[HN Gopher] Ask HN: We found a cracked version of our software o...
___________________________________________________________________
Ask HN: We found a cracked version of our software on the web, now
what?
Hi HN, I work for a small company and we've recently come across a
version of our software that's been cracked. Specifically, the
crack modifies some of our binaries to circumvent the activation
process and allows bogus registration keys. Pretty standard stuff
AFAIK. Thankfully, our digital signatures are lost in the process,
so that's reassuring. We haven't done the most thorough search of
how widespread the issue is, but we've estimated that it's about 1
user per day since the early half of 2022. A license costs a few
thousand dollars, but we do regional pricing and bulk licenses for
larger firms. We also provide free licenses to academics (with
proof). For context, we are a <15 person company where we all wear
multiple hats and would like to continue providing great service,
training and introducing features. It's clear to us why someone
would crack our software, especially in lower income countries.
I'm not entirely sure what other information would be helpful to
provide, but I was wondering if anyone has run into this into the
past, and how it was mitigated. While we'll always have some
piracy, we'd like to keep it to a minimum.
Author : throwaway932874
Score : 155 points
Date : 2023-01-13 14:35 UTC (8 hours ago)
| Zurrrrr wrote:
| Now nothing.
|
| Piracy is the natural order of things, and likely isn't hurting
| sales at all as counter-intuitive as that seems.
|
| You could perhaps offer cheaper versions in lower income
| countries, but if you try to 'beat' piracy too much, you're just
| going to lower the overall user experience of your software.
| ROTMetro wrote:
| How would lowering your revenue and decreasing the
| competitiveness of your paying customers (because they now have
| to pay MORE than their competition who probably already have
| lower operating costs because they are operating out of a lower
| income country) make any sense?
| xigoi wrote:
| Who said anything about lowering revenue?
| riyakhanna1983 wrote:
| Plug: in the past, I helped a few companies and OSS devs track
| usage of their code in mobile apps https://codescout.app/ and
| provide leads. Happy to chat if this is relevant.
| KomoD wrote:
| It's not relevant, it's just you trying to advertise
| seba_dos1 wrote:
| > now what?
|
| Now congratulate yourself that people are willing to jump through
| hoops to use your software, I guess?
| riffic wrote:
| the obvious approach is to keep raising your prices and attempts
| to lock your software down with anti-circumvention measures. That
| always works.
| nitwit005 wrote:
| Your biggest fear shouldn't be illegal copies, but people
| presenting themselves as somehow legitimate and re-selling your
| software. You can get people calling your support number because
| a cracked version isn't working, creating costs with no sale.
|
| Make sure you have a plan for when that eventually happens. Some
| of those people can be converted to paying customers, but the
| rest can at least tell you where they got it.
| IanCal wrote:
| If you had a non-commercial license that was free, how many users
| do you think would go from paying customers to falsely using that
| version? Do you think it could help on-board people as it lowers
| barriers to getting started? WinRAR feels like a good example to
| keep in mind.
|
| This isn't a strong ethical argument from me, but a practical one
| - if it wouldn't lose money and may help get more in then either
| ignoring the piracy or making it irrelevant would be a very
| simple solution.
| brianwawok wrote:
| Maybe the ultimate reason to be a SaaS? Can't crack my webserver!
| AnIdiotOnTheNet wrote:
| I agree with others saying "do nothing"... mostly. Trying to
| prevent piracy is a waste of time and resources better spent on
| people who actually pay you money. To that end, if you do
| anything, the goal should be to ensure that you can tell the
| difference between who is paying and who isn't. You don't want to
| field support for cracked copies.
|
| Some developers I know and will not name have been known to leak
| their own cracked copies of their product, just to ensure that
| there is something broken about them that easily identifies them
| as a cracked copy.
| josephcsible wrote:
| > ensure that there is something broken about them that easily
| identifies them as a cracked copy.
|
| If the broken thing ends up publicly known, then it will just
| get fixed in the next cracked version. But if you keep it under
| wraps, then you'll end up with a reputation for writing buggy,
| unstable software, especially when the inevitable false
| positives occur.
| burnished wrote:
| Well, a classic response is to add onerous counter measures that
| inevitably get removed from the cracked version, making it the
| unquestionably superior product.
| 13415 wrote:
| Advice from good old shareware days (I never did any of this in
| my own shareware but have seen it many times):
|
| Defeat the crack when you put out new versions, create more
| complex protection and obfuscation, but make the more complex
| check only after a few weeks of running the software. Most
| crackers develop a crack and when it works release the program,
| so any kind of delays and double and triple license checks defeat
| them for a while. Make sure to never tell the user "this software
| is cracked." Instead, make it fail with obscure errors or work
| only partially. Be surprised by the support requests you get from
| users of the cracked version. Put out your own fake cracks with
| complicated installation instructions that sort of work, but not
| fully, etc.
|
| Repeat indefinitely, with many releases. Do _not ever_ use any
| intrusive DRM or hacks like installation of licenses in "secret"
| places, system modifications, etc., and make 100% sure your legit
| users have a perfect experience all the time.
|
| Basically, it's a cat-and-mouse game whose goal is to frustrate
| the users of the crack. At the same time, consider giving legit
| users better deals and more flexible pricing options. Maybe you
| can even give away older versions of the software for free or
| cheap.
|
| Finally, please remain polite even to users of the cracked
| version (they'll be on forums asking for help). Most of them
| simply do not have the money to buy a license, but might become
| legit customers later in their life when they earn more money.
| Some of them also aren't serious users, i.e., no future customers
| anyway.
| CommitSyn wrote:
| One thing I haven't seen mentioned..
|
| The reason that I pay for all software I can afford, and run the
| REALLY expensive stuff in an isolated VM, is ransomware. If I
| were to search for the latest version of a program on torrent
| sites and forums, and I found it and installed it, and then +1
| day + the next time I opened it, it "updated" with ransomware
| that the cracker included... well, I'd be real unhappy and make
| sure to warn people with negative reviews on the crack sites.
| There are ransomware as a service providers now that pay a large
| percentage of any payments... It's everywhere!
| ivank wrote:
| Some vendors who sell expensive software arrive (perhaps
| unintentionally) at this solution: produce software with enough
| defects or missing features that it cannot be used without
| regular contact with support. An adjacent idea is to produce
| software with a large number of plugins that are separately
| purchased. That multiplies the effort needed to crack and
| distribute everything.
| counttheforks wrote:
| Ignore it. They probably weren't going to buy your software
| anyway at this point in their lives. Maybe later when they have
| experience they will, though!
| [deleted]
| schnebbau wrote:
| Add a trigger that doesn't fire until a few months after install
| (to prevent the cracker coming across it and patching it out) and
| then run rm -rf if it detects it is cracked. Optionally display a
| countdown from 10 and play an alarm sound before this happens for
| extra lols.
| josephcsible wrote:
| You could go to jail for doing this.
| kazinator wrote:
| Probably not. The plaintiff would be making their case from a
| very poor position.
|
| "I stole some software from a warez site, and months later,
| my system got wiped".
|
| The burden of proof is entirely on their side.
|
| The time bomb could be hidden such that there is no traces of
| anything malicious in the software build. When the time
| comes, the software could contact a server from which it
| downloads a script to execute. The script does the job and
| then vaporizes.
|
| The mechanism by which that script executes could be
| something that licensed versions of the program use regularly
| (e.g. fetch a harmless, update-related script), so the
| discovery of its existence would prove nothing.
|
| Proving that it was your program could be very difficult.
| garganzol wrote:
| Piracy is a slow cat and mouse game. You, as a software
| manufacturer, do not have to panic. Instead, take your time and
| gradually fix the identified breaches.
|
| Piracy is a compliment. Piracy is a form of free advertising.
| Your core customers will remain yours anyway. But you have to
| close the open breaches from time to time, gradually narrowing
| the attack surface. This will help you remain profitable.
|
| You may need some tools to help you win that game.
| Obfuscators/protectors may be of some help. For instance, code
| virtualization is a pretty decent technique to deter most attacks
| of such kind.
| FlyingAvatar wrote:
| I had a number of techniques I used when I used to make shareware
| that were very effective at the time.
|
| Happy to talk with you via DM if you're interested.
| ilyt wrote:
| You can't do anything that would 100% provide it but you might
| try to at least convert some to sales.
|
| Code something that detects the tampering and either sends the
| info about it somewhere (that might not work if they just not
| allowed firewall out tho), then you might be able to send a
| letter to company (if that is company not just some random non-
| professional user). Probably illegal in EU tho.
|
| Or just have it display delayed warning/info notice about
| software being illegal and where you can buy legal copy.
| Disabling software is probably pointless (if it stops it from
| working they will find way around), but just "using this is
| illegal and can get you in trouble, contact with us to buy a
| legal copy, we offer bulk discounts" migtht get you some
| ChrisMarshallNY wrote:
| I'd suggest taking a page from Adobe and Microsoft.
|
| They fight pirating, and that prevents it from becoming
| absolutely endemic, but they don't really lose massive amounts of
| sleep over the cracks, because every cracked copy is training
| people to use their software.
|
| Sort of "The Old Dope Peddler" model.
|
| It's not really correct to assume every cracked copy is a lost
| sale.
|
| Instead, think of it as indoctrination of possible future sales.
| bitexploder wrote:
| Even be cheeky. Detect when the software is cracked
| (signature/binary hash changed) and message the user "we see
| your version is corrupt or cracked, you may want to reinstall.
| If you are using this software without paying for it
| <something>". You can invest some time in obfuscation and more
| frequent releases, but I would not spend a lot of effort on it.
| kobalsky wrote:
| am I the only one that thinks that the remote possibility of
| showing this message to a legit customer by mistake
| outweights any benefit it could bring?
|
| you are not gonna guilt anyone into not pirating and if the
| message blocks or is annoying, crackers are gonna circumvent
| it just like they did the license check.
| dpedu wrote:
| I think the inclusion of 'corrupt' gives legitimate users a
| mental excuse from this problem.
| jjeaff wrote:
| A lot of big players like adobe and microsoft don't seem to
| think this is a problem. In the past I have gotten cracks
| for legitimately purchased software from both because their
| licensing system is/was crap and would block access
| thinking my copy was not valid.
|
| Pretty bad when the pirated versions of your software work
| better than the legit copy.
| huhtenberg wrote:
| This too will be trimmed from the cracked version just.
| CJefferson wrote:
| One good idea is to time-delay that response -- hackers
| generally won't sit around for a month, or even a week, and
| see if your app will start responding differently.
|
| Of course, they'll probably re-hack it at that point, but
| often the first hacked version ends up being the most spread
| around one.
| raverbashing wrote:
| You don't want to do this "immediately" after checking for
| pirated versions, that will be checked and cracked as well
|
| Do it silently and maybe warn in a non-obvious way. But I
| wouldn't annoy the user too much
|
| Parent is right, most of those pirating it wouldn't have
| bought it in the first place. Especially if it's a technical
| software with limited use (as opposed to a game, for example)
| RenThraysk wrote:
| Probably a waste of time. If they've gone to the trouble of
| cracking, removing a nag screen is probably trivial.
| dmarlow wrote:
| Also a note about the dangers of cracked software. There
| could be malware, viruses, etc. The value becomes much
| smaller to use something that could ransomware your system.
|
| Then, cracked software becomes free advertising!
| ryandrake wrote:
| > Also a note about the dangers of cracked software. There
| could be malware, viruses, etc. The value becomes much
| smaller to use something that could ransomware your system.
