Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Add license key verification to your apps

github.com

Post reply on HN
Print view View original

51–60 of 95 posts

Re: Show HN: Add license key verification to your apps

#51

Post by huhtenberg »

rsp1984 wrote: post #37
huhtenberg wrote: post #20

No to be harsh, but this is largely useless. The biggest issues with in-app licensing is (1) Binding licensing to the machine (or the user!) (2) Making sure that your licensing check can't be NOP'ed by a l33r haxxor within 5 minutes of the release. Tangential to that is (3) which is an ability to tolerate minor changed to the machine and OS reinstalls without invalidating the license. (1) and (3) aren't hard to solve…

True, but note that in many cases the goal is not absolute security but rather making it as inconvenient as possible for someone to circumvent the licensing. In some cases the licensing security is even weak by design, e.g. Windows 95 or the early AutoCAD. This is desirable when the size of the userbase itself is of value (which is actually true for a lot of software!).

Cases like W95 and Photoshop are exceptional edge cases that worked for them as a part of a very aggressive marketing push with a very long-term market domination goal. It doesn't apply to ISV products that need to feed their devs right now.

If you add licensing enforcement into your program, making it trivially breakable is just... dumb. At the very least it will pollute the heck out of native search results with all the hacked versions, because THAT will in fact be the more relevant search for a lot of people. Secondly, people won't bother actually buying a license if a hacked version works. It's a very persistent urban legend that allowing easy hacks is good for adoption, but it's a legend indeed. Making products less easily hackable results in massive increase in sales.

Re: Show HN: Add license key verification to your apps

#52

Post by metaobserver »

ddevault wrote: post #34
metaobserver wrote: post #31

Earlier quoted context omitted.

No one is entitled to free software and should not expect others to slave off and give away fruits of their hard work for free. This entitled communist mentality is unethical.

It's my computer, not yours. If you want to run software on it, I get to see the source code, that's the deal. We could agree that I can't use your software under these terms, but this would exploit those who don't understand the value of the source code. This is how spyware is born. If it runs on my machine, it's open source, or it's bunk. And, once again, you can sell open source software .

If it's sandboxed and accesses only the resources (network, disk etc.) you explicitly allow it to, you don't need to know how the processing is done. Spyware is not born out of legally obtained closed-source software. It's born out of corporations selling centralized SaaS, infringing on users' privacy and locking them in by design. The very same corporations championing OSS big time, because it benefits their spyware business. With thousands of naive contributors slaving off for posterity and hope that they will get noticed and hired. How ethical is that?

Granted, if you sign an NDA and pay extra, you may have the source. If this is the model you suggest, I think it's fair.

Re: Show HN: Add license key verification to your apps

#53

Post by ddevault »

renewiltord wrote: post #48
ddevault wrote: post #38

Earlier quoted context omitted.

Correct. But we are entitled to the source code for programs which run on our computers, or is paid for by our taxes.

Haha, I know that Sourcehut is open-source and you derive revenue from the fact that people prefer to use it as a SaaS product, but it is amusing that the SaaS-ness of it means that your statement only applies to the front-end portion.

The SourceHut backend is also open source. A related idea is "if you're handling my data, I'm entitled to view the code which is doing so".

Re: Show HN: Add license key verification to your apps

#54

Post by frobozz »

ptx wrote: post #47
paypalcust83 wrote: post #14

Be very careful with licensing. VMware early-on had licensing code that disabled a customer's app and cost them a lot of money. Licensing of enterprise features is best to have a nag screen and disable some future actions rather than drop a ban-hammer. They were forced to strip out that code and ended up with weak enforcement of licensing. Telemetry and online verification are unacceptable to some customers of on-pre…

> open sources surveillance (search engines and warez sites) That's the first time I've heard "open source" used to refer to a warez site. Is this overloading of the term being seeded by someone in order to, in a roundabout way, discredit the open source movement? A few years ago there would have been an obvious suspect for such FUD, but they seem to have embraced open source these days, so that wouldn't make sense.…

Open Source surveillance means "looking for/at stuff that is openly published" - e.g. looking on warez sites for keys being shared..

