Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>I work for a company selling <em>protected</em> Java software.</p> <p>I won't comment on the scheme for user authentication, but I can comment on the online license check.</p> <p>Don't make it even "work for two days": that's how I pirate most software... Virtual Machine set "back in time" and externally firewalled so that it doesn't "phone home" anymore (that is: only allowing it to contact the server once, to get the trial key), always reimaged from the point where the software got freshly installed and bingo, the 30-days trial (or two days trial) has become a lifetime trial. Why do I do this? To learn how to better protect our app of course ;) (ok, ok, I do it just for fun too)</p> <p>What we do in our commercial Java software is to check the license at every startup.</p> <p>We've got hundreds of customers and nobody ever bitched about it. Not once. We generate a unique class at each run, which is different at every run, which depends both on things unique for that launch on the client side and on things generated once on the server side.</p> <p>In addition to that having the app contact your server at every launch is a great way to gather analytics: download to trial ratio, nb average launches per trial, etc. And it's not nasty anymore than having an Urchin/Google JavaScript tracker on each webpage is nasty.</p> <p>Simply make it clear to people that your software performs the online licence check: we'got a huge checkbox either on or off saying: "Online licence verification: OK/Failed". And that's it. People know there's a check. If they don't like it, they go use inferior competitor products and life is good. </p> <p>People are used to live in a wired world.</p> <p>How often can you <em>not</em> access GMail because your Internet connection is down? How often can you <em>not</em> access FaceBook or SO because your Internet connection is down?</p> <p>Point is: make as much computation as possible dependent on the server side:</p> <ul> <li>licence check</li> <li>save user preferences</li> <li>backup of the data generated by your app </li> <li>etc.</li> </ul> <p>Nobody will complain. You'll have 0.1% of your user complain and anyway you don't want these users: they're the one who would complain about other things and post negative feedback about your app online. You better have them not to use your software at all and complain about the fact that it requires an always-on Internet connection (which 99.99% of your target demographic and hence they won't care about the complain) rather than actually have them use the app, and complain about other things related to your app.</p> <p>Regarding decompiling, .class can usually be decompiled back to .java unless you're using a code flow obfuscator that produces valid bytecode but that it impossible to be generated from .java file (hence it is impossible to get back a valid .java file).</p> <p>String obfuscator helps make it harder to figure out.</p> <p>Source code obfuscator helps make it harder to figure out.</p> <p>Bytecode obfuscator like the free Proguard makes it harder (and produce faster code, especially noticeable in the mobile world) to figure out.</p> <p>If you're shipping Windows/Linux only then you can use a Java-to-native converter like Excelsior Jet (not free and kinda expensive for startups, but it produces native code from which you simply <em>cannot</em> find the .java files back).</p> <p>As a funny side note you'll see people trying to mess with your online server... At about 30 beta-testers we had already people (which we know where part of the trial) trying to pirate our online servers.</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
    1. CO@WizardOfOdds - What happens when a company wants to run your software on a network not connected to the internet? I can think of a number of industries where this is very likely to occur, so I guess it comes down to who your user base will be maybe?
      singulars
    2. CO@Binary Nerd: The very few industries that have such a need have both an internal net and an Internet net. I'll give you an example I know very well: *Broadcom* was such a company: chip engineers had at least two computers, one Un*x workstation to run the chip-design (highly trade-secret) and another computer (Windows, Linux, Mac) that was on the Internet. Think of this: there are really *very* few companies today where people use computer software yet where their users cannot send emails. Trade secrets? Two networks or live in the stone age and be outpaced by your competitors.
      singulars
    3. CO@Binary Nerd: in addition to that, seen the original question that talks about a server and is concerned about "warez", it seems pretty obvious that the OP is not after the very few companies in the world that would happen to use computers yet not allow their computers to access the Internet... Now I'm not disputing that there may a few exceptional cases where this wouldn't work. But nowadays most individuals, SMEs and big companies are all using daily Webapps like GMail etc. We *do* live in an Internet connected world and if this changes one day, we'll have bigger problems than anti-piracy ;)
      singulars
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload