Ask Slashdot: Copy Protection Advice For ~$10k Software?

An anonymous reader writes I'm part owner of a relatively small video editing software company. We're not yet profitable, and our stuff turned up on thePirateBay recently. Some of our potential paying customers are using it without paying, and some non-potential customers are using it without paying. Our copy protection isn't that tough to crack, and I'd rather see the developers working on the product than the DRM (I'm convinced any sufficiently desirable digital widget will get copied without authorization). Would it be insane to release a 'not for commercial use' copy that does some spying and reporting on you, along with a spy-free version for ~$10,000? I feel like that would reduce the incentive to crack the paid version, and legit businesses (In the US anyway but we're trying to sell everywhere) would generally pay and maybe we could identify some of the people using it to make money without paying us (and then sue the one with the biggest pockets). What would you do?"

Comments

"does some spying and reporting on you"

[Gaygirlie]

Please do clarify as to:

1) What would the program actually collect about users?
2) What would you do with the data?
3) Would you do that without informing the users of this or not?

You see, whether or not that is even LEGAL in the first place depends on the answers of yours.

Re:"does some spying and reporting on you"

[hellkyng]

To the already great questions above, I would also add:

How will you feel when your product is flagged by Anti-Virus companies as malicious, and what will the impact be to your reputation?

Re:"does some spying and reporting on you"

[Anonymous Coward]

I have downloaded software in the past and many times I didn't think it was worth full asking price but really wished I could give them some money for it. Unfortunately there's no way to do that right now, it's full price or nothing, and it's even worse when the item is no longer sold because you can't even pay full price for it, you're forced to download

Have you tried? I've purchased several application from small-business vendors at a discount simply by sending an email saying "I like your product, but it's value to me is $X instead of your price at $Y. Would you be willing to sell me a copy at $X?" You'd be surprised, it works. I think some companies recognize that a sale made at a discount is better than a sale lost entirely.

Re:"does some spying and reporting on you"

[Moryath]

I have another question to the anonymous devloper: Have you considered NOT being an asshole about it?

Yes, your software turned up on TPB. So has software from Microsoft, and from Adobe, and from Bethesda, and from... well pretty much every software company on the fucking planet. So your first job is to get over yourself and realize that all that has to happen is for someone to crack or strip out your copy protection once, and that's that, the DRM is meaningless and a wasted cost to you.

Now, have you considered building up brand loyalty instead? Reward your paying customers with support, treat them well, maybe give them access to beta or updates if they want. Focus on making your software the best you can, and making your customers feel like their investment in your software is worth it.

Now let's look at your NEXT proposal: Would it be insane to release a 'not for commercial use' copy that does some spying and reporting on you, along with a spy-free version for ~$10,000? I feel like that would reduce the incentive to crack the paid version - Yes, it would be insane. Anyone who doesn't want to be spied on is going to block the damn thing via firewall, or they'll crack the unpaid version and route all its traffic to 127.0.0.1 or dev/null.

Or this: Some of our potential paying customers are using it without paying - face it, if they're not paying now, you are either charging too much or they'll be just as happy with freely available alternatives that either cost less or are completely free-to-them.

, and some non-potential customers are using it without paying. - If they're not a potential customer, why do you give a rat's ass? Again, they'll just go to some other source or use some other free (to them, whether actually free or not) program.

Chances are, 90% of the software's functions that these people are using are duplicated already by Virtualdub (Free/Opensource) and Windows Live Movie Maker (Not open source but free to anyone with Windows). If you want to make sales, try not being an asshole, price your program appropriately, and treat your customers as customers with whom you want to build loyalty.

Oh, and by the way: a legit copy of Adobe Premiere Elements 10, which probably does everything your software does and then some, is available for somewhere between $70 and $130 online right now. $10,000 for your suite? No fucking way it's even close to that cost.

Re:"does some spying and reporting on you"

[mhajicek]

I'd say you should have two versions of the software, like many high end developers do. One should be the "professional" full blown thing, and with the purchase price would come support, patches, and updates for a specified period, or indefinitely with maintenance. The other should be a stripped down "home" version which is either free or cheap. Don't put spyware in your software, it just sucks and makes people hate you.

