Slashdot Mirror
Ask Slashdot: Copy Protection Advice For ~$10k Software?
An anonymous reader writes I'm part owner of a relatively small video editing software company. We're not yet profitable, and our stuff turned up on thePirateBay recently. Some of our potential paying customers are using it without paying, and some non-potential customers are using it without paying. Our copy protection isn't that tough to crack, and I'd rather see the developers working on the product than the DRM (I'm convinced any sufficiently desirable digital widget will get copied without authorization). Would it be insane to release a 'not for commercial use' copy that does some spying and reporting on you, along with a spy-free version for ~$10,000? I feel like that would reduce the incentive to crack the paid version, and legit businesses (In the US anyway but we're trying to sell everywhere) would generally pay and maybe we could identify some of the people using it to make money without paying us (and then sue the one with the biggest pockets). What would you do?"
Please do clarify as to:
1) What would the program actually collect about users?
2) What would you do with the data?
3) Would you do that without informing the users of this or not?
You see, whether or not that is even LEGAL in the first place depends on the answers of yours.
Why aren't you using one already?
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
Hardware dongle.
If your software is really worth that much, then I think it's justified.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
Well provide the paid version like you do now, and provide a stripped down version that has some really neat features that the pirates who would really want your software would use. There's no form of DRM that will stop anyone from taking it, none. Auth servers? Crackable. Dongles, about 8mins with a soldiering iron. Token keys, same deal, just longer. Rings, yep. And every bit of DRM that you use, will more than likely piss off your paying customer when it breaks the software.
Unique serials do work, especially if they're uniquely identified to who you're selling it to. Then you can at least go after them for copy infringement.
Om, nomnomnom...
No matter how much DRM you put on it it will always be removed. The best thing to do is concentrate on adding value for paying customers. Do an on-launch check against the serial number over the Internet. If no Internet is available up to X number of times then launch without it. This is similar to what DOOM 3 by id Software does. If the same serial number is showing up too often then ban it. Basically: you're a niche - put a little DRM on it, enough so that a normal user wouldn't notice it at all ideally but at the same time that just enough that it would need to be cracked for every version for illegitimate users.
Shh.
you should have posted the spyware one to thepiratebay yourselves before it got cracked. Then nobody would've bothered to crack your commercial version, assuming it is indistinguishable feature-wise.
Not for commercial use option would allow people to upskill using your product. Some of these guys may end up in the industry you sell to and in taking their skills into that industry raise your products profile. I would think that this is the easist way to become the defacto supplier of niche software. However, spying on these people might turn them away from you.
I thought all the $10K video editing programs had gone away except a couple of holdovers from yesteryear. Use a hardware dongle and piss people off like Autodesk did. Or use an online authentication scheme that will piss off other users. Hell, for $10K, fly a lackey there to install it personally.
My point is, if someone wants to crack it, they will. The high price tag makes it more attractive.
Release the software as free, open-source software. Then, use the community goodwill and appreciation to feed your family and pay rent.
Alternatively, identify the client who released the software into the wild and sue them for breach of contract.
Lastly, make your software so awesome that one of the big players can buy you out before the well runs dry.
Oh, and brace for the commenters calling shenanigans. People who pirate software don't like the thought that there may be actual, real-life negative consequences for small development houses.
If I knew the commercial free version did any sort of spying I would not trust the company what-so-ever. There is a reason I am boycotting Sony.
by Anonymous Coward: I, for one, welcome the shift from car analogies to pizza analogies. um.. overlords?
Is there potential for offering a basic product for a nominal amount, and selling modules which improve functionality to those willing to pay?
I certainly wouldn't pay the many thousands of dollars for Photoshop, but I might pay the hundred or so for the functionality I actually needed. Bolt-ons seem to make sense when appealing to many different markets.
Finally had enough. Come see us over at https://soylentnews.org/
Your flaw is to assume those "pirating" your software are "potential customers". They are not.
My karma is not a Chameleon.
How would this work for a product that's so reliable and so easy for most end users to figure out that it doesn't need a lot of support/services/consulting?
My recommendation would be to provide a not-for-commercial-use free version which is almost totally identical to the premium version. Have this version embed a digital watermark so you can identify if videos pop up commercially which haven't paid for a commercial license. Make it non-obtrusive so home users don't mind (I recommend it not being a visible logo or anything of that sort, just the digital watermark).
