Top
Best
New

Posted by zdw 5 days ago

Defeating a 40-year-old copy protection dongle(dmitrybrant.com)
855 points | 286 comments
weinzierl 5 days ago|
These dongles used to be ubiquitous and they broke all the time.

As a young intern, I arrived early one morning to find the PCB layout software (PADS PowerPCB) on our "design PC" wasn’t working. (I use quotes because it was just the beefiest machine we had, naturally our boss’s PC, which he kindly shared)

Obviously the dongle. I tried unplugging and replugging it, with and without the printer daisy-chained. Nothing.

So I begrudgingly asked my colleague who’d just arrived. He looked at the dongle, looked at me, looked at the dongle again, and started laughing.

Turns out our Boss had stayed late the previous night processing customer complaints. One customer had sent back a "broken" dongle for the product we were selling. Boss tested it on his PC, found it worked fine, and mailed it back on his way home.

Except he didn’t send our dongle back. He had sent my PowerPCB dongle. More fun was had when the rest of the team and finally our boss arrived. Luckily he took it with good humor.

rwmj 4 days ago||
I remember when I worked in an electronics lab one of our EEs built several "dongle buses", a parallel port "bus" that you could plug up to about half a dozen dongles in, and it was frequently fully populated on the machines we used for CAD and PCB layout. An early version of PADS (PADS2000?) was one of the applications we used.
l33tman 4 days ago|||
We had proper licenses for all PADS seats at my previous work, but all the users always installed the cracked versions because it was unusable with the dongle.
xxr 4 days ago||
>they broke all the time

While I was reading the OP I kept thinking about how an accounting firm's entire ability to do business rested on the continued functioning of a parallel-port dongle. I just have to imagine that they had a box full of these.

ruleryak 5 days ago||
Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races. As the author found, the tough part is just finding and interpreting where and how the protection was implemented. If throwing the exe in a hex editor gave you access to String Data References (not always the case, but more common than not) then you'd just fail the check you were trying to skip, find that string, hop over into assembly to see what triggered loading that, and then just alter the logic to jump over it when the time comes.
markh1967 5 days ago||
Many years ago I was a technician supporting a few custom programs on thousands of PCs. The developer of one of these programs had added a date check to his code so the program would refuse to run after a set date and each new release would increase this date by a few months so it would stop working after a few weeks if he ever stopped creating new releases. His contract ended and a few weeks later his software, now relied upon by hundreds of sites, stopped working. The contract for the software development was thoroughly checked and legal action against the developer was started but I asked to see if I could resolve the problem in the meantime.

It only took ten minutes with a dissassembler to find the JGT (Jump if greater than) and convert it to a JLT so the software would stop running if the date was before a certain date rather than after. I created a patching tool that simply flipped one bit that was sent out to all the sites and everything was good again. I don't think I'll ever beat the elegance of a single bit flip hack.

anymouse123456 4 days ago|||
If you think it's bad now, the early days of the web were absolutely filled with scumbag grifters who made small fortunes hiring contractors and then refusing to pay.

Many of them disappeared in the y2k dot com bust, but then seem to have reappeared in SF after 2008.

In the late 1990's, my second ever Flash app development client stiffed me on a $10k invoice.

He finally figured out 6 months later that he didn't have the source material to make changes and paid the full invoice in order to get it.

So I took precautions with the next client. It was a small agency that was serving a much larger business.

We were on 30 days net payment terms and I submitted the invoice when the project was done.

They didn't pay and within a couple weeks of gentle reminders, they stopped responding.

I smiled.

Exactly 30 days from the due date, I got a panicked call shrieking about their largest client website being down and did I have anything to do with it?!

I asked them what the hell they were talking about, they don't own a website. They never paid for any websites. I happen to own a website and I would be happy to give them access to it if they want to submit a payment.

They started to threaten legal nonsense, and how they had a "no time bombs clause in the contract."

I laughed because my contract had no such clause. If they signed such a contract with the client, that's not my problem.

I told them I wouldn't release the source files until the check cleared my bank, which could be weeks. A cashier's check arrived that morning and their source files were delivered.

By the end of it, the folks at the agency thanked me because that client wasn't planning to pay them and they hired me for other work (which, they had to prepay for).

Of course I don't know about the OP, but I'd bet the company was trying to stiff that contractor on their last check.

bonzini 4 days ago||
> because that client wasn't planning to pay them

Wait, you mean they used your little ruse as a means to be paid themselves??

anymouse123456 2 days ago||
Yes they did, and it worked!
Ntrails 4 days ago||||
Mostly non-malicious example... My employer asked me to write a UI to solve a problem for a handful of people until a proper (giant ever-delayed) migration was finished. Over a couple of weeks I made it work despite not having dealt with MVVM/XAML/Whatever before and I was pretty pleased with the outcome. But it was a hacked together thing! I'm not a real dev and given that I got a promise it wouldn't get distributed.

So, you know, in the program.cs startup I checked the username vs a hardcoded list of people in the relevant teams, and if it wasn't crashed out with an error and a support email address.

About 18 months after I had moved on, I got an email with a screenshot of that error message. it would appear the Milan (something like that) office had got their hands on a copy but it just wouldn't work for them...

Trivial to undo of course, but I did enjoy the throwback!

wat10000 4 days ago|||
That's a dangerous fix. What if someone tries to run your new version in the past?
superxpro12 4 days ago||
the spacetime paradox is the bigger concern imo. nothing to worry about.
hinkley 5 days ago|||
There's a lot of things going on that lead to this.

One, the developers spend more time running this code than we do, and they have to get the program working before we can even use it. So any parts of the program that are hostile to the developers risks killing the entire project. Obfuscating the copy protection can hit a point where it makes bug fixing difficult.

Two, lack of training. If you, me, and Steve each have a bag of tricks we all use to crack games, whichever one of us figures it out gets bragging rights but the game remains cracked. Meanwhile Developer Dan has to be aware of all the tricks in all of our bags together if he wants to keep the three of us out. Only there's not three of us, there's 300. Or today, probably more like 30,000.

Three, lack of motivation, which is itself several different situations. There's a certain amount of passive aggression you can put into a feature you don't even really want to work on. You can lean into any of the other explanations to defend why your code didn't protect from cracking all that much, but it's a checkbox that's trying to prove a negative, and nobody is going to give you any credit for getting it to work right in the same way they give you credit for fixing that corner glitch that the QA people keep bitching about. Or getting that particle animation to work that makes the AOE spells look badass.

miki123211 5 days ago|||
Another method (much more common for software that asks for two pieces of information, like a name and a key) is to take a memdump of the process at the "your key is invalid" dialog, find the invalid key you just typed, and hope that a valid key is somewhere nearby in memory. Unlike the assembly trick, this requires 0 programming expertise beyond the ability to type `strings` on the command line.

This works because some programs use a hashing algorithm to calculate the key based on the name, do a strcmp, and pop a messagebox if the keys don't match, without zeroizing the valid key buffer first. If the key buffers are on the stack (or if the two mallocs just happen to use the same region in memory), it is often easy to find a valid key if you know where the invalid one is.

I guess software that derives keys this way is far less common than it once was, but I know of somebody who cracked something using this method just a few years ago, so it still pops up from time to time.

alias_neo 5 days ago|||
When I was a child, in the 90s, I did this all of the time.

Input a unique string I could watch for, fire up SoftICE, watch for the string, and then step through until the == comparison happened, then either grab the calculated key and input it, or patch the comparison from == to != or just return true, depending on the implementation.

SV_BubbleTime 4 days ago||
SoftICE was such a gift and pain in the ass.

I did a massive crack that involved a program and it’s inf/dll hardware driver package.

Some of the most rewarding work I’ve done and also just so tedious!

Having to stop the OS like that and accidentally getting to the kernel but then not wanting to lose my position so having to hit step over and step out until just the right place… whew.

burnte 4 days ago||
Yep. I used SoftICE to do a few of these dongle-workarounds. Amazing and terrible software. :D
alias_neo 4 days ago|||
Haha yeah. It was mostly just fun for me as a nerdy child who spent way too much time on Astalavista forum.

