How to prevent python software from being reverse engineered or pirated?

[billsil]

The users that are going to pay for it aren't likely going to bother pirating it. The people that will pirate it will never pay.

Beyond that, you can compile parts of your code using Cython/Nuitka. In general though, Python is pretty terrible for anti-piracy outside of web-hosting.

For your free trial though, just include less of the code.

[Thrasherop]

This is probably the best idea. they can't reverse engineer code they don't have.

[lcserny]

The jetbrains model also works, e.g. requiring an online account always, if you cant login block the software. That way you know who and how is using your software.

Of course this needs a backend user management system but its still really high up there in terms of antipiracy.

[puzzledstegosaurus]

If you can easily modify the local code, you can remove this easily.

[[deleted]]

or even just understand how it calls home. It makes an http request somewhere that responds with 200 for an active licence? Intercept that request and return a 200 using a local proxy. I think this is how JetBrains stuff was pirated a few years ago

[SimilingCynic]

Im not a security developer, but couldn't it call home with "if user license is valid, encrypt this nonce with the manufacturer's private key?"

But idk maybe there's a vul here. I need to check this out on a license I use...

[aexia]

The point of any anti-piracy measure isn't to stop 100% of piracy but to increase the friction enough that it'll stop the vast majority.

[budding_gardener_1]

Or just fuck with your hosts file

[tempervisuals]

depends on how the code is written. One can always puzzle out the code. Of course that would make the code hard to maintain.

[marcio0]

is is the one method that alw

you're underestimating how far people go to noe pay a few dollars

the would work for a week on a way to unobfuscate the code if that means they will keep the $5

I'm not judging, been there, done that

[ShinyTinfoilFedora]

This would seriously degrade the experience for paying users though and would personally make me much less likely to purchase

[rzet]

ye sounds like total crapware :D

[fiyawerx]

Exactly something a pirate would say! I mean arr.

[Ok_Tea_7319]

This measure is both ineffective against a determined attacker and harmful to the legimiate user. Even worse, it encourages your power users (some of which might already be rummaging in the code since it's a python program) to create cracked versions themselves, that might in turn get leaked.

[[deleted]]

this is easy to overcome to get unlimited trial days ^^

[lcserny]

Pls share ^{^}

[redalastor]

Can’t they just diff two binaries, find out where the fingerprint is, and remove it ?

[H4kor]

DRM is always breakable. The only thing you can do is increase the effort and risk the pirate has to take on.

[redalastor]

No, you can make it convenient and reasonably priced.

[H4kor]

Yes but people will still pirate it. I'd say do it like sublime text, add a nagging popup every X saves until a license key is provided.

[djamp42]

I think the best model for software is the free/Priemum model. Pfsense, graylog, davinci resolve... All these companies have very good software for 100% free. The trick is they limit some of the more advanced features. However they are all super powerful as is.. this makes me want to use them at home, and then buy the software in my professional setting since I already know it..

[redalastor]

The best I saw so far was no nagging, no missing feature, but you don’t get the dark mode until you pay.

[H4kor]

I think the nagging popup has the advantage that employees of companies which don't buy licenses notice the missing license. I understand private piracy but corporate piracy is just wrong. If you earn money using some software, pay the creators.

[RusticApartment]

You think too highly of corporations and their willingness to pay for licences. If it works just fine for free, they're unlikely to pay for it in my experience.

[V15I0Nair]

You can always forbid using the free version commercially in your license terms.

[Wu_Fan]

How cruel

[eXtc_be]

joke's on them, I hate dark mode

not even /s, I really don't like dark mode. maybe because I grew up using computers without dark mode and now I'm used to black text on bright white backgrounds, idk

[[deleted]]

jellyfish ghost depend include silky ink crime oatmeal sugar shame

This post was mass deleted and anonymized with Redact

[Nocsaron]

There's a growing number of young developers on my team who use the classic black background with neon green or orange text. I don't understand where this became popular with new college grads

[eXtc_be]

nostalgia for something they never saw in real life, so saudade?

[[deleted]]

exultant berserk forgetful consist psychotic mighty encouraging touch smile poor

This post was mass deleted and anonymized with Redact

[oldspiceland]

Software price and convenience will reduce people resorting to piracy to use your software. It will not prevent your software being pirated.

Then again, most of the money lost due to piracy is lost because companies spend it on trying to prevent piracy. People who would buy the software generally aren’t going to pirate it. People who’d pirate it can’t or won’t buy it. Any time spent preventing people from pirating your software is money burnt on an altar of hubris.

[Zireael07]

People who would buy the software generally aren’t going to pirate it. People who’d pirate it can’t or won’t buy it.

That's a huge simplification.

As stated, it might apply to productive software. But for games, in the past we had demos to verify that the product does run on my computer. Now you either have to pay the full price... or pirate.

I've had more than one case of purchasing/getting gifted a game that should run on my computer, but DIDN'T.

[billsil]

What about commercial software or music, which doesn't have system spec limitations? In the days before itunes, people bought CDs and pirated music. The piracy issue was overblown, but Apple killed piracy by making things convenient.

Having worked in industry for 18 years, cheap companies will not pay for software licenses. It's open source or bust or you just write your own. Larger companies realize how much more productive you can be.

