What's the Right Amount of Copy Protection?

WPIDalamar writes "I'm currently working on a piece of commercial software that will be available through a download and will use a license key to activate it. The software is aimed at helping people schedule projects and will be targeted mostly to corporate users. With the recent Windows Vista black screen of death, it got me thinking about what sort of measures I should go through to prevent unauthorized users from using the software. While I don't wish to burden legitimate users, I do want to prevent most piracy. How much copy protection is appropriate? Is it acceptable for the software to phone home? If so, what data is appropriate to report on? The license key? Software version? What about a unique installation ID? Should I disable license keys for small amounts of piracy, like when there's 3 active installations of the software? What about widespread piracy where we detect dozens or hundreds of uses of the same license key? Would a simple message stating the software may be pirated with instructions on how to purchase a valid license be sufficient?"

Comments

None at all

[Ckwop]

While I don't wish to burden legitimate users, I do want to prevent most piracy. How much copy protection is appropriate?

This may not be what you want to hear but any copy-protection will burden legitimate users. Pirates will remove the copy protection from your software and the unprotected version they create will be more usable than the version you offer.

It doesn't just hurt your customers, it hurts you too. The time you waste trying to create some copy-protection and losing the arms race with the pirates (which you will lose) is time you could have spent making your product better.

The way to beat the pirates is to provide a better service to your customers than they do. The commonly advocated business model is to provide support on the software to paying users - and since your target is business customers this makes a lot of sense.

Businesses, by the way, tend not to pirate on the scale of the private user. Piracy is a big risk to business because businesses have very deep pockets.

In short, the answer is to have no copy protection at all and trust your customers. Trusting the customer is hard but they'll appreciate it.

Simon

Re:None at all

[JohnFluxx]

I disagree.

In the work place, most people might enter a fake installation code for example, but won't go as far as to apply a crack. If the software requires you to apply a crack to use it, then I think most people at work will get their company to buy it. If it just installs anyway with just a small nag screen or something, then most people won't buy it.

Re:None at all

[lukas84]

I disagree, even though just on a tiny bit.

Businesses tend to purchase software they need, yes, but extending of software licenses is often overlooked.

e.g. they buy 5 licenses of your software. A year later, a team member is added to the team using said software. Now there are 6 users. Over time, many more people than the original number of licenses will use the software.

This doesn't happen in all Businesses, but the smaller the more often.

A good idea would be to add "soft activation". This means customer have to activate your software, and the number of currently active machines counted. Deactivating machines should be running a simple tool that removes the software and decrements the activation count on the server. Activation should never fail (even if the activation server is unreachable), but the customer should be reminded if he is running unlicensed software. This way, you can make sure that users don't mistakenly use to many licenses.

Criminal elements will of course find ways around this, so i wouldn't bother with making the activation process very secure - it's essentially just a license counter for your honest customers.

Re:None at all

[struppi]

Good points, but I can not completely agree with you. I personally never found it much of a burden to enter a license key. Even a one-time online activation is OK IMHO as long as it's painless. And I can understand why software companies put these measures in, not to stop pirating at all, but to keep the honest people honest.

I know that piracy is not so much of a problem when it comes to businesses, but consider the following: A company purchased 50 user licenses of a product, but the product has no copy protection whatsoever. Probably the people in charge won't even notice if more than 50 employees install the software - at least not in the companies I have worked so far. OTOH, if this software would have told the 51st user "Your company has no more licenses for you to install the software. You can use this program for another 30 days, but please contact your system admistrators to buy a license for you", the company probably will buy another 20 licenses.

So, IMHO, one-time activation is OK if it doesn't get too much in my way, but phoning home at every start or some annoying procedure like the Vista phone activation (I went through that once - took me more than 1.5 hours to activate a copy of Vista) is not OK.

Re:None at all

[xtracto]

f it just installs anyway with just a small nag screen or something, then most people won't buy it.
I agree, you just have to see the hundreds of computers I have seen in several different government offices that use WinZip, they invariably show the startup nag screen telling you how many thousands of files have you compressed and asking you to buy it... of course, you just have to click the continue button and keep using it..

Re:None at all

[arth1]

A good idea would be to add "soft activation". This means customer have to activate your software, and the number of currently active machines counted. Deactivating machines should be running a simple tool that removes the software and decrements the activation count on the server. Activation should never fail (even if the activation server is unreachable), but the customer should be reminded if he is running unlicensed software. This way, you can make sure that users don't mistakenly use to many licenses.