Re:"does some spying and reporting on you"

[demonlapin]

Now you have 100 people to support, instead of one. Depending on his cost structure, that might be a losing proposition.

Re:"does some spying and reporting on you"

[Anonymous Coward]

I'd add another one here: Don't DRM, join the BSA, and if you have evidence that one of your potential customers is pirating your software, send the BSA to audit them. (fake an employee leak if you have to.) Odds are if they're pirating your software they're pirating someone else's and as terrible as it sounds, they'd be getting what they deserve.

While I have fewer problems with pirating at a personal level, pirating for-profit tools deserves no pity, especially if they're not hurting for cash.

Re:"does some spying and reporting on you"

[0111 1110]

Have you ever done any video editing? You do realize that video editing is resource intensive? If you tried to run the software from a remote server it would be an absolute performance nightmare. You'd be famous for creating the slowest video editing software known to man.

I agree, however, that remote execution is the only way to prevent your software from getting cracked. Essentially the program never leaves the company servers. Crackers can't crack what they don't have. Another "solution" is to release software that is so bad or that does something so useless that no one will bother to crack it. Or there is always security through obscurity. Don't tell anyone about the software. Keep it a secret. If people don't know about the existence of the software they can't crack it.

Re:"does some spying and reporting on you"

[crath]

This will be the least popular (in /. terms) answer to your question; but, it's actually the best one for your business as it avoids adding DRM (or a dongle) to your software but gives you a lever to enforce compliance.

Step 1: Join the BSA.
Step 2: When you detect illegal use of your software, report those firms to the BSA so that the BSA can perform an audit.

I would recommend that you ignore individual users who wouldn't normally be your customers; as, the BSA isn't going to audit them and for those users you are probably not financially out of pocket. That said, if you find that there are lots of individual rogue users, maybe that is indicating demand for a "lite" version of your application that costs 1/10th the full version and is accessible to non-commercial individuals.

Re:"does some spying and reporting on you"

[StikyPad]

Here on Earth, people will steal whatever they can get their hands on

People, somewhat, businesses, generally no. The question of whether to spend $10k on a license or to defend a possible lawsuit in the future with lawyer fees, damages, and the license they should have bought in the first place isn't even a question for most businesses. All it takes is one (ex-)employee with a grudge. Sure, there are exceptions -- companies run by idiots who are penny wise and pound foolish -- but they tend not to last very long anyway.

And $10k isn't an outrageous price for commercially used software at all. Our software is very uncomplicated and starts at about $3k, and we sell tens to hundreds of programs to individual companies. Why? Because it costs a lot more than that for someone to hire a competent developer with the technical knowledge necessary to write the software themselves. Even if they hire a developer on contract, they need someone to support it, and support can get expensive when you're not pooling your resources with other clients and getting "free" updates and bug fixes (built in to the cost of the software, really).

What the original poster *should* do is accept that the people who aren't paying for the software are almost certainly people who never would or could, but that these people are still providing a service, because they'll eventually take their knowledge and (if it's worth pirating over, say, Sony Vegas or Adobe Whatever) love of your software to their job where they will extol its virtues, and where sales will potentially be made. The question would actually be much more difficult to answer if he were writing consumer oriented software, but he's not, so the answer is simple: ignore the piracy unless and until it's brought to his attention that a business is using it without a license, and then decide how to handle that separately. Running video editing software in a browser is particularly stupid given the bandwidth requirements, unless you're suggesting that the processing be done locally, which is also stupid because then you're creating unnecessary overhead versus a native app AND it can still be copied. There's nothing magical about running code locally just because it's running inside of a browser.

Re:"does some spying and reporting on you"

[bzipitidoo]

You're the ones who are lost in space. As has been repeated many, many times: copying is not stealing. Maybe it's illegal, but if so, it's a different crime, just like vandalism is a different crime. As long as so many of you have difficulty with this basic fact, we can't move on. You refuse to see copying in any other light.

