Skip to content

PHP Script Security Revisited

So back in the day when I first started building Caffeinated Content for WordPress, it occured to me that I should include some sort of registration scheme so I could protect my interests.

Don’t get me wrong, I’ve walked on both sides of the tracks.  I whole-heartedly believe in a try before you buy software system (though demo videos largely fill this void in certain niches).  I hate large software companies that put out a new and improved version of their software every year or so and charge hundreds of dollars for the upgrade (Adobe, I’m looking at you).  These days, though, now that I’ve been out scraping by in the real world for a decade or so, if I use something, I’ll pay for it.

In terms of Caffeinated Content piracy, I’m thinking of dropping the registration requirement.  In other words, if you have the script, you will be able to run it without it calling home to tell me what’s going on.  This’ll remove the single largest support request I get… but also affords me no way to attempt to keep people honest.

I’ve also resigned myself to the fact that if it’s written in PHP and given to a 3rd party, there is no good way to secure it.  All PHP securing methods are largely innefectual and broken by nature…

Does anyone have any thoughts on this matter?

12 Comments

  1. Si wrote:

    I’ve thought about the same thing mate (although I’m still reluctant to unleash my poorly-coded creations on the public!)

    The only way I can see to completely avoid piracy is to offer it for free yourself and somehow make that pay.

    Offering a free “lite” version might help, or maybe support a free version with ads or links inserted every x posts?

    A different approach would be to sell it as a hosted service rather than a plugin – seems to work for datapresser.

    Take it easy,

    Si

    Wednesday, April 15, 2009 at 7:53 pm | Permalink
  2. blackhat seo wrote:

    The only way to be sure is to offer part of the software as a service. Also some simple obfuscation, replacing all variable/function names with random strings, would prevent people from doing much with your code.

    Thursday, April 16, 2009 at 6:51 am | Permalink
  3. Johny wrote:

    I have to be honest here, you’ve created quite an astounding plugin, but there is no way you’re gonna be able to protect it from being pirated.

    Adobe, Microsoft, and tons of other giant corporations have failed, what makes you think you’ll be different?

    I’m not trying to sounds like an a**hole, just saying what’s on my mind.

    Cheers,
    Johny

    Friday, April 17, 2009 at 5:38 am | Permalink
  4. kansieo wrote:

    Si: I’ve got a hosted version ready and waiting backstage. Just need to iron out a few kinks, most notably with the limits imposed by the services I’m accessing…

    BS: Currently, I do mash up the function names and SOME variables. And then run it through a simplistic little encoding routine. Realistically, it’s just keeping the honest people honest. ;)

    Johny: Believe me, I know–as long as your PHP code is in a third party’s hands, it is remarkably impossible to protect. Even the Zend and Ioncube encoders fail at this, though they do up the protection for a price ($$, customers have to have the decoder installed on server, something I’m not willing to put my customers through).

    Friday, April 17, 2009 at 2:53 pm | Permalink
  5. Si wrote:

    If ya need any beta testers for the hosted version….. ;)

    Wednesday, April 22, 2009 at 5:30 pm | Permalink
  6. Johny’s right because I know for a fact that v3.37 has been pirated because I’ve seen it.

    And for the record, I’m a delighted CC customer! :)

    One other option you could think about which is quite radical would be to release it as open-source for free under the GPL, MIT, Creative Commons or some other “open” licence.

    The script comes with zero support unless you people buy a support contract from you for a one-off/yearly $x amount.

    That takes away the need to pirate, but still gives you a way to generate some income.

    There are loads of companies out there using this business model (Linux distributions, MySQL etc.) so why not you?

    I use this business model, so give me a shout if you want to talk more on this.

    HTH

    Cheers

    Nick :)

    Monday, April 27, 2009 at 2:14 pm | Permalink
  7. Gregory Robinson wrote:

    As a software developer i know that piracy is and always will be an “ASPECT” of the game. But the trick is to make it too difficult for the masses to pirate and not too difficult to install for the masses.

    There will always be a bunch of evil geniuses with more time on their hands than money to buy the software.

    Keep a balance Kansieo. And make sure ur well marketed ;)

    Monday, April 27, 2009 at 2:55 pm | Permalink
  8. kansieo wrote:

    @Nick: Interesting–I’ve actually never thought to go that route, although I do get requests for one on one installation help…

    @Gregory: That’s my problem–time, or just not enough of it! :)

    Tuesday, April 28, 2009 at 10:47 am | Permalink
  9. Clint wrote:

    I am a member of a couple different forums where this plugin is available and nulled. The description in several forum posts piqued my interest, and I came to your site to find out more.

    You have a video example of a part of the plugin’s functionality. That, coupled with the descriptions and comments on the forum posts, convinced me to purchase it, even though I could have gotten the current version for free.

    My thinking is this: If somebody comes up with a tool that has an obvious benefit to it (in this case, a huge time saver) then purchasing it is the only way to encourage them to continue development. Getting it for free is extremely short-sighted, in my opinion.

    The other side of piracy is that you get a pretty good idea whether or not your product is any good, as it will either be praised or slammed liberally by those who download/use it.

    As mentioned above, a service where the software calls home to get data is likely the only way to combat the majority of the piracy (sort of like Keyword Elite, perhaps). There will always be somebody who will likely crack it, but support and updates are important to the people who use it.

    I would also wager that a large percentage of the pirated copies floating around are not being used, but rather tried once and now collecting dust on someone’s hard drive. Getting access to something for free immediately devalues it to those who steal it, and as such it is not treated with the same attention as something they bought.

    At any rate, keep up the good work! It is very much appreciated.

    Wednesday, May 6, 2009 at 3:29 pm | Permalink
  10. Beasiswa wrote:

    I’ve also resigned myself to the fact that if it’s written in PHP and given to a 3rd party, there is no good way to secure it.
    Yes, I agree with you. Thanks a lot for reminding me. :)

    Wednesday, December 23, 2009 at 2:54 am | Permalink
  11. mimar wrote:

    I have to be honest here, you’ve created quite an astounding plugin, but there is no way you’re gonna be able to protect it from being pirated.

    Adobe, Microsoft, and tons of other giant corporations have failed, what makes you think you’ll be different?

    I’m not trying to sounds like an a**hole, just saying what’s on my mind

    Wednesday, December 23, 2009 at 7:00 am | Permalink
  12. Nothing elese you can do really in terms of whats happening. The steps you’ve taken and the comments that that have been provided are spot on. Fine job with the plug-in and you’ll get recognition as long as the marketing of it is sound. Keep plugging mate.

    Wednesday, December 23, 2009 at 5:11 pm | Permalink

Post a Comment

Your email is never published nor shared. Required fields are marked *
*
*