Slashdot Mirror
What's the Right Amount of Copy Protection?
WPIDalamar writes "I'm currently working on a piece of commercial software that will be available through a download and will use a license key to activate it. The software is aimed at helping people schedule projects and will be targeted mostly to corporate users. With the recent Windows Vista black screen of death, it got me thinking about what sort of measures I should go through to prevent unauthorized users from using the software. While I don't wish to burden legitimate users, I do want to prevent most piracy. How much copy protection is appropriate? Is it acceptable for the software to phone home? If so, what data is appropriate to report on? The license key? Software version? What about a unique installation ID? Should I disable license keys for small amounts of piracy, like when there's 3 active installations of the software? What about widespread piracy where we detect dozens or hundreds of uses of the same license key? Would a simple message stating the software may be pirated with instructions on how to purchase a valid license be sufficient?"
This may not be what you want to hear but any copy-protection will burden legitimate users. Pirates will remove the copy protection from your software and the unprotected version they create will be more usable than the version you offer.
It doesn't just hurt your customers, it hurts you too. The time you waste trying to create some copy-protection and losing the arms race with the pirates (which you will lose) is time you could have spent making your product better.
The way to beat the pirates is to provide a better service to your customers than they do. The commonly advocated business model is to provide support on the software to paying users - and since your target is business customers this makes a lot of sense.
Businesses, by the way, tend not to pirate on the scale of the private user. Piracy is a big risk to business because businesses have very deep pockets.
In short, the answer is to have no copy protection at all and trust your customers. Trusting the customer is hard but they'll appreciate it.
Simon
None.
First of all, you need to open up the source. Get those customer eyes working for you!
/.
Second, you don't have to charge for the software or limit the distribution of the software in any way. You wrote the software, so you have the most/best knowledge of it. You can make tons of money on service contracts.
--
All I need to know about life I learned on
Just like any kind of DRM. Dedicated individuals will find ways around it and likely have some fun in the process. Cracking copy protection is practically a game to a lot of people who will never even use the software. The only people who will be inconvenienced are the people willing to pay for the software.
Use a license key, make constant improvements to the product and each new version needs a valid key, disable disclosed keys in new versions.
To use your product a pirate would either have to settle for an old version, or constantly get a new hacked version and new hacked keys. It's enough to eventually get them to be legal.
Remember if you make your product hard to use with lots of negatives like phoning home, them you'll learn the lessons the Record companies are learning. Nobody is bigger than their customers.
I will not use closed source software that phones home. I'm sure others feel the same.
Prompting for a license key upon installation could be ok, since most users are used to that hassle anyway (though it's still a hassle).
"Phoning home" should never be done. Keep in mind that internet connection isn't flawless, sometimes it doesn't work for one reason or another, and would you really want to get a bunch of angry customers mailing/calling you when the software won't work/install because their internet connections went down for a while.
On top of that, if your main user base is business users, most of them will sit in a protected environment which probably won't let your program phone home even if it tries.
This is just an aside from the real problem with programs "phoning home", though. Integrity and privacy should not be taken ligthly.
Be open about the phoning home. Noone likes a closed source software that phones home for no reason. Don't hassle customers, even the ones who install a copy that is known to be pirated. You can't really tell who's the legitimate customer and who is not.
If you discover that there is widespread piracy of your product, and you want to do something about it, then make the leap to hardware protection. Bear in mind that dongles are quite a hassle for the customer. But at least the hassle is effective. Other means of protection means a hassle for paying customers, and just a fun challenge for pirates.
"While I don't wish to burden legitimate users, I do want to prevent most piracy."
This will not happen. Cracks for very heavy-handed measures will be available to exactly the same people in exactly the same ways as a cracks for a simple serial-number check on installation, ergo a simple serial-check will get you 99.9% effectiveness of any other software system.
The only things I have seen that seem to work are the hardware usb-dongles; the earlier ones were cracked but the new versions seem to be quite safe. (but they cause a number of other issues and don't qualify as non-intrusive).
Consider your potential customer:
You're writing project management software, so we're probably talking 150-200+ employees. Companies of this size are going to have some sort of security policy in this day and age, and potentially (depending on your market segments) may be on closed (meaning no or extremely limited external internet access) networks.
There's a good chance at the low end of your customer base that they will have some variety of managed software push in place where IT pushes down software and licenses to the workstation users, and it's almost a certainty at the high end of project management using companies (my primary contract fits into this category, and uses centrally managed software).
I'd therefore recommend a model that allows for central licensing, preferably with no need for IT management to install a license server (lower barrier to entry for your application) and does not need to phone home. I'd suggest a license key mechanism with an optional ability for volume licensees to share a single license database via a network connection.
Will it be hacked? Yep, naturally (but you sound like you're clued enough to have worked that out without my help) but you're trying to keep honest people honest here. Let's face it, do you really care if you have one or two users install it for free at home to hone their skills if you just sold 500 licenses to the multinational who employs them?
Large organizations have busy IT depts who appreciate it when software developers make their lives easier. Having an IT dept pushing your software over your competitors can only be perceived as a good thing, so take advantage of it! IT can put up very effective roadblocks if they perceive you as making their life more difficult and impeding things such as system imaging. The last thing you want to be is branded "incompatible with our environment" by your customer's IT dept.
Cheers,
Minupla
On the whole, I find that I prefer Slashdot posts to twitter ones because I don't get limited to 140 chars before
A much better question is, how can we maximize the rewards to our paying customers for providing us with the income we need to pursue our chosen path of software development?