Copying is good! We all benefit from easy copying. But some of you have bought into the dream that you might create something of value yourself, and think you need copyright to protect your valuable work from exploitation. You're so afraid you might miss out on some profit you deserve, you'd strangle all creativity and ignore huge, huge savings just to prevent that possibility. Many also significantly overvalue their work, and feel that those who disagree with their valuation are just robbers, trying to lowball them. You think no one would pay if they didn't have to, that strong protections, harsh laws, and force is the only way to make it work, and that force can make it work. Yet no force can make it work. The current copyright system functions somewhat because there are lots of people who could pirate but choose not to. In other words, they didn't have to pay, but they did. They were not forced. There is another way, and it's called patronage. But you can't believe patronage could work. You believe in copyright, despite the many ways in which it is broken, but you won't give patronage a chance. You think if only we got serious and really clamped down on piracy with even harsher laws, more invasive surveillance, and harder locks, we could make copyright work. Except that can't be done. Even if all that could be put in place, it still would not stop piracy. The cloud is not a silver bullet that can fix all these problems either. There isn't anything that can. We'll all have to continue suffering with this costly, dysfunctional system.

Here on Earth, we obey the laws of nature. You cannot reasonably regulate copying. Copy protection simply does not work. Only has to be cracked once, and protection is always cracked. Software producers have been trying copy protection schemes for more than 30 years, and not one has remained uncracked, not even for long enough to wring all the value out of initial sales.

Re:"does some spying and reporting on you"

[aix tom]

Of course, there would also be the option to sell the software with "Online User Community Support" for $100, and with "Work hour e-mail support" for $1000 and with "premium 24/365 phone support" for $10,000.

If the act of copying the software one more time is cheap, but support expensive, then charge for what really is expensive.

Re:"does some spying and reporting on you"

[aix tom]

EXACTLY this. I'll probably get stoned for this, but the one Software I *rally* like license-wise is the Oracle Database.

Download everything you like, use everything you like for prototyping and self education, no DRM at all, but God help you legal-wise if you are found to use it in production unlicensed somewhere. Either you will get sued into oblivion, or you will get hung out to dry if there is some problem someday and you can't get support when your business data is in jeopardy.

The *legal* copy protection is the only model out there where the customer has less problems than the pirate. With any *technical* DRM the customer has more problems than the pirate.

Two words:

[kheldan]

Hardware dongle.
If your software is really worth that much, then I think it's justified.

Re:Two words:

[vinehair]

And if you use it, USE IT PROPERLY, bake in the encryption into your software so it becomes fiendishly difficult to crack (it will never be impossible.)

Guilt-ware doesn't work (WinZip, mIRC, anyone?) and I would ask a lawyer before attempting any kind of data collection.

Re:Two words:

[MisterMidi]

How about moving the code to save your work to the dongle? Encrypted, of course. People will be able to toy around, but to actually do something useful they'd need the dongle. You could even give away the software for free and sell the dongle. It will work as long as the encryption doesn't get cracked.

Re:Two words:

[fermion]

I use Autodesk software. I note that it does not use a dongle. I see other software does use a dongle, and see that there are issues with OS updates. I am not sure how widespread the problem is but my preference as a consumer is not to be inconvenienced by the software I pay for.

A model I can live with is one in which a big watermark is placed over all print, and a pop up is presented occasionally to make the user aware that the copy is not licensed and how to get a license.

Years ago, before the internet was used for verification, I used software in which each copy appeared to be personalized. The company details could not be changed by the end user. Therefore the software could be loaded onto any machine, but it was not practical for another firm to use the software because all prints and interactions wold list the original firms information.

Just some ideas that might not cause the user to hate the software while still providing some incentive to pay for a product that presumable generates profit for a firm.

Re:Two words:

[Anonymous Coward]

And if you use it, USE IT PROPERLY, bake in the encryption into your software so it becomes fiendishly difficult to crack (it will never be impossible.)

You must be new to the internets. The crack will be up on pirate bay (etc etc) by the end of the week. Why waste the time and money on something guaranteed not to work?

Ah HA! What if they go with a hardware dongle and they ship said dongles using a method that takes longer than a week to get there?

Ha! See that? You little internet punks think you're soooooo clever, don't you?