You're not going to be able to prevent a pirated version from cropping up except that you make the pirated version not attractive compared to the legitimate version. Those inclined to not pay for the software are not going to pay for the software. Provide it for free with the forensic ability to detect license violations. The paid version places no watermark, so you get the best quality and the legal right to use videos commercially after it's paid for.
Slay a dragon... over lunch!
Can also add in a quick reporting function, and check if the source IP is from a major studio.
Disclaimer: I am not your lawyer, this is not legal advice, but is simply for my own amusement and should not be relied upon.
Would it be insane to release a 'not for commercial use' copy that does some spying and reporting on you, along with a spy-free version for ~$10,000?
Watermarked as non-commercial use only? Hilarious if you run your water mark detector on a TV show or movie and it shows up and you start blogging about the pirates.
Another good laugh would be bait and switch the free version has 75% of the features removed at compile time. You can left align or right align all you want but if you want to center its $10K. Or you could use any font you want for $10K but for free its only possible to use... comic sans.
Another good laugh would be speed. Intentional slow down loops in the free version. While evaluating your software for possible purchase do I care if everything happens 20% slower? Heck no. But if I'm a bean counter at corporate, I'd be insane to reduce my employees productivity by 20% just to save $10K Unless said employee using the software for 2 years earned less than $25K/yr, which is probably the case outside the US...
The problem you're going to have is "free or $10K" is an absolutely insane market. It better be unimaginably amazing to be worth $10K in a world of 99 cent apps and $100 video editors. Rather than the revenue from 100 sales at 10K each, wouldn't you prefer a million app store sales at $20 each?
Would I download your software for free at home if its legal? Maybe. Why not a license of pure profit where any CC released work is a $10 software license with no support. The cost to you is minimal and you get "free" revenue. Or a license where its gotta be CC licensed work with a link to your company in the comments or credits screen or something, basically they pay you, to market for you. Or "please support us by purchasing an anonymous coward XXL tee shirt along with a software license for CC released works for only $50" Or the software is free for CC editing work, but the fine manual in printed and pdf form is only available for $50 along with a formal written license for CC-released work.
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
after 10 min just pop up a random passage from the user manual and make the user find the correct page. the longer the manual, the more effective this is. alternatively, devise a strange set of symbols and provide the user with a high tech spinning paper wheel so they can "decode". this isn't rocket science here ; )
Use FlexLM (license server tied to a hardware address - defeatable, but annoying) like the the majority of other vendors. Also, try to remember that you're company is in it's infancy. The more publicity and use your product gets the better. Better to lock it down after more people use it than before.
And why would I allow a system housing my valuable, corporate pre-production video data, direct access to the internet?
Paying taxes to buy civilization is like paying a hooker to buy love.
Doing some of the processing server-side might work for some applications but not for video editing because of the immense amounts of data that would need to be uploaded.
Thats assuming you'd need to upload/download the whole works.
It would be hilarious if the app had no concept of how to create a simple .avi header each time it saved to a new file (made up example). You can't just NOP around that, and its not much bandwidth and its probably too much of a PITA for the crackers to write their own.
The only thing funnier is the support calls when your https avi header webserver is down, or when the paying $10K customer is having a momentary internet outage or firewall issue. ha ha funny.
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
Well, you certainly won't find a shortage of opinions on Slashdot. :-)
If you think the software is good enough, then a non-commercial version with limited registration information (e-mail, name), and some very privacy-thoughtful reporting (maybe to ensure that the registered serial numbers are only being used by one machine at a time), should only be a good thing. Getting your software into the hands of the people that might buy it will get them used to it, relying on it, and eventually make them customers. But (as others here have posted), don't abuse the "spying"... if you start to make money by pilfering the free registrations for ancillary information you're just going to annoy your users and they'll be more apt to pirate the software or use fake registration information. Giving them something in return, like forum access for very limited support, is helpful.
Other possible models include giving the software for free and asking payment for support -- nearly all profitable Open Source companies do this, and even if you leave the source closed the business model isn't terribly different. You could publish a "crippleware" version, which I find rather annoying, unless the limits are such that the home and non-commercial users needs are really satisfied, and the only people that need to pay $10k for the software are those to whom it's worth it. I give a nice shout out to Andrea Mosaic for doing this correctly (at a lower price point).
Lastly an option you may have missed may be to ignore it because it isn't a problem. A pirated version by a customer that wouldn't have paid anyway probably doesn't hurt you. A pirated version by a customer that would have paid may actually turn into a sale if they need assistance. When you upgrade, if the pirates liked it, they'll want the next version, so they may buy. It may be pirated by employees or students who years later may remember it and decide to buy it. You never can tell.
