(OT) lincense protection generator

[flupke]

I'm going to be distributing a program based on wxPython & python in a
few weeks time. The code will run on windows machines.

Because i don't want the users to move the folders around or mess with
the program or taking copies home to fiddle with it, i was thinking of a
way to check when the program starts that it's still on the same
directory and same computer.

That way i at least avoid unnecessary phone calls asking me for help
when they messed the program up.

I'm thinking of a function that will generate such a code and put it in
a file. Then when the program starts it checks this file and checks the
code in there with a code that it generates at that time again based for
instance on the current directory and other components unique to that
computer. It could be a long string (but what info?) and then take a
hash from it and store the hash value.

How could i construct such a code without being a total pain? For
instance i don't want to check for anything hardware related because
then my program would fail to work once the people change their hardware.
Anyway, it doesn't need to be waterproof. (not possible anyway)

Any ideas?

Regards,
Benedict

[Jarek Zgoda]

flupke napisa³(a):

I'm thinking of a function that will generate such a code and put it in
a file. Then when the program starts it checks this file and checks the
code in there with a code that it generates at that time again based for
instance on the current directory and other components unique to that
computer. It could be a long string (but what info?) and then take a
hash from it and store the hash value.

Better, generate sha1 sum of general machine configuration (i.e. what
"set" command returns) and store it on random internet node. You can be
sure nobody would get it.

Anyway, it's bad idea. Restrict program usage in license) or any other
contract), but don't do such a mess to people who pay your bills.

--
Jarek Zgoda
http://jpa.berlios.de/ | http://www.zgodowie.org/

[flupke]

Jarek Zgoda wrote:

flupke napisa³(a):

I'm thinking of a function that will generate such a code and put it
in a file. Then when the program starts it checks this file and checks
the code in there with a code that it generates at that time again
based for instance on the current directory and other components
unique to that computer. It could be a long string (but what info?)
and then take a hash from it and store the hash value.

Better, generate sha1 sum of general machine configuration (i.e. what
"set" command returns) and store it on random internet node. You can be
sure nobody would get it.

Anyway, it's bad idea. Restrict program usage in license) or any other
contract), but don't do such a mess to people who pay your bills.

Well as i said it's more to see when they tampered with the config or
the program. It's not a commercial application but it's for inhouse use
in the hospital where i work. These people are, to put it mildly, not
the most computer savant people around.
It could be handy to avoid me searching for a solution to a problem that
arises because of messing with the setup rather than a bug in the code.

Thanks,
Benedict

[Elliot Temple]

Why not check if all files you use are in appropriate directories,
but not worry about same computer?

You could also use some kind of hash on all your files, and check
that they haven't been changed using that (ie, do they still hash to
the same value they are supposed to?). (I know very little about
hashes, so don't ask me for details.)

On Jun 2, 2005, at 9:33 PM, flupke wrote:

I'm going to be distributing a program based on wxPython & python in a
few weeks time. The code will run on windows machines.

Because i don't want the users to move the folders around or mess with
the program or taking copies home to fiddle with it, i was thinking
of a
way to check when the program starts that it's still on the same
directory and same computer.

That way i at least avoid unnecessary phone calls asking me for help
when they messed the program up.

I'm thinking of a function that will generate such a code and put
it in
a file. Then when the program starts it checks this file and checks
the
code in there with a code that it generates at that time again
based for
instance on the current directory and other components unique to that
computer. It could be a long string (but what info?) and then take a
hash from it and store the hash value.

How could i construct such a code without being a total pain? For
instance i don't want to check for anything hardware related because
then my program would fail to work once the people change their
hardware.
Anyway, it doesn't need to be waterproof. (not possible anyway)

Any ideas?

Regards,
Benedict
--
http://mail.python.org/mailman/listinfo/python-list

-- Elliot Temple
http://www.curi.us/
---
[This E-mail scanned for viruses by Declude Virus]

[John Machin]

flupke wrote:

I'm going to be distributing a program based on wxPython & python in a
few weeks time. The code will run on windows machines.

Because i don't want the users to move the folders around or mess with
the program or taking copies home to fiddle with it, i was thinking of a
way to check when the program starts that it's still on the same
directory and same computer.

That way i at least avoid unnecessary phone calls asking me for help
when they messed the program up.

I'm thinking of a function that will generate such a code and put it in
a file. Then when the program starts it checks this file and checks the
code in there with a code that it generates at that time again based for
instance on the current directory and other components unique to that
computer. It could be a long string (but what info?) and then take a
hash from it and store the hash value.

How could i construct such a code without being a total pain? For
instance i don't want to check for anything hardware related because
then my program would fail to work once the people change their hardware.
Anyway, it doesn't need to be waterproof. (not possible anyway)

Your requirements are confusing -- you want the program to check "that
it's still on the same ... computer" but you don't want it to fail if
they change their hardware???