Re:Two words:

[CompMD]

I agree. At $OLD_DAYJOB, we sold software for about the same price per perpetual floating license. Early versions of our software used password protection which was easily circumvented, then a software key based system (quickly cracked) and you could find those versions of our software all over TPB. After a major overhaul to the software, we incorporated WIBU key dongles and peppered our code with various kinds of dongle interactions. There were literally thousands of license checks. There was also encrypted data stored in the key itself that instructed the program how to run. In three years of working there, I never ran across a single instance of our new software being successfully cracked. We were very happy with this, especially considering we sold the full version (at huge discount) to students, and had several commercial and academic customers in China.

The only problems I ever had with piracy of our software included a guy who had the old version who came onto our forums asking for help, apparently not realizing we knew who every one of our customers were. We also had some students at a Canadian university install pirated software on lab computers. The installations phoned home to say "I've been installed!" (there was nothing nefarious, it was designed to do this as part of the registration process) and we noticed that the school wasn't licensed for that version. Their IT department was very helpful in tracking down those responsible.

Good luck.

Simple

[Mashiki]

Well provide the paid version like you do now, and provide a stripped down version that has some really neat features that the pirates who would really want your software would use. There's no form of DRM that will stop anyone from taking it, none. Auth servers? Crackable. Dongles, about 8mins with a soldiering iron. Token keys, same deal, just longer. Rings, yep. And every bit of DRM that you use, will more than likely piss off your paying customer when it breaks the software.

Unique serials do work, especially if they're uniquely identified to who you're selling it to. Then you can at least go after them for copy infringement.

Don't waste money.

[headkase]

No matter how much DRM you put on it it will always be removed. The best thing to do is concentrate on adding value for paying customers. Do an on-launch check against the serial number over the Internet. If no Internet is available up to X number of times then launch without it. This is similar to what DOOM 3 by id Software does. If the same serial number is showing up too often then ban it. Basically: you're a niche - put a little DRM on it, enough so that a normal user wouldn't notice it at all ideally but at the same time that just enough that it would need to be cracked for every version for illegitimate users.

Re:Don't waste money.

[samjam]

NO! I've paid for software that does these stupid online serial number checks; and I wish I'd pirated the software instead.

Big fail there, to make a paying customer WISH he had a pirated version.

Too late

[Zerth]

you should have posted the spyware one to thepiratebay yourselves before it got cracked. Then nobody would've bothered to crack your commercial version, assuming it is indistinguishable feature-wise.

non-commercial commercial

[symes]

Not for commercial use option would allow people to upskill using your product. Some of these guys may end up in the industry you sell to and in taking their skills into that industry raise your products profile. I would think that this is the easist way to become the defacto supplier of niche software. However, spying on these people might turn them away from you.

Re:non-commercial commercial

[0100010001010011]

Some of our potential paying customers are using it without paying

Exactly, how can you prove that potential paying customers are using it? I work at a rather large company and stuff is locked down. You're not going to be installing pirated versions of anything.

One example is Matlab. I pirate Matlab, I don't feel bad about it. I use it for random home projects (Especially since Simulink works with Arduino). I'm not a potential paying customer. I'd never be able to afford a seat. But I can put that on my resume and sell myself to a company. My COMPANY then buys it. That is your customer. I've even talked the powers that be to buy some additional licenses to toolkits that I taught myself to use on the pirated version. I know they have a 30 day trial but you never know when you're going to need that toolbox to experiment with.

Non-Commercial Free Version

[nahdude812]

My recommendation would be to provide a not-for-commercial-use free version which is almost totally identical to the premium version. Have this version embed a digital watermark so you can identify if videos pop up commercially which haven't paid for a commercial license. Make it non-obtrusive so home users don't mind (I recommend it not being a visible logo or anything of that sort, just the digital watermark).

You're not going to be able to prevent a pirated version from cropping up except that you make the pirated version not attractive compared to the legitimate version. Those inclined to not pay for the software are not going to pay for the software. Provide it for free with the forensic ability to detect license violations. The paid version places no watermark, so you get the best quality and the legal right to use videos commercially after it's paid for.

Watermark the files...

[Theaetetus]

... and include in the license agreement that the user agrees to pay royalties of X% on gross revenues for work involving the files, but with the stipulation that you won't go after users earning less than $Y. Then offer an ability to purchase a royalty-free license for your $10k price. Big commercial users would want the royalty free license, small commercial users would want the percentage license, and non-commercial or educational users could use the program freely. Then, just watch for the watermark in videos of commercial entities that haven't paid.

