Hacker News Reader

Comment by SOLAR_FIELDS | Hacker News Reader

I used to work with a guy who worked at a prominently successful FOSS style company that used self hosted licensing as one of their bigger sales models (think like Elastic or Mongo) and he mentioned something I found really interesting. He said that you really should not care about licensing that much beyond just basic controls. Why? The people that would cheat your licensing are very often not who you want as customers anyway. The real moneymakers would never risk being caught out violating license terms. So really licensing software, at least for enterprise software, is kind of a dead end from that perspective as a moneymaker.

View on HN

I'd second that. If someone is circumventing your licensing checks then they're not a customer, but on the plus side they're effectively the same as a free plan user (with zero support) and maybe in their next job they'll recommend using your tool and getting a real license, or maybe they'll get tired of hacking each update and just buy a license.

I can see the idea that the OP is suggesting but decades of keygens and hacking have taught us that if someone really wants to use your software without paying, then they will.

I've seen people craft elaborate ways around my own software licensing check when the actual "hack" is jaw droppingly simple (and is all on github), the point is that the people you need to concern yourself with are the people who will pay for a license.

Decades of keygen have taught us that cracking licensing is an irresistible puzzle to some personalities

Interestingly enough the same thing happens with a lot of gamers. In the low end of the software market, often your pirate users were never going to buy your game in the first place, it was just opportunistically available to them.

Many pirates still buy games anyway, too.

What you should do is track your installs but don't enforce. Then you can enforce later if you need to...but you can nag more effectively because you can show the value you bring (since they have like 50 installs).

That said, most licensing checks are simplistic and can be bypassed easily. I mean, this code:

if (licensed) then activate=true

is relatively easy to find and patch around by a motivated individual.

A better way would be to use a key from your key server to encrypt/decrypt their configuration, like with TOTP. But you still would have to make sure they didn't just bypass your encrypt/decrypt code.

That's also how I think of it, too. But still you need to do a good job of your basic controls. In our case, I want them to be as cryptographically strong as possible. Can you share the company?

My thinking on pirates is: marketers who work for free. Hahaha! :)

This is likely the best advice for the HN crowd. However there is clearly some sort of tipping point where draconian licensing models make a difference. These BIGCORP don't hire legions of lawyers because it loses them money.

Reply on news.ycombinator.com