Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free.

This came up with another question I had here, I have decided on a programming verification system that requires a hardware verification system, a software key, and a name/password system.

Now people are saying that hackers will bypass any new security, which may be true, but I have a few questions.

There has to be a balance between programmers programming and hackers stealing software, otherwise programs wouldn’t be made, and we wouldn’t be where we are today. What is that balance? 5%, 10%, 20%, 50%?

  1. What is too much security for the end user?
  2. What is too little security so the hacker can just push through without issue?
  3. If your software becomes popular, what should you expect or accept as acceptable loss?
  4. Why should we accept black hat hackers as a way of life?
share|improve this question

closed as not constructive by thorsten müller, Walter, gnat, Caleb, pdr Oct 12 '12 at 10:43

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.

Who are your users? Fortune 500 companies may be able to hire a hacker to get free software, but they don't want the risk and have better things to do. –  JeffO Oct 11 '12 at 12:58
I'm actually attempting to write a program that I am working on making it so that it can be used for a specific group that utilizes a lot of rules and regulations, laws, as well as awards. if addopted by said group I could be looking at around 1.2 to 10 million in individual sales a year world wide. –  Matt Ridge Oct 11 '12 at 13:24
To point 4: mithral.com/~beberg/manifesto.html. Not much more needs to be said ;) –  Demian Brecht Oct 11 '12 at 14:01
I believe the term "pirate" or "cracker" is more accurate then referring to them as "black hat hackers". Arguably, there's overlap, but generally black hats penetrate systems and gain access. Crackers are the ones who bypass DRM. Pirates use the output of crackers. Although... there's a lot of nuance I'm missing. –  Philip Oct 11 '12 at 16:28
@MattRidge: Absolutely. However, my intent with sharing the link (other than it's one of my favorite nostalgic readings) was to suggest that you should accept black hat hackers as a way of life because it's never going to go away. I'm also not quite sure how standing on shoulders of giants is a bad thing.. We are all doing that.. Programmers and hackers alike. –  Demian Brecht Oct 11 '12 at 23:04

5 Answers 5

up vote 10 down vote accepted

They'll crack your keys and spoof the passwords. It will happen, it's just a question of whether your stuff is worth the trouble.

  1. You've got too much security when your end users start leaving because your security makes the NSA look lazy. It really is dependent on what you are actually storing on your end. I've heard it argued that security is impossible to over-engineer. I'd say that's true, provided that your end user never notices it.

  2. Too little is doing things like storing things in plaintext or not using parameters for your table inputs to stop SQL injection.

  3. That's a hard question. I think World of Goo made a profit with a piracy rate of like 90%.

  4. We accept Black Hats because they exist and there are more of them than you think. You have the internet. They have the internet. Thus, there be Black Hats. Even a world-wide police state wouldn't be able to fully kill them off (and would have horrifying drawbacks for the rest of us). It's an arms race to the bitter end (and it will never end), so just keep your measures up to date and keep going.

I recommend IT Security.SE if you have some more specific questions.

share|improve this answer
I was thinking of positin this question here, but I wasn't too sure if it was more of a question programmers here could answer since they are the ones in many cases been directly affected by it. –  Matt Ridge Oct 11 '12 at 11:55
Please don't talk about sanitizing SQL inputs. That's the wrong approach, and can still lead to SQL injection flaws if there's a bug in your escaping routine. The right way to do it is with Parameters. –  Mason Wheeler Oct 11 '12 at 14:01
@MasonWheeler fixed. –  World Engineer Oct 11 '12 at 17:23

World Engineer's answers are pretty good, but I think you're not talking about security as such, but piracy and counter-piracy measures. In that sense:

What is too much security for the end user?

Anything which the user considers too visible / obtrusive. This is highly dependent on the nature of your software - specialised software typically gets away with having stricter activation requirements. E.g. I may put up with a dongle for a 10 00$ application, but have refused to purchase 50$ games and applications because of DRM / "always online" requirements.

What is too little security so the hacker can just push through without issue?

If we're going down this path, I would say no activation at all, or incorrectly implemented checks (e.g. having everything boil down to a single if in your code.

If your software becomes popular, what should you expect or accept as acceptable loss?

How do you propose to measure this loss, exactly? Remember that a pirated copy is not necessarily a lost sale - there's a good chance that your software is being pirated because that person didn't think it was worthwhile paying for it.

To actually answer the question, nobody knows. Estimated piracy rates are generally pretty high. One example is Ubisoft claiming a piracy rate of 93 to 95% and this list by country showing it to be quite high in general. Yet somehow, they are still in business. I also believe that purchasing power inequalities play a large role in it, and unfortunately there's no easy way to deal with that. Basically, 100$ for Windows may seem cheap for someone in the US, but may be a year's savings for a Zimbabwean. Do you really think they will buy it, and is that pricing fair in the first place?

