Comment by gwbas1c
12 days ago
> take the Javascript code from my website, remove all ads from it, and they publish such a "new product" on Github for everyone to download
Remember that there is still quite a bit of friction to doing that, and that many people have better things to do than jump through those hoops.
In addition to the "hire a lawyer" comments in this thread, I suggest building in some heuristics that detect when Photopea is running outside of your domain. They don't need to be "foolproof," but add additional friction to pirating Photopea so that less people will jump through the hoops.
Some historical examples:
- Commercial software in the 1980s and 1990s would burn a hole on the disk, and the software would look for the error when reading that sector.
- Donkey Kong Country would detect that it was pirated by reading the amount of RAM available. (Because SNES backup systems had slightly different runtime properties than the real cartridge.)
More importantly, when detecting that Photopea is pirated, if it runs for 3-6 minutes and then crashes, it's more likely to look like a bug in the export than a deliberate anti-piracy attempt.
---
Finally, you could consider a business model that relies on server-side functionality for revenue or stickiness, that's hard to replicate merely by pirating the software. (IE, some kind of server-side storage and sharing system.)
> Remember that there is still quite a bit of friction to doing that, and that many people have better things to do than jump through those hoops
The thing is that Photopea has been extremely obnoxious with giant colorful ads. They take a big portion of the right-side of the screen (anywhere between 1/4th and 1/6th depending on your screen resolution), stealing important real-estate for actual work.
The owner of Photopea also fights ad blockers harshly and he went as far as surreptitiously breaking some features on purpose when it detected that an adblocker was installed (of course with a fair share of false positives), and then showed later a popup telling the user that they lost their work because of the adblocker. I think he eventually backpedaled on this due to the massive backlash.
You can pay to remove the ads but it costs 60€/year. I think few people are willing to pay for that when they just use it 2-3 times a month.
Overall the developer made the friction so extreme that people will do anything to get rid of the DRM entirely and use self-hosted instances. I think Photopea’s days are counted, a community effort to rebuild a similar tool from the ground up will definitely become a thing. The only thing left to say will be farewell Photopea, you served us well.
Talking about the devil, a few days ago this happened: https://github.com/storytold/photocraft
> Remember that there is still quite a bit of friction to doing that
If they're using the github.io repo, the web app can be just as accessible as any other site
Another example I remember from quite a while ago. The site owner realized that the copycat site was displaying images sourced directly from his site. Since he had control over them, he changed the data to return less-than-appropriate images. I believe the copycat site ended up taking their site down after that.
> More importantly, when detecting that Photopea is pirated, if it runs for 3-6 minutes and then crashes, it's more likely to look like a bug in the export than a deliberate anti-piracy attempt.
This is a very frequently repeated point, which is invalid.
Crashing pirated versions do not affect the reputation of the original. It’s an urban legend.
People using pirated versions are perfectly aware of the fact that they are using butchered versions of the original. So when it crashes, chances are it's because of a botched DRM bypass. It's an obvious connection, has always been.
Techniques like what you describe made a little more sense when the means to even figure them out were less feasible for the average person, especially before the web had much information on reverse engineering, when powerful debugging tools weren't as accessible or free.
Today, there is little point in trying to slow down software pirates. At best, adding an arbitrary piracy detection only adds anywhere between mere minutes and a few days to the effort to crack software. This is true absent AI assistance or even a meaningful understanding of ASM outside of logical JMP instructions. The author will likely waste more of their time implementing anti-piracy techniques than a software pirate would figuring out which function call results in the program exiting abruptly. I've yet to encounter a program where a single flipped JE/JNE or NOP couldn't unlock most or all capabilities. This is in spite of various licensing and contextual checks throughout.
It would slow down a pirate more to have a program modify or decompress itself in memory, but that class of techniques is still more trouble than it's worth. Experienced pirates already know how to deal with those traps. The timeout thing you mentioned is clever, but the type of person who knows enough to disassemble software would think to themselves "wtf does it crash after 5 minutes?", immediately investigate, and identify the source of the crash.
Having a license check is the only thing authors of software should bother with. It provides most people a framework to consider whether they should pay for a product. Most people won't download potential malware from a sketchy website if you offer your product at a fair price. Those who either know how to crack apps or refuse to pay will keep doing what they're doing.
tl;dr Don't fool yourselves into thinking you'll outsmart a kid with Ghidra installed by throwing a glorified if-statement in their path.
EDIT: I'm speaking in the general sense. The same principles apply to an app that runs almost all of its logic in the browser.
> I've yet to encounter a program where a single flipped JE/JNE or NOP couldn't unlock most or all capabilities
There are some, with code consistency cross-checks and such. Cracking them with static code patching can get very time-consuming. Patching them dynamically works, but some have checks for that too. It's not common though for sure.
Yeah, I'm sure they're out there, but it's very rare in my experience. I'm a micro-brain when it comes to cracking software, and I've almost never encountered this, whether it's small fry software or something from Microsoft or Autodesk. There was some software with debugger detection I came across once (can't remember which it was), but that's the kind of thing where lots of existing workarounds often exist by other crack-ers.
2 replies →
I've spent some years in gamedev and doing PC versions was a big part of it. I have seen countless attempts at 'code consistency cross-checks' and they all have been defeated. The only thing that came close was Denuvo. You may want to read up on it before dismissing it. It's sad that folks here will downvote and hate anything about it. What it changed is that publishers got their money from people playing on PC and some of it was spent on developers to actually improve future games =)
3 replies →