|
| I've always thought this was kind of an old wives' tale
| FUD. Long time back when I used to hoist the ol Jolly
| Roger, the pirated versions of software seemed to always be
| pristine copies. Reputable release groups had their
| reputation in mind and would go out of their way to release
| clean copies, or even go so far as to remove the official
| company-shipped malware like all those offers you used to
| get during install to Also Get This Toolbar! Reputable
| crack groups were the same way--leave no trace and use the
| smallest, most minimal binary modification possible.
|
| Same with pirated movies: The pirate releases are often
| better than the official releases, containing more subtitle
| languages, stripping off marketing and FBI warnings, and so
| on.
| nebula8804 wrote:
| Problem with pirated movies these days (and for a long
| time) is that you have so many variations: garbage like
| different encoding schemes because some loser still
| watches the films on their DivX player or re-encoded in
| other methods. Then you have different release groups
| releasing their own variations and you have to keep on
| top of all these silly labeling schemes on the filenames.
| It all leads to clutter on the scene sites and no true
| guarantee that you are getting the pristine release.
| These days, I acquire the 4K Blue-Ray, rip the data,
| strip off the DRM, and make my own pristine release that
| I know for sure is the best of the best. Its got all the
| ads/copyright stuff stripped and all tracks, subtitles
| added.
| Eisenstein wrote:
| Neither of those things you mentioned (poor/strange
| encoding, silly filenames) are a problem beyond minor
| inconvenience. Any standard release will be x264 or x265
| with AAC or DTS, and a simple program like Filebot will
| lookup all the files on imdb and rename them for you
| automatically. It is great to support the industry that
| makes things you like, but ripping blu-rays is orders of
| magnitudes more work (I do it though, since I like the
| commentary tracks, I just wanted to correct your
| misconceptions).
| nebula8804 wrote:
| It depends on your perspective. If your intention is to
| enjoy the film with the best possible quality, then it
| goes from being an inconvenience to being a real problem.
| If you don't care, then yes it is just an inconvenience.
| I'm not saying it is a dealbreaker for everyone, but it
| is a dealbreaker for me.
| gjsman-1000 wrote:
| You could always do the Windows 10 Activation model.
|
| If you don't activate Windows 10, you have no ability to
| personalize your PC (change wallpaper, colors, Lock Screen
| image, etc.) But you can still use it - which makes it
| annoying, but still functional.
|
| After a few weeks without activating, it also adds an always-
| visible watermark warning to "Activate your PC." But it still
| lets you use it.
|
| Perhaps the OP could do similar. Where... he has his standard
| system of copy protection, but then adds additional checks
| that stamp watermarks on printed documents, or show a
| watermark about illegal copy, doesn't allow adding business
| information to documents, so forth...
|
| Maybe that's even the trial version. Always free, forever -
| but certain features disabled and lots of watermarks.
| nominatronic wrote:
| The cracked versions will simply disable all these anti-
| features.
|
| All you will do is annoy legitimate users.
| luckylion wrote:
| The risk in any of those measures is mis-identifying a copy
| as "cracked" and refusing to function fully for a paying
| customer. Sometimes that customer will be understanding,
| but sometimes they'll just plain angry that you're selling
| them a license for thousands of dollars and then mess with
| their ability to get things done. And they usually won't be
| silent about it either.
|
| You can totally do that when you're Microsoft because
| pretty much everybody hates you already but you have
| essentially a monopoly so what can they do? But it's very
| different when you're in a market where alternatives exist.
| dmurray wrote:
| I think the idea is to put out a company-approved nagware
| "trial" version. It makes piracy less likely (because the
| benefit of a full cracked version is smaller) and gives
| you a sales channel to those who would have pirated it.
|
| The downside is, people who would have paid might
| discover they're quite happy with the trial version.
| jahnu wrote:
| I've seen an advanced version of this once. A company I'm
| familiar with made sure it was relatively easy for users to
| copy existing licenses. So in an organisation where their
| software was popular but maybe a pain to get a purchase order
| for it would spread. They had activation ping backs and could
| see which companies were running lots of unlicensed copies.
| They would let it spread and wait till usage plateaued. Then
| legal would contact that org and suggest they buy the full
| thing with a nice juicy support contract to avoid litigation.
|
| This worked especially well with (I think) US government
| agencies who can in theory be fined for every time the software
| was activated.
| yardie wrote:
| This almost sounds like one of the companies I used to work for.
| I also would occassionally find our software, cracked, online. We
| would download the cracked version into a container and debug it.
| Reverse engineer the crack that reverse engineered our
| protection.
|
| We never took it too serious. You don't have to lose sleep over
| it but you also shouldn't completely ignore it. Just refactoring
| the copy protection ever few release cycles. Most of the cracks
| were using Windows APIs to access entrypoints to flip variables.
| Simply renaming, moving them, or adding removing properties was
| enough to throw them off for a while.
|
| We figured out some of our customers were using cracked editions
| without paying for more seats. The support calls were interesting
| because we told them the bug was fixed but they were super
| reluctant to update. We'd pass the message off to the accounts
| managers and let them wrangle with it. This was more prevalent in
| developing countries where pirating for business use wasn't
| considered a big deal.
|
| I tried to bring up a low cost edition at our company meeting but
| it was shot down. The numbers wouldn't work. Business users get
| training provided; casual users would swamp our helpdesk in lieu
| of actual training.
|
| The plan should always be to get those pirated users into actual
| users, unless the country they're in is embargoed, funny story.
| From reading the piracy forum thread I found many were using our
| software for job training in hopes of gaining foothold in the
| field. Similar to how Photoshop was everywhere in the early web
| design days.
| qwezxcrty wrote:
| I mostly agree with others saying don't care too much. If someone
| use cracked version of your software, it's unlikely that you can
| persuade them to purchase at least at the current pricing
| available to them. And in some situations, being pirated do help
| one earn popularity and even have vendor lock-in effect. There
| must be a reason that COMSOL comes with up to date FlexNet
| licensing 11.16 but only uses it's non ECC short SIGN with well
| documented method of cracking.
|
| Technically, it's very hard to stop a determined cracker once
| they get your binary. VMProtect, Themida or other strong packers
| maybe to some extent can, but those do degrade user experience,
| so not really popular for professional software. Dongle based
| solutions by Gemalto or Wibu? They are expensive. One need to
| physically post the dongles. And they are still crackable unless
| one have been really carefully implementing the protection scheme
| (never seen one yet).
|
| See how the cracker's tools (well, reverse engineering tools) are
| protecting themselves: IDA and JEB Pro are two prominent
| examples, they don't get pirated until someone leaked the
| installer. They watermark their distributions, and then they can
| trace who leaked the binary and act accordingly.
| dns_snek wrote:
| Whatever you decide to do, don't add hurdles that in any way
| inconvenience legitimate users or take away their functionality
| (e.g. offline usage). Those measures _will_ be cracked sooner or
| later and it 's only going breed resentment among your legitimate
| users.
| josephcsible wrote:
| Software getting cracked is just about as inevitable as death and
| taxes. There really isn't anything you can do about it.
| sjducb wrote:
| You say a license costs a few thousand dollars. Is that kind of
| customer going to use cracked pirated software? Are those
| customers going to risk a data breach to save a few thousand
| dollars? I don't think it'll affect your business at all.
|
| If the cracked software gets downloaded a lot then maybe there's
| another mass market that will pay tens to hundreds of dollars for
| your software. If that happens then it might be worth releasing a
| new version of your product at a lower price point for those
| customers.
| heavyset_go wrote:
| Find out the host, send them a DMCA takedown requests.
|
| If it's on BitTorrent, you can get crazy about it and monitor
| people who share it and send them letters/notify their ISP, but I
| think that's a lost cause.
|
| Similarly with other P2P networks, you often make direct
| connections with sharers, and you can use IP addresses to report
| them to ISPs.
|
| That or you can do what studios/rights holders so with movies and
| poison the well with broken downloads, bogus files, etc.
|
| You can obfuscate binaries, it's just a matter of how determined
| crackers are and how much effort they want to expend cracking
| them.
|
| If you want to prevent this, tie your product into remote
| services that require authentication with your servers. New
| features are now implemented in the cloud, and the binaries you
| ship are just clients to those remote features.
| no_time wrote:
| >That or you can do what studios/rights holders so with movies
| and poison the well with broken downloads, bogus files, etc.
|
| Can you provide some proof of this happening? I'm curious
| because I've always thought about this but never actually
| encountered it in the wild.
| heavyset_go wrote:
| Look up movies that haven't been released yet or were just
| released in theaters on public BitTorrent trackers and you'll
| see a bunch.
| banana_giraffe wrote:
| I've not seen studios do this (which doesn't prove they
| don't, of course)
|
| It is, however, _very_ common for different groups to use
| unreleased or recently release movies to release a video
| that's just a sign post. Either the URL shown in the video
| leads to a malware site, or a site that charges you to see
| the full video, itself a scam of some degree.
|
| For instance, you'll see this: "name": "A
| Man Called Otto.2023.720p.BluRay.x264-WDC", "files":
| [ {"name": "A Man Called
| Otto.2023.720p.BluRay.x264-WDC/A Man Called
| Otto.2023.720p.BluRay.x264-WDC.avi", "size": 670547315},
| {"name": "A Man Called
| Otto.2023.720p.BluRay.x264-WDC/Readme.txt", "size": 223}
|
| The AVI is unplayable with some generic message, and the
| readme has something like "to watch the movie, use this link
| to create an account", and the resulting website will
| eventually ask for your credit card for "verification
| purposes"
| no_time wrote:
| Yeah good catch. I couldn't find an example on public
| trackers, but the one you mentioned does exist on DHT.
|
| At least it's not made by the "official" WDC.
|
| For the curious, the file directs the victim to the link
| below. Open at own risk.
|
| echo "otto-dellac-
| nam-a/8545047tt/hctaw/zyx.llufseivom//:sptth" | rev
| cjbgkagh wrote:
| I have a similar problem and I don't know how to deal with it
| either. Sometimes it's hard enough to get actual customers to
| pay, if they felt that there was a viable free alternative many
| would take that option. I've had to shift focus from small
| companies to exclusively large companies which have very
| different needs. I now treat my offering to smaller companies as
| a loss leader. I no longer invest in new functionality for small
| companies and when the maintenance becomes too expensive we'll
| abandon all work for small companies all together. Part of the
| shift up is moving from a desktop app to a browser app that few
| people would have access to the server software and given the
| complexity no big company is going to risk running pirate copies.
| Plus there is an immense legal risk to them if we find out.
| Having grown sufficiently large the loss of the smaller companies
| wouldn't affect bottom line and would substantially reduce the
| number of companies interested in pirating. Some of our more
| advanced features we've kept secret and only available to big
| customers due to the risk of piracy with the small customers. It
| really does suck and I wish there was better protection
| available. It may get so bad we'll have to do what ** ****** does
| and sue anyone who mentions them online.
| lopkeny12ko wrote:
| The solution here is pretty simple: make your software free and
| open source. Transition your business model to paid support
| tiers, or paid hosted/managed offerings. I have been advocating
| for the promotion of FOSS software for years, and this model has
| worked very well for many software businesses. People will always
| crack and pirate software; not only will be a never-ending cat
| and mouse for you, but also inhibits the proliferation of truly
| free-as-in-freedom software.
| xeromal wrote:
| The solution is simple but not easy. Relying on the goodwill of
| humans is often a terrible bet.
| jansan wrote:
| That is a very naive proposal. There are a few open source
| projects that are actually successful, but far more that make
| no money at all.
| treebeard901 wrote:
| Way back in the day I was involved in cracking software that I
| needed to use and would share the keygens etc with other groups.
| Like many posts here say, I couldnt afford licenses.
