There shouldn't be a need for client side database. Or at least it should be optional.
That’s not a client side database. The “verification server” is a publicly accessible database.
Show HN: Easy-to-use licensing library for .NET apps
11–20 of 35 posts
Re: Show HN: Easy-to-use licensing library for .NET apps
#12Quick start: takes 5 minutes
Quick crack: takes 5 minutes
Find the is-valid-license method and make it always return true.
As someone who has spent a considerable amount of time "on the other side", it's amusing to see things like this being open-source, because being closed-source --- and sometimes obfuscated --- is almost entirely what most DRM relies on for its strength.
Re: Show HN: Easy-to-use licensing library for .NET apps
#13If I were concerned about licensing, then I'm really not sure I'd put my faith into a library like this - not least that if the app just shipped with the dll, then it could be swapped out in the blink of an eye with a stub. There's significantly more involved in managing this sort of thing that a simplistic library such as this can manage. Companies concerned with licensing usually do it because they're protecting th…
Since we're on the topic, I would highly recommend https://cryptlex.com/
I have used them for a few projects. They have great support and features.
Re: Show HN: Easy-to-use licensing library for .NET apps
#14If I were concerned about licensing, then I'm really not sure I'd put my faith into a library like this - not least that if the app just shipped with the dll, then it could be swapped out in the blink of an eye with a stub. There's significantly more involved in managing this sort of thing that a simplistic library such as this can manage. Companies concerned with licensing usually do it because they're protecting th…
Since we're on the topic, I would highly recommend https://cryptlex.com/ I have used them for a few projects. They have great support and features.
Also I've heard good things about LimeLM
Re: Show HN: Easy-to-use licensing library for .NET apps
#15If you absolutely want client apps to check against a remote licensing source, it would make more sense to use an HTTP API for that rather than accessing a SQL Server or MySQL database directly. Requiring Entity Framework for the app is adding a lot of overhead, and corporate policies often ban publicly-exposed database servers. (Removing the EF dependency would also let you ship a .NET Standard 2.0 version suitable…
Yeah I don’t think using a database is a sensible API for this task
It’s beyond not a sensible API, it’s significantly harder to secure, inappropriately so…
On the licensing service side as they have to lock down a database server to allow safe A.C. access by arbitrary clients…
And requires end users to carve out firewall/network security rules to allow outbound connections to an arbitrary database server, which is a pretty significant data exfiltration vector and I’d be extremely concerned about enabling this even at the best of times…
The mitigation would have been trivial, gRPC, gRPC Web(which has excellent support in the .Net world) , or a regular HTTP API would have been completely adequate and this database driven solution is the sort thing I’m not surprised to see from a .Net developer, as along with Java devs seem to be the last remaining pockets where it’s obvious that a developer can go their entire career without knowing anything about code outside the corporate Network. Since that’s the only place this is even close to safe, 100% inside the corporate firewall. To clarify this is to say that the only two developer communities where I would not be surprised to see this are Java and .Net, because they contain enough developers who lived inside the corporate walls and have yet to gain enough exposure to wider community practices, not because of anything about the languages themselves but because if the social dynamics involved in the developer population that work with these languages.
Re: Show HN: Easy-to-use licensing library for .NET apps
#16Quick start: takes 5 minutes Quick crack: takes 5 minutes Find the is-valid-license method and make it always return true. As someone who has spent a considerable amount of time "on the other side", it's amusing to see things like this being open-source, because being closed-source --- and sometimes obfuscated --- is almost entirely what most DRM relies on for its strength.
I think the goal isn't to combat cracks. Cracking software is often easy, especially for dotnet applications.
I would use this for products that are mostly used by businesses. Some businesses will happily run pirated software, but any potential customer will just pay for the license. All you need is a way to turn a trial version into an activated version to make the popups/watermarks go away.
Re: Show HN: Easy-to-use licensing library for .NET apps
#17This is about as secure as loading a text file that says "licensed=true".
Anyone can easily proxy the server DNS call, put up their own server, etc.
A client app connecting to a public facing database server with no authentication is a huge security risk, aside from anything this whole library is doing.
Re: Show HN: Easy-to-use licensing library for .NET apps
#18Not that I'd use this, but in its defense there are applications for a lightweight licensing nag screen: B2B products where your customer almost certainly isn't going to be a leet hacker and is otherwise bound by the terms of a broader contract.
Think of it like locks on doors in the professional world of business software. Helps to keep the customer honest because at the end of the day they don't actually want to violate any rules. It can be hard to keep track of all the instances of things in some enterprises. The scale of our average customer has informed us that integrated licensing functionality is ideal for some of our products.
Re: Show HN: Easy-to-use licensing library for .NET apps
#19Earlier quoted context omitted.
Yeah I don’t think using a database is a sensible API for this task
It’s beyond not a sensible API, it’s significantly harder to secure, inappropriately so… On the licensing service side as they have to lock down a database server to allow safe A.C. access by arbitrary clients… And requires end users to carve out firewall/network security rules to allow outbound connections to an arbitrary database server, which is a pretty significant data exfiltration vector and I’d be extremely co…
Taken into account. Maybe an HTTP API will be introduced in version 2.0.0. Thanks for leaving your feedback!
Re: Show HN: Easy-to-use licensing library for .NET apps
#20If I were concerned about licensing, then I'm really not sure I'd put my faith into a library like this - not least that if the app just shipped with the dll, then it could be swapped out in the blink of an eye with a stub. There's significantly more involved in managing this sort of thing that a simplistic library such as this can manage. Companies concerned with licensing usually do it because they're protecting th…
Please note it's only the first major version! Do you want a perfect, bug-free library in releases 1.x.x?! Your feedback was taken into account, though.