Any system that requires an active deactivation through a tool on the machines where it is installed is badly designed, because the host might not be available for deactivation. If a PC dies, and is replaced with a new one, you can't deactivate the old installation. Similarly if a PC is restored to a point before the installation occured -- then it's impossible to deactivate. (This is part of what bit the Biosphere users -- some people installed the software, ran into problems, and rolled back to pre-install, and tried again.)

Plus, then you have a potential loophole in that people can install on one machine, back it up, deactivate, install it on a second machine, et cetera, and then restore all the backups, and you have a park full of activated copies.

The only sensible approach that I can see for large scale installations is to count concurrent usage through a network server or appliance, and bill according to peak usage. Anything else is going to create a headache for the admins who have to deal with broken machines and reinstalls on a daily basis, and can't reasonably be expected to hang over people's shoulders to count who is using software either.

Re:None at all

[FlyveHest]

So, in short you recommend using a piece of software, that installs another piece of software, that stays on the system after uninstalling the first piece of software (How else could it work, if you have multiple pieces of software that uses it?), and, as you say service, I assume it runs while the original piece of software is not.

Even though you say that you have never had any problems with it, I would absolutely HATE using anything of the kind, and would actively avoid using any piece of software that uses that kind of activation.

Re:None at all

[rucs_hack]

I doubt they will love to phone or send snail mail.

Oh I dunno, that used to work in the seventies and eighties. What'd'ya mean that was years ago, eh? Come 'ere you young hooligan, say that again! Get off my Property!

ZZZzzzzzzzz whut?

Re:None at all

[Chelloveck]

You don't work in a corporate environment and/or I doubt you deal with many systems.

Maybe he doesn't, but I do. And I completely agree with him. Installing a background task just to deal with license keys is bad juju. You recommend Elicense. How many other services are there? This isn't the only program I'm likely to install. How many different license key monitors do you think I want running on my machines? How are they all going to interact with each other?

Re:None at all

[mce]

... that stays on the system after uninstalling the first piece of software (How else could it work, if you have multiple pieces of software that uses it?), and, as you say service, I assume it runs while the original piece of software is not.

You obviously have no clue what you are blabbering about. There is no reason whatsoever why you can't have multiple independent products protected by the same third party mechanism without linking said products together. I know, because I've done it.

In short: Nobody interested in anti-pirating wants the licensing to be in a dedicated dll, since those are easy to locate, break, and replace. Licensing code should always be fully merged into a key component of the product you're protecting and as such be "invisible". That automatically means that you can have multiple copies of it that are not aware of each other and that are automatically uninstalled together with the product they protect.

Re:None at all

[GPL Apostate]

I have registered a lot of shareware over the past decade and more. In fact, I have ended up with a whole CD-R that I label 'registered shareware' that has folders with all the shareware installers and the cd keys, license files, etc. that are collected with them.

One of the things I will not do, and it's something that causes me to no longer consider registering or paying for a piece of software, is if it has one of the complicated 'validation' schemes like you describe. I will NOT run a piece of software where I have to pass numbers back and forth from a live server somewhere to generate a 'key' and 'validate' the software. When I see that's how a piece of software works I drop it and move on to consider other packages. I've did so in several instances and it's always turned into money sunk down a hole that was a waste.

Don't tie my use of your software to your ability to stay in business. I can and will send you money for to register a piece of software. After doing so, I do not want to lose use of it because you happened to go out of business or changed your business plan.

When Microsoft started using this scheme for 'validating' software is when I decided Microsoft had ceased being an entity I wanted to do business with.

Re:None at all

[morgan_greywolf]

I do. And I hate these things. At any place that I've worked that uses these background daemons to control licensing, due to the proliferation of various similar programs, we've had to run a special license server -- and usually more than one. FlexLM, LUM, proprietary license solutions, etc., with multiple daemons usually. A typical box might run 25 different license processes. And management is usually a big PITA, because these processes almost always break in some way sooner or later.

Re:None at all

[Ender77]

Do you guarantee his business will be here in a couple of years? Do not put anything in where you have to contact somewhere to get a key/permission. If the company goes down and you have to reinstall the software, you are screwed.

Re:None at all

[morgan_greywolf]

Don't know what version of FlexLM you used, but every version I've used does nodelocked licenses by tying to a machine's 'lmhostid', which typically matches the MAC address on the machines first Ethernet card. Hardly unique, to be sure, but AFAIK, faking the MAC address with software doesn't work (but changing it using firmware that allows the MAC to be changed does.)