Why should we accept black hat hackers as a way of life?

Well, for one, it's the nature of computing at the moment. If you are handing out your application to be run on other people's hardware, there isn't much you can do to avoid them messing with it. There will always be people who crack software for fun, profit, social standing, political motivations, whatever. And more importantly, it's an uphill battle - nothing is uncrackable, and by investing in stopping piracy, you may irritate legitimate users and waste your valuable time.

So basically, it's in your best interest to play along - it's a "battle" you can't win.

Some alternatives / solutions to consider:

  • Make the application web-based, and sell it as a service, or make it partially dependent on some hosted service (the actual meat of the app, not just activation). Edit: coincidentally, the latter part is what dongles actually attempt to do; given time, it can also be reverse engineered and emulated.
  • Incentivise users to buy the real thing by offering them value-adds. Frequent updates and new features can make your app a moving target, even if it runs on the client.
  • Alternatively, if played cleverly, "DRM-free" can also be a powerful marketing tool. You gain goodwill from the community, and some free marketing. A good example was Galactic Civilisations, a relatively unknown game which enjoyed stellar success after a huge publicity boost for being DRM-free.

Edit: as a final summary, I'd put it this way: either turn your application into a service, or (if that's not possible), put in the minimum amount of DRM to make it "good enough" and move on. Rather invest your time and energy into giving your real users value-adds, etc.

share|improve this answer
So sacrifice security for usability, or limit usability by adding security is what you are ultimately saying? –  Matt Ridge Oct 11 '12 at 13:46
@MattRidge well, it's a bit more complex (perhaps something like this article by MS), but if we assume that your time is fixed (that would be the cost part), then yes, it's a trade-off between security and usability. –  Daniel B Oct 11 '12 at 13:54
My time is technically unlimited after my 40 hour work week, I'm doing this on my free time, which right now is limited only by my ability to stay awake, but not so much that I can't give as much or as little time as possible. Thanks for the advice though. –  Matt Ridge Oct 11 '12 at 13:57
@MattRidge - Your time is most certainly not unlimited particularly if you are doing this in your free time. It is unlikely, for example, that you can sustain a productive 40 hours/ week on this plus 40 hours/ week on your regular job. So you have to weigh the cost of implementing anti-piracy measures against the best alternative use of that time. That is, what other features could you build in the time that you would be spending trying to prevent people from pirating the application? Would those features make more than you would lose in additional piracy? –  Justin Cave Oct 11 '12 at 17:06
I think Daniel B has a great point. Anyone pirating your software is not likely part of your projected demographic... People who need the software will also likely need the support that comes with buying it. I think Microsoft is a perfect example. I don't know one person that paid for their copy of Windows, but I also don't know of one company that hasn't paid out the nose for unlimited copies. –  aserwin Oct 11 '12 at 17:15

Actually, I get paid to solve problems. Some of the places I worked couldn't care less if the software I wrote for them was GPL'd or stolen afterwards. As long as it continued to solve their problems, they were cool. So, even if we lived in a world where all software was instantly available to the masses, there would still be a lot of work for programmers.

To most of your questions, it depends on the users and the business case. So far, painless DRM is a myth and anything you do to thwart pirates is going to cause your customers stress. Any amount of effort that gets between users and doing what it is they want to do will dissuade a percentage of users from using your software and/or paying you. For lightweight things like... say... impulse gaming during a coffee break, any amount of effort will put off the majority of your user-base. For important things that are crucial for the lifestyle of the user, like it's their job to run this software, or it literally keeps their heart beating, then a far smaller percentage will be put off when you have them jump through DRM hoops.

And yes, any security measure you put in place has a chance of being circumvented. Usually there's a direct correlation to how off-putting it is to how hard it is to circumvent. It's a business decision to decide how angry you want to make your users and pirates.

Why should we accept black hat hackers as a way of life?

Because you don't have the option not to? Malicious people don't go away if you ignore them.