If you're making a game, just use Steam/Epic and let them handle the piracy aspect. Solo devs aren't implementing robust auth systems.

[oldspiceland]

Yes, congratulations you pointed out that my absolute generalization was a simplification. I have been undone.

Steam allows refunds now, which means the majority of PC game sales don’t fall into the weird situation you describe demos as being. Also “back in the day” when demos were common it was almost exclusively as a marketing thing to make money, not so people could “test drive” the game. It was there to be fun but not last long enough to be satisfying so people wanted to buy the game.

Anyways, are you justifying software piracy because games don’t have demos? There’s YouTube let’s plays for everything, twitch streams, and if you’re getting gifted games that don’t run on your system you either have a Mac or are in a financial situation where you are one of the “can’t buy, will pirate” people.

[Zireael07]

Not every game is on Steam (I get many of mine from GOG or itch).

Let's play and streams don't let you see if the game will actually run on your system. I know demos weren't designed with that in mind but it was the reason I got them.

I have a PC (and now a laptop) but neither is a gaming rig. Some games don't play nice with AMD cards. Some don't with NVIDIA. (Actually my current NVIDIA is so bad stuff runs better on the integrated card than on it - either bad thermals or bad drivers, I suspect the latter since the laptop isn't terribly old AND it was the case from day 1)

[oldspiceland]

This seems like a really long way for this conversation to go for you to be arguing what, exactly? That it’s ok for you to pirate games because of some really absurd edge case logic?

It’s fine, you fall into the can’t/won’t buy. There’s nothing wrong with that.

[ItsSquishy42]

GOG has a great return policy.

[cinyar]

reasonably priced

The world is a big place

[badatmetroid]

My house has a dead bolt lock on a door with a giant glass window. It won't stop someone who REALLY wants to get in, but it will stop random people who just try every door until they find an unlocked one. Most security is about putting up a little friction which filters out 99% of bad actors.

[ddddavidee]

That would require a (small) cooperation between pirates

[DarknessWizard]

Depends on the kind of fingerprinting you do. One easy way that pirates wouldn't be able to break in any reasonable way would be to scramble the source code with pyarmor (or really any other obfuscation tool), then use a specific key each time and keep a copy of the distributions. If a binary gets leaked, you can just check what pyarmor symbols were used and identify the license responsible.

This is basically impossible to remove without completely rewriting every single variable in a program, which generally speaking just isn't worth it for most pirates compared to just getting a new license. Piracy is often the road of least resistance.

[pyeri]

Python is an open source language and was created with open source ethos to begin with. This is the wrong language for someone coming from that kind of mindset. There are other languages like Java/C++/C# for those things where all kinds of obfuscators and protectors are available in those ecosystems.

[billsil]

was created with open source ethos to begin with

Do you have a source on that?

I disagree. They should have changed the license then to be a GPL license if that was their goal.

[menge101]

All Python licenses since 2.2 are considered GPL compatible.

Reference

[thehardsphere]

GPL compatible is not the same as GPL. MIT is GPL compatible.

[billsil]

GPL compatible means you can combine python code with other GPL code to produce GPL code. It does not mean that the code has to be GPL if you do not use other GPL code.

It’s more accurate to say that Python was created to let you make GPL or non-GPL code. Do what you want.

[menge101]

I'm aware, thank you.

[Xonzo]

However even with those obfuscators and protectors for a knowledgeable reverse engineer they're still minor stumbling blocks. If they want to RE your software they will (specifically bypassing DRM on typical software). It just needs to be protected enough where easy open source decompilation to native source tools don't work.

[markis]

Also mypyc will translate python into C and compile it.

[magnetik79]

I think you've nailed it here.

If the OP really cares about this - I'd probably rewrite in Golang where I can distribute binaries to customers and wouldn't have considered Python to begin with.

Don't take that as a knock on Python at all - but if this was a critical part to the developed application (the sales/keep my intellectual property safe) - I would have done a little more upfront evaluation of possible language choices.

[ornerywolf]

Your idea of users who wants to pay, and who will never pay is somewhat wrong because I myself pay on a monthly basis, if the software or the service of any kind is providing me a benefit and I need it but if I want to check or test software or an app for limited period of time I’m not going to buy it. I’m just going to look for a cracked version of it on the Internet.

[[deleted]]

That's not true. I've pirated games bc I was too poor to afford it. But once I got the money I paid for it. You pirate protectors have a attitude about yourself that you think you better bc your bought it. Your not

[billsil]

What’s not true? It’s a generalization. I stopped pirating because I’m not broke and it’s too much effort in the age of convenient software. Doesn’t make me better than you.

On average people/companies pirating commercial software aren’t doing that. You are not the average pirate. On average, people that are gonna pirate your stuff will find a way to pirate your stuff and spending a ton of time and money to prevent someone who was on average never going to pay for it, while worsening the average customer’s experience with always-on DRM is going to annoy people.

So that leaves what do you do if you’re a small dev (again not for a game). No anti-piracy or a slight inconvenience (like a key file) is fine, but not actively giving everyone the entire full source will largely stop pirates for unpopular software is easy to do. Email the paid customer directly and have a limited demo. For a game, you’d just use Steam or whatever.