Re:None at all

[fishbowl]

>I have registered a lot of shareware over the past decade and more. In fact, I have ended up with a whole CD-R that I label 'registered
>shareware' that has folders with all the shareware installers and the cd keys, license files, etc. that are collected with them.

'
1. I've outlived more than a couple of developers, both in the sense that individuals died and that companies vanished. I may or may not ever use their software again, but that's my decision not theirs.

2. I've used software in emulation of 20+ year old hardware, and not just for games.

I will buy software that gives me a license key which I am responsible for keeping.

I will not buy software that's tied to some specific device (e.g., Synchrosoft or ILok dongle, don't even assume "USB" or current architecture), nor will I buy anything that has to "call home" (will you still be answering in 20 years? I'm not willing to take the chance that you'll answer *tomorrow*.)

Re:None at all

[walt-sjc]

Bing bing. Give that man a dollar.

Working in a larger environment, the ONLY software we allow ANY kind of phone-home / activation shenanigans is from large vendors that have a proven business record - you know they will be around tomorrow / 3 years from now. Not thrilled about it in any case, but we will deal.

Any smaller vendor is required to put source code in escrow for any such eventuality, and none of that activation crap. We need to be able to move software from one machine to another without someone's blessing in order to handle EOL replacement, swapping out failing hardware, etc.

Re:None at all

[UnknownSoldier]

> I'm a programmer, I make my living writing applications for various companies, and I get paid pretty well to do it because I posses specialized knowledge.

Same -- knowledge is traded for money.

> Assuming copyright was abolished, this would effectively kill off the entire software industry.

Nonsense. Copyright is only a RECENT invention, and other industries where it costs ZERO to copy something, are still around.

People would still pay (gasp!) for software, because most are under the moral law of supporting the authors. (There are a few above it, and a few who think they are above it, but that has always been the case.)

The whole concept of "ownership" is based on a system of greed, because people can't treat others how they want to be treated.

> Going to a system without copyright would quickly destroy any motivation to provide works not directly beneficial to major corporations

Did you forget the fact that BEFORE copyright, people CREATED because they ENJOYED it? Famous works such as The Bible, we written not because of some corporation, but because people wanted to share a different outlook on how to live.

I see tons of open source programs created because a developer found it interesting. Heck, myself I work on one, precisely because I find it fun.

> As an added bonus, medical research would be pretty useless as well. No point researching a drug to cure cancer,

So now you are going to put a price on SAVING a human life?! Yay for capitalism! Screw the long-term thinking of doing things for the greater good, and focus on the short term solution of making a quick buck.

> You seem to forget that people are greedy, and without motivation they don't work.

You seem to forget that money is not the only motivation.

> There must be at least a reasonable hope of profit (either in the traditional sense, or as some sort of personal gratification) before someone is willing to undertake the effort.

Tell me, do you have any hobbies? And you do them for profit??

Someday, the human race will look back at copyright for what it was, a necessary step along the way from when people were focused on controlling their expressions and thinking they determined the "value". I have a dream where someday people will willingly share their creative expressions, and the value of that is not only thought in terms of financial gain, but also by the lasting value it creates in people's lives.

Laws are created BY people, and by the number of people sharing music, videos, etc, more people are ready to acknowledge copyright is an archaic hold-over from when physical things (let alone information) was a form of power; its time to stop being so greedy and short sighted, and look towards the long term where people enjoy sharing (positive) things with each others, and not just focused on what they can get from others.

Peace

Re:None at all

[TClevenger]

Broderbund has done this both with Print Shop and American Greetings CreataCard. My wife has a Creatacard installation CD that is worthless, because they've shut down the activation server, and there's no other way to activate the software. In fact, Broderbund's tech support site says that reinstallation from the disc is not possible.

Activation sucks--Broderbund ripped off a paying customer.

Don't phone home

[Anonymous Coward]

Use a license key, make constant improvements to the product and each new version needs a valid key, disable disclosed keys in new versions.

To use your product a pirate would either have to settle for an old version, or constantly get a new hacked version and new hacked keys. It's enough to eventually get them to be legal.

Remember if you make your product hard to use with lots of negatives like phoning home, them you'll learn the lessons the Record companies are learning. Nobody is bigger than their customers.