Cracking and RE were just gateways into a career in (defensive) security for me.

phatskat 4 days ago|||
I honestly can’t recall how I even found SoftICE, but my uncle gave me a floppy with LJPEGViewer and the license was written on the disk. Eventually I lost the original but I’ll be dammed if I’m going to use Paint. I fired up SoftICE, managed to break before the “invalid key” dialog, and just did a cute little “return true” and that was that
compsciphd 4 days ago||||
mellanox switches included an executable keygen in their firmware bundle. It could be used to both generate a key (given feature set) combined with a secret, but could also be used to validate what features a given key gave you (using the secret). Hence, the secret was stored in the binary and was easily visible with strings and one could then just use the tool itself to generate keys.
jasomill 4 days ago||
Sort of reminds me of the DEC PAKGEN tool to generate licenses for the VMS license management facility, which DEC distributed so third-party software vendors could issue licenses for their own software.

To prevent vendor A from creating licenses for vendor B's products, each DEC-issued PAKGEN license only authorized license generation for a specific named vendor's products.

As with all other DEC-supplied VMS software, PAKGEN was licensed through the VMS license management facility.

Thus if you could somehow get a PAKGEN license for the vendor name "DEC", you could use it to generate licenses for arbitrary DEC products.

Including PAKGEN itself.

And you could therefore generate licenses authorizing PAKGEN to generate licenses for arbitrary vendors' products.

Thorrez 4 days ago|||
The proper thing to do is not to zeroize the correct string memory before comparing. The proper thing is to only store the hash in the binary in the first place, not the correct string. (Although having a 2nd layer of hashing before comparing might also be a good idea, and in that case you would want to zeroize the 1st hash before comparing the 2nd hash.)
miki123211 3 days ago||
You can't not store the correct string in this case, as the key is calculated from the user's email address. There is an infinite number of possible keys. THe only way to check if the key is correct is to recalculate it yourself.

These days, I guess you could make the key an ECDSA signature for a public key embedded in the binary if you were willing to accept such long keys.

antonvs 5 days ago|||
> Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races.

I did that with dBASE III, which used ProLok "laser protection" from Vault Corporation - a signature burned onto the diskette with a laser. Back then, I found it amazing that Ashton-Tate actually spent money to contract with a copy protection company for something that could be so easily defeated by a teenager reading assembler.

They could have easily just written the same kind of code themselves. An example of the power of marketing over substance.

I was able to replicate that protection mechanism just by scratching a diskette with a pin. The "laser" was a meaninglessly advanced-sounding solution that added no value compared to any other means of damaging a diskette.

Aaargh20318 5 days ago|||
I remember doing something similar with Lemmings 3D. You could simply NOP over the JMP into the copy-protection subroutine. It was surprisingly easy.

Made me feel like such a badass hacker at 15 years old.

p1mrx 5 days ago|||
When I was 10 or so, I "cracked" Slam! Air Hockey for Windows 3.1 by opening the exe in EDIT.COM and replacing some random binary garbage with spaces. After a few attempts, I managed to bypass the shareware dialog but also introduced some weird bugs that I don't recall the details of.
2Gkashmiri 5 days ago||||
"Cheat enginge"

This was one of those things you really really wanted but once you toyed with it, it sucked the fun out of games and they felt pointless.

foresto 5 days ago||||
> I was able to replicate that protection mechanism just by scratching a diskette with a pin.

How did you figure out where to scratch it? Was the laser mark visible on the original disk, or did you have to read the code and orient based on the diskette's index hole?

anyfoo 5 days ago|||
Yes, it was apparently very visible: https://martypc.blogspot.com/2024/09/pc-floppy-copy-protecti...

But as I mentioned in a sibling comment, I’m not sure it was ever confirmed that it was really a laser that made that mark.

antonvs 5 days ago|||
I described two different scenarios: defeating the protection, and replicating it, e.g. to protect your own software without paying Vault for their "laser" protection.

Defeating the protection didn't involve knowing anything about the laser mark - as the comment I replied to described, it just involved changing a conditional jump to an unconditional one.

Replicating the protection involved causing minor damage on the diskette - the details don't really matter, laser, pin scratch, whatever - then formatting the disk, and registering the pattern of bad sectors created by the damage. A normal copy of the disk didn't replicate those bad sectors exactly, which made it possible to detect that the original disk was not present.

lstodd 5 days ago||
Ha! I remember disk copy programs which read these bad sector patterns and then replicated the error pattern in software (not on physical disk obviously).

Similar stuff was later used for CDs IIRC.

anyfoo 5 days ago|||
Was ist ever confirmed that it was in fact a laser? I wanted to make a trivia question out of this ProLok protection, because “lasers for copy protection” sounds just weird enough to potentially be a nonsense answer without context, but I couldn’t confirm that the holes were indeed made with lasers, and not with other means.
antonvs 5 days ago|||
Good question. I don't know the answer, but I'm quite certain that it didn't really matter what mechanism was used to mark a diskette. Any damage would be equally strong as a way to detect copying.
anyfoo 5 days ago||
Yeah, it matters only in “interestingness” or “coolness”.
Someone 4 days ago|||
Their patent (https://patents.google.com/patent/US4785361A/en) doesn’t mention a laser, but of course that doesn’t imply it wasn’t a laser.

I would guess (more or less) identically damaging multiple floppy disks in the same way would be easier with a laser than with something mechanical (e.g. a knife or a drill) (it is fairly easy to control power and duration of a burn), so it might well have been a laser.

On the other hand, disk tracks weren’t exactly tiny at that time in history.

anyfoo 4 days ago||
It could be a tiny drop of something corrosive, but with that I’m also still wondering if a laser isn’t simpler, yeah.

I have almost no doubt that it could be a laser, it’s just unfortunate (and maybe a little bit suspicious) that I haven’t found it confirmed anyway. Almost like they wanted it to be a laser (hence the folklore around it), but had to use a less cool method to do it. But of course it might as well just have been a laser, and they for some reason declined to market or even just document it that way, for whatever reason.

anilakar 5 days ago|||
A certain automation system vendor uses proper USB license dongles in their PC software but they do not do challenge-response authentication. Instead they send a hardcoded string to the dongle and compare the response against a list that contains various software feature levels.

The whole automation system including machinery costs anywhere from 200k to 1M yet Vendor™ tries to milk the customers dry with a 1.5k software license that lets you manage up to 254 physically* connected systems. I'm pretty sure the license dongle is in reality designed to prevent casual tinkering of parameters, which is something only service techs should do.

*You can circumvent this with serial-over-Ethernet converters, which has resulted in an Industrial Internet of Shit-level security nightmare as companies happily expose their systems over the internet, thinking that license dongles are a substitute for authentication.

m463 5 days ago|||
I remember I had some demo software that could be enabled with a code. I was just curious and at the code prompt, I entered the debugger. I dumped the process space and there was a nul-terminated string of letters and numbers. I restarted the process and entered them at the prompt and voila, it was enabled.

(I did go on to pay for the software)

ale42 5 days ago|||
I remember an icon editor (or something similar) for Windows 3.1, it was a shareware where you could enter a code to remove the nag screen. No crack was necessary, I basically managed to enter valid registration codes by just typing random numbers. In the end I had enough valid numbers that I could figure out the logic, it was something about the sums of digit groups.
jasomill 4 days ago||
This was true for the 10-digit CD keys Microsoft used for many products in the 90s: the first three digits could be almost anything, and the last seven digits had to sum to a multiple of 7, so, e.g., 111-1111111 was a valid product key (for any product that used the scheme).
bombcar 4 days ago||
I think it was StarCraft where we’d just try random keys until it would work, usually only three or four needed.
jeffwass 5 days ago|||
I was wondering this actually, why not just skip past the check entirely instead of going through the effort to pass the check without the dongle?
harph 4 days ago||
Because sometimes skipping is not enough: https://mrwint.github.io/winter/writeup/writeup.html
alfiedotwtf 5 days ago||
Cracking is so fun because we have Slides!
giamma 5 days ago||
This reminds me the old days of Windows 95 when I found a software to burn CDs that had a trial version which was limited to 150MB of data or so. If you tried to create a CD bigger than that it would refuse to burn and it would instead open a popup and tell you that the image exceeded the limit of XYZ blocks allowed by the trial version.