In those cases, you're getting your software out there and used; you could take an "all exposure is good exposure" attitude. The fact that you didn't list the name of your software in the original post here means that you may not think that way, or you may outright disagree.
Still, piracy is going to happen. At least you're asking the right questions. Don't let yourself get dragged into a fight with the anonymous masses on the internet, though -- you'll probably lose.
WTF does it do?
Apple has Final Cut for the prosumer and wannabe pro
Avid is the pro software market
people like me use imovie or adobe something which is like $100 and includes the adobe version of iphoto whatever the name is
video editing software is a mature market. unless you are making some cool plug in or your software does something really cool that the big boys don't do you are screwed
$10,000 is a lot. Maybe make real but effectively no-op customizations to each legit copy so each is unique, including a banner that says whose copy it is. If it later shows up stolen you know whom to sue. Add some phone-home statistics and you know how much to sue them for. Do a little runtime checking on the visible ID banner to make hard to remove.
You obviously don't have much experience with software at the business level. The $10k usually includes support, upgrades, etc. It's not like they're charging $10,000 for a basic word processor.
The only DRM you need is: Make sure that your users have a valid serial number before you start providing support for the product.
You're trying to compete with 'free'. The solution is to make the version you're selling for $10,000 worth that much. Add more features, innovate, and provide support to the users who have paid you.
Also, most of the people yanking your software off of the Pirate Bay are not your customers now - they either can't afford it, or they're not even sure if your software will meet your needs. In the future, they might have that same need AND the money to pay you, and at that point they'll know your name.
This is something that I have never dealt with directly, but I saw a similar post on StackOverflow a few months ago and bookmarked it because it seemed useful.
The answer it seems is something called "Partial Key Verification": http://stackoverflow.com/questions/3550556/ive-found-my-software-as-cracked-download-on-internet-what-to-do
In short, the software would still work, but re-direct people to a page letting them know that they've been "caught" pirating software and that they should really purchase it. This won't stop everyone, but some people (especially in a business environment) won't risk "being caught", so they will purchase the software knowing that you know that they know they are pirating your software.
Is what the software does worth $10K? If it really is, then you'd be far better off hiring some in house editors and offering your services using your magic proprietary undistributed tools. After all, you'd be able to undercut all your competition by at least $10K/yr equivalent.
Its has to be worth more than that, like $25K/yr, otherwise your purchasing clients would not waste the time and money learning new software, they'd just throw more bodies/billable hours at the task and not have to deal with you. They're planning to save $25K using your software of which they're giving you $10K to keep it legal. Why not keep the whole $25K for yourself?
Its one of those put your money where your mouth is moments... if its really worth the dough, you'd make more money reselling video editing services than you'd make selling the tools to edit video.
My guess is, you're about to discover the appropriate price would be maybe $100 not $10K.
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
What makes it worth 10k? How about developing software that takes a team of 5 people 3-7 years to write, for a target market of 200-500?
You and 4 of your buddies may be willing to work for the next 7 years for a possible income of (500*100 = 50,000), and you can split it between yourselves. Sounds fair. What number can I call you to schedule when you can start?
I have a Reprap 3d printer. The software that seems to work the nicest for designing parts is Solidworks. But they only sell it in two ways: for business for about $4000 and for verified university students for $150 a year. I'm neither. They don't make an option for hobbyits. Which leaves me with the Pirate Bay option. That kind of sucks because I wish there was a way a hobbiest could use this software without stealing it.
So that's something to consider. Who's stealing it? If it's businesses then yeah you have a problem. If it's hobbyists then maybe it's because you don't have a deal for them.
Specialized software can be very expensive especially when there is no alternative around. I've seen this happen many times with businesses looking for some special iventory database, or software to run specialized equipment. The problem is that other software companies catch on to these specialized programs and start selling similar software for a much lower cost. It's like tapping into a new idea, charging a crazy amount for it until someone else jumps on, and the price falls down from $10,000 to $100.
-- By all means let's be open-minded, but not so open-minded that our brains drop out.
When your software is THAT expensive, then you can afford to compile each instance for each customer. By recompiling for each customer, you can make each release version they have unique to them so you know where the leaked copy came from. Secondly, you can also arrange and require a "license server" on the network where it will be run. This enables a machine to run without internet access but will need access to a licensing server. You can figure out the details to make it usable but the idea is that it won't run without licensing information available at any or even all times.