Phoning home is _not_ an option

[gunne]

Prompting for a license key upon installation could be ok, since most users are used to that hassle anyway (though it's still a hassle).

"Phoning home" should never be done. Keep in mind that internet connection isn't flawless, sometimes it doesn't work for one reason or another, and would you really want to get a bunch of angry customers mailing/calling you when the software won't work/install because their internet connections went down for a while.
On top of that, if your main user base is business users, most of them will sit in a protected environment which probably won't let your program phone home even if it tries.

This is just an aside from the real problem with programs "phoning home", though. Integrity and privacy should not be taken ligthly.

A license key is enough.

[Draconix]

A license key is enough to discourage the casual pirate (custom encryption and multiple variables helps, such as name + password instead of just password) while, from my experience, not being enough to discourage regular users. Entering a key once and not worrying about it ever again is normal enough, and not bothersome. Going beyond that is asking for some glitch to cause legit customers to be calling you up to ask what the hell just caused their copy of your software to invalidate, or why they can't install it on their new computer, etc. Most importantly, it will also encourage people to crack your protection, thus making the pirate version more appealing to the end user.

Re:What's the Right Amount of Copy Protection?

[pilaftank]

If the question is how much should I beat the customer over the head, the answer is none. However, the question is wrong. The really question is how can my licensing mechanism best help legitimate customers track their licenses and stay compliant within the licensing agreement. The customers you want have no desire to steal your software, but they'll get annoyed if you make it laborious to maintain license compliance. Forget about the people who want to pirate your software. You add no value to your product when you waste time on them.

Don't require a connection

[dargaud]

I worked with equipment that was 3000+km and 10 months away from the closest internet connection, so anything that requires a net-activated key is an absolute no-no. We are still using Win2K for that purpose, and more Linux all the time (although you have to select a distro that won't try to download itself all over again once a week).

You don't need to go this far: I spent the last 3 weeks on the road with my laptop: Matlab ceased to function as soon as the license key manager got out of touch of the license server. I hate that macromedia shit.

As little as it takes...

[pla]

Is it acceptable for the software to phone home?

As a member of a small corporate IT department, I can tell you that (except for Microsoft itself), software phoning home for anything other than updates means instant banning of your product.



If so, what data is appropriate to report on? The license key?

If you insist on going down that path, what information would really help you reduce piracy? Keep in mind that, merely during the initial evaluation of your software, the same license may get used a dozen times without any intended piracy... "Yup, works on XP. Yup, works on 2k... Oops, blows a gasket on 98... Doesn't seem to like server versions...".



Should I disable license keys for small amounts of piracy, like when there's 3 active installations of the software? What about widespread piracy where we detect dozens or hundreds of uses of the same license key?

That gets tricky... IANAL, but only the big boys like Microsoft can get away with that BS. If you try it, you should probably prepare to get sued.

Now, you do have one chance to block it - At installation. Even I'll allow (grudgingly) most products a one-time online activation. If at that time you deny activation and give an EASY way to contact you to resolve the problem (you can expect them to lie, and should probably just give them a new code, but it might serve as a reminder to the users that they shouldn't make too many more copies), okay, fair game. After-the-fact, though? YOu'll just piss legitimate users off.

Code Wheels

[ameoba]

I've been waiting for code-wheels to make a comeback.

Personal Delivery

[clickety6]

Have each copy personally delivered(*) to the client and you will find that they never pass on copies and will faithfully purchase every upgrade you make available.

(*) Personal Delivery service to be carried out by Marco and Guido who have their own, very smart uniforms (Gucci suits, dark glasses) and will also provide their own baseball bats. A personal message from you to the client will also be delivered with every copy of the software with a reassuringly soft, menacing undertone. Contact Marco and Guido DRM(**) Services on 555-NO-REFUSAL.

(**) DRM = Delivery with Real Menace

Let some fall through the cracks

[otter42]

Who was it that said to always make sure to leave a spot in the fence where children could sneak through? P.T. Barnum, perhaps? The point is, people used to understand and accept that a certain amount of "losses" will occur, and that sometimes these "losses" are in fact good for profits, by driving more paying customers to the business. It's only recently that we've evolved the technology and capabilities to ensure that EVERY person gets charged for EXACTLY what they consume. As if we could even know that for sure...