I'm pretty sure the term has been in use since the 1940s

Re: Show HN: Add license key verification to your apps

#55

Post by rooam-dev »

jedberg wrote: post #15
rooam-dev wrote: post #6

Earlier quoted context omitted.

Why !MongoDB?

Because MongoDB is a document store and you really only need a key/value store for this. Also because MongoDB started life preferring speed vs durability, which is a bad look for a database. They may have fixed that now, but I cannot forgive them for that.

"The best tool is the one I know".

Re: Show HN: Add license key verification to your apps

#56

Post by jedberg »

rooam-dev wrote: post #55
jedberg wrote: post #15

Earlier quoted context omitted.

Because MongoDB is a document store and you really only need a key/value store for this. Also because MongoDB started life preferring speed vs durability, which is a bad look for a database. They may have fixed that now, but I cannot forgive them for that.

"The best tool is the one I know".

Except when it's not. :)

Re: Show HN: Add license key verification to your apps

#57

Post by ptx »

frobozz wrote: post #54
ptx wrote: post #47

Earlier quoted context omitted.

> open sources surveillance (search engines and warez sites) That's the first time I've heard "open source" used to refer to a warez site. Is this overloading of the term being seeded by someone in order to, in a roundabout way, discredit the open source movement? A few years ago there would have been an obvious suspect for such FUD, but they seem to have embraced open source these days, so that wouldn't make sense.…

Open Source surveillance means "looking for/at stuff that is openly published" - e.g. looking on warez sites for keys being shared.. I'm pretty sure the term has been in use since the 1940s

Ah, I guess so. Thanks. Perhaps my tinfoil hat got in the way of seeing the context.

Re: Show HN: Add license key verification to your apps

#58

Post by paypalcust83 »

frknsn wrote: post #50
paypalcust83 wrote: post #14

Be very careful with licensing. VMware early-on had licensing code that disabled a customer's app and cost them a lot of money. Licensing of enterprise features is best to have a nag screen and disable some future actions rather than drop a ban-hammer. They were forced to strip out that code and ended up with weak enforcement of licensing. Telemetry and online verification are unacceptable to some customers of on-pre…

Thanks for your valuable comment! I thought telemetry and online verification will be just an option. If some app vendor doesn't want their users to force such thing, they will not use it. However, maybe, for some specific users, it may make sense.

Np. I forgot to mention that on-prem software usually optimizes for either proprietariness or COSS. If the former, it maybe worthwhile to employ multiple obfuscation and integrity checks in order to protect IP.

A VMware acquisition product I was involved in used a lot of dynamic language code and it seemed like a great idea for rapid development, but not necessarily for maintenance, sustainment, and IP protection. (They were still acquihired for eight figures nonetheless.)

If I were to be involved in a future enterprise startup intended for FNAC and/or acquihire, I would look at Crystal, Go, Haskell, OCaml, or Rust rather than the usual dynamic language suspects.

Re: Show HN: Add license key verification to your apps

#59

Post by renewiltord »

ddevault wrote: post #53
renewiltord wrote: post #48

Earlier quoted context omitted.

Haha, I know that Sourcehut is open-source and you derive revenue from the fact that people prefer to use it as a SaaS product, but it is amusing that the SaaS-ness of it means that your statement only applies to the front-end portion.

The SourceHut backend is also open source. A related idea is "if you're handling my data, I'm entitled to view the code which is doing so".

Right, right, I know. It's just the style of what you said was amusing, not your actual practice, which is consistent.

Re: Show HN: Add license key verification to your apps

#60

Post by [deleted] »

ddevault wrote: post #46
mwcampbell wrote: post #43

Earlier quoted context omitted.

But then as soon as a paying customer exercises freedom 2 and helps their neighbors by redistributing the software on the Internet, the vendor is most likely screwed. Particularly if they developed a great piece of end-user software that doesn't need support, training, hosting, or any other service to go with it.

Has this ever been shown to happen in practice? The vendor is the only one who can provide a guarantee that the distribution is genuine (i.e. not tampered with), provide timely updates, security notices, etc.

[deleted]
Post reply on HN