Show HN: Easy-to-use licensing library for .NET apps

https://github.com/SNBSLibs/Licensing.ActivationKeys

by SNBS • 3 years ago

54 34 3 years ago

This free, open-source .NET library allows you to license your non-free applications through activation keys. Follow the quick start instructions and try it out in 5 minutes!

Available on:

NuGet https://www.nuget.org/packages/SNBS.Licensing.ActivationKeys...

Website (full docs, downloads) https://snbslibs.github.io/Licensing.ActivationKeys

GitHub (downloads, full docs, release notes etc.) https://github.com/SNBSLibs/Licensing.ActivationKeys

garganzol• 3 years ago

Why does it need a database on the client side? Sounds like a significant restriction. A lot of apps do not have a database at all or have an exotic one (NoSQL).

pugz• 3 years ago

It looks like the client is designed to connect to a publicly accessible MySQL/MSSQL server. I don’t know if that’s better or worse than a client-side database!

jeremycarter3• 3 years ago

It's poor design

SNBS11• 3 years ago

It doesn't need a database on the client side. It can connect to a server-side DB.

swdev281634• 3 years ago

I usually use something completely different for that use case. Specifically, ECDsaCng class from the standard library, which implements ECDSA asymmetric cryptoalgorithm.

Generate a key pair, embed public key in your executable, keep private key private.

A license is some JSON or XML or whatever, signed with the private key. If your licenses are permanent, and you don't need different license types, a license is just a signature of some computer ID (like hard drive serial), with that private key.

Unlike the older RSA, ECDSA results in very small signatures, even for very strong curves like NIST P-521. These signatures only take couple lines in Base64 text format.

layer8• 3 years ago

If your licenses are time-limited, you can use regular X.509 certificates to represent a license (where the subject name signed is the computer ID, and the validity period of the certificate is the validity period of the license). You could even run standard X.509 revocation checks in order to enable blocking of illegally shared keys.

dogma1138• 3 years ago

You can go a step further and you can embed a key in the license itself that is used to sign any files that the software produces that then would alert someone if they were created with unlicensed software.

AutoDesk software and quite a few other creative tools do that.

So whilst they are fairly easily cracked its quite hard to use that software in a commercial setting.

SNBS11• 3 years ago

I know. It's another kind of licensing. I've created a library specifically for activation keys.

amir734jj• 3 years ago

There shouldn't be a need for client side database. Or at least it should be optional.

devrand• 3 years ago

That’s not a client side database. The “verification server” is a publicly accessible database.

jeremycarter3• 3 years ago

Yep. I would avoid this library.

SNBS11• 3 years ago

Publicly accessible? Well, if you share the database username and password, maybe yes.

The credentials can be taken from the disassembled source code, but I've already taken it into account. The next versions will use an HTTP API.

Uvix• 3 years ago

If you absolutely want client apps to check against a remote licensing source, it would make more sense to use an HTTP API for that rather than accessing a SQL Server or MySQL database directly. Requiring Entity Framework for the app is adding a lot of overhead, and corporate policies often ban publicly-exposed database servers.

(Removing the EF dependency would also let you ship a .NET Standard 2.0 version suitable for .NET Framework apps.)

klysm• 3 years ago

Yeah I don’t think using a database is a sensible API for this task

techdragon• 3 years ago

It’s beyond not a sensible API, it’s significantly harder to secure, inappropriately so…

On the licensing service side as they have to lock down a database server to allow safe A.C. access by arbitrary clients…

And requires end users to carve out firewall/network security rules to allow outbound connections to an arbitrary database server, which is a pretty significant data exfiltration vector and I’d be extremely concerned about enabling this even at the best of times…

The mitigation would have been trivial, gRPC, gRPC Web(which has excellent support in the .Net world) , or a regular HTTP API would have been completely adequate and this database driven solution is the sort thing I’m not surprised to see from a .Net developer, as along with Java devs seem to be the last remaining pockets where it’s obvious that a developer can go their entire career without knowing anything about code outside the corporate Network. Since that’s the only place this is even close to safe, 100% inside the corporate firewall. To clarify this is to say that the only two developer communities where I would not be surprised to see this are Java and .Net, because they contain enough developers who lived inside the corporate walls and have yet to gain enough exposure to wider community practices, not because of anything about the languages themselves but because if the social dynamics involved in the developer population that work with these languages.