Don't apply macro-laws (movement of fluids) to micro situations (individual molecules in a fluid). Focus on the macro violations-- widespread corporate use without a license-- but let the little people slip through the cracks. Those of us who install and forget, and never really get much use out of the program anyway, are very unlikely to buy the program in the first place.

Explaining to people how to pirate but appealing to their goodwill might go a little far, though. I would report only the serial numbers used in the registration, along with the IP address that contacts your server (not the IP address of the machine itself). The rest of the information is None Of Your Business (TM). Try to find a happy medium between accepting a couple copied serial numbers in the wild, and noticing that a large number of computers coming from similar IP addresses are using the same serial number.

Definitely do NOT disable the program if it cannot phone home. I *hated* that about Bioshock, when my crappy firewalled network made it almost impossible for me to activate the software. Since you're aiming at corporate networks, you're certain to have lots of people with this problem.

Good luck with it.

PS: What are the current laws on downloading a program and using a serial number to unlock it? We all know that EULAs have yet to be proven in court, with many cases existing that both support and reject EULAs. So is there a clear case where it's illegal to use a serial number to unlock freely given content?

Protected Environments.

[burnttoy]

Spot on - I know plenty of people who use PCs (usually laptops) in their music and/or art studios who never connect those machines to the internet... EVER! The muso types will often strip back everything on a PC leaving a bare OS + drivers + sampler/sequencer + ASIO drivers. It's all they need and they believe they get better performance and more security without it.

I also know, and have worked for, companies where information is so secret (mission critical biz stuff or military) that you have to use a provided laptop in a room with no windows that's shielded from radio wavs... paranoid, yes, but "phone home" software is simply not an option in that case. Also. no phones were allowed in that room so manual "phone home" wouldn't have been possible.

Also, some of us are so paranoid that we don't let anything in/out of our firewalls except our browser application. Mind you, I can still use the interweb and I've never been trojan/virused... except this damn cold I seem to have but I can't blame the internet for everything!

A rapping black guy

[Ash-Fox]

The only copy protection you need is something to detect you're inserting a disc/disk into the system, then have a black guy which raps with artificial intelligence to interact with the user.

Re:What's the Right Amount of Copy Protection?

[cliffski]

wow, what awesome insight. you sound like you are answering the question "what is the right price for my software?" to which the slashdot crowd will answer "Free!".
You will not get a sensible answer here on slashdot, as this post above me clearly illustrates. there are far too many people in the "stick it to the man!, lets torrent everything!, all software should be free!, information wants to be free! MAFIAAAAA! is dinner ready yet mom?" crowd on here.

Yes, copy protection will annoy a small fraction of legit customers.
Tough.
That's the price of doing business. Do security guards irritate people in shops? does having to get a security tag taken off clothes at the till slow down the sale and irritate the end user? We get sued to a small amount of hassle in return for businesses preventing casual theft in the real world, the software world should be no different. I'd like to see most of the anti-DRM people on here try to extend your theories to the meatspace world. Try leaving the right money on the counter and walking out of a store next time you go shopping, after all, that guy at the till is just an irritating bit of theft prevention in this case isn't he?

As for this lunacy that you should make it free and charge for support, that gives you zero incentive to ship a bug-free product, and makes you a wage slave again rather than a creator of new products.

Re:Give it away for free

[Anonymous Coward]

You can make tons of money on service contracts. Spoken like somebody who has never run a software development company.

The fact is most companies will not make tons of money on support. If people are not willing to pay for the software up front, they are not willing to pay for support. I will take my former employer as an example. They purchased one copy of RHEL and had a support contract in place for that one copy. They installed it on over 200 machines.

My current company charges $100 per agent and $20 per agent/year for support. We often get requests from people asking if we have a free or open source version. We have had people make comments that they would gladly pay for support if we had a free version. Based on experience, that is a lie and these people want something for nothing. We have business expenses to cover and cannot rely on support fees that may not show up.

Unrealistic expectations

[Peeteriz]

"While I don't wish to burden legitimate users, I do want to prevent most piracy."

This will not happen. Cracks for very heavy-handed measures will be available to exactly the same people in exactly the same ways as a cracks for a simple serial-number check on installation, ergo a simple serial-check will get you 99.9% effectiveness of any other software system.

The only things I have seen that seem to work are the hardware usb-dongles; the earlier ones were cracked but the new versions seem to be quite safe. (but they cause a number of other issues and don't qualify as non-intrusive).

Re:What's the Right Amount of Copy Protection?

[Rik Sweeney]

None.

