Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Add license key verification to your apps

github.com

Post reply on HN
Print view View original

71–80 of 95 posts

Re: Show HN: Add license key verification to your apps

#71

Post by rahimnathwani »

toyg wrote: post #68
rahimnathwani wrote: post #66

Earlier quoted context omitted.

Oracle does not rely on companies' good intention, or their need for ongoing support. They use contracts and audits to make sure they get what they're owed. If you can force companies to pay after they start using something, then making it as easy as possible for them to expand usage is going to maximise your revenue. Google 'Oracle License Audit' or 'Oracle LMS' to learn more.

Man, I worked for them, I know the score :) And that's precisely what I said: they just use the law ("contracts"). Legitimate businesses don't want problems with the law. It's more effective, for Oracle, to carefully draft (and subsequently enforce) legal documents, than to add some rigamarole that will only make life harder for legitimate clients and their own support ops.

Right, but the cost of enforcement doesn't scale linearly with licence cost. If your median customer spends millions with you per year, you can afford to spend money on enforcement. If your median customer spends $10k/year, I don't see how you can compel them to submit to an audit, or how you can get positive ROI from enforcement activities.

This is one of the benefits of SaaS (for sellers).

Re: Show HN: Add license key verification to your apps

#72

Post by bscphil »

metaobserver wrote: post #42
ddevault wrote: post #29

Earlier quoted context omitted.

I reject any argument which justifies behavior because it makes someone money that they otherwise might not. Captalism does not justify a lack of ethics.

Your premise is wrong: there is nothing unethical about closed-source software. In 99% of the cases users want great software, great customer support and don't care about the source. If they really do, they can often sign an NDA and buy it. And that's fair. Free market doesn't need a pseudo-ethical middle-man.

I think you might have replied to the wrong comment, because this response makes no sense. ddevault said:

> I reject any argument which justifies behavior because it makes someone money that they otherwise might not. Captalism does not justify a lack of ethics.

ddevault's point is that the mere fact that doing P makes someone money is irrelevant to whether it's ethically okay to do P. ddevault does not say whether closed source software is unethical or not (in this comment), and so your "premise" does not exist here.

Furthermore, you go on to make exactly the mistake ddevault is complaining about: "there is nothing unethical about closed-source software." Why? Because "[the customers are willing to pay for it]". The fact that there are people willing to pay for something is irrelevant; the fact that there's a market for hitmen doesn't make that acceptable either.

Re: Show HN: Add license key verification to your apps

#73

Post by nexuist »

huhtenberg wrote: post #20

No to be harsh, but this is largely useless. The biggest issues with in-app licensing is (1) Binding licensing to the machine (or the user!) (2) Making sure that your licensing check can't be NOP'ed by a l33r haxxor within 5 minutes of the release. Tangential to that is (3) which is an ability to tolerate minor changed to the machine and OS reinstalls without invalidating the license. (1) and (3) aren't hard to solve…

I really believe this is why SaaS is such a dominating business model now. Software licensing failed because it is technically impossible, and no amount of clever tricks will save you from determined groups / individuals. If it runs on your machine, you will be able to get it to run again without the licensing requirements. We saw large companies get pwned time and time again.

On the other hand, there is no way you can see what a SaaS backend is doing and replicate that locally. Sure, you can rip off the frontend, but that's just a thin client over the API anyways. The API is the proprietary product, and much easier to secure.

Even if a blackhat breaks into your SaaS repository and leaks your source code (which is generally a freak event, especially among businesses that take cybersec seriously) - what are your customers supposed to do with that? I wouldn't expect your average AirTable customer to be able to understand how to launch and maintain an AirTable instance.

It's just a better idea to serve your product over the Web. If you sell native applications, you can't expect to make as much money as SaaS equivalents.

Re: Show HN: Add license key verification to your apps

#74

Post by mcny »

paypalcust83 wrote: post #58
frknsn wrote: post #50

Earlier quoted context omitted.

Thanks for your valuable comment! I thought telemetry and online verification will be just an option. If some app vendor doesn't want their users to force such thing, they will not use it. However, maybe, for some specific users, it may make sense.

Np. I forgot to mention that on-prem software usually optimizes for either proprietariness or COSS. If the former, it maybe worthwhile to employ multiple obfuscation and integrity checks in order to protect IP. A VMware acquisition product I was involved in used a lot of dynamic language code and it seemed like a great idea for rapid development, but not necessarily for maintenance, sustainment, and IP protection. (T…

> If I were to be involved in a future enterprise startup intended for FNAC and/or acquihire, I would look at Crystal, Go, Haskell, OCaml, or Rust rather than the usual dynamic language suspects.

Thank you for your insight again. I tried to Google FNAC but I didn't have luck. What does it mean?

Re: Show HN: Add license key verification to your apps

#75

Post by niij »

freedomben wrote: post #33
koolba wrote: post #10

Earlier quoted context omitted.

There’s plenty of reason for end user software to be closed source. The biggest one is so that it can exist. Plenty of software would not be written if someone was not paid to do it. And plenty of those would not be paid if the source was available. If you disagree, vote with your wallet.

Minor nit, open source != free as in beer. In FSF philosophy it's not wrong to charge money. It is wrong not to include the source with the customer's purchase.

I love open source software and use it everyday, so this question is coming from genuine curiosity. I'm a bit conflicted about how I feel above the "ethical" argument for OSS.

