Licensing in PHP?

wesblake

Hi, I have more of an architecture question but this seemed like the closest section to that. Here's the situation. Our company has created a modification to an open source php application that we would like to start selling. Of course, since it's just a modification (although a heavy modification) and not a separate app, we cant obfuscate with Zend Guard. Has anybody ever come across or come up with a good way to police something like this? I.E., some way to prevent 1 person from purchasing the modification and giving it to others, other than the honor system.
My best thought so far is to set an encrypted key in the db scrypt when they purchase the mod, with a matching key on our end. Keep the decryption key and key matching method on our end as well. Call the method (with a fairly cryptic name) in a hard to find place. At least it would be somewhat dificult to track down the single method on their end and remove it.
Any ideas or experience with this? Thanks.

Horizon88

Well if it's a modification to an open-source app you're bound by the license to re-distribute the source upon request, usually, so it's probably rather pointless to try and encrypt it. Right?

wesblake

Right, I can't encrypt the code. I meant just encrypting a key that I match against. And we are not re-distributing the entire code of the app, the mod is simply a file the user can run in the module loader of the application to modify it. I want to hopefully police the purchase of our mod.

jkurrle

To create a licensing mechanism you need a way to correctly identify that the code is on the right website. You will need to look at your PHP variables and see what are workable self-identifying tags.

Then, you need to encrypt those tags, so that they aren't so easy to track down. Embed them in a file who's name is also an encrypted varient of your customer's website name. Your code will need to look for this encrypted filename, based on the encrypted name of its self locating PHP variables. Then, your code needs to properly decrypt the license key variables and see if they match the current web site they are on. If they match, execute the code. If not, it doesn't work.

One caveat: Some people like to go to www.somesite.com, while others like to go to somesite.com (minus the www). You probably will need to generate two license keys if it's a public website.

kakki

maybe you can seperate your code from the original open source software and do
your change on a remote machine,
then you have to publish the connector to your software and not the code itself

or ... you know, have a little trust in the future and sell your support for the software
like redhat did

Kudose

kakki wrote:
or ... you know, have a little trust in the future and sell your support for the software
like redhat did

Then turn around and take all the open source work and through it into an Enterprise version?

kakki

yup ... or even better:
closing the free distri and then ... after a few days
remembering the gpl ( it has to be free downloadable )
and in a hurry reopening the "free" distri and start wondering where
the community has gone ;-)

i just mentioned redhat because you can read about their biz-model all
over the web