Wrong, everyone has the right to protect something that they've worked hard on. What if the product you made was your only source of income and no-one bought it but everyone had a copy of it? You'd do whatever you could to protect your livelihood.

Get out of your fucking tree, cut your hair and get a job.

gentle reminders

[devonbowen]

A while back I wrote an app that was key activated. The key had two components. The first was the name of the person that it was sold to (from the credit card) and the other was a hash of that name, the version number, etc. The user needed to enter both in order for it to work. (And the two needed to match, of course.) My thinking was that using the name in plain text would make it personal and encourage the user to not give it away while still allowing them to do what they thought was reasonable (running on both a laptop and desktop, for example). Basically, a gentle reminder to help honest people stay honest. The dishonest people are just going to hack your binaries anyway.

Devon

Speaking as a very successful vendor: None.

[fyngyrz]

how can my licensing mechanism best help legitimate customers track their licenses and stay compliant within the licensing agreement

A much better question is, how can we maximize the rewards to our paying customers for providing us with the income we need to pursue our chosen path of software development?

The answers are:

• Provide them with a software key that is uniquely theirs so they have the means to protect their investment in us, not so we can attack them.
• Archive that software key so we can give it to them again if they lose it.
• Never, ever disable, restrict, or otherwise cripple a customer's product.
• Provide a means so they can legitimately share our software so as to spread the word.
• Price software reasonably; if the market is large, price low. If small, price higher.
• Be valuable: Provide strong functionality. Remain valuable: Fix it, improve it, be helpful.
• If someone wants a key and can't pay for it or wants to look before they leap, just give them one. Really. Doesn't hurt a thing. People who won't or can't pay aren't going to anyway. Better they use our stuff than our competitor's; better to make them happy than annoy them; better to see to it there's no value to an underground trade, because hacked software presents a security risk to us all.
• Last, but not least, don't burden our customers with "agreements" or "licenses." We wrote stuff, they paid for it. Done deal. Now it's up to us to add value to the product so they'll continue to boost our positions by using our support; spreading the word, the demo, the results.

You know the people who will insist on paying you when you mom their lawn, carry groceries, etc.? Those are the socialized, economically stable majority. They'll pay for good stuff as long as you price it sensibly and shovel value at them like it is going out of style (it actually seems to be in some cases, so use that instead of being part of it.) There is simply no need to go to war with everyone else - be a leg up instead of an obstacle to overcome.

I've done extremely well using this approach, as have my loyal employees. The only thing I would raise a flag about is you actually have to have something worthwhile; if you hand customers (and non-customers) bloated, cpu-hogging bugware, no amount of good will can counter the negative effects of the software itself.

That trick never works.

[porkchop_d_clown]

So, by way of example, I wrote an un-copy-protected software package and released it as "guiltware" - I asked them to click on the paypal link and make a donation to MDA through me. 5 years on, I know people are still using it because I get help requests.

But not one person ever, ever, ever clicked the link.

Re:That trick never works.

[Just Some Guy]

I've done the same sort of thing with my GPL Palm software, Contraction Timer.

Whoa, hey, back up. Contraction Timer?

Husband: Honey, can you just hold it a second longer?
Wife: STOP PLAYING WITH THAT $#!$(@)#$! PALM AND GET YOUR ASS IN THE CAR!
Husband: But I almost have it uploaded!
Wife: You have no chance to survive make your time.

Re:Not strictly true

[cliffski]

*sigh*

So if the customers want the product for free, you work for nothing?

It isn't that simple. Customers want unreasonable things. I want every pizza I ordered to be free, delivered instantly by a dozen naked supermodels. But just because my local pizza company will not provide such a service does not mean a new company will materialize to do so.

throwing out glib comments you read on some web forum does not equate to actual business experience. You cannot pay employees or bills with glib expressions, only profits earned from PAYING customers.

Wheee, my first slashdot article!

[WPIDalamar]

Thanks for all the comments everyone. I've been reading through them and have some ideas. Here's a scheme I had been considered that might address some of the concerns brought up.

1) Upon purchase, user gets a license key.
2) When installing, the software generates a random (somewhat) unique installation id
3) The license key is checked locally, with no net connection required.
3) Upon app startup, if there's an internet connection, the software phones home with the software version, the license key, and the installation ID
        The phone-home also gives a version-check to let the user know about any updates.
4) We log the license key and installation ID

Someday, we do some data analysis and find any license keys with a large number (maybe 5, maybe dozens, not sure) of installation ID's. The data analysis should look for interwoven log records of installation ID, because the user might have uninstalled it on one machine, and installed it on another. Then a person (not automated process) would get a report and be able to investigate and flag certain keys as compromised.