So I first decompressed the executable program (Windows executable were often packed at that time [0]), then I opened a binary editor, looked for that specific number in hexadecimal notation in the binary and changed to something much higher. I was than able to burn CDs without limitation.

[0] https://en.wikipedia.org/wiki/Executable_compression

notpushkin 4 days ago|
My grandma used to be playing casual games from a certain publisher on her PC. They were all trial versions, though, limited to 30 minutes or so. Turns out, the time left was stored in the registry, and didn’t have any validation – so when a 10 y.o. me made a quick edit, she was left with 4294967295 minutes of trial left.
davidwritesbugs 4 days ago|||
Hope she knows she still only has 3million trial days left
stvltvs 4 days ago||
Grandson was naive to his grandmother's mortality.
notpushkin 4 days ago||
Yep – she died a couple years ago.

Hope she enjoys the full version of life better than the trial we live in :’)

itsTyrion 4 days ago||||
I used to patch games for my mom that had a different mechanism but also 30 min of trial. got 5 bucks for each one and mom didn't have to pay 15-30. good times and the easiest money ever
compsciphd 4 days ago||||
back in the mid to late 90s, I got a trial for compuserve that was a free 2 month trial. I liked it as as they provided dialup PPP access so was able to use it as full time internet access. It wasn't quite "2 months" of access though. It was 1500 hours of access (which in practice > 24*62).

However, their usage accounting software wasn't great. I had it setup to reconnect if the connection dropped, and they didn't do a great job seeing this, so they accused me of using 2-3k hours during those 2 months (should be impossible if always coming from the same #) and sent me a large bill (for the hours used over 1500). They eventually gave in when I showed them it was impossible and they could validate that the calls were coming from the same line due to the connection dropping and being simple reconnections.

marssaxman 4 days ago|||
Back in the same era, an enterprising young hacker of my acquaintance obtained unmetered access to another of those pay-by-the-hour dialup services by messing with window Z-order. The dialup service's GUI client had a free tech support area; billing stopped once you opened its window, and did not start again until you closed it. The rest of the system was all still there and running as usual - you just couldn't click on any of it while the support-area window was active.

So... this kid whipped up a little bit of code which let you force the topmost window to the back, and proceeded to spend impressive quantities of time online doing apparently nothing in the online service's free support area.

hypercube33 4 days ago|||
Heh there was some ad supported dial up Internet I found. you were supposed to download their browser and it'd dial in and work normal enough.

I noticed it created a windows dial up connection. When you launched the browser the login info worked on this. I could just dial their server and save the username and password and use any browser or game normally.

nonamenoslogan 4 days ago||
Was this NetZero? I kind of recall their CDs would do something similar, launch an Ad supported version of Netscape--but if you just copied the Dial-Up connection it made, you could recreate it without the need for the Browser.
486sx33 4 days ago||
Eventually NetZero forced you to use their own dialer to ensure you kept the ads running… but you could spy on the ppp connection by just opening the COM port of your modem in terminal and watching. The password was encrypted (xor?) but you could just copy and paste the value into a regular dialer lol
andreaven 4 days ago|||
you were lucky it was an unsigned var..

otherwise you could have gifted a very nasty trial time of -1 minute! a pretty nice anti-addiction feature :-)

notpushkin 4 days ago||
Hahaha. On a second thought I think it was a bit trickier and did some weird math to obfuscate the value (probably something simple, like XOR).

So yeah, my actual fix was to mash buttons until I got a big enough number :D

nsoonhui 5 days ago||
I write civil engineering software [0] and am familiar with this kind of dongle. Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation. They feel secure only if they have something tangible in hand.

Since we sold (and still sell) perpetual licenses, it becomes a problem when a dongle breaks and replacement parts are no longer available. Not all users want to upgrade. Also, you may hate cloud licensing, but it is precisely cloud licensing that makes subscriptions possible and, therefore, recurring revenue—which, from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade.

Also, despite investing a lot of effort into programming the dongle, we can still usually find cracked versions floating online, even on legitimate platforms like Shopee or Lazada. You might think cracking dongles is fun and copy protection is evil, but without protection, our livelihood is affected. It’s not as if we have the legal resources to pursue pirates.

[0]: https://mes100.com

b1temy 5 days ago||
> You might think cracking dongles is fun and copy protection is evil, but without protection, our livelihood is affected.

I understand you might feel this way, but it seems to me customers are mostly business clients, who would are more inclined to spare the expense of purchasing said licenses, since they're not personally buying it themselves, and would want to have support and liability (i.e: Someone to hold liable for problems in said software.). In fact, having no copy protection would probably have saved you the problem you mentioned where a dongle breaks and replacement parts are no longer available; this is one of the talking points that anti-drm/copy protection people advocate for, software lost to time and unable to be archived when the entities who made such protections go out of business or no longer want to support older software.

> even on legitimate platforms like Shopee or Lazada.

On a slight tangent, but I personally don't find either platform legitimate (Better than say, wish[.]com or temu, but not as "legitimate" as other platforms, though I can't think of a single fully legitimate e-commerce platform). Shopee collects a ton of tracking information (Just turn on your adblocked, or inspect your network calls. It's even more than Amazon!), is full of intrusive ads, sketchy deals, and scammers. You yourself said you can easily find cracked versions of the dongle there, which doesn't speak well for the platform. And Lazada is owned by Alibaba Group, which speaks for itself. I'm not sure why consumers in South East Asian regions aren't more outspoken about this, since they seem to be the some of the more popular e-commerce platforms there.

samplatt 5 days ago|||
>business clients, who would are more inclined to spare the expense of purchasing said licenses, since they're not personally buying it themselves, and would want to have support and liability (i.e: Someone to hold liable for problems in said software.)

This is a nice idea but the reality is that there's MANY corporate customers who are happy to get away with casual piracy. Sometimes it's a holdover from when the company was small enough that every business expense is realistically coming out of their own pocket, sometimes they're trying to obfuscate how much their department actually costs to the company at large.

You think individual consumers lie to themselves to justify software piracy? Corporate self-deception is a WHOLE new kettle of fish.

kcplate 5 days ago|||
I can tell you that piracy in the corporate world was RAMPANT in the ‘90s. I made a nice sum of money back in the day as a freelance auditor for companies trying to get their legal ducks in a row. Productivity software like Lotus, WordPerfect, Word, Excel were just mass installed off one license because there was no product activation keys or any sort of license validation methods.

Dongles were pretty commonplace on your more expensive software products from mid 90s through the early 00s. If I was publishing software that was a >$1000 a license, I damn sure would have used them.

Plasmoid 5 days ago||||
Even at a simple level, if it's between spending weeks going through purchasing or not asking too many questions and getting on with it. I can see a lot of people choosing option B.
BobbyTables2 3 days ago|||
Also don’t underestimate the stupidity of inexperienced employees in their mid 20s…

One found someone installed a cracked Adobe Photoshop on a work PC. Probably a stupid one/off task. We were not graphic artists. Not 100% sure who did it but it was in an area only a few people had access.

The risk management team was not amused…

IshKebab 5 days ago|||
Yeah case in point - how many people actually pay for Visual Studio? You're supposed to if you're using it for commercial purposes but I don't think I've ever seen a commercial license used (though I don't do a lot of Windows work tbf).
samplatt 5 days ago|||
VS is actually one of the cheaper tools in our stack; Unity (the game engine) is probably the most expensive one at the moment, and it's going to get much more so with their recent changes to licensing structure for embedded hardware.
Joel_Mckay 4 days ago||
Unity has always had janky shaders, the fact people still use it over Unreal Engine or even Godot is completely baffling.