Can also add in a quick reporting function, and check if the source IP is from a major studio.

Disclaimer: I am not your lawyer, this is not legal advice, but is simply for my own amusement and should not be relied upon.

solved years ago...

[yodleboy]

after 10 min just pop up a random passage from the user manual and make the user find the correct page. the longer the manual, the more effective this is. alternatively, devise a strange set of symbols and provide the user with a high tech spinning paper wheel so they can "decode". this isn't rocket science here ; )

Re:dongle

[HBI]

So just write the software so that it operates in "free user" mode until it finds a dongle. That would get him out of the business of maintaining two versions of the software and destroy most of the desire to crack the software. Besides which, if the dongle calls are interspersed across multiple libraries, it'll be too much of a pain in the butt to remove them all every time he updates the software.

For extra points, build in the ability to remote disable the code based upon particular dongle numbers, have the software phone home with its particular dongle id, and when you see a remotely multiplying dongle spread across the world, just disable that dongle number and reissue a replacement to the legitimate owner.

If you're going to run a software business you need to run it like a business. This isn't hardcore antipiracy. He's just making it easy for casual pirates to play with the software without broaching the reason why people will pay $10k for it.

Re:Serial number that calls home

[ArsonSmith]

And why would I allow a system housing my valuable, corporate pre-production video data, direct access to the internet?

Re:To the cloud!

[vlm]

Doing some of the processing server-side might work for some applications but not for video editing because of the immense amounts of data that would need to be uploaded.

Thats assuming you'd need to upload/download the whole works.

It would be hilarious if the app had no concept of how to create a simple .avi header each time it saved to a new file (made up example). You can't just NOP around that, and its not much bandwidth and its probably too much of a PITA for the crackers to write their own.

The only thing funnier is the support calls when your https avi header webserver is down, or when the paying $10K customer is having a momentary internet outage or firewall issue. ha ha funny.

You've come to the right place

[ZahrGnosis]

Well, you certainly won't find a shortage of opinions on Slashdot. :-)

If you think the software is good enough, then a non-commercial version with limited registration information (e-mail, name), and some very privacy-thoughtful reporting (maybe to ensure that the registered serial numbers are only being used by one machine at a time), should only be a good thing. Getting your software into the hands of the people that might buy it will get them used to it, relying on it, and eventually make them customers. But (as others here have posted), don't abuse the "spying"... if you start to make money by pilfering the free registrations for ancillary information you're just going to annoy your users and they'll be more apt to pirate the software or use fake registration information. Giving them something in return, like forum access for very limited support, is helpful.

Other possible models include giving the software for free and asking payment for support -- nearly all profitable Open Source companies do this, and even if you leave the source closed the business model isn't terribly different. You could publish a "crippleware" version, which I find rather annoying, unless the limits are such that the home and non-commercial users needs are really satisfied, and the only people that need to pay $10k for the software are those to whom it's worth it. I give a nice shout out to Andrea Mosaic for doing this correctly (at a lower price point).

Lastly an option you may have missed may be to ignore it because it isn't a problem. A pirated version by a customer that wouldn't have paid anyway probably doesn't hurt you. A pirated version by a customer that would have paid may actually turn into a sale if they need assistance. When you upgrade, if the pirates liked it, they'll want the next version, so they may buy. It may be pirated by employees or students who years later may remember it and decide to buy it. You never can tell.

In those cases, you're getting your software out there and used; you could take an "all exposure is good exposure" attitude. The fact that you didn't list the name of your software in the original post here means that you may not think that way, or you may outright disagree.

Still, piracy is going to happen. At least you're asking the right questions. Don't let yourself get dragged into a fight with the anonymous masses on the internet, though -- you'll probably lose.

Re:What is your software called

[SJHillman]

You obviously don't have much experience with software at the business level. The $10k usually includes support, upgrades, etc. It's not like they're charging $10,000 for a basic word processor.

Re:dongle

[Short Circuit]

No better than DRM. As far as I know, it all comes down to one of two types of setups:

1. "Is this authorized? Then do stuff" However the sophisticated the rest of the setup, all a cracker needs to do is identify this if conditional and patch it. In this type of system, the rest is just obfuscation of where that clause is, and how it works.
2. "Decrypt necessary code or data, then execute." At some point, the encrypted material will be in the clear, at which point it can be snagged. Binary gets patched to use the snagged, unencrypted form rather than need to use the encrypted form.

