Hacker News Reader

Comment by imglorp | Hacker News Reader

Ah yes, the feature designed to prevent the product from working.

Back in the 90s our product--and many of our competitors in EDA--integrated with FlexLM (then Globetrotter, then Macrovision, then I lost track). It was clever and flexible, especially when talking about seats and site licenses and combining different vendors onto one license server, all before Internet was serious.

In reality, it was painful for users and they lost so much time fighting it: someone forgot to "check in" a license before using it, or the site license server was down, or you had the wrong feature line, or dozens of other failure modes.

View on HN

FlexLM is still going "strong" and used to encumber many scientific pieces of software widely used. It's exactly as you describe and incredibly user hostile -- albeit somehow the "best" DRM scheme out of many bad options in a space that often includes hardware dongles like iLok. It's incredibly frustrating to e.g. pay >$1m for a piece of kit and get a DRM encumbered UI for it, deliberately designed to make life awkward.

Of course, the obvious issue with the public key approach listed as being "best" in the article is that all it takes for an attacker to overcome the scheme is to replace your private keys with theirs -- or to patch a JMP for every do_license_check() call in the binary. It's fundamentally an approach that is always hackable.

Also its still massive in anything that's licensed by the CPU core - FEA/CFD type stuff (1 license = 1 core; 16 licenses = 16 cores).

I never enjoy seeing FlexLM, but I absolutely dread seeing the homebrew license servers from companies that choose not to use it.

>all it takes for an attacker to overcome the scheme is to replace your private keys with theirs -- or to patch a JMP for every do_license_check() call in the binary. It's fundamentally an approach that is always hackable.

That might be true in theory, but is non-trivial in practice. The code responsible for license verification is often obfuscated and tied to critical functionality, so you can't do a simple find and replace.

Indeed. If you're selling a 1MM piece of scientific equipment, then that's the dongle.

i made a killing when i was 17 selling w32 POS software i developed in my bedroom with vb6(?) because i hit the time 1) everyone wanted the window look and 2) all the big players (with ascii art ux) were succumbing to flexLM pushing dongle licenses and they never worked.

Reply on news.ycombinator.com