Unity is getting way too cheeky considering how they started out. =3

wongarsu 4 days ago||
For anything smaller than AAA, C# is just generally much more pleasant to work in than C++. That's Unity's edge. And Godot is the "new" kid on the block

I'd agree that between Unreal and Godot, Unity doesn't look very attractive right now. But inertia will carry them for a long time

samplatt 4 days ago||
Programming semantics is a large part of the equation, but it's a secondary part. Unity is just too damn EASY for spinning up a prototype and gluing other modules onto it. C# is a part of that but simple implementation is so much easier and powerful than other engines.

This goes out the window for polished end products but that's a different argument... but by then the ship has often already sailed and you're already using Unity.

Joel_Mckay 3 days ago||
A few of those Unity store Assets are Copyright submarines. Where the original rights holders work was slightly tweaked to avoid detection for royalty fees in some jurisdictions.

Those assets end up being a liability later after publishing, can get your content DMCA flagged, and a firm sued (you will 100% lose in court if you don't settle.)

The Unity store does not prevent this issue, and kit bashing fun became dangerous to a publisher on the platform. It was impossible to determine what is safe with the new LLM tools, so the board banned the platform and engine.

Firms do make this mistake everyday, or just license generic Reallusion content. =3

"There is a bear in the woods. For some people, the bear is easy to see. Others don't see it at all. Some people say the bear is tame. Others say it's vicious and dangerous. Since no one can really be sure who's right, isn't it smart to be as strong as the bear? If there is a bear." (Hal Riney)

electroly 4 days ago|||
In the late 90s/early 00s, I worked at a company that bought a single license of Visual Studio + MSDN and shared it with every single employee. In those days, MSDN shipped binders full of CDs with every Microsoft product, and we had 56k modems; it was hard to pirate. I don't think that company ever seriously considered buying a license for each person. There was no copy protection so they just went nuts. That MSDN copy of Windows NT Server 4 went on our server, too.

This was true of all software they used, but MSDN was the most expensive and blatant. If it didn't have copy protection, they weren't buying more than one copy.

We were a software company. Our own software shipped with a Sentinel SuperPro protection dongle. I guess they assumed their customers were just as unscrupulous as them. Probably right.

Every employer I've worked for since then has actually purchased the proper licenses. Is it because the industry started using online activation and it wasn't so easy to copy any more? I've got a sneaky feeling.

andyjohnson0 4 days ago||
> In the late 90s/early 00s, I worked at a company that bought a single license of Visual Studio + MSDN and shared it with every single employee.

During roughly the same time period I worked for a company with similar practices. When a director realised what was going on, and the implications for personal liability, I was given the job of physically securing the MSDN CD binder, and tracking installations.

This resulted in everyone hating me, to the extent of my having stand-up, public arguments with people who felt they absolutely needed Visual J++, or whatever. Eventually I told the business that I wasn't prepared to be their gatekeeper anymore. I suspect practices lapsed back to what they'd been before, but its been a while.

numpad0 4 days ago|||
Yeah, there is a reason why Adobe, Autodesk, Oracle, IBM, etc., are notorious for weirdly draconian and idiotic-sounding licensing enforcement. Many corporate managers show very little sympathy to the concept of IP laws if they did understand superiority of laws over convenience in the first place.
quietbritishjim 5 days ago||||
> who would are more inclined to spare the expense of purchasing said licenses, since they're not personally buying it themselves

They often need to "purchase" the license themselves in the sense of convincing someone higher up to buy it - so they're spending their time, which is still a sort of expense.

Also, piracy in companies is often just honest people who are in a bit of a hurry and need this software running on some other PC right now, or just want their colleague to give it a quick go (but then they end up using it all the time). Copy protection helps keep those honest people honest.

tonyedgecombe 5 days ago||||
> I understand you might feel this way, but it seems to me...

I always thought that selling B2B. Then I started checking and it was much worse than I expected. Big corporates were mostly fine but small to medium sized business were pretty bad. Also Asia was much worse than Europe and the US.

acdha 4 days ago||||
> it seems to me customers are mostly business clients, who would are more inclined to spare the expense of purchasing said licenses, since they're not personally buying it themselves, and would want to have support and liability

Trust the people whose paychecks depend on it, it was extremely common. I knew multiple people at different companies who had endless stories about customers buying a couple of copies for a large department to “share”, and they expected the vendor to support everything because it was “business critical”. This was also a problem for things like student licenses where people would expect enterprise-level support despite the massively-discounted copy they had clearly stating it was only for educational usage.

This has a lot of negative aspects for preservation, downtime due to issues with licensing, challenges around virtualization or hardware replacement, etc. so I don’t love the situation we ended up in but it’s entirely understandable given how pervasive theft was – there were a ton of small businesses which ran entirely on bootlegged software. Software developers have high leverage but if you aren’t in a mainstream market you’re not going to get over the threshold where you’re no longer worried about making payroll.

eduction 5 days ago||||
You’re using “spare” incorrectly. It means to avoid. “Spare the expense” means to avoid having to pay for the license. Which seems to be the opposite of what you are saying.

“Spare the money” is probably what you mean. That is to part with the money, to avoid having it, for example by spending it. Or by giving it away - As in “can you spare a dime.” The is the inverse of sparing the expense, just as an expense is the inverse of money.

b1temy 5 days ago||
Yes, I meant to say "spare no expense" (though it isn't a drop in replacement, the sentence would need to be restructured slightly).
bradley13 4 days ago|||
The honestly of clients, even businesses, is...questionable. I have an acquaintance who sells a very expensive software suite that is absolutely needed in a particular industry. Price for a perpetual license is 6 digits.

The big boys in the industry won't risk problems, and anyway, that's a small price for them. However, the many smaller companies? They may absolutely need the software, but that's a substantial price for them. If they can get a cracked version online, they do.

And the cracked versions? They are made by companies out of legal reach: Russia, Belarus, Pakistan, India. They crack the software, and either put it online for free, or even have the cheek to sell it for a reduced price.

I've told my friend/acquaintance that he really needs to put the software in the cloud, accessible only via browser. However, this would be a massive undertaking, so he hasn't done it (yet).

throw101010 5 days ago|||
> Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation. They feel secure only if they have something tangible in hand.

In my experience this continues to this day due to people who require drawing on air-gapped computers, because the drawings/simulations they work on are highly sensitive (nuclear, military, and other sensitive infrastructure).

But I'm sure there are also old-fashioned people who like the portability/sovereignty of not having to rely on a third-party license server as you suggest.

izacus 5 days ago|||
What's old fashioned about not having your business ability dependant on the vendors crappy cloud license check?
wildzzz 4 days ago|||
Hardware dongles are incredibly rare now. Even on airgapped machines, you'll see a local Flex license server running. This is especially true when you have a small network of multiple machines that may require the use of a network license. Dongles are just too delicate, they get lost or break. Or you end up with overzealous security software that decides to block anything that isn't a mouse or keyboard. There are plenty of modern day solutions for a transferable license.
jweather 4 days ago|||
In my small corner of technology (AV) I regularly use three products with physical USB license keys: Crestron VC-4, Scala Digital Signage, and Dataton Watchout. Two of them have a "virtual license key" option that costs extra, intended for use with a VM. I wish they were more rare...
bobmcnamara 4 days ago|||
I once had a goon glue the mouse and keyboard ports and fill the unused USBs with glue.
dataflow 5 days ago|||
> from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade.

Why should users upgrade or keep paying you when they already bought what they need and don't need anything else?

nsoonhui 5 days ago|||
Because

1. Physical dongle tends to break, and when it does, they expect us to give them replacing parts

2. They do expect bug fixes-- especially calculation bug fixes-- as the bugs are discovered. It's hard to leave their production critical apps broken like that once you know that the bugs can cause monetary or even life loss.

haspok 4 days ago|||
> They do expect bug fixes-- especially calculation bug fixes-- as the bugs are discovered.

