Live data from Hacker News

Ask HN: We found a cracked version of our software on the web, now what?

news.ycombinator.com

91–100 of 297 posts

Re: Ask HN: We found a cracked version of our software on the web, now what?

#91
post #24

Earlier quoted context omitted.

Also a note about the dangers of cracked software. There could be malware, viruses, etc. The value becomes much smaller to use something that could ransomware your system. Then, cracked software becomes free advertising!

> Also a note about the dangers of cracked software. There could be malware, viruses, etc. The value becomes much smaller to use something that could ransomware your system. I've always thought this was kind of an old wives' tale FUD. Long time back when I used to hoist the ol Jolly Roger, the pirated versions of software seemed to always be pristine copies. Reputable release groups had their reputation in mind and w…

Problem with pirated movies these days (and for a long time) is that you have so many variations: garbage like different encoding schemes because some loser still watches the films on their DivX player or re-encoded in other methods. Then you have different release groups releasing their own variations and you have to keep on top of all these silly labeling schemes on the filenames. It all leads to clutter on the scene sites and no true guarantee that you are getting the pristine release. These days, I acquire the 4K Blue-Ray, rip the data, strip off the DRM, and make my own pristine release that I know for sure is the best of the best. Its got all the ads/copyright stuff stripped and all tracks, subtitles added.

Re: Ask HN: We found a cracked version of our software on the web, now what?

#92

I agree with others saying "do nothing"... mostly. Trying to prevent piracy is a waste of time and resources better spent on people who actually pay you money. To that end, if you do anything, the goal should be to ensure that you can tell the difference between who is paying and who isn't. You don't want to field support for cracked copies. Some developers I know and will not name have been known to leak their own c…

> ensure that there is something broken about them that easily identifies them as a cracked copy.

If the broken thing ends up publicly known, then it will just get fixed in the next cracked version. But if you keep it under wraps, then you'll end up with a reputation for writing buggy, unstable software, especially when the inevitable false positives occur.

Re: Ask HN: We found a cracked version of our software on the web, now what?

#94

Add a trigger that doesn't fire until a few months after install (to prevent the cracker coming across it and patching it out) and then run rm -rf if it detects it is cracked. Optionally display a countdown from 10 and play an alarm sound before this happens for extra lols.

You could go to jail for doing this.

Re: Ask HN: We found a cracked version of our software on the web, now what?

#95
You can beef up the protection or you can ignore the issue.

Without knowing specifics of your software (language, platform, etc.) it's hard to advice on the protection scheme, but a simple option for compiled Windows binaries would be something like VMProtect (which is what Denuvo protection is based on). This will dramatically increase the amount of effort needed for a crack. On the flip side it may also increase the amount of false positives from anti-viruses and security software, but an EV sig on the binaries and a smaller installation base should easily offset that.

Also, it's worth keeping in mind that there are two classes of cracks. One is done for (basically) the street cred and another is the paid-for cracks. The vast majority of cracks are of the first kind, done by people on the warez scene. They tend to go after easy targets and will give up when there's more to the crack than nop'ing a couple of IFs or patching a couple of functions via a proxy DLL. So even a little friction here will go a very long way.

Something as simple as periodically re-verifying your license at random intervals using independent copies of your license validation code would be a good start. Ditto for checking the signature on your binaries. Never displaying the result of failed validation immediately, but always delaying it a bit. We are aiming at irritating, frustrating and wasting their time.

Despite of some people say, you can cripple your software if you detect it's running an "altered" version. The counter-argument goes that this will cause users of cracked versions assume that your software is of a poor quality, this information will spread and taint your reputation. This is 100% b/s. In reality every single user of cracked software is perfectly aware of incomplete cracks, so when a cracked version malfunctions, they know why.

If your program phones back home, e.g. to check for updates, make it report the hash of its binary and a license, and then allow crippling the install remotely. Among other wonderful uses, this allows messing with someone who is in the process of cracking your software, in real-time. Really dirty, but super effective.

Or you can do nothing, lay back and relax. But where's fun in that?

Re: Ask HN: We found a cracked version of our software on the web, now what?

#96

Place secret bits in each copy that identifies the purchaser, then sue when the next version comes out.

This won't help. Either one person will buy with fake information and then leak that copy, or when a legitimate buyer's computer gets hacked, the copy from there will get stolen and distributed.

Re: Ask HN: We found a cracked version of our software on the web, now what?

#97
Consider this: if the license costs 1,000, most people who are pirating it can’t afford it. Those pirates are learning how to use your software, and when they get a job at a relevant firm, what software are they going to want their new bosses to buy? I think Photoshop grew quite a bit due to something like this (before they went with the subscription nonsense)

Re: Ask HN: We found a cracked version of our software on the web, now what?

#98

I’d suggest taking a page from Adobe and Microsoft. They fight pirating, and that prevents it from becoming absolutely endemic, but they don’t really lose massive amounts of sleep over the cracks, because every cracked copy is training people to use their software. Sort of “The Old Dope Peddler” model. It’s not really correct to assume every cracked copy is a lost sale. Instead, think of it as indoctrination of possi…

I’ve seen an advanced version of this once. A company I’m familiar with made sure it was relatively easy for users to copy existing licenses. So in an organisation where their software was popular but maybe a pain to get a purchase order for it would spread. They had activation ping backs and could see which companies were running lots of unlicensed copies. They would let it spread and wait till usage plateaued. Then legal would contact that org and suggest they buy the full thing with a nice juicy support contract to avoid litigation.

This worked especially well with (I think) US government agencies who can in theory be fined for every time the software was activated.

Re: Ask HN: We found a cracked version of our software on the web, now what?

#99

Congratulations! Having cracked versions out there indicates that your software is both useful and notable, which is a point where many developers would love to arrive at, maybe, one day. As to what to do about it, there are two basic tracks, neither of which is incompatible with the other: 1. The legal route: notifying distribution sites that they're hosting content in violation of copyright law, requesting takedown…

A (possible) third option would be to distribute the product under a SaaS model instead of a binary.

Re: Ask HN: We found a cracked version of our software on the web, now what?

#100

Congratulations! Having cracked versions out there indicates that your software is both useful and notable, which is a point where many developers would love to arrive at, maybe, one day. As to what to do about it, there are two basic tracks, neither of which is incompatible with the other: 1. The legal route: notifying distribution sites that they're hosting content in violation of copyright law, requesting takedown…

There was a videogame that got famous because it was pirated, it was a management game about setting up a gaming company. Turns out, the pirated copy had a special feature where the player would feel immense economic pressure from piracy, so a bunch of players asked how to win against this, it was pretty hard and really fun for people who knew what was going on. Point is, you could hide an Easter Egg for pirated vers…

Crysis 3 would let you play an hour or two and then some special weapon wouldn't have ammunition essentially soft-locking you out. Great way to sell too.
Post reply on HN