Hacker News Reader

Comment by evgpbfhnr | Hacker News Reader

For anyone else wondering about the license, it's standard signing with an ec (sect239k1) key https://github.com/postalsys/emailengine/blob/master/lib/too...

So the author can just write whatever validity date/license details (apparently hostname etc), sign it and give that to their customers.

View on HN

Could you elaborate on this, not necessarily the code itself, but about signing and "an ec". I'm new to this and will be wanting to provide licences for software in the future.

Ecliptic curve signing. You can produce a message body like “valid_until=2025-02-25” then sign it and distribute it as an api key that’s body+sig. Client can verify signature using public key without a server call (sig validation).

EC beats other signatures because signature is muuuuuch shorter, so it can still look like an API key.

"an ec key" (elliptic curve) is just a detail, this can be done with any crypto library or utility - for example directly with the openssl command: https://stackoverflow.com/questions/15686821/generate-ec-key...

embed the public part in your application and you can verify that something signed with the 'dgst' command and the private key really has been signed with the private key (which you obviously shouldn't publish)

(Note if using plain commands there is more friendly than openssl, minify/signify are much harder to get wrong, but I'm not sure they're as easy to use programmatically in as many languages there are for libcrypto/sodium/etc; this is really just an example)

I use jwt for my app’s licensing. It works great.

Any resources you can provide that will help in understanding how this works?

https://jwt.io/

So all I have to do is generate my own private-public key pair, replace the hardcoded public key in the code you linked, then generate a license key with my private key. But yeah, I don't know what should be the payload of the signature.

If you're going to edit the source code you can just short-circuit the license check.

You can actually walk right past most "no trespassing" signs as well.

Signs, locks, and copyrights keep honest people honest. They don't change anyone else's behavior.

Add "face the angry company lawyers" to the todo list

Can't a user generate a fake license? Is there another layer of integrity checking, or can users simply patch in a fake checkLicense (which is apparently referred back to in four other spots in the code).

Well, you sure can patch it if you want :^) I think there isn't really a reason to add more than a simple license check though, as enterprise users are generally scared of using pirated software.

Also keep in mind pirated software doesn't cost the author anything if the user wasn't going to buy it anyway. If a company is willing to risk all that effort and liability to crack and maintaining the patches across changes to avoid paying for your software, they were not likely to pay for it in the first place. Nothing lost.

This. Any licensing schema that protects locally running software can be circumvented by a reasonably crafty individual – but there is simply no overlap in the Venn diagram of Paying Customers /\ These Crafty Individuals.

Yeah, or more specifically a company might have the competence but will not waste their engineers time, because the reason they’re using the service in the first place is to not have to focus on their core business. Not random accessories.

A lot of time, circumventing a license check would be more work than - say - implementing sending email on their own. Depending on what the service is.

Developers think they’re selling fancy tech. Most often, what we’re selling/providing is convenience - something boring that just works.

It would probably be even easier to patch the license check function. That's presumably against the software license, so due to copyright you would no longer be legally entitled to run the software.

Reply on news.ycombinator.com