Maybe I'm the weird one to expect reasonably bug-free software, and if a bug is found, an eventual bugfix "for free"? ESPECIALLY if they cause monetary or life loss!

A bug means the developer did not do their job. Let's not pretend this is OK.

dataflow 4 days ago||
I'd argue software isn't even special in this regard either. If your battery burns down someone's house you better recall all units and replace them with better ones. If you feel that is a reasonable thing to expect your industry, insurance is the solution to that. If anything, your job is easier as a software engineer given that you can deploy fixes remotely and immediately, not harder. Expecting people to pay a subscription as if this is somehow the only solution to a novel problem doesn't make sense, as I see it.
Dylan16807 5 days ago||||
Wanting to say in business makes sense, bug fixes make sense.

But the actual dongle... look, something like that should have a 30+ year warranty. There should be a plan for how to replace it a couple times before making the initial sale.

bigbuppo 5 days ago||
They actually have this solved with iLok... You can move the license to new dongles at will. And they have a relatively inexpensive annual service where they'll issue you temporary licenses for what was on the ilok while you ship it back the defective dongle to them. Mostly used for DAW software and plugins, but apparently a few other things have used it for licensing.
atomicUpdate 4 days ago|||
If my car’s brakes have a design flaw and don’t stop my car reliably, I don’t expect to have to keep paying for my car to get them fixed. The manufacturer’s warranty covers that, and bugs in your software fall into the same bucket.
xp84 5 days ago||||
Honestly, if they never need anything more from the developer, a perpetual license and never spending another dime seems fine. However, in modern times, OS vendors (especially one named after fruit) tend to break a ton of APIs and change rules with every "major release," meaning developers have to invest a ton of effort to at minimum meet all those new requirements every year (!) or else the app will at best look out of place, more likely look totally screwed up and exhibit sudden "bugs" due to the unexpected OS changes, or at worst, crash.

Then users are suddenly all over the developer to provide an update "so I can use this on Tahoe" or whatever, and unless the application is in its honeymoon period where new sales suffice to keep money flowing, the developer is gonna need recurring revenue in order to do recurring development.

hdjrudni 5 days ago||
Right, but then you're providing tangible value to the customer and thus it's warranted to charge again.

The fairest thing to do is when a customer buys the software, they're entitled to that exact version forever. Or maybe 1 year of updates and bug fixes if you're feeling nice. If they want the next version that supports the next OS, it's fair to charge some more.

This what IntelliJ does. When I buy their IDE I can use it forever, and then they offer discounts for renewing. Pricing seems reasonable even though I'm currently generating $0 from my software development so I keep paying.

xp84 4 days ago||
> When a customer buys the software, they're entitled to that exact version forever

Sure. And if the audience is very broad that could be perpetually sustaining -- they're each year selling new licenses to people who just became old enough to want that type of software. You can see how a major IDE can afford to do that, right?

What it is really bad for is more niche software. This software often reaches its whole addressable audience in just a few years, and then revenue dips toward zero until the random occurrence of an OS breakage, which may take 1 year or 5 years. And some people even expect that "unbreaking" update to be free.

Obviously everyone has a right to refuse to buy under any business model other than a perpetual license if they wish. But I think that refusal to consider paying for subscription-based software under any circumstances greatly decreases the options that are going to be made at all, as the perpetual license model is absolutely unsustainable to all but the largest developers, and the apps with a very broad, naturally-replenishing audience. Everyone else will either quit or make ad-supported crap.

mschuster91 5 days ago|||
> Why should users upgrade or keep paying you when they already bought what they need and don't need anything else?

Because things evolve and inevitably, hardware dies, and you can't get a replacement.

With an old "dumb" piece of machinery, when something breaks you can either repair the broken part itself (i.e. weld it back together, re-wind motor coils), make a new part from scratch, have a new part be made from scratch by a machining shop, or you adapt a new but not-fitting part. It can be a shitload of work, but theoretically, there is no limits.

With anything involving electronics - ranging from very simple circuitry to highly complex computer controls - the situation is much, much different. With stuff based on "common" technology, aka a good old x86 computer with RS232/DB25 interfaces, virtualization plus an I/O board can go a long way ensuring at least the hardware doesn't die, but if it's anything based on, say, Windows CE and an old Hitachi CPU? Good fucking luck - either you find a donor machine or you have to recreate it, and good luck doing that without spec sheets detailing what exactly needs to be done in which timings for a specific action in the machine. If you're in really bad luck, even the manufacturer doesn't have the records any more, or the manufacturer has long since gone out of business (e.g. during the dotcom era crash).

And for stuff that's purely software... well, eventually you will not find people experienced enough to troubleshoot and fix issues, or make sure the software runs after any sort of change.

nopakos 5 days ago|||
Hey, fellow civil-engineering-software designer here! [https://www.anadelta.com/en/anadelta-tessera/] Same story, same problems with dongles, perpetual & subscription licenses.
SecretDreams 5 days ago|||
> which, from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade

This take is diametrically opposite to what end users need. In a world where "if it ain't broke, don't fix it" is perfectly fine for the end user, buying a one off license for a software seems much more sane then SaaS. SaaS is like a plague for end users.

I don't condone piracy, but I also don't condone SaaS.

nsoonhui 5 days ago|||
In a perfect world, I would have agreed with you, even if it's diametrically opposite to my interest as a software developer cum business owner.

But in an imperfect world whereby our dependencies ( software components that we use) and platforms that we need to build/rely on ( like Civil 3D) do charge us on annual basis, and that some of users expect perpetual bug fixes from us, with or without a support contract of sorts, SaaS seems to only way to go for our sustainability.

SecretDreams 5 days ago|||
There's gotta be better middle ground. Release something polished and only fix major bugs/vulnerabilities for free (because that's a liability). Minor bugs are accepted for a one off cost (I'm still using Microsoft 2016, e.g.).

We've all got to push back against these bloated saas models that don't bring tangible benefits to end users and serve only to pad company valuations. Make new versions of your software with features meaningful enough to encourage people to upgrade and outline support periods for existing software sales after they buy a one-time license. There's gotta be a better way. For everyone (except big tech CEOs).

j16sdiz 5 days ago||
> Release something polished..

That's why software keep adding bloat fancy buttons and change color scheme every few years. This is anti-productive.

lazide 5 days ago||||
Just charge for support, or if that is too harsh. If that is too harsh, charge for upgrades (but give point/minor bug fixes for the version they have for free).

No support contract? Pound sand.

bruce511 5 days ago||
This sounds good, but in the real world it leads to massively upset customers.

The problem exists from both sides of the coin. Firstly the bulk of customers don't purchase a support contract. So there is very little income to pay staff. So the "support" department has very few people. They're also not very good because low wages means staff turnover.

Then Betty phones with a problem. Significant time is spent explaining to Betty that we can't help her because she (or more accurately her company) doesn't have a contract. She's fighting back because an annual contract seems a lot for this piddly question. Plus to procure the contract will take days (or weeks or months) on her side. And it's not I any budget, making things harder. Betty is very unhappy.

The junior tech doesn't want to be an arsehole and it's a trivial question, and is stuck in the middle.

We switched to a SaaS model in 2011. Users fell over themselves thanking us. They don't have to justify it to procurement. The amount can be budgeted for. No sudden upgrade or support fees. Users get support when they need it. The support department is funded and pays well, resulting in low staff turnover, and consequently better service.

Plus, new sales can stop tomorrow and service continues. Funding for support remains even if sales saturate the market.

Consumers may dislike SaaS, but for business, it absolutely matches their model, provides predictability, and allows for great service, which results in happy Users.

darkwater 4 days ago||
> We switched to a SaaS model in 2011. Users fell over themselves thanking us. They don't have to justify it to procurement.

