Here's a tricky question!

VooDooRT

Ok, here's the problem...

I'm going to be selling a script package soon, and due to some issues with a prior version, I'm going to ecrypt it. Now, I also want to make sure each copy is only run on one site. The thing is, I don't want to have to re-encrypt the files each time I sell one. The way I play to encrypt them is through ioncube.com and I'll have to pay each time I sell one. The files are pretty large, so it's going to cost me a pretty penny each time I sell.

Here's what I want:

Each script will only work on one URL unless the owner contacts me with proof they are going to use it legally on another URL.

Not have to encrypt each time

Still have to encrypt to protect my 2000 hours of code work...

Zack

well if you plan to sell a lot of copies of your scripts (which look very good and time well spent, by the way), I'd say buy the encrypter program instead of using a site to encrypt each time. I can't remember the name of the program, but I'm sure someone here does...

VooDooRT

Any idea what a price on something like that would be?

I know Zend software is bucku loot, and I can't afford that, at least not until I sell a couple hundred copies! LoL

BTW, thanks!

www.clantek.net is what you were looking at hopefully.

Scurvy

That's a nice script you did there VooDooRT. I wish I'd known about it when I was running an HL clan. I have a similar situation with a script I'd like to offer for sale so any replies or info?

VooDooRT

I ended up using Zend. They are offering a nice deal now for people that own small businesses. It's 450.00 and that includes the Encoder, Development Suite, Optimizer, and a year of updates. A cheaper version is 295.00 but it doesn't come with updates.

examancer

you could set up your own registration database, and have the script connect to your site and send you its current location which you could check against a database of authorized locations. If its not in the database the script will fail, and you will be notified. Since this would be quite a load if there were many of these scripts out there you could set it up so that it only does this periodically or something like that, but thats an idea.

procoder

Originally posted by examancer
you could set up your own registration database, and have the script connect to your site and send you its current location which you could check against a database of authorized locations. If its not in the database the script will fail, and you will be notified. Since this would be quite a load if there were many of these scripts out there you could set it up so that it only does this periodically or something like that, but thats an idea.

What prevents from someone of removing the checks or stealing the code?

examancer

Ok, after thinking about it, this is how I would do it:

There would be 3 things protecting the code:

Encryption of the code, as VooDooRT is planning on doing. This will make the code very unreadable, and should make it very very difficult to edit.
Check whether the files have been changed using a checksum like md5(). You could store the correct checksum value somewhere in the code itself, or even on YOUR website so it couldn't be altered. using md5() on all the files every time a script is executed would be a ton of load, so you would have to shedule this event somehow. I can think of a number of tricks to get the scheduling working without the user really being able to stop it, and you could have the program alert you if somehow they did stop the checksum events from happening.
Have the program check back to your site every once in a while to check the location of the program against your database of allowed locations.

I don't think any solution would be "bullet proof". If your code is going to be stored on someone else's server, its always going to be "possible" for them to steal your code. But, I think correctly implementing all three of these ideas (maybe less if done right, maybe more if you're paranoid) would make stealing your code WAY more hassle than its worth. I could see you making it hard enough so that it would take more skill to steal the program than it would to just make it.

procoder

welp its easy as doing a search for md5() function in the script.

🙂

Since you cant compile programs, encoding is the only way I could see to make it secure

dalecosp

... I saw this on some other thread 'round here a while back ...

http://www.websitecreations.co.nz/codelock/