Now, I'm not an expert; I just develop software. I haven't tried to crack others' protection.

Re:Do as you like

[L4t3r4lu5]

Your flaw is to assume those "pirating" your software are "potential customers". They are not.

That's an incomplete assumption. Some of those who "pirate" the software are potential customers who won't pay $10,000 for the full product in order to use the two or three tools they actually want. These would maybe pay $50 for a basic version (home user), $200 for extended (mom and pop video editing, semi pro) etc. They may also be interested in paying only for certain features as modules instead of certain package types.

Making paying customers out of pirates is about offering a better service. If I can pay for what I want and have it conveniently offered to me, I more than likely will. I won't, however, pay $X,000 for a funky filter effect as (was?) is the way with Photoshop. Then again, Adobe have already said that those using unlicensed copies of Photoshop just lead to companies using PS as the standard because everyone was familiar with it. Guess that could work too.

Who's stealing it exactly?

[DRMShill]

I have a Reprap 3d printer. The software that seems to work the nicest for designing parts is Solidworks. But they only sell it in two ways: for business for about $4000 and for verified university students for $150 a year. I'm neither. They don't make an option for hobbyits. Which leaves me with the Pirate Bay option. That kind of sucks because I wish there was a way a hobbiest could use this software without stealing it.

So that's something to consider. Who's stealing it? If it's businesses then yeah you have a problem. If it's hobbyists then maybe it's because you don't have a deal for them.

Re:dongle

[Jerom]

I have seen setups where the dongle contains a processor and code (quite a library actually) - the software then calls this dongle to perform certain critical calculations. Quite hard to hack if the algorithm is unknown...

Re:dongle

[cforciea]

My guess is that's security through obscurity at work. That key hasn't been cracked because there hasn't been enough reason for anybody to bother cracking it. It's possible that $10k/copy software locked behind it would get people interested enough.

The problem is that you're running up against the software version of the analog hole. Before you feed it into the processor pipe, your application has to be in the standard machine code format that your processor is going to understand. You can dedicate some small portion of your codebase to refusing to work under certain circumstances, and you can make the binary inaccessible until right before it gets executed, but if the entire working application is on a cracker's computer, he's pretty well guaranteed a way to beat it. That leaves always-on style DRM schemes that constantly phone home to continue working, but if I buy $10,000 a seat software and I can't use it because one of your servers goes down, you can be pretty sure I'm not going to be very happy with you.

You also have to remember that hard to break DRM isn't a deterrent to your average pirate unless it is so hard that nobody does it. So what if it takes Sven The Reverse Engineering Scandinavian 30 hours of Monster and amphetamine-fueled thrashing about to circumvent your USB key DRM scheme? That will just make him even more of a hero when he posts the cracked copy of your software to The Pirate Bay for everybody to install. And at that point, the pirated version of your software is now easier to use as a consumer than the commercially released version; you are trying to sell an inferior product.

Re:dongle

[Short Circuit]

The point is, nothing is 100%. The game is to make it sufficiently difficult that the number of people who have the skill and time and interest to crack the protection is small (for a suitable definition of small). Then people will have the choice of either a) lots of effort to steal code which will become obsolete or b) pay for it.

Did you see me arguing that anything was 100%?

Could anyone do it? No way

It only takes the one, who turns around and uploads it.

Is it something that one does in an afternoon? Certainly not. The level of effort to crack this sort of scheme is actually quite high

Sure. But most people I know who've ever done this kind of thing do it for personal entertainment and challenge.

at the end of the day you end up with one version of the product which one will have no support options for, and which will rapidly become obsolete.

Yup. I've taken support calls from people whose serial number matched that of a cracked version of one of our products which floats around being sold by a scam artist. You know what we do? We solve their problem, and then offer to sell them a legit copy at a discount. Having just gotten out of a time-sensitive jam, they're always quite happy to get things straightened out properly. I'd much rather distribute the software for free, and then go the support route. That'd clear off that scam artist, too.