|
| It's an arms race and the best thing you can do is redesign your
| activation process. There are certain ways to do this that make
| it increasingly difficult to get around it.
|
| It's like computer security in a way... You cant ultimately solve
| the problem but you can make it so difficult to do that the time
| investment required is probably not worthwhile for an attacker.
| m00dy wrote:
| Were you also doing demo-scene for your cracks ?
| treebeard901 wrote:
| I havent heard about demoscene for years. Unfortunately I was
| never a part of it.
| lll-o-lll wrote:
| Ignore all the "piracy is actually wonderful" posts. Depending on
| your industry and product, you can lose a great deal of revenue
| from piracy.
|
| Circumventing licensing restrictions, "sharing" keys, customers
| pretending to be other customers to avoid paying support
| agreements, I've seen it all. Some people view avoiding paying
| you as a legitimate way to do business, and will happily do so if
| they can get away with it.
|
| One mechanism to prevent this that actually works, is having a
| chunk of your functionality "cloud based". Put new functionality
| server side and piracy loses its value. Make it so that the
| upgrade mechanism is through their account. Generally, stop
| thinking in terms of "registration" and start thinking in terms
| of "licence to access services".
|
| Most other mechanisms are legal rather than technical, but these
| are hardest to pursue in the countries where piracy revenue loss
| will be most prevalent.
| Sohcahtoa82 wrote:
| > you can lose a great deal of revenue from piracy.
|
| This argument falls apart when you recognize that people that
| pirate weren't going to pay anyways. Piracy isn't a lost sale.
| A lack of piracy doesn't mean more sales, it means fewer users.
|
| Yes, I pirated Photoshop (Who didn't?), but if I couldn't
| pirate Photoshop, the alternative was _never_ going to be
| buying Photoshop, it would be using GIMP or something else.
| lll-o-lll wrote:
| This just isn't correct for much commercial and industrial
| software. Your customers are companies and they will avoid
| paying if they can get away with it. At least outside of the
| the US. Large swathes of Europe? Totally fine. India? China?
| Paying when you don't have to would make you a fool!
|
| When you make piracy hard enough, they _will_ pay.
|
| As a youth I pirated everything I could get my hands on, I'm
| not saying the photoshop example is invalid. I'm saying that
| if you are making software that's used in a commercial
| setting, then piracy is a genuine problem that must be
| addressed.
| hermitcrab wrote:
| >This argument falls apart when you recognize that people
| that pirate weren't going to pay anyways.
|
| There is a spectrum. Some people will never pay (e.g.
| teenagers, who don't have credit cards). Some people will
| always pay. A lot of people (most?) are in between. They will
| use a pirate copy if it is easy and they think can get away
| with it, otherwise they will pay. So some level of protection
| is important. But you shouldn't do anything that makes life
| more difficult for the people that are prepared to pay.
| mikotodomo wrote:
| Do nothing? Cracked software isn't a big deal. My cousin works
| for a 20 person company and they all make $200K / year.
| jsty wrote:
| If someone is sufficiently motivated, they'll always find ways to
| crack the software. If you don't have a large "personal" user
| base (as opposed to firms) - consider introducing a cut-price
| personal edition to lessen said motivation. Firms using it for
| "real work" - which I would hazard a guess at your price point
| form the bulk of revenue - are unlikely in any case to use a
| cracked or personal edition. Firms in less well-off regions may
| choose to buy the personal edition and accept the legal risk, but
| avoid the larger security risk of a cracked version - so you
| still get some revenue.
| anenefan wrote:
| The only thing I can say is this is an old situation that goes
| right back to the copyright protection wars to protect the
| software sold on floppies.
|
| Present time the solution for many is the phone home route with
| the idea that their client's system is online always. The other
| goto was to contract a service that specialises in tracking down
| any unauthorised versions and contacting site admins - but IMO
| the web is so diverse these days it's simply not worth the money.
|
| I would say if software is intriguing and works well, more often
| there will be a 'cracked' version on the web somewhere. I know
| many people see the pirating as lost profit, but more often
| there's a stark reality, they were never going to afford it in
| the first place - in which case it's not money lost but software
| getting exposure which might lead to more sales by those who've
| seen it in action. I've also seen absolute rubbish that had more
| money and time spent on protecting the ever so precious contents,
| that's been cracked only to allow curious users to see what a
| lemon it was.
| surfmike wrote:
| From a technical perspective, here's a strategy I used in the
| past: In addition to having a simple activation check in the
| code, I actually created/identified some constants that are
| critical to the internal functioning of the code, and hashed with
| a reversible hash function.
|
| Then, when the user gets activated, I used that as one of two
| pieces to recover the hash function to decode those secrets.
|
| Still circumventable, but requires more complexity than simply
| skipping the activation check, because simply omitting some code
| doesn't cause it to work.
| paxys wrote:
| Here's the standard playbook for dealing with this:
|
| - Let hobbyists and tiny companies pirate your software. You
| don't have to encourage it, but you can still turn a blind eye.
| They weren't going to pay you anyways, and this is a good way to
| get people familiar with your products.
|
| - Ruthlessly go after mid-large sized companies if you find their
| employees pirating your software. They have money to pay, and
| will be happy to do so (at least in the face of legal threats).
|
| The interesting part is that the first demographic (students,
| hobbyists, tiny companies) directly feeds into the second when
| they start working corporate jobs. So in that sense piracy is
| sometimes a key part of the sales funnel. This is exactly how
| companies like Microsoft and Adobe have been able to maintain
| complete hold on the market.
| jeffybefffy519 wrote:
| This is a fascinating take that I have never considered.
| Thanks!
| cobertos wrote:
| How do you correlate the installation with the company if it's
| pirated, for going after mid/large sized companies? Phone home
| and reverse IP lookup?
| paxys wrote:
| > Phone home and reverse IP lookup
|
| Pretty much. You can add more data points - email address
| used to sign up, whether the IP address matches a company's
| network, whether their machine is connected to a corporate
| domain.
| cheald wrote:
| This is what I've referred to in other contexts as the
| "Photoshop strategy". Literally _everyone_ I knew growing up
| had pirated copies of Photoshop, but they wouldn 't have used
| it without first pirating it, and they all grew up to take
| those Photoshop skills into respectable contexts where their
| employer was happy to pay Adobe exorbitant costs to stay legal,
| since Photoshop became such a fundamental part of their product
| development pipeline.
| bearjaws wrote:
| In terms of how to know its a mid/large cap, the best way I've
| seen is to detect Windows Pro licenses or Active Directory. Are
| there better ways?
| krisoft wrote:
| The alternative playbook is to develop a subscription based web
| service where the user can't pirate your code because they
| don't have access to it.
|
| "Crack" gmail or ChatGPT if you can.
| paxys wrote:
| Much of the corporate and industrial world runs on software
| that is sold in boxes and installed on the local machine.
| This is doubly true when you go beyond standard $10/mo
| consumer tools and in the range of thousands of dollars per
| license and beyond.
|
| The move to the webapp model you describe _is_ slowly
| happening, but it will be a very long time (if ever) before
| it can cover 100% of software use cases. Try telling someone
| in your accounting department they they have to use the web
| version of Excel moving forward and watch them quit on the
| spot.
| timwaagh wrote:
| Well I too like money. It feels nice. Lovely texture too. I
| suppose this is a matter for legal.
| fxtentacle wrote:
| With newaudiotechnology.com we eventually switched to using USB
| sticks as dongles.
|
| The reason is that we noticed some paying users were cracking it,
| too, because our licensing system didn't allow dual boot or
| having a workstation and a laptop.
|
| But our licenses were supposed to be per user and people wanted
| to carry our software around with them. If setup correctly, the
| same USB stick is now used both as licensing dongle and it also
| contains installers for Windows and Mac.
| gwbas1c wrote:
| Some people will crack it because they hate dongles. Damned if
| you do, damned if you don't.
| progman32 wrote:
| Have the licensed crackers started carrying the sticks around?
| weakfortress wrote:
| [dead]
| lopkeny12ko wrote:
| Additionally, as another commenter mentioned, piracy is not
| theft. Someone who pirates your software will almost certainly
| never pay for it; it's not a lost revenue opportunity. Consider
| it free promotion and popularization of your product: any
| publicity is good publicity.
| polartx wrote:
| Absolutely correct. If I can piggyback to elaborate: Piracy is
| *not* theft, it's 'copyright infringement'--they had to define
| a legal term because the courts determined that copying content
| does not deprive the IP owner of whatever-it-was-that-was-
| copied. And assuming OPs product has some productivity or
| business uses, many pirate users are simply b2b sales in
| embryo. As a college student I may have pirated software to
| help get an assignment done, (AV editing, or something), which
| later in my career I advocated to my business unit leader that
| we should buy, and I could demonstrate it too!
| [deleted]
| callalex wrote:
| You could take the same approach as 1Password and move the
| valuable parts of your product into the cloud. It will make you
| immune to piracy, but your customers will absolutely hate you for
| it and may leave altogether.
| clnq wrote:
| I've worked for a small company that also had one of its products
| widely pirated.
|
| You indeed get some users from piracy. Some of our legitimate
| users asked for a Russian localization because they've seen
| images of our GUI in Russian online and bought it for that. In my
| estimation, the number of clients you get from piracy about
| equals the number of clients you lose to it. Many people online
| say that those who pirate would never be your users anyway, but
| some users with an inelastic need for your software will prefer
| piracy if it is easy.
|
| Moving your features to your servers will significantly reduce
| piracy. Sometimes that is not feasible. In that case, you can
| issue cryptographic tokens from your server to perform operations
| on client machines. With enough effort, that can be worked
| around, but you can make it difficult enough so that the
| inelastic users will buy the software.
|
| It depends on what kind of software you make, but you could also
| license it cheaply in some regions with a special licensing
| agreement. In exchange, you could ask your clients to advertise
| you in their products (logo in movie credits, splash screen in a
| video game), or you could add royalty payment terms.
|
| You could also think about flipping your business model upside
| down and, rather than focusing on great customer experience,
| focusing on getting as many software units out there at a lower
| price. A price that may be more affordable for the lower income
| countries. Do you know your marginal revenues and marginal costs?
| What happens if you drop your marginal costs by 80% by moving
| your training online, slowing down customer support, and drop
| your price by 50%? What would be the % growth of units bought?
| Maybe, in the end, that could be a profitable transition and
| would eliminate piracy.
|
| But overall... I don't know how many pirates you'll be able to
| convert. In my professional experience, sometimes you can get a
| bigger ROI on effort spent in other areas than fighting piracy.
| There is no silver bullet for piracy; otherwise, it would not
| exist.
| ballenf wrote:
| Double down efforts to survey users and potential users. Keep
| making the product better. Consider the pirate option as a
| competitor. Don't demonize your user base, but don't be afraid to
| go after any institution you know is using pirated version.
|
| Build multiple telemetry code paths in your code -- if you can
| just get IP addresses of offenders you'll have way more info than
| now.
| hh3k0 wrote:
| > Don't demonize your user base [...] Build multiple telemetry
| code paths in your code -- if you can just get IP addresses of
| offenders you'll have way more info than now.
|
| Sorry, but from where I stand that absolutely looks like
| demonizing the user base.
| vorpalhex wrote:
| I think the parent means more "analyze why they are pirating"
| (is your price for a given too country in a weird spot, is it
| an unapproved software purchase, etc)
| KomoD wrote:
| The "why" is easy to find out without tracking all your
| users.
|
| > A license costs a few thousand dollars
| yjftsjthsd-h wrote:
| Okay, but the suggestion amounts to "track all your users,
| including the legitimate ones who paid you, all the time".