The answers are:
You know the people who will insist on paying you when you mom their lawn, carry groceries, etc.? Those are the socialized, economically stable majority. They'll pay for good stuff as long as you price it sensibly and shovel value at them like it is going out of style (it actually seems to be in some cases, so use that instead of being part of it.) There is simply no need to go to war with everyone else - be a leg up instead of an obstacle to overcome.
I've done extremely well using this approach, as have my loyal employees. The only thing I would raise a flag about is you actually have to have something worthwhile; if you hand customers (and non-customers) bloated, cpu-hogging bugware, no amount of good will can counter the negative effects of the software itself.
I've fallen off your lawn, and I can't get up.
*sigh*
So if the customers want the product for free, you work for nothing?
It isn't that simple. Customers want unreasonable things. I want every pizza I ordered to be free, delivered instantly by a dozen naked supermodels. But just because my local pizza company will not provide such a service does not mean a new company will materialize to do so.
throwing out glib comments you read on some web forum does not equate to actual business experience. You cannot pay employees or bills with glib expressions, only profits earned from PAYING customers.
DRM-free indie games for the PC and Mac: Positech Games
I would also like a pizza delivered by a dozen naked supermodels (if only to make my neighbor green with envy), but I'd expect to pay quite a lot for that service.
You are welcome on my lawn.
The best method I've really seen is at the company I used to work for, Maxon Computer, they make cinema 4d. The only stuff you can really protect against is casual opportunistic pirating. Ie a company that buys a copy and puts it on several machines at once instead of buying several licences; which by the way is extremely common amongst smaller 10 man studios. C4D uses a serial number, this is very little burden for you or the customer. The serial is not tied to the hardware in any way; its freely moveable and installable on any machines you like. The check is simple, it checks the network to see if someone else with the same serial is already running the software, if so then it just doesn't load, that's it. Yes, you can in theory start yanking out network cables before you load it and so forth but this isnt really an option for most, crawling under the desk, losing shared network drives of media etc several times a day. Just make a personally identifiable serial number to scare some away from giving it out and add a network check to stop people casually spreading it around the office. If someone wants to copy your software for free, they will do it, no protection will save you, just accept this and don't burden your paying customers with annoying crap. - Dongles cost money, you'll have driver/os issues, they'll break, they'll get fried and corrupted, they take up slots, they get stolen, they are truly crap IMHO. - Tying your serials to NICs is a hassle and you will be forever sending new serials every time someone upgrades their computer, you don't want to set yourself up for this eternal headache - Online checks, lets not even go there.
Really, really bad marketing.
So how do i get the creepy feeling that this guy isn't entirely honest, but actually an elicense marketing stooge?
The install is painless (it installs a license control service that in many years of using I've never had any sort of issue with), and it stops a LOT of piracy.
Err, yes. I have original software too, but somehow the companies failed to send me regular, detailed newsletters about the LOTS of piracy they stopped with their particiular brand of DRM.
It IS possible to "unwrap" the executable, but of all the Elicense protected software I've used, I've only ever seen one game cracked. (Ironically it is the most obscure of the ones I own.)
Yeah, shure, I too make regular searches on the web for cracked versions of the originals i own, especially when the DRM is soooo good that i dont't want a no-cd crack.
And by the way, what are the multiple(!) games that haven't been cracked? I would really like to buy them, if only for rarity value. After all, in the whole history of mankind they are likley to be the only pieces of software ever that weren't cracked....
I am vehemently opposed to DRM, copy protection, call it what you will, but I find Elicense extremely inoffensive due to it's ease of use.
Yeah, i'm opposed to DRM but happy to install extra software on my computer that monitors me. But i am vehemently against everything else DRM-related, trust me.
DRM should not impact legitimate consumers, and this one is the only one I've come across that has never caused me any sort of negative experience.
Software where you have to enter a code ONCE is really a pain in the ass, believe me. But elicense is soooo easy to use, i have to mention it five times. Please buy our product.
DRM-Companies, i beg you, if you let your marketing division run loose on slashdot, at least stop them from taking drugs. Thanks!
+1 Spinal Tap reference.
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
If your target is buisness users, this sort of "phone-home product activation" scheme is going to cause you and your customers a lot of grief. The install might be "painless" on someone's home computer (assuming the someone isn't ethically opposed to product activation), but it won't be in a corporate environment, where your product may have to traverse a proxy server (or even an authenticating proxy server) to reach the internet.
What happens next? Nothing. Don't disable the software, don't handicap the software, and for chrissakes don't you dare email me to tell me I'm pirating your software. Even if it's true, I don't want to hear it and I sure as hell will not do anything about it.
What might be appropriate is a simple email once every six months thanking each customer for their purchase of X number of licenses, and asking them to please get in touch if they have any questions at all. Make sure to prominently display the emails and phone numbers for sales and support. If you suspect someone might be pirating your software in a big way, include a special one-time offer to expand their licenses and/or support for a very good price. But don't suggest that they're pirating; it will be viewed as insulting and invasive even if it's true.
work on employee PCs it definitely won't work on servers that need to be able to reboot by themselves (and if the nag screen does not halt booting of the program than you have not accomplished anything as in many cases no-one will see it). In the same way you *MAY* get away with phone home software on a PC, but it definitely would not work on a server - especially one that may not have any direct internet access.
I would agree with previous posters that a one time installation code would be acceptable, and even perhaps one that expires over time (though that would certainly be annoying) as long as the process to upgrade is easily scriptable.
For employee PCs you might be able to get away with a call-in-on-boot type scheme as long as it uses standard protocols like http or ftp. But I would certainly understand people balking at this sort of thing.
It depends on where your software is intended to be installed.