Should I open source my licensing server?

Question

Recently developed an in-house "zero trust" license server based on PKI idea, blockchains, and proof-of-time, to convert a regular "vendor hosted" license server, into one that can be hosted on the buyer side. A lot of anti-piracy goes into obfuscation, and while I consider that defense-in-depth, I also consider obfuscating client-controlled code useless, and tried to make the system depend on cryptographic guarantees as much as possible. No such system where possibly adversarial clients control the license server, especially in an offline scenario, is perfect, but with immutable secure logs, and PKI chain of trust through a hierarchy of root authorities, I think we have a fairly solid approach.Open sourcing might lay bare some flaws which could be fixed. Or it might lay bare some flaws which could be exploited. This is mostly theoretical, we will probably not OSS it right now, but I consider it a useful exercise to crowd-think through the possibilities.In the rare chance that it is actually something novel, secure and useful, it might help other companies secure their deployments in a zero trust way.

SOLAR_FIELDS · Accepted Answer

I used to work with a guy who worked at a prominently successful FOSS style company that used self hosted licensing as one of their bigger sales models (think like Elastic or Mongo) and he mentioned something I found really interesting. He said that you really should not care about licensing that much beyond just basic controls. Why? The people that would cheat your licensing are very often not who you want as customers anyway. The real moneymakers would never risk being caught out violating license terms. So really licensing software, at least for enterprise software, is kind of a dead end from that perspective as a moneymaker.

insane_dreamer · Answer

Keygen.sh developed a good API based licensing service in the cloud which they later open sourced and worked out well for them (the main dev blogged about it and explained the reasoning.I think with security products like this, open sourcing can be a good idea as it allows users to inspect the code and feel more confident that it is indeed secure. Plus you get feedback (and maybe even help) you wouldn&rsquo;t otherwise get. And you can charge for services, etc even if open source (if you want).

komali2 · Answer

Yes, but I doubt I could convince you if you haven't already been convinced by all the people smarter than me
https://www.gnu.org/philosophy/free-software-even-more-impor...
https://opensource.google/documentation/reference/why

sorrythanks · Answer

> Open sourcing might lay bare some flaws which could be fixed. Or it might lay bare some flaws which could be exploited.If there are flaws(, and there are!) it might be preferable to have the chance to learn about them from grumpy security open source contributors than after the exploit

brudgers · Answer

Open source it if you want to open source it.
Don't open source it because you want/need/expect other people to work on it because statistically, that is not going to happen.
Open sourcing your project will create more work for you, not less. Good luck.

stuckkeys · Answer

There was an open source licensing server that also managed software updates for clients over the network. I forget the name. It was cool. Lots of people contributed. I think it got so popular it ended up tailoring to enterprise. They did the hosting. It took time but it worked out well for that team.

daksigns · Answer

Strengths:Zero-trust approach: This is a strong foundation for security, eliminating the need to completely trust any component in the system. Leveraging PKI and blockchain: These technologies offer robust cryptographic guarantees and tamper-proof records. Focus on cryptographic guarantees: This prioritizes strong security over obfuscation, which can be bypassed with enough effort. Immutable secure logs: This provides an auditable trail of license activity, aiding in troubleshooting and potential legal situations. PKI chain of trust: Utilizing a hierarchy of root authorities strengthens the overall trust model. Considerations:Open-sourcing: This can be a double-edged sword. While it might expose vulnerabilities, it also allows for community review and improvement. Consider a private beta with trusted security researchers before full open-source release. Offline scenarios: While not perfect, exploring options like pre-downloading licenses or implementing secure, limited offline functionality could further improve usability. Threat model: Clearly define the types of attacks you're trying to mitigate (e.g., unauthorized license use, license server compromise). Overall, your approach seems promising! Here are some additional thoughts:Performance: Consider the impact on application performance, especially with blockchain interaction. Scalability: How will the system handle a large number of clients and licenses? Integration: How easily can it be integrated with existing licensing systems? Open-sourcing for crowd-think is a valuable exercise. Here are some ways to mitigate potential risks:Security audit: Before open-sourcing, consider a professional security audit to identify and address any critical vulnerabilities. Phased release: Start with a limited open-source release, allowing trusted partners or researchers to review before a full public release. Strong license: Choose a license that allows for contributions while protecting your intellectual property. By carefully considering these points, you can build a robust and secure zero-trust licensing system that benefits your company and potentially the wider software community.