Why is closed source software unethical? Is it unethical for McDonald's to sell me a Big Mac, even though they won't provide the recipe for the secret sauce (yes I know it's Thousand Island dressing)?

Re: Show HN: Add license key verification to your apps

#76

Post by jlgaddis »

mcny wrote: post #74
paypalcust83 wrote: post #58

Earlier quoted context omitted.

Np. I forgot to mention that on-prem software usually optimizes for either proprietariness or COSS. If the former, it maybe worthwhile to employ multiple obfuscation and integrity checks in order to protect IP. A VMware acquisition product I was involved in used a lot of dynamic language code and it seemed like a great idea for rapid development, but not necessarily for maintenance, sustainment, and IP protection. (T…

> If I were to be involved in a future enterprise startup intended for FNAC and/or acquihire, I would look at Crystal, Go, Haskell, OCaml, or Rust rather than the usual dynamic language suspects. Thank you for your insight again. I tried to Google FNAC but I didn't have luck. What does it mean?

> FNAC

In this case, "feature, not a company" (I believe).

Re: Show HN: Add license key verification to your apps

#77

Post by freedomben »

niij wrote: post #75
freedomben wrote: post #33

Earlier quoted context omitted.

Minor nit, open source != free as in beer. In FSF philosophy it's not wrong to charge money. It is wrong not to include the source with the customer's purchase.

I love open source software and use it everyday, so this question is coming from genuine curiosity. I'm a bit conflicted about how I feel above the "ethical" argument for OSS. Why is closed source software unethical? Is it unethical for McDonald's to sell me a Big Mac, even though they won't provide the recipe for the secret sauce (yes I know it's Thousand Island dressing)?

It's a great question, and I wish I had more time to delve into it. It really comes down to how a person defines their ethics.

FSF philosophy (which I love but am not 100% in sync with) is detailed here: https://www.gnu.org/philosophy/philosophy.html

Discussion around why proprietary software is unethical: https://www.gnu.org/proprietary/proprietary.html

A lot of it ties into theories around power dynamics as well. When you deny someone the freedom to see what is running on their machine, you put the developer/company in an unfair position of power over the user. We have seen that abused time and again for spying purposes and data collection, for example.

Anyway, interesting stuff. I'll try to come back when I get some time.

Re: Show HN: Add license key verification to your apps

#78

Post by zamfi »

paypalcust83 wrote: post #58
frknsn wrote: post #50

Earlier quoted context omitted.

Thanks for your valuable comment! I thought telemetry and online verification will be just an option. If some app vendor doesn't want their users to force such thing, they will not use it. However, maybe, for some specific users, it may make sense.

Np. I forgot to mention that on-prem software usually optimizes for either proprietariness or COSS. If the former, it maybe worthwhile to employ multiple obfuscation and integrity checks in order to protect IP. A VMware acquisition product I was involved in used a lot of dynamic language code and it seemed like a great idea for rapid development, but not necessarily for maintenance, sustainment, and IP protection. (T…

> I would look at Crystal, Go, Haskell, OCaml, or Rust rather than the usual dynamic language suspects

Or, you know, go full obfuscation: minify your JavaScript before your ship it!

Back in the day, we used Mozilla's Rhino as a JS engine -- if you're not familiar, it was a JS engine that compiled JS to Java byte code, literally putting the Java in JavaScript (or vice versa?). IIRC every function became a Java class, which made for some serious weirdness when it came to debugging garbage collection (new anonymous function? more permgen usage!)...

We shipped a .jar for on-prem installation. Needless to say, anyone who tried to decompile got a hilariously confusing set of Java code. :)

Re: Show HN: Add license key verification to your apps

#79

Post by jlgaddis »

ptx wrote: post #47
paypalcust83 wrote: post #14

Be very careful with licensing. VMware early-on had licensing code that disabled a customer's app and cost them a lot of money. Licensing of enterprise features is best to have a nag screen and disable some future actions rather than drop a ban-hammer. They were forced to strip out that code and ended up with weak enforcement of licensing. Telemetry and online verification are unacceptable to some customers of on-pre…

> open sources surveillance (search engines and warez sites) That's the first time I've heard "open source" used to refer to a warez site. Is this overloading of the term being seeded by someone in order to, in a roundabout way, discredit the open source movement? A few years ago there would have been an obvious suspect for such FUD, but they seem to have embraced open source these days, so that wouldn't make sense.…

> That's the first time I've heard "open source" used to refer to a warez site.

I think "open-source intelligence" [0] is probably a little more commonly used but both terms basically refer to the same thing -- the acquiring and/or gathering of data or information from public, or "open", sources.

Originally, it was mostly a government/intelligence thing:

> Open-source intelligence (OSINT) is data collected from publicly available sources to be used in an intelligence context. In the intelligence community, the term "open" refers to overt, publicly available sources (as opposed to covert or clandestine sources).

More recently, it has been used to refer to the act of gathering information by searching the Internet.

> Is this overloading of the term being seeded by someone in order to, in a roundabout way, discredit the open source movement?

To be clear, this usage of "open-source" predates open-source software and "the open source movement" by a few decades, at least. Additionally, as the Wikipedia article explicitly points out (in the first paragraph), "it is not related to open-source software".

---

[0]: https://en.wikipedia.org/wiki/OSINT

Post reply on HN