| nullish_signal wrote:
| It's a matter of course to firewall all Networking of all DLLs
| in Illicitly Downloaded applications
| speedgoose wrote:
| Remember to be GDPR compliant though. You must ask consent if
| you decide to track personal information such as IP addresses.
| hyperthesis wrote:
| This might not be appropriate for your case, but piracy can be
| considered a form of differential pricing.
|
| Student movie tickets are cheaper, even though the seat taken is
| the same. This is done so students will spend some money instead
| of none, without reducing the price that other segments will pay.
|
| Although you get no revenue from piracy, you do get people
| trained on the software, integrated into their workflow and
| infrastructure, advertising and promotion - it helps your product
| become the standard. They may later become paying customers. _It
| denies oxygen to competitors._
|
| Apparently, adobe turns a blind eye to piracy of photoshop, for
| reasons like these.
|
| But to repeat: this mightn't be appropriate for your case. Are
| there such network effects? Would you benefit from them, over
| time? Is there some trigger for actual purchase?
| swframe2 wrote:
| I was wondering about a few options.
|
| 1) Publish your own cracked version that has a survey that allows
| you to determine who is using the cracked version. Use the survey
| to figure out if it make sense to create a special version (lower
| price and few features) or special pricing for those users (see
| #3 below).
|
| 2) Move some key logic to a server so a cracked version would
| need to use your server for some part of an important feature.
|
| 3) Consider a subscription funded version of your product. If a
| user only needs your tool for one week and will not use it again
| for months, then it would allow them to pay a fraction of the
| purchase price.
| wahnfrieden wrote:
| When I made my own Palm OS software, I put a funny hidden message
| in the binary for crackers to find. They noted it, amused, in the
| crack DB and I like to think it endeared some to support an indie
| dev directly. I didn't bother trying to make it hard to crack
| (waste of my time and another's time) and left some note about
| how to do it in the message. I was 15 or 16 and enjoyed the
| indirect interaction with that community.
|
| After I shut down and stopped distribution, some other Chinese
| crackers kept the app alive and going via both cracking AND
| forcing in Chinese translations for the whole app. I loved to see
| that forum thread continue for years after I had moved on.
| alexjmbarton wrote:
| Hello,
|
| You may want to consider Software Protection and Licensing from a
| vendor and not roll it yourself.
|
| The high end versions of these solutions accomplish binary
| protection and encryption quite well and can require things like
| a token or hardware dongle to utilize the software.
|
| Additionally given you've been pirated already, from a business
| perspective a freemium model might be helpful for converting
| pirate customers to real customers.
|
| Hope it works out for your business!
| MPlus88 wrote:
| "Thankfully, our digital signatures are lost in the process, so
| that's reassuring."
|
| So you mean the software has been digitally signed? If it is
| signed how is it possible that it is cracked? Isn't even a slight
| modification of the binaries will render the software unusable if
| it is signed? I have a software that is signed digitally and the
| certificate private/public key is supposedly takes some hundred
| billion years on average to crack. So what is the point of
| signing a software?
| TheAdamist wrote:
| Signing the software protects against tampering and attests
| that it came from who signed it. There are some systems that
| require signed applications before they allow them to run, but
| most systems dont.
|
| Signed drivers are more frequently required than applications.
|
| Cracking tampers with the binary, so the signature is removed.
| MPlus88 wrote:
| The way I understand it is a signature is included in the
| binaries and when run the software will hash the binaries and
| the result is compared to the signature. If the two don't
| match the software has been tempered and the software won't
| run. If it is that easy to remove the signature then what is
| the point of signing a software? It will be like your first
| floor home has a steel door but the window is wide open.
| remexre wrote:
| I think this is the OS-level signature verification; so the
| OS (possibly with nudging) will still allow you to _run_
| the binary, but won't say "this is from FooCorp" and may
| nag the user on startup "this is a potentially
| untrustworthy binary"
| huhtenberg wrote:
| A signature can be stripped off a binary, usually using the
| same tool that is used to add it.
| yakkityyak wrote:
| People who download pirated versions will just clickthrough the
| trust warnings that the .exe or whatever is not signed.
| easylogin wrote:
| Focus on pro consumer features by adding more features to create
| an updated release for which people want to stay current.
|
| And make them recrack the latest version by changing the function
| which accepts serials, etc.
|
| Note: As others have mentioned, it's going to be tough to win the
| arms race against someone with defeating your checks. So drive
| consumers to want the real thing by providing a value add.
| hermitcrab wrote:
| Creating a 'honeypot' page is something quick and easy you can do
| to try to convert some would-be pirates:
| https://successfulsoftware.net/2017/03/10/honeypot-page/
| huhtenberg wrote:
| You can beef up the protection or you can ignore the issue.
|
| Without knowing specifics of your software (language, platform,
| etc.) it's hard to advice on the protection scheme, but a simple
| option for compiled Windows binaries would be something like
| VMProtect (which is what Denuvo protection is based on). This
| will dramatically increase the amount of effort needed for a
| crack. On the flip side it may also increase the amount of false
| positives from anti-viruses and security software, but an EV sig
| on the binaries and a smaller installation base should easily
| offset that.
|
| Also, it's worth keeping in mind that there are two classes of
| cracks. One is done for (basically) the street cred and another
| is the paid-for cracks. The vast majority of cracks are of the
| first kind, done by people on the warez scene. They tend to go
| after easy targets and will give up when there's more to the
| crack than nop'ing a couple of IFs or patching a couple of
| functions via a proxy DLL. So even a little friction here will go
| a very long way.
|
| Something as simple as periodically re-verifying your license at
| random intervals using independent copies of your license
| validation code would be a good start. Ditto for checking the
| signature on your binaries. Never displaying the result of failed
| validation immediately, but always delaying it a bit. We are
| aiming at irritating, frustrating and wasting their time.
|
| Despite of some people say, you _can_ cripple your software if
| you detect it 's running an "altered" version. The counter-
| argument goes that this will cause users of cracked versions
| assume that your software is of a poor quality, this information
| will spread and taint your reputation. This is 100% b/s. In
| reality every single user of cracked software is perfectly aware
| of incomplete cracks, so when a cracked version malfunctions,
| they know why.
|
| If your program phones back home, e.g. to check for updates, make
| it report the hash of its binary and a license, and then allow
| crippling the install remotely. Among other wonderful uses, this
| allows messing with someone who is _in the process_ of cracking
| your software, in real-time. Really dirty, but super effective.
|
| Or you can do nothing, lay back and relax. But where's fun in
| that?
| hermitcrab wrote:
| >Also, it's worth keeping in mind that there are two classes of
| cracks. One is done for (basically) the street cred and another
| is the paid-for cracks. The vast majority of cracks are of the
| first kind, done by people on the warez scene.
|
| Indeed. To understand the motivation of these people see:
| https://successfulsoftware.net/2011/04/07/interview-with-a-c...
| Terretta wrote:
| Play your music on the radio so people tape it. You might even
| want to pay the radio to play it, so they hear it to tape it.
|
| The more they tape it, pass it around, and talk about it, the
| more you'll sell.
|
| It your case, you might put a better cracked version on pirate
| sites with subtle messaging you want shared. Because some of them
| will tell people that work places that will pay, and some of them
| will take jobs at places that will pay.
|
| Cheapest mass marketing you'll ever get.
| H8crilA wrote:
| Side question, is cracking software actually a business? I always
| imagined that cracks turn your computers into botnet components,
| or mine crypto. In the background, lightly, so that it's not too
| annoying.
| adzm wrote:
| Subscription based licensing can be really useful for getting
| legitimate users who can't fork over a thousand dollars at once.
| IMO Adobe creative cloud is a great example of this working out
| well.
| aceazzameen wrote:
| Unfortunately it also generates negative press on social media
| from frustrated users, and people who avoid subscriptions will
| avoid the product. But if you're an already established market
| leader that doesn't care, then subscriptions are fine.
| dns_snek wrote:
| I'm not a fan of subscription services but there are decent
| compromises to be had, e.g. Jetbrains model where you receive
| a perpetual fallback version after a year.
| aceazzameen wrote:
| I agree that there are decent subscription models. Adobe,
| however, isn't one of them.
| chabad360 wrote:
| It's really not, Creative Cloud is the most pirated software
| suite in the world, and the company that makes it is almost
| universally hated by its customers.
| jollyllama wrote:
| Agreed, the software I am most likely to buy (and least
| likely to try to use without buying) is one with a lifetime
| license and offline activation for unlimited machines, even
| if it's just for one version. That's very valuable to me; as
| long as I can access the key and installer, I know I will
| always be able to run it.
|
| Subscriptions are a negative value, it's something that'll
| bleed me dry as long as I have it.
| teovall wrote:
| Whatever you do, don't punish your paying customers for being
| honest. If your anti-piracy measures have restrictions, bugs, or
| inconvenience your paying customers, you're allowing the pirates
| to release a superior product to your own.
| ops wrote:
| Consider this: if the license costs 1,000, most people who are
| pirating it can't afford it. Those pirates are learning how to
| use your software, and when they get a job at a relevant firm,
| what software are they going to want their new bosses to buy? I
| think Photoshop grew quite a bit due to something like this
| (before they went with the subscription nonsense)
| tgsovlerkhgsel wrote:
| > what software are they going to want their new bosses to buy?
|
| In many cases, none because they'll just keep pirating yours.
| Even if the company has a "don't pirate, we want to pay for it"
| policy, some employees will still do it! That's something to
| keep in mind. For some, piracy has become the default way to
| get software.
|
| You _need_ to make it easier to buy than to pirate. I believe
| taking small credit card payments for 1-seat licenses is key
| here. If a low-ranking employee 's options are piracy vs.
| informally asking their manager "hey can I buy this $99
| software" and entering their credit card, you're much more
| likely to make a sale than if the employee has to choose
| between piracy and dealing with their purchasing department,
| legal department, IT security, etc.
|
| This only applies to companies with corporate credit cards and
| employees that have a lot of flexibility, of course. I don't
| know what other methods you need to offer to make it easy for
| other companies.
| ops wrote:
| Where I work, it would absurd to chose piracy over waiting a
| few months for approval - simply because of the risk to one's
| career. Is this not the case elsewhere?
| coding123 wrote:
| Place secret bits in each copy that identifies the purchaser,
| then sue when the next version comes out.
| josephcsible wrote:
| This won't help. Either one person will buy with fake
| information and then leak that copy, or when a legitimate
| buyer's computer gets hacked, the copy from there will get
| stolen and distributed.
| jeffwask wrote:
| Nothing. Almost all of the research points to piracy having zero
| impact on sales for example, https://corsearch.com/content-
| library/blog/does-piracy-impac...
|
| It's been shown time and again in gaming no matter what you do
| people will crack it and your measures to stop them will have
| more negative impact on your paying customers than it does on
| pirates, see Denuvo.
|
| Honestly, the best thing is probably working on your conversion
| funnel to understand why you aren't converting people from
| pirates to purchasers.
| OrderlyTiamat wrote:
| I believe denuvo is by now more a success story than a failure,
| there's not many groups cracking the latest versions of denuvo
| anymore.
| jeffwask wrote:
| That's not consistent with anything I've seen or read in the
| last 5 years
|
| https://www.wired.com/story/empress-drm-cracking-denuvo-
| vide... https://www.pcgamer.com/denuvo-cracks-2019/
| selectodude wrote:
| There's only one person still cracking Denuvo games,
| Empress.
|
| She's falling behind though.
