Hacker News Reader

> Remember that there is still quite a bit of friction to doing that, and that many people have better things to do than jump through those hoops

The thing is that Photopea has been extremely obnoxious with giant colorful ads. They take a big portion of the right-side of the screen (anywhere between 1/4th and 1/6th depending on your screen resolution), stealing important real-estate for actual work.

The owner of Photopea also fights ad blockers harshly and he went as far as surreptitiously breaking some features on purpose when it detected that an adblocker was installed (of course with a fair share of false positives), and then showed later a popup telling the user that they lost their work because of the adblocker. I think he eventually backpedaled on this due to the massive backlash.

You can pay to remove the ads but it costs 60€/year. I think few people are willing to pay for that when they just use it 2-3 times a month.

Overall the developer made the friction so extreme that people will do anything to get rid of the DRM entirely and use self-hosted instances. I think Photopea’s days are counted, a community effort to rebuild a similar tool from the ground up will definitely become a thing. The only thing left to say will be farewell Photopea, you served us well.

Another example I remember from quite a while ago. The site owner realized that the copycat site was displaying images sourced directly from his site. Since he had control over them, he changed the data to return less-than-appropriate images. I believe the copycat site ended up taking their site down after that.

> Remember that there is still quite a bit of friction to doing that

If they're using the github.io repo, the web app can be just as accessible as any other site

> More importantly, when detecting that Photopea is pirated, if it runs for 3-6 minutes and then crashes, it's more likely to look like a bug in the export than a deliberate anti-piracy attempt.

This is a very frequently repeated point, which is invalid.

Crashing pirated versions do not affect the reputation of the original. It’s an urban legend.

People using pirated versions are perfectly aware of the fact that they are using butchered versions of the original. So when it crashes, chances are it's because of a botched DRM bypass. It's an obvious connection, has always been.

Techniques like what you describe made a little more sense when the means to even figure them out were less feasible for the average person, especially before the web had much information on reverse engineering, when powerful debugging tools weren't as accessible or free.

Today, there is little point in trying to slow down software pirates. At best, adding an arbitrary piracy detection only adds anywhere between mere minutes and a few days to the effort to crack software. This is true absent AI assistance or even a meaningful understanding of ASM outside of logical JMP instructions. The author will likely waste more of their time implementing anti-piracy techniques than a software pirate would figuring out which function call results in the program exiting abruptly. I've yet to encounter a program where a single flipped JE/JNE or NOP couldn't unlock most or all capabilities. This is in spite of various licensing and contextual checks throughout.

It would slow down a pirate more to have a program modify or decompress itself in memory, but that class of techniques is still more trouble than it's worth. Experienced pirates already know how to deal with those traps. The timeout thing you mentioned is clever, but the type of person who knows enough to disassemble software would think to themselves "wtf does it crash after 5 minutes?", immediately investigate, and identify the source of the crash.

Having a license check is the only thing authors of software should bother with. It provides most people a framework to consider whether they should pay for a product. Most people won't download potential malware from a sketchy website if you offer your product at a fair price. Those who either know how to crack apps or refuse to pay will keep doing what they're doing.

tl;dr Don't fool yourselves into thinking you'll outsmart a kid with Ghidra installed by throwing a glorified if-statement in their path.

EDIT: I'm speaking in the general sense. The same principles apply to an app that runs almost all of its logic in the browser.

> I've yet to encounter a program where a single flipped JE/JNE or NOP couldn't unlock most or all capabilities

There are some, with code consistency cross-checks and such. Cracking them with static code patching can get very time-consuming. Patching them dynamically works, but some have checks for that too. It's not common though for sure.

Yeah, I'm sure they're out there, but it's very rare in my experience. I'm a micro-brain when it comes to cracking software, and I've almost never encountered this, whether it's small fry software or something from Microsoft or Autodesk. There was some software with debugger detection I came across once (can't remember which it was), but that's the kind of thing where lots of existing workarounds often exist by other crack-ers.

I'd recommend taking a look at DRM for games. It's been a while since I read anything, but AFAIK Denuvo is still effective enough to protect newly released games for weeks.

If I was a much younger man, I would gladly spend weeks or months out of my life to try and break a Denuvo protected game. haha

(again, for the mere intellectual challenge, not to take profit away from someone's work)

I've spent some years in gamedev and doing PC versions was a big part of it. I have seen countless attempts at 'code consistency cross-checks' and they all have been defeated. The only thing that came close was Denuvo. You may want to read up on it before dismissing it. It's sad that folks here will downvote and hate anything about it. What it changed is that publishers got their money from people playing on PC and some of it was spent on developers to actually improve future games =)

I wouldn't dismiss Denuvo. It is intended for a particular use case, which is games where a week or more delay between the release of a game and the appearance of a crack would make a meaningful difference. The payoff wouldn't be nearly the same for a lot of other software.

Both fortunately and unfortunately, this situation may change as AI models and workflows tailored around reverse engineering improve.