In the companies I've worked for so far since SaaS became a thing you absolutely need to go through procurement for a big enough purchase. You actually need to negotiate the contract each time it expires, which is IMO more burden on the end user than buying a one-off license.

bruce511 4 days ago||
Sorry, I should be more clear. Yes there is a procurement process. But that happens out of band to the support request.

The problem with support contracts, or support requests solved by an upgrade, is that the User needs it now, not after a procurement process.

Doing procurement annually is easier because it can be planned for, budgeted for etc, and happens on a separate thread to the actual support.

Even when they overlap there's enough grace to keep the User happy while waiting on the customer.

xp84 5 days ago||||
> "if it ain't broke, don't fix it" is perfectly fine for the end user

That's okay, but in say, 2 years when Mac OS 28 completely bricks the app, the developer will not be there to give you an updated one (even if you're willing to pay), since most of the addressible market already bought the app in 2025, and after 2 years with almost no revenue, the developer stopped working on it, deleted the repo and moved onto another project. The developer can't even rely on a future OS update "encouraging" people to buy "App (N+1)" since it might be "ain't broke" for 1 year, or for 5.

The point of a subscription is not to rip you off, it's to acknowledge a few realities:

1. For reasons beyond developers' control, platform vendors do not provide a "permanent" platform, but a shifting one without any long-term guarantees. You can put a 100-year certificate into your app, but the OS vendor might decide that only certs with expiration less than 45 days are okay and your app no longer works unless you're around to (A) keep abreast of the platform's rules and changes, and (B) ship an update.

2. Many software offerings need to provide a server-side component, which is never a one-time cost.

3. Relying on upgrade purchases to sustain a product gives developers perverse incentives to shove a ton of new features just to be able to pitch "Upgrade to Appitron 2!" with a ton of bullet points, whereas subscription pricing incentivizes them simply to keep users loving the app forever, including adopting new technologies but also just improving the core experience.

Due to 1 and 2, it makes sense to let users who stop using the program after a short time pay very little, and to let users who rely on the continued operation of the program, pay a little bit each year, instead of paying $500 once and using it for a few years, and maybe upgrading for $250.

alkonaut 5 days ago||||
> I don't condone piracy, but I also don't condone SaaS.

What's wrong with SaaS?

If we didn't sell our desktop software to ~1000 companies as a SaaS then few would afford it. We could sell one-off/perpetual licenses for maybe $1M but only our biggest customers would manage that expense, while smaller competitors would not. And if that means we sold only 300 licenses, then the price would be even higher because the number of licenses sold would be even smaller. The SaaS is basically what the customers ask for. They can cancel and switch to competing software when they want to. In fact, customers who use the software rarely feel the SaaS yearly cost is too high so ask for even more SaaS-y functionality such as paying by minute of use or per specific action like "run simulation", instead of having a yearly subscription. Because they might just use it a few days per year so they feel that (say) $10/yr is too much.

charcircuit 5 days ago|||
If a user gets ongoing value from software it makes sense for them to be willing to pay ongoing for that value. What users need is that the value they get from a product is more than the money they are trading for it. A one off license would be the result of a race to the bottom due to competition.
icameron 5 days ago|||
Sure, if there is increasing or evolving utility being offered. But it’s also fair to charge for upgrades in that case.
SecretDreams 5 days ago||||
If I get ongoing value from my fully paid off car, should I keep paying the OEM? How about my house or my bike or my shoes? My toilet (huge ROI on this one)? My fridge?? Why do we feel that software gets to impose this ridiculous SaaS model? The only real answer is "because they can", not because it's helping anyone.

Reality is that many modern software developments have plenty in common with designing a toilet. You spend time identifying the problem statement, how you can differentiate yourself, prototype it, work out the bugs, ship the final product, and let sales teams move the product. The difference is the toilet can't be turned into a SaaS (yet) and, if it ever could, that would break functionality because you're supposed to poop in it, not have it poop on you.

MiddleEndian 4 days ago|||
The funny thing is SAAS frequently provides less value because of automatic updates. If your toilet could change its shape at a moment's notice because of some study on a sample of people who are entirely unlike you or even just because some random PM wanted a promotion, and you could not stop it from doing so, it would be incredibly obvious how bad that was. Yet many people in the software field try to convince users that mandatory automatic updates on their devices are a good thing.
zhengyi13 4 days ago||
... If there were an ever-evolving landscape of awful things crawling up out of my sewer through my toilet, I would very much want to pay for automated toilet updates to prevent the most recent awful crawling horror from appearing in my bathroom.
MiddleEndian 3 days ago||
If the people who produced toilets ACTUALLY cared about stopping the ever-evolving landscape of awful things, they could:

A. Release security updates independently from feature updates

B. Stop adding random features that hook you up to more unwanted landscapes, or landscapes at all (software that could run entirely locally without network access but have network access anyway, updates that force ads, the updater itself, etc.)

but they don't because that's not the actual reason they have automatic updates.

charcircuit 5 days ago||||
I think it would be fair to keep paying for a car, house, bike, shoes, toilet, and fridge. If I'm still using such great products, why not reward the creators of them. But as a consumer I am also price conscious so if a competitor can offer an equivalent product for cheaper I will go with them.
eesmith 4 days ago|||
"Creator". Huh. Interesting word.

If I have "Ajax" brand leather shoes sown by an East Asian sweatshop worker, who is the "creator" of the shoes, for purposes of benefiting from this system?

We are agreed that the company "Ajax" is not a creator, yes? Companies don't create - people create. Patented inventions are created by people, though patent ownership may be transferred to companies.

So does the monthly fee go to the skilled laborer who sewed the pieces together to give the final form? And also the laborers who turned cow hide into leather? As well as everyone involved in the shoe design? Does it also pass to their inheritors? For how long?

The house I owned was built in the 1950s by a local construction firm which is still around. There were several owners before me, including ones who remodeled and renovated it. Do all of them get part of my monthly fee? Or does it go to the woodworkers and plumbers and other builders who did the actual work?

I have books in my personal collection from authors who died decades ago. How do I reward Robert Heinlein in this "keep paying" scheme? Some of these books I bought used, so neither Heinlein nor his estate ever got a penny from me.

But that's fine, as the price point for the original sale already factored in the effect of the First Sale Doctrine.

Just like how the price of a car, house, bike, shows, etc. already factors in the reward for everyone involved, without needed an entirely new system to determine who the "creators" are, and how they get paid monthly.

And that's all assuming the fee distribution system itself is fair. We need only look to academic publishing to see unfair things can be once a system is entrenched.

chongli 5 days ago|||
There are arrangements where you continue to pay for cars and houses without owning them. They're called leases and rental agreements. They typically cost a lot less for the consumer than outright purchases and at the conclusion of the lease/rental term the consumer is free to return the car/house to its owner without compensation for depreciation or wear & tear (though car leases usually impose mileage restrictions and routine maintenance requirements).
charcircuit 5 days ago||
Rental cars and houses do exist, but you could still have fully owned cars and houses whose doors lock without paying a subscription. It doesn't have to be the full thing either. Certain tiers could disable only air conditioning for example.
My_Name 5 days ago|||
This is happening right now with cars. Regular payments or some features on the car you bought outright stop working.

Mercedes restricts the performance of some cars if you don't pay $1200 a year for the “Acceleration Increase”. You have to pay more if you want to use the power you already paid for.

BMW offer heated seats for £10 a month. The car has heated seats that work fine, and you paid for the hardware already, but they are turned off if you don't pay more.

Neither of these are anything to do with ongoing costs to the company, like support or mobile connection, they just want ongoing revenue.

chongli 4 days ago|||
Rental cars and houses do exist, but you could still have fully owned cars and houses whose doors lock without paying a subscription.