And since you are compiling each copy for each customer's site, "cracks" will be a bit harder to maintain, but in order to accomplish this feat, you would have to take some pages from virus writers' playbooks.
In the end, everything I have spelled out is defeatable. EVERYTHING. In the end, software is a series of instructions that the computer runs. It's not a magic box.
And this interpretation of "potential customers just getting it for free" is nonsense. If they use it professionally, they will pay. There will be incidents where some professionals will not want to pay. You will either have to live with it or spend a lot of money on investigators and lawyers. Is that really where you want your existing profits to go?
And are you SURE you're not charging too much in the first place?
You are living on some cloud nine. We have seats of parametric 3D cad software: about $4500 per seat, with a discount, too. Yearly maintenance is $1500 or so per seat. It works out because there's no one else who provides it any cheaper than that, and the file formats are completely proprietary and their binary structure is intentionally obfuscated. We attempted to move to a different system, by writing scripts for the source software to export all the data to a human-readable text file, and then writing other scripts for the target software to read it in. It turned out that the underlying representation of data in both pieces of software differed enough that we'd need to license a not-cheap 3D geometry engine just to massage the data. Overall cost of migration looked like it'd pay itself back in the per-seat difference savings over ~15 years. IOW: they know exactly what they are doing with their pricing. You'd need a 100 seats to have payback in a reasonable amount of time (3 years), and then you're still betting on other things (lack of new killer features on the more expensive end, etc).
A successful API design takes a mixture of software design and pedagogy.
10k is pretty cheap for a lot of specialised software. The support you get tends to involve having an engineer actually solve your problem.
Whether it's cheap for video editing software depends on what useful features it has, and whether that can save several days' work over the course of a year
Ok, I hate being pesimistic, but we need to face the facts. Money spent on DRM is wasted money. However, there are some ways others have spoken about that have some merit, but also problems. One such is the aways-online network model and also hardware dongles. Networks go down and standard dongles are easy to hack around. So, what to do?
The always-online model has the strong point that a portion of the processing can be off loaded so the central server, and user's software itself has code missing that can not be simply hacked around like in the dongle. The dongle can have some unique embedded features which can be tested for but is generally easy to hack around since its easy to bypass code. What about a mix of the two? What about a custome dongle that actually adds processing power to the software and the software is then sold as a "system".
If the dongle/board/unit has real functionality (e.g. FPGA accellerator board) the software without it is useless, and if the device is non-trivial it would be very hard to duplicate by the average hacker, and they couln'd just post the results of that hacked code online. You need both. It would be too costly to develop the replacement hardware for fun and impossible to sell it without being noticed. It would not be like a "standard" dongle that one can hack by putting in noop's and nonconditional jumps to deactivate it, as it actually does things the software side needs. A pirate would have to be *very* comitted, and with much more money and resources than the cost of one simple licensed unit to even think about trying to replicate it. As long as the coprocessor dongle unit adds functionality in the form of function or performance it may be acceptable to users, but not unless it actually gives them something for their money. So, can you product be decompoed into two peices where a portion is hardware accellerated?
The best way I've found to do this is to have a non-obvious component actually doing the licensing evaluation (periodically as part of some normal functional operation) and if that fails to subtly screw up the operation of the software. You still want to have standard 'relatively easy to tear out' protection so that legitimate users get notifications of a bad configuration or license, but what you're trying to do is make the software useless for people pushing it on a torrent/warez site.
Yes. AutoCAD did that, back in the DOS era. There were several levels of protection. The first level checksummed the program during loading to detect a corrupted executable. That prevented any accidental error from triggering the deeper checks. Anyone attacking the software would first have to bypass the checksum code. Further down were many other checks for changes to the protection code. These checks were executed randomly, based on the state of the program, at varying levels of odds. Some were executed every few minutes; some as infrequently as once a year on average. Some of them just made the program exit without saving. Some made subtle changes in the drawing data.
This destroyed the market for cracked versions of AutoCAD. No one trying to crack the software could ever be sure they'd found all the checks. There were dealers selling cracked versions as if they were real ones. Those guys had some very angry customers.
This was effective enough that it stopped piracy in Hong Kong and the USSR. The USSR eventually cut a deal with Autodesk for a bulk buy on a Cyrillic version.
(Note: Developer, small dev shop, higher-priced software, same situation.)
If you distribute an "unlimited" version, this will be what is pirated; there's no value in having different versions. Also, if you have a key which allows "unlimited" access without secondary verification, this is what will be distributed on pirate sites.