tonymet · Answer

are there subcomponents you could open source to test the waters? that would allow you to build the discipline and community before going for the whole thing

singpolyma3 · Answer

Yes

eps · Answer

If you already have the PKI, why would there be a need for blockchain?

iJohnDoe · Answer

Apply to YC. Take on the major license companies like Thales, Flexlm, Wibu, etc.You&rsquo;ll need a lot of money and stay in it for the long run to take on companies like that. It&rsquo;s possible though.

stop50 · Answer

It would be an interesting idea.

firesteelrain · Answer

This might be an area of opportunity where you could open source it however require a license for enterprise/business use.
We use CodeMeter. It is possible your product may be competitive to other SW license server products.
https://www.wibu.com/us/products/codemeter.html

Should I open source my licensing server?

Yes, but I doubt I could convince you if you haven't already been convinced by all the people smarter than me
https://www.gnu.org/philosophy/free-software-even-more-impor...
https://opensource.google/documentation/reference/why

> Open sourcing might lay bare some flaws which could be fixed. Or it might lay bare some flaws which could be exploited.
If there are flaws(, and there are!) it might be preferable to have the chance to learn about them from grumpy security open source contributors than after the exploit

Open source it if you want to open source it.
Don't open source it because you want/need/expect other people to work on it because statistically, that is not going to happen.
Open sourcing your project will create more work for you, not less. Good luck.

are there subcomponents you could open source to test the waters? that would allow you to build the discipline and community before going for the whole thing

Yes

If you already have the PKI, why would there be a need for blockchain?

Apply to YC. Take on the major license companies like Thales, Flexlm, Wibu, etc.
You’ll need a lot of money and stay in it for the long run to take on companies like that. It’s possible though.

It would be an interesting idea.

This might be an area of opportunity where you could open source it however require a license for enterprise/business use.
We use CodeMeter. It is possible your product may be competitive to other SW license server products.
https://www.wibu.com/us/products/codemeter.html

Should I open source my licensing server?

Yes, but I doubt I could convince you if you haven't already been convinced by all the people smarter than mehttps://www.gnu.org/philosophy/free-software-even-more-impor...https://opensource.google/documentation/reference/why

> Open sourcing might lay bare some flaws which could be fixed. Or it might lay bare some flaws which could be exploited.If there are flaws(, and there are!) it might be preferable to have the chance to learn about them from grumpy security open source contributors than after the exploit

Open source it if you want to open source it.Don't open source it because you want/need/expect other people to work on it because statistically, that is not going to happen.Open sourcing your project will create more work for you, not less. Good luck.

are there subcomponents you could open source to test the waters? that would allow you to build the discipline and community before going for the whole thing

Yes

If you already have the PKI, why would there be a need for blockchain?

Apply to YC. Take on the major license companies like Thales, Flexlm, Wibu, etc.You’ll need a lot of money and stay in it for the long run to take on companies like that. It’s possible though.

It would be an interesting idea.

This might be an area of opportunity where you could open source it however require a license for enterprise/business use.We use CodeMeter. It is possible your product may be competitive to other SW license server products.https://www.wibu.com/us/products/codemeter.html

Yes, but I doubt I could convince you if you haven't already been convinced by all the people smarter than me
https://www.gnu.org/philosophy/free-software-even-more-impor...
https://opensource.google/documentation/reference/why

> Open sourcing might lay bare some flaws which could be fixed. Or it might lay bare some flaws which could be exploited.
If there are flaws(, and there are!) it might be preferable to have the chance to learn about them from grumpy security open source contributors than after the exploit

Open source it if you want to open source it.
Don't open source it because you want/need/expect other people to work on it because statistically, that is not going to happen.
Open sourcing your project will create more work for you, not less. Good luck.

Apply to YC. Take on the major license companies like Thales, Flexlm, Wibu, etc.
You’ll need a lot of money and stay in it for the long run to take on companies like that. It’s possible though.

This might be an area of opportunity where you could open source it however require a license for enterprise/business use.
We use CodeMeter. It is possible your product may be competitive to other SW license server products.
https://www.wibu.com/us/products/codemeter.html