| https://www.reddit.com/r/EmpressEvolution/
| paxys wrote:
| Denuvo's purpose is to stop piracy for the first few weeks of
| release, since that is when the bulk of a game's sales happen.
| No one cares if it gets cracked after that. Many publishers
| themselves remove Denuvo protection from their games after a
| set period of time. By those measures it is an incredibly
| successful and effective piece of software.
| Dylan16807 wrote:
| Get it to the point that they _all_ remove Denuvo after 90
| days and I 'll be much less upset about the harm it causes...
| jeffwask wrote:
| And none of that changes the fact it's a tool to solve an
| non-existent problem that often impacts paying customers
| disproportionately.
| pessimizer wrote:
| > Almost all of the research points to piracy having zero
| impact on sales for example
|
| This is probably often true, based on the product and its price
| point, but pirates using it as a blanket truism isn't good.
| There are a lot of possible situations.
|
| Real life example: movie piracy may not generally affect box
| office, but an _arguably bad_ movie leaked before release date
| will create a cloud of gossip that could tank its opening
| weekend. If previewing a film for _reviewers_ will affect the
| box office of a bad movie, 100,000 copies being watched two
| weeks before release certainly will.
| racingmars wrote:
| I'll throw my hat in the "mostly just ignore it" camp. I work for
| a small software company and we have basic license key protection
| stuff, but our philosophy is "someone who is pirating the
| software probably isn't someone we want to bother with as a
| customer anyway."
|
| Only a small percentage of people who pirate it are likely to be
| paying customers if they couldn't pirate it. So the real revenue
| loss is likely minimal. (Without know more about what the
| software does it's hard to make generalizations about the target
| market, though.) And you never know when someone who was able to
| use/learn the software by pirating it will be in a position to
| turn around and recommend to their employers or friends your
| product and those entities will actually buy it.
|
| If there's a specific site or forum online where the crack is
| being distributed, you can always at least just send a DMCA
| takedown notice, but overall it's probably not worth spending
| much time or money worrying about it unless you have real data
| showing significant missed revenue opportunities (which is at
| most a tiny fraction of the number of people who pirate the
| software).
|
| If you can update future versions of the software to not be
| cracked by the existing mechanism, BUT NOT AT THE EXPENSE OF
| CAUSING HASSLE FOR REAL CUSTOMERS WHO ARE UPGRADING, you could do
| that too.
| afry1 wrote:
| I wish I could find this post again, but one company had a clever
| approach to the problem. If you can figure out which countries
| the cracked software is originating from, you can serve up a
| version of your page where you offer up a free, unlocked version
| of your app.
|
| You're still losing out on sales, but cracked software often
| originates in those same low-income countries. They get to have
| their free copies, and it's a likely bet that your customers in
| wealthier parts of the world will just buy the license instead of
| attempting to crack it themselves.
| insanitybit wrote:
| Someone built you a free trial feature, congrats.
| addaon wrote:
| One trick I've learned from the mobile game world is to make sure
| your localization files are separate resources -- don't compile
| them in. They way, when your game is first cracked, you'll get a
| pretty decent Russian translation immediately that you can, with
| no moral concerns, "steal" back for your next update -- and
| within only a few weeks you'll have a pretty rich set of
| languages floating around for your distribution. I do recommend
| testing with CJK text first to set up your free labor for
| success.
| folli wrote:
| That's actually really smart, I would have never thought of
| this.
|
| Why CJK text first?
| addaon wrote:
| Most scripts will mostly work if you support localization,
| but have only tested English. You'll most likely find issues
| with scripts needing compulsory ligatures (Devanagari) and
| CJK; so test them to make sure that someone trying to hack in
| an alternate localization doesn't run into a missing font,
| bad line breaking, unreadable text size, etc.
|
| [Edit: "first" meaning "before releasing", not meaning
| "before other scripts."]
| baud147258 wrote:
| I remember that a video game editor once released a collector
| edition of one of their titles, where the bundled OST was
| copied from a torrent (which had presumably been ripped from
| the standard edition); apparently the file names or metadata
| made the origin clear.
| justsomehnguy wrote:
| GoG is/was notorious for shipping a legal product with
| patches and cracks from the scene.
| crazygringo wrote:
| This is one of the funniest ideas I've ever seen on HN. Clever.
|
| The best part is that while it's technically illegal (you
| didn't pay for rights to the translations), they're never going
| to reveal who they are to come after you (since they don't have
| the rights to distribute their translation).
| aehajdoi wrote:
| Make a blogpost talking about this, say you won't pursue users
| who pirate, but you hope that once they realize the value you
| provide they come to purchase the real thing.
|
| Demonizing and chasing people who pirate will only work against
| you, just like it happens with gaming.
|
| Consider the pirate version a "trial" for people who are
| considering whether to buy the official version. Again, many with
| gaming do this.
|
| Don't feel bad. In all seriousness, piracy is probably helping
| you spread the word and get people to try your project.
| thedougd wrote:
| I've recently reverse engineered a bunch of commercial software
| we pay for. They encrypt values in text configuration files and
| leave no way for us to template the configuration files with
| configuration management (Chef, Ansible, etc). Most of the time
| I'm working with Java. I've noticed several common patterns:
|
| 1) Typically obfuscation is not used, but even when it is used,
| it's easy to find what you're looking for. They're going to be
| using JCE or BouncyCastle for encryption. Look for the relevant
| classes.
|
| 2) The key is nearly always hard coded as a string constant that
| is not unique to the installation or customer. Super easy, and
| often discoverable with just the 'strings' command line utility.
| I would find your concats of chars and other silly schemes if you
| did that, but it would slow me down a bit.
|
| 3) IV is never used correctly with AES. It's always a static
| value, usually 0.
|
| 4) License keys are usually encrypted with the same scheme, but
| their format of entitlements takes some extra effort to discover.
| I occasionally must reverse engineer this as well to understand
| the limitations. For example, stupid licenses lock to IP address
| or a BIOS uuid, complicating a disaster recovery plan.
|
| My favorite encounter was a class file, in the spirit of OOP,
| dedicated to licenses (ie License.class). It was not obfuscated
| in any way and had both the load() and save() methods included.
| All one must do is write your own Java class (or use Groovy
| interpreter), include the vendor jar in your classpath, set your
| license entitles and call save().
|
| A real WTF is that SAP will encrypt the contents of _your_
| database with simple substitution ciphers. If you want to query
| it for insight, you're going to need their simple character
| shifting/replacing scheme.
| anigbrowl wrote:
| I wish you had included a brief description of what it does.
| Commercial piracy is generally bad; if someone is collecting
| money to basically operate your software without kicking anything
| back to you they're certainly ripping you off, and maybe their
| customers too. OTOH if you have a free academic license the
| piracy may be by people who are simply curious but lacking in
| academic credentials.
|
| I sometimes reverse engineer things for fun or curiosity, though
| I don't generally use or redistribute it. TBH I don't understand
| the psychology of licensing/pricing. Some commercial software is
| excellent and seems worth every penny the vendors ask for (and I
| am happy to pay for such software). I've seen a few products that
| cost thousands to license and are just dreadful. I have the
| impression that such products are sometimes not intended to be
| marketed as such, but their usage is licensed as part of a
| consulting deal, effectively borrowing the academic reputation of
| the person behind it.
| bdcravens wrote:
| Ignore it - you aren't "losing" money unless those customers
| would have paid you otherwise. Keep focusing on the features and
| service for those who do pay you.
| ROTMetro wrote:
| We are not talking about video games. Business software that
| gives a company some edge, give the company using your pirated
| software a greater edge because they don't have the expense
| that the legitimate company paying for the software does. That
| is the value, and in this case you are very much 'rewarding'
| the theif and punishing the 'sucker' who pays you. Why would
| you do this?
| gjsman-1000 wrote:
| > I'm not entirely sure what other information would be helpful
| to provide, but I was wondering if anyone has run into this into
| the past, and how it was mitigated. While we'll always have some
| piracy, we'd like to keep it to a minimum.
|
| I don't have answers but I have a few unusual ideas.
|
| I would suggest (perhaps as a "fun" way of dealing with it)
| looking into _The Legend of Spyro_ style copy-protection. This is
| where, rather than just depending on the small activation
| component, there are small checks throughout your code that cause
| little inexplicable annoyances constantly if a pirated copy is
| found. Maybe people try to print things and 1 /3 of the page is
| blank. Maybe they try to save files and there's a 1-in-100 chance
| of total corruption. Checks like these, when widely distributed
| through the code, obfuscated, and having different things they
| look for, can sometimes be a major PITA to fully detect and
| remove. If a pirate feels that getting an initial cracked copy is
| easy, but getting all the bugs out is miserable...
|
| Another possibility is the "great service, training and
| introducing features." Pirated copies shouldn't provide access to
| your training material or any customer support if possible (make
| it a bit of an enigma to use sometimes). If the pirate has a
| question but can't read the documentation or watch videos about
| what to do because he doesn't pay for an account... it is a
| little annoying for legitimate customers but causes further
| frustration.
| einr wrote:
| _I would suggest (perhaps as a "fun" way of dealing with it)
| looking into The Legend of Spyro style copy-protection. This is
| where, rather than just depending on the small activation
| component, there are small checks throughout your code that
| cause little inexplicable annoyances constantly if a pirated
| copy is found. Maybe people try to print things and 1/3 of the
| page is blank. Maybe they try to save files and there's a
| 1-in-100 chance of total corruption. Checks like these, when
| widely distributed through the code, obfuscated, and having
| different things they look for, can sometimes be a major PITA
| to fully detect and remove. If a pirate feels that getting an
| initial cracked copy is easy, but getting all the bugs out is
| miserable..._
|
| This sounds like a great way to make sure prospective customers
| think your software is buggy and awful and dissuade them from
| ever spending money on it.
|
| Don't underestimate how often cracked software serves as
| educational tool or trial version for someone who will later be
| a professional with money who will buy legit licenses.
| gjsman-1000 wrote:
| I'd also suggest (sorry for forgetting) also having a student
| license program that is cheap or free upon proof of academic
| use, and other more-lenient ways of getting a legitimate copy
| if you are in such circumstances.
| grujicd wrote:
| It's risky that some of "intentional bugs for pirates" end up
| working for paying users as well. Every software has bugs, is
| it really a good idea to create extra ones, some of which
| might slip by?
|
| At least this creates extra code paths and requires extra
| testing.
| grumpytiger wrote:
| The risk for the first option is that your software will get
| the reputation of being glitchy
| boltzmann-brain wrote:
| The cracked copy is the start of your sales funnel, literally
| don't fight it, you're doing yourself a disservice.
| KomoD wrote:
| Take basic measures such as requesting removal of search results
| for the cracked versions, but don't put a lot of energy into
| anything else.
|
| It is a waste of your time and you will be in a forever game of
| cat and mouse.
| tlb wrote:
| You might consider offering more free or cheap versions, like a
| student edition (cheap with no proof required) and a free trial.
| Wolfram, for instance, does both. Not many real companies will
| cheat, and it's better to have users who can't pay using an
| official version than a cracked one. Perhaps they start using it
| in an un-funded skunkworks project, then buy a full license when
| the project gets funded.
| SecurityMinded wrote:
| This shows that you have never dealt with companies in 3rd
| world countries. When money is tight, which is always in those
| countries, there is not a cheap-enough price that you can make
| them pay. They want the benefit of the product but they do nit
| want to pay anything for it. So, a free trial version in those
| places, will turn into a perpetual "free" trial. Same for "no
| proof needed" student/academic versions. Unfortunately for the
| original poster, there is no solution to such a situation.