In short: don't bother. You will end up annoying people who have not
"messed with" your software. Heuristics like "it's not on the same
computer therefore it's been fiddled with" don't seem like a good idea.

An app should not care where it is installed, so long as it can find its
associated files and folders. If the app can't find them:

Try putting out informative messages when something does go wrong, and
write a copy to a dump-file (like the Dr Watson log file, but skip all
the hexdump stuff). Put a timestamp and the computer name and the user's
name and whatever else you can dig out of Windows in the dump-file. Then
you can ask the user with a problem to e-mail you a copy of the
dump-file. If (say) the computer name is "frodo" instead of
"pathology03" then you can tell the user their usage is not supported.
This is a good idea even with "normal" i.e. non-fiddling users, who
can't remember what the error message said -- they've since killed the
window or even re-booted their PC.

Iy you tend towards paranoia, put a checksum somewhere in each message
in case the devious fiends use Notepad to change "frodo" to
"pathology03" :-)

[Steven D'Aprano]

flupke wrote:

Jarek Zgoda wrote:

flupke napisa³(a):

I'm thinking of a function that will generate such a code and put it
in a file. Then when the program starts it checks this file and
checks the code in there with a code that it generates at that time
again based for instance on the current directory and other
components unique to that computer. It could be a long string (but
what info?) and then take a hash from it and store the hash value.

Better, generate sha1 sum of general machine configuration (i.e. what
"set" command returns) and store it on random internet node. You can
be sure nobody would get it.

Anyway, it's bad idea. Restrict program usage in license) or any other
contract), but don't do such a mess to people who pay your bills.

Well as i said it's more to see when they tampered with the config or
the program. It's not a commercial application but it's for inhouse use
in the hospital where i work. These people are, to put it mildly, not
the most computer savant people around.
It could be handy to avoid me searching for a solution to a problem that
arises because of messing with the setup rather than a bug in the code.

Log the program's errors.

If a config file isn't found, it will log that fact. If
they edit a config file and change (say) num_widgets =
5 to num_widgets = -88888, then when the program raises
an exception it will log something like ValueError("Num
widgets is less than zero").

This will also help catch your errors as well as their
errors.
Alternatively, put a lot of error checking in one
module which you import and run at startup. Something like:

try:
import mymodule
import databasemodule
except:
print "PEBCAK error, call tech support"
sys.exit(99)

and you will know they have moved things around.

--
Steven.

[Aahz]

In article <42**************@REMOVEMEcyber.com.au>,
Steven D'Aprano <st***@REMOVEMEcyber.com.au> wrote:

Alternatively, put a lot of error checking in one
module which you import and run at startup. Something like:

try:
import mymodule
import databasemodule
except:
print "PEBCAK error, call tech support"
sys.exit(99)

Yeah, except it's PEBKAC. ;-)
--
Aahz (aa**@pythoncraft.com) <*> http://www.pythoncraft.com/

"The only problem with Microsoft is they just have no taste." --Steve Jobs

[Robert Kern]

Aahz wrote:

In article <42**************@REMOVEMEcyber.com.au>,
Steven D'Aprano <st***@REMOVEMEcyber.com.au> wrote:

Alternatively, put a lot of error checking in one
module which you import and run at startup. Something like:

try:
import mymodule
import databasemodule
except:
print "PEBCAK error, call tech support"
sys.exit(99)

Yeah, except it's PEBKAC. ;-)

I'm pretty sure it's commutative. :-)

FOLDOC says PEBCAK, Jargon File says PEBKAC, po-tay-to, po-tah-to.

--
Robert Kern
rk***@ucsd.edu

"In the fields of hell where the grass grows high
Are the graves of dreams allowed to die."
-- Richard Harter

[flupke]

flupke wrote:
<snip>

Thanks for the good ideas people.

Regards,
Benedict

[Terry Hancock]

On Thursday 02 June 2005 05:46 pm, Elliot Temple wrote:

Why not check if all files you use are in appropriate directories,
but not worry about same computer?

This is pretty trivial, by the way --- just use dirlist recursively,
use tuples, and hash the result. All you want is an idiot-proof
tamper tag --- you aren't trying to defend against malice.

As for which computer is in use --- when I was doing tech support,
I provided a command for registering for tech support which called
"uname" to automatically collect machine information. It would've
been easy enough to set this up as the standard way to contact
tech support.

Most likely you are working with Windows clients, so you'll need
something other than "uname", but I'm sure there is something
appropriate. You can do it by examining information in Python's
sys module, too, which I think should be portable.

--
Terry Hancock ( hancock at anansispaceworks.com )
Anansi Spaceworks http://www.anansispaceworks.com