For cars maybe, but not for houses. Property law for land is very old and very well established. If someone else is able to lock you out of your house then they are the title owner, not you. If you are the title owner then you’re well within your rights to have a locksmith replace the lock on the door.

ryandrake 5 days ago||||
Seriously, I have a house full of appliances, tools, clothing, and so on, that I get "ongoing value" from and whose manufacturers don't have the gall to try to charge me monthly for. Totally unacceptable business model.
lazide 5 days ago|||
As long as no one expects updates and ongoing support beyond some pre-agreed time.

The issue is a mismatch of incentives - customers wanting things for free - even if they aren’t actually customers. Vs businesses need/want for ongoing revenue (ideally for free too!).

Both sides are never going to be perfectly happy, but there are reasonable compromises. There are also extractive abusive psychos, of course.

direwolf20 5 days ago||
There was a comment here recently — someone complained that SoundCloud doesn't treat "former paying customers" well. This complainant was a "former paying customer".

Free customers can store 3 hours of sound. This former paying customer had more than 3 hours of sound stored.

The comment said SoundCloud was a terrible company holding their data hostage, by not letting them do anything with it except delete things to get it under 3 hours, and threatening to delete all of it if they didn't.

https://news.ycombinator.com/item?id=46783575

alkonaut 5 days ago|||
If you were given the choice of buying a fridge for $0 and paying $10/mo for using it, or paying $1k and $0/mo those are both entirely valid pricing models. If you are a homeowner you probably don't want the hassle of managing subscriptions but if you are starting a business where you need fridges but don't have a lot of capital it might be worth looking into. It's basically just financing + service etc.
misir 5 days ago||||
I am not sure if the replies are serious or sarcastic
hulitu 5 days ago|||
> work out the bugs, ship the final product

This part is left out in modern software development.

Bugs ? What bugs ? We just (re)wrote a new version. This one should be better.

direwolf20 5 days ago|||
Because I ate food each day between 1 July 2013 – 31 July 2013, I didn't starve and die. I am receiving ongoing benefit from not being dead. Should I continue paying for all that food?
charcircuit 5 days ago||
No, since that food no longer exists. There's nothing the food creator can do. They can't cause it to spoil after you ate it. The massive benefit of not dying allows the price ceiling of food to be very high. But within society there is a lot of competition for nutrients which prevents food from reaching such heights.
direwolf20 5 days ago||
So when I buy a CD, I can install the software, and then grind the CD into powder, and since what I bought no longer exists, I can stop paying?
charcircuit 5 days ago||
Well the software could disable itself when you stop paying. You stop paying for the value, the software stops providing you value.
direwolf20 5 days ago||
Could the molecules from the food stop forming parts of my body?
charcircuit 4 days ago||
I am not chemist or biologist but I don't think that is possible.
direwolf20 3 days ago||
Impossibility is the only reason it can't? It would be totally legal you think?
Nextgrid 4 days ago|||
With the low cost & power of modern microcontrollers, instead of having the dongle act purely for licensing purposes you could offload some of your "secret sauce" to it (I assume your software does a lot of calculations with some hardcoded, industry-specific constants). This makes it somewhat crack-proof because cracking it would involve replicating your secret sauce - at which point they may as well just make and sell their own software instead of distributing cracks.
jbm 5 days ago|||
My dad used to use this kind of dongle for a civil engineering program called 'Cosmos'. Just wild to see it, it was so annoying to because sometimes it would simply not be detected on our 80386.
analog31 4 days ago|||
I use one engineering app that has a "soft" license. It has a lot of failure modes, all of which are essentially administrative not technological. A fair number of departments have to work together: IT, purchasing, and accounts payable (in case the company is on credit hold for non-payment of a previous license renewal) across multiple corporate divisions. It can eat up a few days of my life, and sometimes I lose access to the software for a few days.

The IT department restructures the license server or it goes down.

The vendor changes their license technology every few years.

If you have a physical dongle, the vendor will beg you to send it in and receive a soft license. The few remaining users with dongles refuse. The hardware is more reliable.

wildzzz 4 days ago||
We use Flex license server for so many pieces of software. It works well as long as everything is up and running. Several years ago, we merged with another company and slowly began to consolidate IT infrastructure. The license server was moved many times without giving proper notification to users until it eventually settled at the main DC we use. Then came the issue of renewing the license. Previously, license renewal was managed at the department level which means the users only need to go to their boss if there's an issue and only had to send one email to our local IT to apply a new license. Funding for licenses came out of a special budget so department heads didn't have to beg. Very simple and it worked fine for years. Now, everything is centralized which sounds great except that the people that manage the license server are so far removed from where we are that it can take months for a license renewal. You're not talking to people you have an email address for, you're submitting tickets to our central system where they forward it onto the license group somewhere. It used to be incredibly painful but has gotten better now that the license group is more aware of the entire division of employees that now require their services too.
hulitu 5 days ago|||
> Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation.

Sometimes, there are network interuptions. Then it is the right time to work because youtube isn't available.

huflungdung 5 days ago|||
[dead]
truekonrads 5 days ago||
The problem seems the sales model rather than the dongle:

1) a hardware and software solution implies that hardware will stop working at some point. Customers should understand it 2) you could sell them a new dongle every time support contract ends which is what I’ve experienced with Xways as an example. Even if you’re air gapped once a year usage data upload and new dongle seems fine. 3) why should users receive free upgrades and bug fixes? No software is bug free.

Finally there are several brand protection shops that fight fakes and work well with Shopee, Lazada, Facebook etc. It’s not five dollars but they will take these down effectively

lazide 5 days ago||
The model you are referring to works fine when the industry is expanding and/or legal entities turn over eventually.

Which is not uncommon.

It’s also one that is typically pretty good for customers that like to do an investment and then continue to reap benefits from it. The capitalization model.

The ‘lease’ model (SaaS) is good for customers with highly variable licensing/software needs or that expect extremely high turnover, and prefer to see these costs as, essentially ‘cost of production’. The cash flow model. It does require a lot of trust, however, that when the lease comes up for renewal the fees won’t be usurious.

Neither is necessarily wrong. A whole lot of folks are starting to realize the downsides of expenses coming out of cashflow though! And losing a lot of trust.

dehrmann 5 days ago||
> I must say, this copy protection mechanism seems a bit… simplistic? A hardware dongle that just passes back a constant number?

Seems like it was an appropriate amount of engineering. Looks like this took between an afternoon and a week with the help of an emulator and decompiler. Imagine trying to do this back then without those tools.

15155 5 days ago||
Audience matters. Something intended to stop legitimate business consumers in a non tech industry requires substantially less sophistication than something built to withstand professional reverse engineers.
dwattttt 5 days ago|||
Locks are there to keep honest people honest.

To expand on the saying, they're not there to be insurmountable. Just to be hard enough to make it easier to do things the right way.

nkrisc 5 days ago||
And often they’re there so no one can plausibly say they didn’t know what they were doing or stumbled into it accidentally. You can’t “accidentally” go through a door with a padlock on it.

I’d guess it’s something similar with this dongle. You can’t “accidentally” run the software without the dongle.

classichasclass 5 days ago||||
Copy protection was also generally less robust for educational software, since it sold to generally law-abiding folks (parents, educators, etc.). Never saw Rapidlok or V-MAX! used for educational software on the Commodore 64, for example.
Gigachad 5 days ago|||
These days there would be an Aliexpress listing selling fake dongles within a month making it easy for the business customers too.
rustyhancock 5 days ago|||
The tool of choice back then was SoftICE and it would have been trivial to trap even bios level LPT access.

More to the point the guy didn't even open the dongle, which in all likelihood was a simple set of logic gates in this case.

I'm assuming he did have a careful look at the caller to the function because his reasoning that the communicating function took no inputs is faulty.

What if the hardware has a LFSR in it and returns changing responses, and the caller can check them with a verify function else where that maintains a state and knows to expect the next in the sequence?

We have far better tools today for sure, but we understood the system better back then. The right tool is sometimes better than a sharper tool as they say.

