Simple license protection for Python app
Although there are quite a few questions like this, please bear with me as I think mine is different...
I have a $5 Python app that I distribute using py2exe, py2app, and source for Linux. The app has a one-year license so that people need to upgrade to a newer version after one year. I would like to add some kind of simple license protection to enforce the one-year limit. Since the app is only $5, I don't care if it is easily circumventable. Just having something will encourage many users to pay $5 to upgrade after a year as opposed to ignoring the license.
Note that:
- I want the source to be easily readable so no obfuscation
- I don't want to have compiled code or SaaS
- I would consider some kind of license key system if it was really simple but don't want anything complicated
My first thought is to simply record the install date (e.g., using wxConfig) and disabling the software after one year with a polite message to please upgrade.
Are there any better solutions to this?
Answer
Why doesn't an if statement comparing the date not trivially solve this for you?
The best way to do this might be to include data into your software that really does need to be kept up to date to be useful to the end user, like the tax forms in TurboTax. Of course the availability of that business strategy depends on your application and market.
You have said the code is source readable. What else could you really do? You can have lots of these if statments... but grep or perl or another python script can also quickly find them all and fix it back to work again quite quickly. If you have a market for your $5 product an annoyed customer might distribute the date disabling script to his buddies, or over the web.
This is like a luggage padlock. Only works on honest people... but perhaps that is good enough.
You could put a DMCA notice next to the critical if statement in the source code. An if statement is a measure to prevent use after the license date. Ask a good lawyer. Your mileage may vary.
Wikipedia has this on the DMCA under "Anti-circumvention":
Circumvention of Access Controls Section 103 (17 U.S.C Sec. 1201(a)(1)) of the DMCA states: No person shall circumvent a technological measure that effectively controls access to a work protected under this title. The Act defines what it means in Section 1201(a)(3): (3) As used in this subsection—
(A) to 「circumvent a technological measure」 means to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner; and
(B) a technological measure 「effectively controls access to a work」 if the measure, in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work. Thus, if there is some "technological measure that effectively controls access to a work", it is illegal to circumvent that measure. However, Section 1201 creates several exceptions to this rule, and the Library of Congress is empowered to create additional exceptions.
If you had the date within a GPG signed string signed with your public key... then IMHO you could claim that this expiration information string... had the authority of the copyright owner. You could also check for tampering against the public key, but it is not obvious that you have to do so, since it is illegal to circumvent...
Note: Richard Stallman, the free software pioneer, had a theory that competition tends to eliminate anti-features from software like paywalls, annoying reminders, etc.