Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Easy-to-use licensing library for .NET apps

github.com

Post reply on HN
Print view View original

21–30 of 35 posts

Re: Show HN: Easy-to-use licensing library for .NET apps

#21

Post by SNBS »

swdev281634 wrote: post #3

I usually use something completely different for that use case. Specifically, ECDsaCng class from the standard library, which implements ECDSA asymmetric cryptoalgorithm. Generate a key pair, embed public key in your executable, keep private key private. A license is some JSON or XML or whatever, signed with the private key. If your licenses are permanent, and you don't need different license types, a license is just…

I know. It's another kind of licensing. I've created a library specifically for activation keys.

Re: Show HN: Easy-to-use licensing library for .NET apps

#22

Post by SNBS »

userbinator wrote: post #12

Quick start: takes 5 minutes Quick crack: takes 5 minutes Find the is-valid-license method and make it always return true. As someone who has spent a considerable amount of time "on the other side", it's amusing to see things like this being open-source, because being closed-source --- and sometimes obfuscated --- is almost entirely what most DRM relies on for its strength.

Same things will happen with other licensing libraries (or I'm dumb). BTW, you have to disassemble the client app first! I think non-free apps are almost always obfuscated.

Re: Show HN: Easy-to-use licensing library for .NET apps

#24

Post by MissTake »

SNBS wrote: post #22
userbinator wrote: post #12

Quick start: takes 5 minutes Quick crack: takes 5 minutes Find the is-valid-license method and make it always return true. As someone who has spent a considerable amount of time "on the other side", it's amusing to see things like this being open-source, because being closed-source --- and sometimes obfuscated --- is almost entirely what most DRM relies on for its strength.

Same things will happen with other licensing libraries (or I'm dumb). BTW, you have to disassemble the client app first! I think non-free apps are almost always obfuscated.

Obfuscation isn't all that good when out to the real test.

Any .net app not compiled to native code can be disassembled if one is prepared to put any time to it.

Back when the .net Framework first came out, I was all over using the full Dotfuscator app thinking it would protect my apps. I was even more excited when I observed reflector giving up on it.

Right up until a friend of mine used a different app and showed me the deobfuscated code. I gave up at that point and realized it wasn't worth the effort.

Whilst your willingness to tip a toe in these waters is a good thing, I'd not hold out much hope of this library being used by many, if any people when there are some far better, more resilient and battle hardened versions out there.

Re: Show HN: Easy-to-use licensing library for .NET apps

#25

Post by jeremycarter »

SNBS wrote: post #20
MissTake wrote: post #9

If I were concerned about licensing, then I'm really not sure I'd put my faith into a library like this - not least that if the app just shipped with the dll, then it could be swapped out in the blink of an eye with a stub. There's significantly more involved in managing this sort of thing that a simplistic library such as this can manage. Companies concerned with licensing usually do it because they're protecting th…

Please note it's only the first major version! Do you want a perfect, bug-free library in releases 1.x.x?! Your feedback was taken into account, though.

Our concern is in the core design of the product offering that shows some big weaknesses. Nobody is being deliberately critical here.

Re: Show HN: Easy-to-use licensing library for .NET apps

#26

Post by jeremycarter »

pugz wrote: post #7
garganzol wrote: post #2

Why does it need a database on the client side? Sounds like a significant restriction. A lot of apps do not have a database at all or have an exotic one (NoSQL).

It looks like the client is designed to connect to a publicly accessible MySQL/MSSQL server. I don’t know if that’s better or worse than a client-side database!

It's poor design

Re: Show HN: Easy-to-use licensing library for .NET apps

#27

Post by jeremycarter »

devrand wrote: post #11
amir734jj wrote: post #4

There shouldn't be a need for client side database. Or at least it should be optional.

That’s not a client side database. The “verification server” is a publicly accessible database.

Yep. I would avoid this library.

Re: Show HN: Easy-to-use licensing library for .NET apps

#28

Post by SNBS »

MissTake wrote: post #24
SNBS wrote: post #22

Earlier quoted context omitted.

Same things will happen with other licensing libraries (or I'm dumb). BTW, you have to disassemble the client app first! I think non-free apps are almost always obfuscated.

Obfuscation isn't all that good when out to the real test. Any .net app not compiled to native code can be disassembled if one is prepared to put any time to it. Back when the .net Framework first came out, I was all over using the full Dotfuscator app thinking it would protect my apps. I was even more excited when I observed reflector giving up on it. Right up until a friend of mine used a different app and showed m…

I don't really think, either, anybody will use a library that is almost in the state of initial development. It's the first.

Secondly, what do you want? I could inject the license check into multiple parts of the library, but this is a dubious way.

Re: Show HN: Easy-to-use licensing library for .NET apps

#29

Post by SNBS »

devrand wrote: post #11
amir734jj wrote: post #4

There shouldn't be a need for client side database. Or at least it should be optional.

That’s not a client side database. The “verification server” is a publicly accessible database.

Publicly accessible? Well, if you share the database username and password, maybe yes.

The credentials can be taken from the disassembled source code, but I've already taken it into account. The next versions will use an HTTP API.

Post reply on HN