Edit : I should add I'm aware it's very likely the actual reversing involved more steps and checks than Dimitrys blog which is narrowed to what worked.

quercusa 4 days ago|||
SoftICE was like magic back in the day.
mobilio 4 days ago|||
BPIO anyone?
bri3d 5 days ago|||
In fairness, the decompiler didn't work on the protection method :)

I think that both halves of the author's thesis are true: I bet that you could use this device in a more complicated way, but I also bet that the authors of the program deemed this sufficient. I've reversed a lot of software (both professionally and not) from that era and I'd say at least 90% of it really is "that easy," so there's nothing you're missing!

opinologo 5 days ago|||
Iremember doing exactly this kind of hack for a small telco in Bueno Aires. Extel. Around the year 2000.

In most cases it was not much more difficult than what OP described.

iamflimflam1 5 days ago||
I worked on some software that was used by telcos around that time - you were probably hacking our dongles :)
iamflimflam1 5 days ago||
Even more amazingly - that software I worked in is still being used and sold. Probably still has some of my ropey old code on it…
cyanydeez 5 days ago||
Yeah, my IT company bitshifts suspect files and provides the magic number.

The protection just needs suficirntly complex.

seblon 5 days ago||
Yeah, Software protection was very naive in the beginning. Fun fact: I owned a windows 3.11 for workgroup UPGRADE disc collection, it was clearly explained and also enforced from the setup installer. So, no previous installed win 3.0 == upgrade installer will fail. The fix: just create an empty Textfile named win.com at any place - the installer simple scans the WHOLE disk just for this existing filename. Next fun fact: in reality, the Upgrade contained the full installation, no only a delta. Men, software was so simple these days....
mikepurvis 5 days ago|
I have a childhood memory of my dad buying a shrink-wrapped copy of the Windows 3.1 Upgrade that was supposed to allow any installation of "3.0 or earlier" to become Win 3.1. it turned out when we actually tried it it only accepted 3.x though. [1]

I think he ended up pirating a 3.x install from a friend and running the upgrade on to of that; felt pretty morally clear given what the box had advertised.

[1]: eg https://www.ebay.com/itm/376080245422

goldfishgold 4 days ago||
Love the Ebay link. Where has that been sitting for the last 30 years?
mikepurvis 4 days ago||
Right?? Even if it's potentially a re-shrink, just the box period still existing in that condition is notable, especially for such a "plain" design; it's not like the full-colour Windows 95 ones for which there are probably thousands of unopened copies sitting in collectors' vaults.
dunham 5 days ago||
Back when I was a kid in the 80's. I cracked one of the Ultima games. I had it on my hard drive and didn't want to stick a floppy in every time I ran it.

The code decrypted itself, which confused debuggers, and then loaded a special sector from disk. It was a small sector buried in the payload of a larger sector, so the track was too big to copy with standard tools. The data in the sector was just the start address of the program. My fix was to change executable header to point to the correct start address.

zzzeek 4 days ago|
my story of this is Atari Macro Assembler. The floppy had a specific sector that was damaged, and the loader would test this sector to ensure it was in fact damaged. this was obvious becuase whenever loading the floppy, you had to wait for one of those big "BZZT....BZZT" things where the 810 drive was trying to access a bad sector and giving up. I was able to disassemble maybe the first 30 bytes of the boot to see it checking this and doing the jmp. I just overwrote it with a single jmp and got not just a copy but much faster loading without the BZZTBZZT part.
aizk 5 days ago||
Very cool to read an article about windows 95 still being used in production - a nice contrast to the infinite AI hype cycle over everything. Tech may move fast in flashy areas but not in the more "boring" parts of the industry.
accrual 5 days ago||
I knew of a Windows 95 host running virtualized in a corp environment until at least 2014 or so. It was surprisingly sturdy, I only had to remote into it once or twice when the old software it was running hung up on something. It was old medical software and we apparently had a couple clients still interfaced to it.
jojobas 5 days ago|||
Win95 is only 30 years old and runs natively on some modern hardware.

Apparently there is important stuff still running in emulated PDP-11s, almost double the age.

Joe_Cool 5 days ago|||
It needs quite a few fixes to even run in a VM. But it can be done: https://github.com/JHRobotics/patcher9x
jojobas 5 days ago||
This post doesn't go to to great detail, but seems to run natively:

https://www.reddit.com/r/windows/comments/1n1no1k/august_202...

userbinator 5 days ago||
It might be possible to use the rest of that RAM above the 4GB barrier as a ridiculously fast RAM disk, with an XMS driver like this one:

https://github.com/Baron-von-Riedesel/HimemSX

grishka 4 days ago||
Huh, so someone actually built this? I was thinking about something similar the other day, in the form of a Windows 9x driver that would use that inaccessible RAM as a "page file".
Joe_Cool 3 days ago||
I did a similar thing on my DOS PC. Lots of DOS software gets confused when there is more than 64MB of XMS/EMS free. So I just gave 64MB of the 128MB to smartdrv. It's more RAM drive I ever had when using DOS for work back in the day.

Win95 complains about needing REAL mode compatibility for a RAM disk though. I wonder how much performance degradation is noticeable with a RAM disk though.

shrubble 5 days ago|||
Yes certain software for Canadian made nuclear power plants, comes to mind. Was a post on the VCF forums about a job listing that required PDP-11 knowledge.
1970-01-01 5 days ago|||
The screenshots show the program was made for DOS. Very likely Windows was used just for network file sharing.
RaftPeople 4 days ago||
Ya, RPG assumed character based IO so probably a safe bet that they just ported stuff that ran on IBM character based terminals and just made it run in DOS. (I worked in RPG in the 80's)
userbinator 5 days ago||
There are subtantial amounts of large industrial processes still in operation using equipment from the late 19th century.
gnabgib 5 days ago||
Do you mean 20th? Even current looms, steam engines, stills aren't from the 18 hundreds
userbinator 5 days ago||
No, I do mean the late 1800s. Operations processing "low level" materials like agricultural, steel, and mining.
urbandw311er 5 days ago||
There are an awful lot of pieces of hardware around still using atoms from when the Big Bang detonated.
alkonaut 5 days ago||
I still develop software requiring hardware dongles. We moved from parallel to USB-A about 15 years ago and we're still on USB-A, much to the annoyance of anyone who has bought a new laptop in recent years.

The crack is a little bit harder these days as there is a special compiler that encrypts the binary using an on-dongle key, decrypting it after it's loaded.

A big reason for the dongle is to regionally control features (e.g. users in country A must not have feature X but users in country B should) and able to "expire" offline desktop software.

spicyjpeg 4 days ago|
Plenty of low-volume industrial software has never really moved on from security dongles. Most modern arcade games for instance still rely on a USB dongle to decrypt game files [1], though nowadays they typically also come with an additional layer of TPM-backed encryption as well as always online DRM (many of them are region locked and operate on a revenue share contract, where the owner has to pay a per-play fee to the game manufacturer).

These measures typically work well against piracy in the markets the game is officially distributed in (mainly Japan), but end up being cracked anyway once the game is popular enough that foreign arcades and private owners start importing older decommissioned cabinets and create demand for a way to get them running again without depending on the manufacturer's servers.

[1]: https://mon.im/2017/12/konami-arcade-drm

51Cards 5 days ago|
I was hired in the early 90's by a collection of franchises for a home care company. The privately owned head office self-developed and distributed required monthly updates to the only software franchises were permitted to run their business. The monthly updates (floppies) reset the license for another month at each location. After years of problems, poor support, and in a couple cases offices getting shut down because head office just "didn't like them anymore", they banded together to sue the owners (one of which developed the software). I did IT work for a couple of the offices and was already familiar with maintaining the software / systems. They hired me to bypass the licensing code which was a lot of fun to figure out. In the end I wrote a DOS based license generator each office had that could update their software by just getting a code over the phone for the upcoming month (or any date for 365 days). A few years later once the lawsuit settled and the company broke apart we issued a patch for the software to remove the license check completely. I should fire up DOSBox sometime so I can play with that old software again.
More comments...