| Especially considering, they do nit want to spend an arm and a
| leg on legal enforcement, for a measly few thousand dollars
| worth of licensing fees. The only solution I can see for this
| kind of problem is to design the product to run purely online,
| leaving nothing more than a UI on the customers' hardware, but
| since the product is out, there is no way to put that cat back
| into the bag. May be they should consider future, enhanced
| versions of their software to run online only.
| zihotki wrote:
| There is a solution - fully or partially cloud based
| software. But there are limitations and not everyone will be
| happy.
| tlb wrote:
| Yes, people who can't pay will keep renewing the free trial
| indefinitely. Since you weren't going to get any money out of
| them anyway, there's no loss. More people using your sw costs
| you nothing, and has various benefits, including:
|
| - if those people someday move to a big company that can
| afford it, they'll be familiar with your sw
|
| - they may blog about it or publish results from it, giving
| you free advertising
|
| - reduces the market for a lower-cost version of your
| product, making new competitors less likely to form
| ROTMetro wrote:
| Add then they can unfairly compete with the people that DO
| pay for your software because their very not having to
| fairly compensate for the benefits of your labour yet still
| gain from it puts them ahead of some 'sucker' who pays. I
| would rather that people willing to steal from me don't
| compete with my paying customers. Even though their usage
| doesn't make you less 'whole' it does impact the ecosystem
| your business operates within.
| 908B64B197 wrote:
| > Same for "no proof needed" student/academic versions.
|
| At this point why not exclusively offer it to legitimate
| university users (with a valid .edu address)?
| wobbly_bush wrote:
| How many universities in the world outside of US give out a
| .edu address?
| SQueeeeeL wrote:
| Maybe one of your main revenue sources shouldn't be trying to
| squeeze already cash strapped 3rd world entrepreneurs
| raverbashing wrote:
| Pricing segmentation based on market and understanding their
| circumstances goes a long way
|
| Help people who want to pay, most don't. And they won't,
| regardless of how many hoops you put as 'copy protection'.
| Yes doing it purely online will work, but that has its issues
| as well
| tarotuser wrote:
| Put some simple tracking in your software. Ping once a day when
| its running.
|
| If individuals run it, eh who cares. There's a not insignificant
| amount of people who want to see if the real version would
| actually work. And see if it'll run on WINE or whatever. Pissing
| off individuals is how you get to be known as bad.
|
| And then there's companies who run it pirated. Those are juicy
| targets. You dont even need to be mean. "We saw that your company
| appreciates the trial of our software on X machines for Y days,
| and would like to engage in licensing for your
| department/company."
| remote_phone wrote:
| The first PC software I got back in the early 80s was a copy
| protection cracking program. I think there were 2, copywrite and
| copyiipc. Since then, the battle between copy protection and
| cracking has been going on.
|
| You will never stop cracking. The only way is to convert the
| application to SaaS. Otherwise just try to minimize casual
| pirating and leave it at that.
| shon wrote:
| These aren't your customers.
|
| The user who is willing to stomach the time and risks associated
| with cracked software is NOT your target market anyway.
|
| This is essentially a free trial program for "aspirational users"
| who will circulate it for you.
|
| I've had my software (games) pirated, and been a pirate in my
| youth. Now I wouldn't consider pirating because I have more money
| than time now. I suspect your actual addressable market is in the
| same boat.
|
| The worst thing you can do is add draconian copy protection that
| adds friction to your product for actual paying users.
| sph wrote:
| > The user who is willing to stomach the time and risks
| associated with cracked software is NOT your target market
| anyway.
|
| I vehemently disagree. Cracked users of commercial software ARE
| your target market that, for any reason, can't afford to pay
| you. They would if they could.
|
| When I was a broke teenager, I pirated a lot of software, games
| and music I later paid for when I had enough money to do so.
|
| Piracy can be annoying, but it is also an underrated indicator
| that some people really like or need your product so much
| they'd rather put up with the discomfort of piracy instead of
| going to the competition. I wonder if this is also an indicator
| to very expensive software that they might increase their
| paying user base by lowering their price. You might be leaving
| money on the table, maybe it's time for a flash sale.
| shon wrote:
| >I vehemently disagree. Cracked users of commercial software
| ARE your target market that, for any reason, can't afford to
| pay you. They would if they could.
|
| I think we actually agree. You said "They would if they
| could", that's exactly what I'm saying.
|
| Especially in business software, the risks associated with
| piracy always outweigh the benefit of free software for those
| that can actually pay.
|
| The person who is trying to learn, or uses the cracked
| software while climbing up the pay-scale will eventually turn
| in to a paying user.
|
| As others have said, getting cheeky and letting folks know
| that you know the software is pirated is also a good
| approach.
|
| Price-testing as you mentioned can also be valuable. Spending
| energy on DRM or anti-piracy schemes beyond a little Easter-
| egg/joke/warning is a waste of energy better spent on
| improving your product for your actual paying customers.
| KronisLV wrote:
| > When I was a broke teenager, I pirated a lot of software,
| games and music I later paid for when I had enough money to
| do so.
|
| I don't know, I feel like it depends on the culture as well,
| not just the amount of money someone has.
|
| For example, I am at a point in my life where I can afford
| JetBrains licenses (actually their Ultimate pack with tools
| for all languages), so I buy them. Some people that I've
| talked with, while also apparently able to afford such tools,
| simply don't bother paying and prefer the pirated versions
| instead. They might look at the ~350 euro yearly price tag,
| consider that it's X% of their current month's salary and
| prefer free instead, even though it means putting themselves
| at risk (sometimes). In other words, they just don't care.
|
| I can pretty much say the same about Windows installs that
| many are running on their computers. Given that buying
| Windows might be a non-insignificant part of their income,
| they just won't and instead might pay 20 euros or something
| to someone who can give them an install that just works. They
| don't care about copyright, or the ethical aspects, they just
| want the shiny thing.
|
| My income has gone up in the past few years to a point where
| I'm comfortable, but I definitely can understand their point
| of view, even if it's unethical, at least given how life can
| be in my country (Latvia, though the same applies to many
| other economies around the world). Heck, in regards to
| entertainment I never buy those new AAA "full priced" games
| and just not play them if I can't find them on discount/sale
| until a few years pass and they're cheaper then, though I've
| heard that shady game key reseller sites are also popular
| here.
|
| Here, the average annual disposable income per capita per
| year was around 11 thousand euros in 2020:
| https://www.statista.com/statistics/1267688/latvia-
| average-i...
|
| Edit: actually, my country might be a bit of a negative
| example in particular, not sure why:
| https://eng.lsm.lv/article/society/society/latvia-leading-
| in...
|
| > According to the MUSO anti-piracy analytics website, 46.3%
| of Latvians use the web to access illegal content, followed
| by Bulgaria (27.4%) and Lithuania (24.5%).
| maxk42 wrote:
| > Cracked users of commercial software ARE your target market
| that, for any reason, can't afford to pay you.
|
| I've gotta disagree here. SOME pirates are your target market
| that can't afford to pay you. I can't tell you how many times
| a friend has bragged to me about pirating a movie over drinks
| at an overpriced bar. If you can afford four cocktails at $15
| a pop then you certainly can afford the $20 or less it costs
| to license a movie. Some people just like to feel like
| they're getting away with something.
| croon wrote:
| I think you're actually in agreement with GP, just in
| different words. You weren't the target market... until you
| had enough money to become part of it.
| agilob wrote:
| >This is essentially a free trial program for "aspirational
| users" who will circulate it for you.
|
| Do you provide demo (limited functionality) and trial (full
| version with limited time) options?
| weakfortress wrote:
| [dead]
| PreInternet01 wrote:
| Congratulations! Having cracked versions out there indicates that
| your software is both useful and notable, which is a point where
| many developers would _love_ to arrive at, maybe, one day.
|
| As to what to do about it, there are two basic tracks, neither of
| which is incompatible with the other:
|
| 1. The legal route: notifying distribution sites that they're
| hosting content in violation of copyright law, requesting
| takedown, and if required, demanding such (with a DMCA notice or
| similar). If a distributor is unresponsive to both, DMCA Google,
| Bing, etc. to at least suppress the cracks in most search
| results;
|
| 2. Having some fun with it: make sure that a special page on your
| own site becomes the #1 search engine result for "<productname>
| crack" and similar. On this page, put a human face on your
| pricing, explain the available discounts, and finally offer to
| supply a free registration key to anyone that truly wants it, so
| they don't have to download all kinds of shady binaries. Of
| course, any such free keys don't come with support and display a
| prominent _PIRATED VERSION_ notice in all window captions,
| printed outputs, et cetera, but you disclose all of that upfront
| and explain how that 's a small price to pay...
|
| But above all, make sure not to confuse a "pirated copy" with a
| "lost sale". In 99% of cases, the Venn diagram of those has _very
| little_ overlapping area.
| moritzwarhier wrote:
| Your comment is beautifully succinct and made my day.
|
| I don't use any cracked software, but I sure did when I was a
| kid without money. And I was so grateful for it, especially all
| the DAW and music production stuff.
|
| There is an utilitarian argument somewhere in there about free
| software.
|
| Copyright owners also habe legitimate interests in their
| products and are afforded with different ways to gain value
| from a software product that is locally installed.
|
| Also, something like a self-contained, "portable" linked binary
| that creates value without any dependency on any online service
| will always be trivial to copy but also maximally useful.
|
| (Edit: languages that depend on an interpreter don't differ too
| much, I think)
| TheOtherHobbes wrote:
| This depends on the market. I know a handful of people who got
| out of the VST plugin market because cracks were killing them
| financially.
|
| VSTs are pretty niche and the market is mostly people without
| much money. But you can find cracks being used in top studios,
| so...
| fsloth wrote:
| 'But above all, make sure not to confuse a "pirated copy" with
| a "lost sale". In 99% of cases, the Venn diagram of those has
| very little overlapping area.'
|
| The non-overlapping are is likely non-trivial. There are
| surprising many shops that use professional software for client
| projects, could afford the license, but that prefer pirated
| copy to paying actual license fee.
|
| Ofc persecuting non-professional users is pointless.
| Persecuting professional users in a smart way can lead to
| license sales.
| gtvwill wrote:
| Lol everytime I read this argument I think of the software
| VirtualDJ. It was notorious for being the DJ software to use
| about a decade and a half ago as pirate copies were
| everywhere! Fast forward to today and you can read post after
| post from ex pirate user that's now a paid user. VirtualDJ
| have one of the more expensive software licenses on the
| market in that sector too. I wonder if many other software
| companies have had similar experiences?
| fsloth wrote:
| That describes the progression from a poor hobby user to a
| more affluent hobbyist/pro. The market I know and meant
| (CAD) there is no such progression and the way to make the
| pirate users licensed users is to give them one call, offer
| a chance to buy an official license, and if this does not
| work inform the authorities. Legal procedures though likely
| need a way bigger org than 15 persons.
| ilyt wrote:
| I'd imagine most of that is out of annoyance of dealing
| with pirate version or just them finally being able to
| afford it as it is now part of their job.
|
| I feel like easiest way to monetize apps like that would be
| free noncommercial license. Want to DJ your school party ?
| Go ahead, as long as nobody pays you it's fine, and if
| someone does, well, now you have money for license.
|
| You're also building potential user base, when everyone can
| play with your software without limits many will pick it
| when they will do something commercial
| fragmede wrote:
| A full actual version of SOLIDWORKS costs, no joke, $10,000
| for a professional license ($8k plus $2k/yr support
| contract). An engineer at, say, Tesla is going to have that
| paid for by their employer while designing the Cybertruck.