As for pirates, you should balance overzealous DRM against losing business. At some point your product becomes easier (monetarily and usability combined) to pirate than to pay for. At some point you lose money. And because there's a culture which absolutely despises DRM and won't give you a bent penny for restrictive software. For some applications, letting people freely take your software yields more revenue then stopping them from doing so.

share|improve this answer
Care to explain the downvote? –  Philip Oct 11 '12 at 18:50
@MattRidge Uh, read it again. The owner of the IP that I created was apathetic about who used it afterwards. As in, there was a project, I wrote software for it, and afterwards I asked if they were ok with releasing it under the GPL. They were. We didn't steal software. We didn't encourage people to steal software. I could understand how you misread that one sentence, except the context doesn't make any sense when you interpret it that way. –  Philip Oct 12 '12 at 15:29
Ok, sorry about that, fixed... and as for the rest, I'd want to create a DRM in my case that would be minimally evasive, yet fully functional. –  Matt Ridge Oct 12 '12 at 16:40
"Minimally [in]vasive, yet fully functional". If you can make that, you can sell that portion alone and become a millionaire. Good luck. –  Philip Oct 12 '12 at 16:51
Was debating about that, might be worth it. –  Matt Ridge Oct 12 '12 at 16:55

First off I think you're talking about crackers not hackers.

Personally I have refused to use certain software due to the DRM. Generally users will use your software as long as it does not require a constant connection to the publisher's servers as this causes users to accuse the company of spying.

You've also got to consider whether it's worth the cost, hardware verification isn't worth it unless your software is along the lines of AutoCAD as crackers will virtualise the device within a few months so unless the devices are locked to an individual copy of the software.

I think the best method is added value, Steam uses this by making downloading legal games easier than illegal and providing cloud backup of all purchases. You could also provide your software for free but then charge for training and support.

share|improve this answer
When I was actually in the field of reverse engineering viruses, AOL was just became a monthly paid service instead of an hourly paid service. There weren’t crackers, tweakers, or other forms when I was doing it. You were a White Hat, Gray Hat, or Black Hat Hacker. I use the term Black Hat Hacker because it is someone who does things to circumvent, alter, or destroy software. That is what it use to mean, now they have new terminology. Thanks for making me feel old ;) –  Matt Ridge Oct 11 '12 at 16:47
@MattRidge white/black hat is still common terminology, cracker was an attempt to remove the bad connotation from hacker, it largely failed though some still try. –  Ryathal Oct 11 '12 at 18:13
@Ryathal Black Hat Hacker I think is a justified term though. –  Matt Ridge Oct 11 '12 at 18:21

Customers arent criminals. So if you are starting off with the assumption that every customer is a potential criminal, you've already broken the trust between vendor and customer. Nicely done.

Now a good rule of thumb is, if you positively insist on some sort of copy protection, implement enough copy protection that it dissuades a casual or accidental copies of your software from being made, but don't implement anything that may risk a legitimate end user not being able to use the software they paid for. Unfortunately, there's a lot of stupid companies out there that do the latter, and ultimately it pisses off the exact people they want to keep happy - paying customers. Unlock codes that locally and permenantly unlock an application, or one time activation for a specific copy would be 'acceptable'. Hardware restrictions, constant calling home, and the like - not so much. If you do use an online activation, you better damn well be sure that activation will always be available. Or do you want a customer to miss a deadline because they couldnt get their software installed at 2am on a Sunday night?

Ultimately, if you think all your protections will actually stop a cracker from cracking your software, you're delusional. All it takes is one successful crack, and its as available online as if there was no copy protection at all. Also, I'd point out... so what if they do? Are you actually losing sales because of it? I know a lot of authors get their shorts in a bunch when their software is copied 'illegally'. But the truth is, in most cases those copies would not have been a new sale anyways. Focus on making your paying customers happy and things will be good. Focus on stopping copying over customer satisfaction, and you'll come across poorly.

share|improve this answer
I hate to ask this but what do you do for a living? The reason I ask is simple, over 50% of all customer if given the option to buy something or get it for free more than likely will take it for free. As proven by a response above with Goo World. I've worked as a Hacker, I've worked as an IT professional, and I've worked as many other things, I've seen the other side of the rose color glasses you are looking through. Yes hackers will break things, I don't doubt it, but I'm asking specific questions. As for the rest, I've never said how exactly I'd implement did I? You are assuming. –  Matt Ridge Oct 11 '12 at 22:21
I said how I'd do it, not how I'd implement it. –  Matt Ridge Oct 11 '12 at 22:31
What do I do? Well, I can tell you what I dont do - I dont waste time worring about how to protect software that doesnt yet exist from crackers who may or may not even try to crack it. –  GrandmasterB Oct 12 '12 at 18:27
Tell me one piece of software that someone hasn't thought worthwhile cracking and I'll show you something that was given away for free originally. –  Matt Ridge Oct 12 '12 at 19:27
Then why are you wasting time trying to prevent piracy when - according to you - every piece of worthwhile software gets cracked. You seem to think you can stop all crackers from cracking your program, which is what you'd need to do. Every single one of them. And once one cracker breaks the product, its available to anyone who wants it on a file sharing network as easily as if 1,000,000 people cracked it. Focus on the people actually giving you money. Or dont - its your software. –  GrandmasterB Oct 12 '12 at 19:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.