In our experience, it took about a week from changing the key format to a new crack key being distributed. Obviously, this is for software which is "in-demand", but don't expect that implementing a new scheme with the same underlying characteristics will buy you much time.
For "good" protection, you basically need secondary verification which is "hard" to fake. Currently, that is hardware dongles or an online verification loop. Both of these can be pains for the users, costly for you, and/or prohibitive in some environments (online, in particular, doesn't play nice with classified government envs).
Keep in mind also: most people who pirate are not potential customers, at least at anything close to full price, but their experience using the tool may turn into a sale at a company later.
My suggestion: do what you can to track usage, but don't be overly obtrusive and/or try to prevent all piracy usage. Being able to watch and track, and act when appropriate, is much better than trying to prevent all piracy.
Some software just costs that much. Hell, a lot of software used by businesses cost much more.
When a company needs a certain functionality that just plain doesn't exist anywhere else, it has to be paid for somehow. I'm not sure you have a good understanding of how much time is actually put into developing software--an engineer who gets paid $80k/year costs the company about $160k/year. If that engineer works on a problem for 3 lousy weeks, that software cost $10,000. Just to develop. That's $0.00 profit for the company.
Some special functionality is very easy. Huge changes from a user perspective can be made in minutes with just a couple lines of code. On the other hand, stuff that seems like it should take no time at all can require an entire re-architecture of a project and take years. Now, your first instinct if you're not a software developer, or a new one, will be to say "if it was made right it wouldn't require re-architecture", but that's just not true in a lot of cases. The only absolutely flexible architecture is an unwritten program, every line of code is a constraint.
Microsoft Office costs so little because it's used by millions of people, but if only 25 developers worked on it (a lot more did) for only 5 years (it's been around for twice that long, and Microsoft doesn't like to throw out code), and they had no managers (they had lots), no testers (there were lots), and no corporate scaffolding (more than you can probably imagine), there are more than a hundred years of human effort in that piece of software. When you look at it, does it look like the culmination of hundreds of years of effort? Not intuitively, not even to me, and I have a very good idea of how hard it was. Specialized software costs a lot. It might sound silly to you, but that's just because you are--don't take this the wrong way I'm not trying to be insulting, it's just the word that best fits--ignorant of the actual costs.
<xml><I><am><so><damn>Web 2.0</damn></so></am></I></xml>
My experience as both a user and a developer is that hardware dongles suck major donkey butt.
They are excellent at preventing customers and pirates alike from using your software.
The drivers for every brand we tried was buggy, and often had conflicts - *especially* when installed on the same machine as a different version of the same brand dongle from someone else's software.
It was a support nightmare, because it can easily turn into a problem that *you* can't fix - only the manufacturer of the dongle and the other software you from who knows where can.
You can also very quickly require a separate USB hub just for all of your dongles.
At $10,000 for a license, the software you sell is not a consumer product. That's not to say that a consumer may not want to use it, but that you've already discounted them as a customer. You should simply not trouble yourself with thwarting them because they would never be able to pay for it. They aren't your clients and by familiarizing themselves with your product, they may well turn their employer or future employers into clients. Some companies even embrace the idea by offering unsupported no-cost versions for non-commercial use.
Once you've decided that your customer base will only be professional / commercial customers, then the license is the important part. A commercial customer stands to loose A LOT if they are caught using unlicensed software. For them, they should consider the software part of their cost of doing business. If your product is too pricey, they should select another, otherwise, they need to purchase it and expense it. If you catch a customer using unlicensed copies, contact them and give them an opportunity to true up (after all, sometimes companies simply loose track of how many licenses they purchased - crappy license management is rampant). If a company still continues to use unlicensed versions of the software, then have a lawyer draft a demand for payment (and consider terminating their licenses; mind you, you'll loose them as a customer). When all else fails, file an infringement claim against them.
There's simply no DRM scheme that's 100% effective, and it only needs to be cracked once for it to become widely available. DRM schemes cost vendors like you lots of money to implement, and they are invariably a nuisance to the customers that legitimately license your software. Ultimately, DRM makes the pirated copies more valuable -- they are more portable between systems as they are upgraded, there are no dongles, issues with license key management, etc. It would be hard to make the case that DRM is likely to pay for itself.
Instead of pirating Matlab you should take a look at Octave. It's fairly similar to Matlab and heavy duty enough for regular work, not just the home projects you mention pirating Matlab for.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.