Keygen: Open-Source Software Licensing

github.com

13 points·serhack_··6 comments

This project is source-available (Elastic License), not open source:

> You may not move, change, disable, or circumvent the license key functionality in the software, and you may not remove or obscure any functionality in the software that is protected by the license key.

Ah yes, you're right

Took me a bit to realize it's licensing as in managing enterprise license keys 'C1B6DE-39A6E3...', not licensing as in MIT/GPL/etc. https://keygen.sh/

Does anyone know a minimal, alternative licensing solution appropriate for a tiny startup? One where the license key is the only form of user authentication. Is there a cheap service available? Or is it easy to roll a custom solution.

> One where the license key is the only form of user authentication.

I think it's the exact thing we have here, the problem is that you need a little bit of code to automatize all the stuff keygen presents to you.

JWTs validated against the public component of asymmetrical keys (ECDSA or RSA) can work if you want something that is client-side only and where the license key contains all information about the license without having to look it up in a remote database.

It won’t be particularly tamper resistant, but it should be sufficient to ‘keep the honest honest’ and (IANAL) might help your case in court if need be. Arguably, you can spend millions and still be in that position — though probably having managed to make a more customer hostile solution without significantly bothering those looking to circumvent your DRM.

We use this for generation: https://hub.windmill.dev/scripts/helper/1508/generate-a-lice... and this for client-side checking (https://hub.windmill.dev/scripts/helper/1510/verify-a-licens...) actually the real one is in rust but same algorithm.

Reply on news.ycombinator.com