Live data from Hacker News

Show HN: Easy-to-use licensing library for .NET apps

github.com

1–10 of 35 posts

Show HN: Easy-to-use licensing library for .NET apps

#1
This free, open-source .NET library allows you to license your non-free applications through activation keys. Follow the quick start instructions and try it out in 5 minutes!

Available on:

NuGet https://www.nuget.org/packages/SNBS.Licensing.ActivationKeys...

Website (full docs, downloads) https://snbslibs.github.io/Licensing.ActivationKeys

GitHub (downloads, full docs, release notes etc.) https://github.com/SNBSLibs/Licensing.ActivationKeys

Show HN: Easy-to-use licensing library for .NET apps
github.com

Re: Show HN: Easy-to-use licensing library for .NET apps

#3
I usually use something completely different for that use case. Specifically, ECDsaCng class from the standard library, which implements ECDSA asymmetric cryptoalgorithm.

Generate a key pair, embed public key in your executable, keep private key private.

A license is some JSON or XML or whatever, signed with the private key. If your licenses are permanent, and you don't need different license types, a license is just a signature of some computer ID (like hard drive serial), with that private key.

Unlike the older RSA, ECDSA results in very small signatures, even for very strong curves like NIST P-521. These signatures only take couple lines in Base64 text format.

Re: Show HN: Easy-to-use licensing library for .NET apps

#5
If you absolutely want client apps to check against a remote licensing source, it would make more sense to use an HTTP API for that rather than accessing a SQL Server or MySQL database directly. Requiring Entity Framework for the app is adding a lot of overhead, and corporate policies often ban publicly-exposed database servers.

(Removing the EF dependency would also let you ship a .NET Standard 2.0 version suitable for .NET Framework apps.)

Re: Show HN: Easy-to-use licensing library for .NET apps

#6
post #5

If you absolutely want client apps to check against a remote licensing source, it would make more sense to use an HTTP API for that rather than accessing a SQL Server or MySQL database directly. Requiring Entity Framework for the app is adding a lot of overhead, and corporate policies often ban publicly-exposed database servers. (Removing the EF dependency would also let you ship a .NET Standard 2.0 version suitable…

Yeah I don’t think using a database is a sensible API for this task

Re: Show HN: Easy-to-use licensing library for .NET apps

#7

Why does it need a database on the client side? Sounds like a significant restriction. A lot of apps do not have a database at all or have an exotic one (NoSQL).

It looks like the client is designed to connect to a publicly accessible MySQL/MSSQL server. I don’t know if that’s better or worse than a client-side database!

Re: Show HN: Easy-to-use licensing library for .NET apps

#8

I usually use something completely different for that use case. Specifically, ECDsaCng class from the standard library, which implements ECDSA asymmetric cryptoalgorithm. Generate a key pair, embed public key in your executable, keep private key private. A license is some JSON or XML or whatever, signed with the private key. If your licenses are permanent, and you don't need different license types, a license is just…

If your licenses are time-limited, you can use regular X.509 certificates to represent a license (where the subject name signed is the computer ID, and the validity period of the certificate is the validity period of the license). You could even run standard X.509 revocation checks in order to enable blocking of illegally shared keys.

Re: Show HN: Easy-to-use licensing library for .NET apps

#9
If I were concerned about licensing, then I'm really not sure I'd put my faith into a library like this - not least that if the app just shipped with the dll, then it could be swapped out in the blink of an eye with a stub.

There's significantly more involved in managing this sort of thing that a simplistic library such as this can manage.

Companies concerned with licensing usually do it because they're protecting their assets from software piracy. Something like this would be horribly easy to circumnavigate.

You're using a simple pseudo random number generator as well (as opposed to a cryptographic one), which is incredibly weak, and, as others have made clear, making a direct DB connection is an absolute no-no: Your methodology of requiring a directly connecting to a remote database server, that is also required to be accessible 100% of the time, is critical point of failure.

I can't imagine anyone (outside of the really big name vendors) that'll have customers that'll be "forgiving" enough to be blocked simply because there's an issue with the remote database.

Not used them myself, but something like https://licensespring.com/ seems to provide significantly better license management.

Re: Show HN: Easy-to-use licensing library for .NET apps

#10

I usually use something completely different for that use case. Specifically, ECDsaCng class from the standard library, which implements ECDSA asymmetric cryptoalgorithm. Generate a key pair, embed public key in your executable, keep private key private. A license is some JSON or XML or whatever, signed with the private key. If your licenses are permanent, and you don't need different license types, a license is just…

You can go a step further and you can embed a key in the license itself that is used to sign any files that the software produces that then would alert someone if they were created with unlicensed software.

AutoDesk software and quite a few other creative tools do that.

So whilst they are fairly easily cracked its quite hard to use that software in a commercial setting.

Post reply on HN