to download the software. When they click download, the site can create a signed S3 download link that is only valid for a few minutes (long enough for the download to complete). That's what I did for my online store (https://dashboard.vuplex.com). On the backend, it uses the getSignedUrlPromise() method from the AWS S3 Node.js SDK:

https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/S3.h...

From the user's perspective, they don't know they're downloading it from S3, because my site triggers the download automatically when they click the "download" button.

Re: Ask HN: What is the sensible way to sell offline desktop applications?

#15

Post by DarrenDev »

Your aim should be to "keep honest people honest," not to prevent your app from being cracked.

As in, a simple license and trial mechanism that may not be bullet proof but is enough such that an uninstall and re-install of the trial is not enough to allow them to use it for free forever, and that a license key needs to be entered somewhere to remove the trial limit restrictions.

You can invest time effort and money in stopping your app being cracked, but that's time effort and money your not spending making your paying users's lives better. Most people do not visit Warez sites to find cracked versions of software, and most people who do visit Warez sites never pay for software anyway -- you won't lose money to these people.

A simple license key that validates locally is the easiest solution -- no dialing home, nothing overly complex. Any extra effort needs to be warranted -- as in, you're losing $1000s a week because of lost users who would have paid but don't because they can use your app without a valid license.

Re: Ask HN: What is the sensible way to sell offline desktop applications?

#16

Post by danjc »

Cue the downvotes: keep some part of the compute in-cloud so that the secret sauce isn’t part of your installed product. You don’t have to charge a subscription fee provided the compute operation is a low enough input cost.

To those who disagree, I humbly submit that you haven’t been in the position of selling an installed app and seeing most use of it pirated.

Another mechanism is to release new features. That way, a cracked version has a limited time value.

Re: Ask HN: What is the sensible way to sell offline desktop applications?

#17

Post by cpach »

danjc wrote: post #16

Cue the downvotes: keep some part of the compute in-cloud so that the secret sauce isn’t part of your installed product. You don’t have to charge a subscription fee provided the compute operation is a low enough input cost. To those who disagree, I humbly submit that you haven’t been in the position of selling an installed app and seeing most use of it pirated. Another mechanism is to release new features. That way,…

”keep some part of the compute in-cloud so that the secret sauce isn’t part of your installed product”

I don’t think there’s any absolute right or wrong here. It’s up to the creator really.

As consumers we vote with our wallets – either we buy the product or not. I could see myself buying such a product, if the value proposition would be good overall.

Re: Ask HN: What is the sensible way to sell offline desktop applications?

#18

Post by cpach »

beamatronic wrote: post #7

My standard for this kind of thing is Beyond Compare by Scooter Software. You purchase a licence key which arrives via email and you copy and paste it into the application, which activates it permanently.

This is a good model. Acorn and Typora use this model too.

Re: Ask HN: What is the sensible way to sell offline desktop applications?

#19

Post by ezekg »

danjc wrote: post #16

Cue the downvotes: keep some part of the compute in-cloud so that the secret sauce isn’t part of your installed product. You don’t have to charge a subscription fee provided the compute operation is a low enough input cost. To those who disagree, I humbly submit that you haven’t been in the position of selling an installed app and seeing most use of it pirated. Another mechanism is to release new features. That way,…

Great advice, generally, but this doesn't work for offline/air-gap environments like for OP.

Re: Ask HN: What is the sensible way to sell offline desktop applications?

#20

Post by ezekg »

ezekg wrote: post #13

I’m the founder of https://keygen.sh . Like many of the comments here mention, Keygen can help generate cryptographically signed license keys and license files for offline use. Lots of code examples to dig into via our docs and GitHub if you’re curious. Happy to answer any questions.

Can't edit so quick follow up: Keygen can also help with the distribution side of things too, asserting that only licensed users can download the app.

Essentially works the way binarynate described in another comment, just with licensing added in as well.

Post reply on HN