MissTake4• 3 years ago

If I were concerned about licensing, then I'm really not sure I'd put my faith into a library like this - not least that if the app just shipped with the dll, then it could be swapped out in the blink of an eye with a stub.

There's significantly more involved in managing this sort of thing that a simplistic library such as this can manage.

Companies concerned with licensing usually do it because they're protecting their assets from software piracy. Something like this would be horribly easy to circumnavigate.

You're using a simple pseudo random number generator as well (as opposed to a cryptographic one), which is incredibly weak, and, as others have made clear, making a direct DB connection is an absolute no-no: Your methodology of requiring a directly connecting to a remote database server, that is also required to be accessible 100% of the time, is critical point of failure.

I can't imagine anyone (outside of the really big name vendors) that'll have customers that'll be "forgiving" enough to be blocked simply because there's an issue with the remote database.

Not used them myself, but something like https://licensespring.com/ seems to provide significantly better license management.

is_the_color• 3 years ago

Since we're on the topic, I would highly recommend https://cryptlex.com/ I have used them for a few projects. They have great support and features.

lazyeye• 3 years ago

Also I've heard good things about LimeLM

https://wyday.com/limelm/

SNBS11• 3 years ago

Please note it's only the first major version! Do you want a perfect, bug-free library in releases 1.x.x?! Your feedback was taken into account, though.

jeremycarter3• 3 years ago

Our concern is in the core design of the product offering that shows some big weaknesses. Nobody is being deliberately critical here.

userbinator• 3 years ago

Quick start: takes 5 minutes

Quick crack: takes 5 minutes

Find the is-valid-license method and make it always return true.

As someone who has spent a considerable amount of time "on the other side", it's amusing to see things like this being open-source, because being closed-source --- and sometimes obfuscated --- is almost entirely what most DRM relies on for its strength.

jeroenhd• 3 years ago

I think the goal isn't to combat cracks. Cracking software is often easy, especially for dotnet applications.

I would use this for products that are mostly used by businesses. Some businesses will happily run pirated software, but any potential customer will just pay for the license. All you need is a way to turn a trial version into an activated version to make the popups/watermarks go away.

SNBS11• 3 years ago

Same things will happen with other licensing libraries (or I'm dumb). BTW, you have to disassemble the client app first! I think non-free apps are almost always obfuscated.

MissTake4• 3 years ago

Obfuscation isn't all that good when out to the real test.

Any .net app not compiled to native code can be disassembled if one is prepared to put any time to it.

Back when the .net Framework first came out, I was all over using the full Dotfuscator app thinking it would protect my apps. I was even more excited when I observed reflector giving up on it.

Right up until a friend of mine used a different app and showed me the deobfuscated code. I gave up at that point and realized it wasn't worth the effort.

Whilst your willingness to tip a toe in these waters is a good thing, I'd not hold out much hope of this library being used by many, if any people when there are some far better, more resilient and battle hardened versions out there.

sorwin• 3 years ago

This is about as secure as loading a text file that says "licensed=true".

Anyone can easily proxy the server DNS call, put up their own server, etc.

A client app connecting to a public facing database server with no authentication is a huge security risk, aside from anything this whole library is doing.

bob1029• 3 years ago

Not that I'd use this, but in its defense there are applications for a lightweight licensing nag screen: B2B products where your customer almost certainly isn't going to be a leet hacker and is otherwise bound by the terms of a broader contract.

Think of it like locks on doors in the professional world of business software. Helps to keep the customer honest because at the end of the day they don't actually want to violate any rules. It can be hard to keep track of all the instances of things in some enterprises. The scale of our average customer has informed us that integrated licensing functionality is ideal for some of our products.

SNBS11• 3 years ago

I KNOW USING DIRECT CONNECTION TO DATABASE WAS A DUMB IDEA. TAKEN INTO ACCOUNT, WILL BE REPLACED WITH HTTP API IN NEXT VERSIONS. PLEASE DON'T LEAVE FEEDBACK ABOUT IT.

Show HN: Easy-to-use licensing library for .NET apps

Related Stories