| That Tesla engineer is also going to want to use SOLIDWORKS
| to design their bike shed. Their two choices for their bike
| shed are either use their work computer, or pirate it. (Using
| non-solidworks CAD isn't really an option due to the muscle
| memory involved with the application, and the resulting
| switching cost.) So it's getting pirated. But that also means
| their next employer better have SOLIDWORKS and so that "lost"
| sale for a bike shed really isn't.
|
| But you'd be insane to use a pirated copy of SOLIDWORKS for
| anything professional (like if you were the Cybertruck's door
| handle subcontractor or whatever), just like you would be
| insane to use a pirated copy of windows or Office. But let's
| be real, plenty of people do that. Whether it's because
| they're poor, or whether it's because they're cheap, or both,
| full list price is simply not gonna get paid, and so they'll
| go with the cheaper option - it's just that cheaper option
| happens to be a $0 pirated copy in most cases. Some offices
| will have one genuine copy for one computer and pirated
| copies for the rest of everyone, especially part-time
| contractors. In that way, a cheaper academic license, even
| accepting that there's no fool proof way of checking for
| that, or having a time-limited entrepreneur/start-up option
| will lead to more sales and more money.
|
| It then becomes an exercise in the dark art of pricing
| things, to figure out where that sweet spot actually is. A 30
| or 90 day copy which is hopefully long enough to build the
| bike shed, priced right, is an actual sale that can be made
| that otherwise wouldn't. A cheaper limited version for the
| non-premium seats at the company are other additional sales
| to be made.
| frankzander wrote:
| Best is 2. because it's human and fully open and clear in
| communication and also sane because you acknowledge that every
| other step is a fight against windmills and swimming against
| the stream. Using what has been given to you is the best thing,
| the smartest thing and with that you show, that you outsmart
| the situation and also respect the users (payed and unpayed)
| 908B64B197 wrote:
| There's a third option:
|
| If the software supports getting updates, get the cracked
| copies to phone home and have a legal firm send them a warning
| they might be using hacked software.
|
| Home users won't care, but legitimate businesses might convert
| to actual sales.
| hutzlibu wrote:
| "and have a legal firm send them a warning they might be
| using hacked software."
|
| Rather send a message directly through the software and give
| a link directly to purchase it. A bit cheaper and more
| straightforward, than finding out adresses and involve
| lawers. That should be the last resort.
| KomoD wrote:
| How would you send them a warning, you'd know nothing other
| than an IP address? If you just send the ISP a regular ol'
| "copyright" notice, there's a lot of ISPs who do not forward
| those notices.
|
| And if you made cracked copies phone home, that's something
| that would get removed by the cracker anyway most of the
| time.
| fest wrote:
| In my country, there is a branch of police that deals with
| such things. They have a relationship with an organization
| called Business Software Alliance, which I believe is
| formed with this specific goal- to allow foreign companies
| or their local distributors reach pirate users. However,
| I'm only aware of the major software companies being
| members of this org: Microsoft, Adobe, Dassault
| (Solidworks), Siemens.
| wobbly_bush wrote:
| If the business is from someone in a low income country, they
| likely wouldn't care about any legal warnings either. Some of
| the software prices in those countries are very expensive
| relative to prices of other things.
| Fire-Dragon-DoL wrote:
| There was a videogame that got famous because it was pirated,
| it was a management game about setting up a gaming company.
|
| Turns out, the pirated copy had a special feature where the
| player would feel immense economic pressure from piracy, so a
| bunch of players asked how to win against this, it was pretty
| hard and really fun for people who knew what was going on.
|
| Point is, you could hide an Easter Egg for pirated versions
| (can you detect the lack of signatures?)
| iLoveOncall wrote:
| Crysis 3 would let you play an hour or two and then some
| special weapon wouldn't have ammunition essentially soft-
| locking you out. Great way to sell too.
| junon wrote:
| Mirrors Edge too. You'd get through the first couple of
| levels then she'd just slowly come to a halt right before
| the ledge and you couldn't move anymore.
| non-nil wrote:
| I first misread this as Microsoft Edge and found it
| funny, if perhaps a little convoluted.
| WASDx wrote:
| I love this approach. If you can detect a crack and block it,
| it will get worked around. Injecting easter eggs is much more
| subtle. There was another game that made an otherwise easy
| jump between two platforms impossible, so the players who had
| cracked the game went on forums and unwittingly revealed
| themselves by asking how to complete that level.
| kuboble wrote:
| We have implemented something similar. The most obvious way
| to crack our software will trigger certain bug. Whenever
| people report that bug I feel a little joy
| krisoft wrote:
| > Whenever people report that bug I feel a little joy
|
| I hope you are super duper 100% sure the bug can't happen
| otherwise. I would hate to be your paying costumer and
| ignored because your drm system is buggy.
| kuboble wrote:
| Yes. 100% super duper sure.
|
| It's something along the lines of: Pi+=2 in one place of
| the code. And Pi += 1.1415 somewhere else. And both are
| guaranteed to run at the start of the program so that
| Pi=3.1415
|
| However one of those lines is hidden in a part of the
| code that the most obvious crack is going to remove.
| krisoft wrote:
| Okay. That sounds reasonable. Well thought out system.
| pxx wrote:
| The hilarious thing about this is that this might have
| different behaviors across architectures or optimization
| levels if you do a bad floating point compare...
| Dylan16807 wrote:
| That kind of thing is a cute idea but that specific example
| has always bothered me because it implies the devs really
| think that piracy is a catastrophe for sales.
| [deleted]
| yieldcrv wrote:
| That happened in I am Legend too
|
| The pirated version had a different name for one of the
| mannequins, but people loved the quote and the acting for
| yelling out the name of the mannequin in the movie, so that
| led to people would arguing in internet comments about the
| name used and you could get a feel for how prevalent the
| piracy was by upvotes
| tgsovlerkhgsel wrote:
| The obvious risk with that approach is that if people do not
| realize that this applies only to the pirated version, you're
| risking bad reviews, which can cost you actual sales (you
| don't win anything _just_ by keeping people from pirating
| your software, you only win if someone who is willing to buy
| but prefers to pirate chooses to buy instead).
|
| I believe there were several games that had a reputation for
| being horribly buggy that was at least partially the result
| of pirated versions having bugs intentionally introduced by
| the copy protection.
|
| I believe the game you mentioned made it really obvious what
| was happening and why to avoid that.
| ilyt wrote:
| > The obvious risk with that approach is that if people do
| not realize that this applies only to the pirated version,
| you're risking bad reviews, which can cost you actual sales
| (you don't win anything just by keeping people from
| pirating your software, you only win if someone who is
| willing to buy but prefers to pirate chooses to buy
| instead).
|
| Any time I've seen game devs try it the comments under
| those people were "you fix it by buying the game pirate".
|
| And platforms like Steam allow you to review only bought
| games anyway
| Semaphor wrote:
| Long ago, I helped distribute cracks and reverse engineered
| servers for warcraft 3 alpha. One of the biggest issues in
| the cat and mouse game was when blizzard introduced 2
| invisible golems that would attack your base. That took the
| crackers much longer to fix than other updates.
| hunter2_ wrote:
| > can you detect the lack of signatures?
|
| I think a fundamental aspect of cracking consists of
| disabling such detection mechanisms. But if the cracker only
| digs far enough to ensure that it seems to work without nags,
| and not far enough to find Easter eggs, then it will probably
| work for a while until people catch on and demand a further
| crack.
|
| It's really the OS that needs to detect a lack of expected
| signature, because the cracker isn't going to be able to
| disable an OS feature unless they release the cracked app as
| a while VM or something. But that's a thing...
| wstuartcl wrote:
| Depending on the nature of the app a suitable easter egg may
| be that over time the outputs become randomly but subtly
| incorrect. Another technique is to canary mark outputs in
| some way (like a tell tale unique string in PDF/export
| outputs). In this way your sales team may be able to search
| for those outputs and put pressure on large orgs creating
| those files.
| blippitybleep wrote:
| One of the Command and Conquer games (Red Alert 2?) would
| blow up your MCV 30 (or thereabouts) seconds into a game if
| it detected piracy. Funny, albeit, entirely less subtle.
| MrPowerGamerBR wrote:
| > There was a videogame
|
| Game Dev Tycoon
| kregasaurusrex wrote:
| It was later added it to the paid copy of the game and it's
| similar to a 'very hard' difficulty where the normal
| strategies of development don't apply and you have to include
| DRM most of the time to break even on per-game costs.
| Completing it was a difficult achievement.
| josephcsible wrote:
| Here's the full story of that:
| https://www.greenheartgames.com/2013/04/29/what-happens-
| when...
|
| It's important to note that they didn't use DRM or anything
| like that to detect whether a given copy of it was pirated.
| They made two builds of the game: a normal one that they gave
| to paying customers, and the special one that they uploaded a
| torrent of themselves.
| esel2k wrote:
| I think 1 is absolutely is fantastic comment. How many people
| define as finding product market fit is if people love your
| program and tell about it to their friends. Here they even go
| as far to crack it.
|
| A third option is a big looking what adobe photoshop did. Most
| people in the early days has an access to a cracked version and
| it became nearly the standard for image editing. And how did
| they then manage this: By adding cloud services.
|
| You could maybe start small and say: ,,You can download our
| free templates (don't know what type of software but I thought
| of some 3D models) from the web (new template every couple of
| month) and this works only with an activated version. By this
| you actively provide more value for your paying customer at the
| same time instead of wasting time and money to just make it
| harder to crack.
| DarrenDev wrote:
| There is a third option which I'm surprised no one has
| mentioned so far: Ignore them.
|
| First, people or companies using the cracked version of your
| software were never going to buy it. These people do not pay
| for software, and nothing you do will convince them to pay for
| it.
|
| Secondly, whatever measures you put in place to combat the
| cracked versions will potentially have a negative impact on
| your actual paying users - the real people you built the
| software for.
|
| Extra security measures or hoops to jump through; extra
| validation or 'calls home.' - all extra things that can and
| will go wrong at some point for a real user.
|
| Why would you inconvenience paying users to combat people who
| will never be paying users?
|
| Ignore them, and spend your time improving your product for
| your real users.
|
| [I've had 3 desktop apps cracked and hosted on Warez sites over
| the past 15 years - even appearing for sale on eBay on some
| occasions. I was worried the first time it happened, then I
| stopped caring. They made no difference.]
| fragmede wrote:
| > First, people or companies using the cracked version of
| your software were never going to buy it.
|
| I've heard this before but I'm not convinced this is actually
| true. Why? Because I use Netflix instead of torrent sites,
| and just accept the limitations of that format. Programs are
| tools vs of entertainment, but I don't know that the human
| psychology actually changes.
|
| A neat trick they did was to introduce downloading as a
| feature. Now search results for "Netflix download" all talk
| about the built in feature as opposed to teaching how to rip
| the DRM off the downloaded file.
| hellotomyrars wrote:
| Not sure how your example of Netflix refutes the point
| being made? It's exactly the point?
|
| Regardless this just goes to show that the problem can be
| mitigated by making the legitimate route less painful than
| the illegitimate one. I used to pirate most of my music
| collection but now I use Apple Music because the friction
| of maintaining the library across multiple devices is so
| much lower.
|
| Imposing restrictions and hoops to make your product
| _harder_ to pirate is vastly inferior and in many cases
| entirely ineffective in than designing the product to be a
| superior experience to pirating it.
|
| The ability to do so is going to vary wildly by the product
| itself, but that is the better way to achieve the goal.
|
| There are people who will always pirate things, whether out
| of principle or out of economics. However there are plenty
| of people who would gladly cross the line if the legitimate
| route was significantly better, either by ease of use or
| design.