What happens next?

Do we cause the software to stop functioning? (I don't like that)
Do we cause the web service-portion to stop functioning? (I don't like that either)
Do we pop up a window saying, "SOFTWARE PIRACY DETECTED!! YOU ARE GOING TO JAIL IF YOU DON'T STOP!"
Do we pop up a window saying, "Hey, this might be pirated. Go to http://xxxxx/ to purchase additional copies"
Maybe the software does nothing, and we deal with it through customer support. A friendly email to the original purchase agent?

I guess the goal is make honest people stay honest. As many have pointed out, it will be impossible to prevent someone who REALLY wants to pirate the software.

Speaking as an IT Director

[weave]

Some tidbits... my personal opinions, not necessarily those of my employer.

1. When evaluating software, if all things are equal between software products being evaluated, the one with the least or no copy protection always wins out.
2. If a product requires a dongle, either on a client or server, unless my back is up against the wall from users and there's no other product to meet the need, it always gets rejected.
3. A product requiring a license server is tolerable in some cases, but see #1 and #2. There's also the issue of disconnected laptop users to address.
4. A product requiring a unique product key is a royal PITA for multiple automated deployments. This means while we might buy n number of copies and install n number of copies, each copy is going to end up with the same product key via ghost image or scripted install. Would you shut us down even though we have purchase enough copies?
5. Activation during install is OK if it can be automated during an install or first run (and if the latter, doesn't require admin or power user rights). However, be advised that machines are regularly reinstalled and software can move around as users move around. (If they move their office, their desktop probably won't go with them, they'll just get a new install at the new office and their old office will get re-installed for the new person there)
6. I can be held legally liable if I know about copyright abuses where I work. Think I'm going to put myself at personal risk if my employer is too cheap to be legit? Think again.
7. IT shops *want* to do the right thing. Don't fight us, help us. That means give us tools to help us remain compliant that are non-intrusive. Like something I can go to to see what copies are installed where and deal with non-compliance on my own. Yes, a lot of shops have tools like this already but many don't, so also make it optional. Just don't treat us as an enemy. Also remember rule #1

elicense marketing sucks

[Snibriloid]

Really, really bad marketing.

So how do i get the creepy feeling that this guy isn't entirely honest, but actually an elicense marketing stooge?

The install is painless (it installs a license control service that in many years of using I've never had any sort of issue with), and it stops a LOT of piracy.
Err, yes. I have original software too, but somehow the companies failed to send me regular, detailed newsletters about the LOTS of piracy they stopped with their particiular brand of DRM.

It IS possible to "unwrap" the executable, but of all the Elicense protected software I've used, I've only ever seen one game cracked. (Ironically it is the most obscure of the ones I own.)
Yeah, shure, I too make regular searches on the web for cracked versions of the originals i own, especially when the DRM is soooo good that i dont't want a no-cd crack.
And by the way, what are the multiple(!) games that haven't been cracked? I would really like to buy them, if only for rarity value. After all, in the whole history of mankind they are likley to be the only pieces of software ever that weren't cracked....

I am vehemently opposed to DRM, copy protection, call it what you will, but I find Elicense extremely inoffensive due to it's ease of use.
Yeah, i'm opposed to DRM but happy to install extra software on my computer that monitors me. But i am vehemently against everything else DRM-related, trust me.

DRM should not impact legitimate consumers, and this one is the only one I've come across that has never caused me any sort of negative experience.
Software where you have to enter a code ONCE is really a pain in the ass, believe me. But elicense is soooo easy to use, i have to mention it five times. Please buy our product.

DRM-Companies, i beg you, if you let your marketing division run loose on slashdot, at least stop them from taking drugs. Thanks!

Re:elicense marketing sucks

[cool_arrow]

This guy has a good BS detector.

Product activation is not appropriate for buisness

[Digital_Quartz]

If your target is buisness users, this sort of "phone-home product activation" scheme is going to cause you and your customers a lot of grief. The install might be "painless" on someone's home computer (assuming the someone isn't ethically opposed to product activation), but it won't be in a corporate environment, where your product may have to traverse a proxy server (or even an authenticating proxy server) to reach the internet.