| fragmede wrote:
| Oh yeah okay I see what you're saying.
|
| DarrenDev says there are _no_ lost sales. However, I pay
| for Disney plus because I don 't have access to invite-
| only torrent sites where the latest movies can be found,
| but I'd still like to watch them. If I had access to
| those torrent sites or someone's Plex, I could cancel
| Disney plus.
| jupp0r wrote:
| I think this is different in consumer and corporate
| markets. The tradeoff to expose a business to legal
| liability and security problems is not a good one for most
| businesses while it's usually acceptable (or isn't realized
| by) many consumers.
| creeble wrote:
| It was called "the WordStar effect" in the 80s. Your marginal
| loss to pirates is nothing compared to the incremental effect
| of becoming a standard.
|
| Not always effective for all applications though.
| branon wrote:
| Distributing cracked software for free is one thing, but
| people trying to make money selling cracks or access to them
| ... if it were my software, that'd feel personal.
| ilyt wrote:
| Eh, you probably want to give company customers some notice
| it is a pirated one.
|
| If there is no note whatsoever it's very easy to get to
| situation where user A starts to use it, pirates it, then
| just dumps it onto file share and tells others to use it.
| FlyingSnake wrote:
| I agree. Ignoring them is probably a good strategy. #2 in the
| list is too time consuming and has opportunity cost for the
| small team already wearing many hats.
| freedomben wrote:
| Yes, exactly! This is IMHO the best answer. You'd also be
| amazed at how many people pirated photoshop while they were
| youths and/or students, and later paid for a legit copy when
| they had a real business need because it was what they knew
| and loved.
|
| It's very bad economics to think of a pirated copy as a lost
| sale. In some cases the piracy _helps_ drive sales!
| technion wrote:
| I agree with this, but I do think having pirate keys show up
| on ebay is a special case. I've dealt with this in businesses
| that expected Microsoft support but had windows and office
| keys bought off ebay that they believed were legitimate. End
| users often just think that $5 key is a special deal. It's
| worth sending whatever complaints you can to ebay.
| 1970-01-01 wrote:
| Yes, this is a good problem for a developer.
|
| 2b. Free with Ads. Yes, this is not for everyone, but many devs
| will make this path an option. Your buyers must realize that
| all ads can be removed for a fair price.
| bonestamp2 wrote:
| Other options
|
| We had this happen too. In our case, our software required our
| hardware to function so we put the recurring license on the
| hardware instead of the software. It's been about 8 years since
| then and nobody has been able to crack that system yet. Some
| software that doesn't need hardware also uses a small hardware
| key to enforce licensing.
|
| Going forward, you could make it so the user has to login to
| your service when they launch your software. You could provide
| extra value to your paying customers through this channel too.
| You would run into some other challenges such as shared
| passwords, but those have some mitigation strategies too.
| moralestapia wrote:
| >Congratulations!
|
| Indeed! There's a nice anecdote from Paulo Coehlo (I don't like
| his work but w/e) where he was stuck in traffic somewhere in
| LATAM and a guy passed by his car selling pirated copies of his
| newest book. He then says this event made him feel like he had
| finally made it and even became a strong promoter of piracy,
| heh.
| mobilio wrote:
| Actually this happens in other country and Coehlo make free
| version of his own books:
| https://paulocoelhoblog.com/2008/02/03/pirate-coelho/
| jspaetzel wrote:
| I like the special page suggestion. Humanizing the software is
| a great way to get people to pay for it if they have the means.
| And if they don't, then you're doing some good in the world
| (hopefully) by giving it away. Maybe at some point in the
| future they'll pay it forward or back.
| kabdib wrote:
| When I was working on video game cartridges, I discovered that
| one of my neighbors in my apartment building was a prolific
| pirate. I introduced myself and we had some fun chats.
|
| The Atari 800 cartridge address range could be populated with
| RAM, and cartridge images simply copied to RAM and run. Copy
| protection techniques usually involved figuring out sneaky ways
| to write to that address range (which would crash an image
| running from RAM).
|
| Toward the end of one project, I spent about two weeks writing
| an encrypted, multi-stage anti-copy system. A few months after
| the game shipped, I asked my pirate "friend" about it.
|
| "That was a hard one," he said, "It took us nearly three days
| to crack it."
| andymccurdy wrote:
| The Atari 800 was my first console and where I typed my first
| lines of Basic code. While it wasn't obvious as a 7 or 8 year
| old kid, I reflect back on this experience fondly and
| recognize that it was instrumental in my development as a
| self-taught software engineer. Thank you for your role in my
| personal development.
| kabdib wrote:
| The Atari 800 was released (IIRC) in 1979. It was a
| surprisingly good platform, with a decent OS, a tolerable
| file system (for a slow floppy disk), and great
| documentation all around. I learned a lot reading the Atari
| docs, long before I worked there.
| Gigachad wrote:
| These days the companies won and modern game DRM often
| doesn't get cracked for the first year if at all.
| ilyt wrote:
| That heavily depends on game in question. Some use "top of
| the line" DRM still get cracked within a week.
| pclmulqdq wrote:
| Steam seems to have significantly reduced the market for
| pirated games. Streaming did that for movies for a while,
| until every single production company decided start their
| own.
| snuxoll wrote:
| Almost like Gabe Newell is right, piracy is first and
| foremost a service problem. There's some irony in things
| like Denuvo making games worse for legitimate users and
| creating new incentives to crack it, or players deferring
| purchases until it's either inevitably removed long after
| the launch window (where publishers are expecting the
| majority of purchases to happen).
| Gigachad wrote:
| To some extent. With modern AAA games costing ~$100AUD
| these days, there is still a strong incentive to pirate
| even if it's far more convenient to buy.
| huhtenberg wrote:
| > _Having cracked versions out there indicates that your
| software is both useful and notable_
|
| In the vast majority of cases it doesn't mean that.
|
| A lot of cracking is done for sport and to show off, especially
| when the protection is weak.
| lll-o-lll wrote:
| "But above all, make sure not to confuse a "pirated copy" with
| a "lost sale". In 99% of cases, the Venn diagram of those has
| very little overlapping area."
|
| I'm seeing many comments saying this, but it's simply not true
| for commercial/industrial software. Outside of the US, even in
| large swathes of Europe, it's extremely common to lose
| significant revenue to piracy, and if you make it too hard to
| pirate they _will_ pay.
|
| Companies (the customers in this case) that are happy to
| exploit workers in sweatshops? Also completely happy to use
| your software without paying for it.
| netrap wrote:
| Completely agree. Great comment. Make it harder to find by
| simple means by requesting link takedowns, etc. Don't bother
| trying to make it harder to crack since real crackers will not
| be deterred.
| hermitcrab wrote:
| >But above all, make sure not to confuse a "pirated copy" with
| a "lost sale". In 99% of cases, the Venn diagram of those has
| very little overlapping area.
|
| Very true. If they were never going to pay anyway, you haven't
| lost anything if they use a crack. It still irks though!
| Enginerrrd wrote:
| Yeah basically. Not only that, but, for all of the most
| expensive software I use, I used a pirated version first for
| months to ~ 1 year first. Once I really got a feel for it, if
| it provided value to me, I have pretty much paid for it
| everytime. And no, a 30-day trial doesn't cut it for
| evaluation. If I used the software enough to where a 30-day
| trial would have been enough to test it properly, the value
| proposition would have already been there to just buy it.
| Software trials should be based on hours used or something,
| and the eval periods are almost always too stingy.
|
| Instead, the value proposition to switching to paid became
| once it had established value to me, and I could benefit from
| the reduced exposure risk of running malware in the cracked
| version, and possibly get updates if they affected major
| things like stability, or new tool-sets or access to online
| data that was useful.
| horsawlarway wrote:
| Consider it free training, education, and marketing rather
| than a lost sale.
|
| It's literally the same reason most companies give students
| essentially fire sale discounts (often just free) versions of
| their software.
|
| They're probably pirating it because they aren't deriving
| much if any revenue from using it yet (it's either for
| personal use, they're learning a new tool, or they have no
| money). But having that person familiar with your software
| and trained on it means that if they reach a spot where
| they're using it profitably for business - it's basically a
| guaranteed sale.
| lb1lf wrote:
| This was how I got a licence for the Protel (Now Altium)
| PCB design software when back in university; the cracked
| version doing the rounds on campus was rather prone to
| crashing, so eventually I figured I had nothing to lose,
| called up the distributor and asked them if they did
| student discounts, as buying a full licence was definitely
| out of the question, but so was using the, uh, evaluation
| version with its stability issues.
|
| "Sure thing, how many do you need?"
|
| When I hesitantly reminded him we hadn't discussed prices
| yet, I was told it was free as they really wanted to snare
| us in as users before we wound up in paid work where we'd
| need to be productive employees fast.
|
| I have since had three employers buy full licenses and
| support deals. Good call by Protel back then.
| omginternets wrote:
| A (possible) third option would be to distribute the product
| under a SaaS model instead of a binary.
| nullish_signal wrote:
| Gabe Newell, CEO of Steam, once said that "Piracy" is a Service
| Problem. If an Illicit Downloader has your Software for Free,
| then they must become interested in Paying to Install Updates, or
| to Pay for a License to Access a Web Resource.
|
| This actually happened to me with NieR: Automata. I downloaded it
| for free, played for 60 Hours, then discovered that the CREDITS
| were a playable minigame which was not feasible to beat alone,
| requiring Network Connectivity to gain helping partners. These
| just being basic AI named after other players' save files.
|
| So then 2 years later I BOUGHT Automata, played another 50 hours
| or so, and finally beat the Credits :) Then bought some DLC so my
| friend could experience it with Steam Share through my account...
| paxys wrote:
| > Gabe Newell, CEO of Steam, once said that "Piracy" is a
| Service Problem
|
| And yet nearly all games on Steam, _including Valve 's own
| titles_, have DRM. What an executive says in public for PR
| purposes doesn't always reflect their or their company's actual
| views on the issue.
| nullish_signal wrote:
| And yet I skirted Steam DRM in my example and downloaded
| Automata for free?
|
| Then Bought it because of a SERVICE that was not available to
| me.
| devwastaken wrote:
| 1. The reason someone has taken dozens to hundreds of hours to
| develop the crack is because your software is prohibitively
| expensive.
|
| 2. Downloaders of cracks are not 1:1 with buyers. Overwhelmingly
| people buy legitimate software if their business actually relies
| on it. If Photoshop cracks didn't exist there would be far less
| professional users.
|
| 3. You cannot remove it from the net. Any legal attempts are a
| waste of money, you will only ever catch the lowest quality
| users, and trying to go after them in court will not only cost
| more, but will put your company on the permanent shit list -
| meaning more clout, more notoriety for cracking future versions.
|
| 4. Congrats, you've made a product people want. Focus on making
| it better, and buyers will come. If you focus on drm and fall
| into the trap of "theft prevention", you will ultimately end up
| locking your legitimate customers out before the crackers.
| Crackers don't play by your rules.
|
| 5. If you do actually see a tangible and significant hit in
| profits, then tie your software to online services. Can't crack
| what isn't executed locally. This will again reduce quality for
| legitimate customers.
| robswc wrote:
| Just want to say, not sure what exactly your software is but it
| might be a good sign. I have nothing to say on how to fight
| piracy (I do believe you should make attempts) as security isn't
| really my field.
|
| I remember any tech-savy/media kid was obsessed with getting
| Adobe products... but no way could they ever afford a license
| like that. I don't think it would be as big as it is today
| without kids/younger generation getting their hands on it
| somehow.
___________________________________________________________________
(page generated 2023-01-13 23:01 UTC)