Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 3 years ago.
Improve this question
I have written a program in C which I need to prevent from illegal use by copying. The system will be connected to internet. How to make this program to run only in this computer or unique computer. Can we use http post and fetch from external server some encrypt codes?. Any ideas will be useful. Dont know if this is already answered, searched but could not find results.
How to secure my linux C program against piracy
You probably can't.
If I am expert enough and motivated enough, I could decompile your binary executable (or study it with binsec), study its dynamic behavior (with e.g. strace or gdb, etc...), or detect your tricks and patch then build and install my Linux kernel source code (it is free software) to circumvent your protections.
In other words, if your adversary is as powerful as the NSA, you have lost that game.
Conceptually the "protection" of a C program can be related to the halting problem and to Rice's theorem. Gory and difficult details are left as an exercise to the reader. And you'll find tons of academic papers about software obfuscation techniques (a quite effective one being in practice compiling and linking with gcc -flto -O3 then stripping the resulting executable).
How to make this program to run only in this computer
Read more about DMZ and iptables. Protect that computer by legal means and by physical means (including even 24h/24 machine guns armed guards to avoid it being stealen or damaged; they would cost you much more than the computer itself). Invest years of your time to learn more about cybersecurity (you could make a PhD on that at my workplace).
The socially and economically effective protection is a good license (EULA) written by some costly and expert lawyer. If your clients are corporations, they won't risk breaking that license, even if technically they could. (think of what could happen if they did). Observe that proprietary programs on Linux have in 2019 less protections against piracy than those in 1999 (and that even Oracle or SAP are not making most of their profit, while selling Linux proprietary software, on software licenses but on related services). Study the business model of RedHat and its profits. Read papers or books on economics of open source (e.g. this one, the most cited one).
According to rumors Oracle costly binaries don't have protections. But I use free software RDBMS.
And if you add too complex to deploy protections into your software, you just are losing potential clients.
The most difficult step is to find actual clients for your software, not to invent or deploy difficult technical tricks to avoid piracy. You could use some existing, but imperfect, license manager. My guess is that you won't find many clients (and you could give your source code to each of them, with a suitable license -perhaps a restricted license written by your lawyer- without harming your business; most persons on Earth don't even have the necessary skills to compile your source code, and those who do won't risk to go against the laws and the contracts, written by your lawyer, signed by you and them, without a very strong incentive; and I won't accept or trust your binary without having glanced into your source code before).
Don't spend a lot of efforts on protecting your software. Do spend months of efforts on documenting it properly, debugging it, and commercializing it (and, once you have a client who paid you, on training and helping your client to use your software).
PS. My personal feeling is that even if you gave me your binary Linux executable for free -as in beer- I won't even bother trying it (because I probably don't need it, and certainly because I don't trust you enough)
PPS. For me, the most important aspect of a Linux distribution is to be made of free software (a.k.a. libre software) or open source. It is certainly not the "gratis" (or free as in beer) aspect of Linux. I value freedom above the fact of not paying Debian. I am professionally writing free software, and I am paid for that.
NB. Look also into this draft report and its bibliography. It is border-line relevant to your question. And consider subcontracting the protection work at my workplace (send me an email at basile.starynkevitch#cea.fr if you are really serious). The lab I am working at is collectively capable of adding good protection to your code. Allocate then a budget of several hundred thousands € for that service, and at least 100k€ (for a few person-months of work). My boss would be delighted if such a contract becomes reality (but I would find such a task very boring).
the only secure way is using usb dongles, giving licence over usb dongles
Related
This may sound noobish, especially as I'm ( as you may have guessed ) trying to write an Operating System. At the moment I'm stuck on trying to make a file system.
What I want is a similar file system as Linux Ubuntu which is EXT4 ( at least mine is ). I want to try and also either write it in C.
Any idea's on how I can go about this? And/or any tutorials that you might have found that may help me ( I have tried searching with no luck ) :L
Thanks in advance!
Jamie.
Really smart and experienced people who have studied this problem extensively have made bugs that ate users' data. The difference between a bug in the computation layer (e.g. a kernel crash) and a bug in the storage layer is that silently eating users' data is very bad - much worse than giving wrong answers in spreadsheets (excel is buggy yet popular) or intermittently sigfaulting while preserving data on disk (this is easily mitigated by frequent autosave).
Start by studying simpler designs, like the minix filesystems from the old operating systems book [1] (the same one Linus Torvalds started with, twenty years ago).
Like others said, ext2 without journaling, extents or ACLs is a better starting point than ext4. The source code for it is in the Linux kernel and in the e2fsprogs userspace tools package[2]. The format is well documented.
As for tutorials, consider who makes them and why they spend effort on this task. Tutorials are generally made by stakeholders in platforms to bring in new people to develop using that platform, to use the network effect to grow the platform and profit from being already-established actors in a larger ecosystem.
Do you see a business model in growing the number of people who implement their own incompatible buggy[3] file systems? Only if you sell software engineering degrees. So Microsoft only writes tutorials on how to use NTFS, not on how to implement it. Same for Sun and ZFS, Red Hat and Google with EXT2/3/4, SGI with XFS, IBM with JFS, Oracle with BTRFS, etc.
If you want education instead of training, you need to read books and study smart peoples' code they use in production, not look for tutorials.
http://en.wikipedia.org/wiki/Operating_Systems:_Design_and_Implementation
http://e2fsprogs.sourceforge.net/
How much use, in how many different use pattern with it see? Consider bugs discovered in production FSs after years of use on millions of computers. It is unlikely your code will be less buggy, even if you're as smart as Matthew Dillon.
Try looking at an existing implementation, like the one in Linux.
Closed. This question is off-topic. It is not currently accepting answers.
Want to improve this question? Update the question so it's on-topic for Stack Overflow.
Closed 11 years ago.
Improve this question
Does anyone know where I might find sample solutions written in C for low level / systems level applications? A really good website or book recommendation would be cool too.
I've learned some of the basics, but would like to see some code within the context of a real solution written in C, and specifically for a lower-level problem. Id' be interested in how C is used within the context of OS programming, for example. What are some areas where C is used for lower-level programming?
Thanks.
I would suggest you to study MINIX3 from Tanenbaum: http://www.minix3.org/
Its a microkernel architecture, and with his book ( http://vig.prenhall.com/catalog/academic/product/0,1144,0131429388,00.html ) it is really enlightning.
As of my opinion, studying the linux kernel is a bit hardcore for a start ;), and out of a academical point of view the microkernel architecture is superior to the monolithic kernel.
Furthermore, with only a few thousands lines of code, unlike the Linux Kernel, its consumable in a realistic timetable.
And its a real serious project, the European Union sponsored some Millions towards it as far as i am aware of. I think i remind him saying that in one of his talks.
And you have a X-Server running there, a gcc-toolchain etcpp.
Have fun :)
EDIT: As i read the comments, someone mentions the Ruby interpreter. Its written in a mixture of C and Ruby, and as far as it was mentioned in one episode of se-radio.net, it is really nice sourcecode. Though i have to admit, i havent looked into it myself. Might be worth the dig into it if you have some interest in Ruby too.
I'd suggest looking at some (for you) interesting open source projects written in C. For example, there's busybox, a piece of software that runs on embedded devices and has lots of smaller programs to study. You could, for example, take the source for the telnet client on one side and the corresponding RFC on the other. Or, for a steeper learning curve, you could also try studying the open source OSes, like the Linux kernel (here's the tree for browsing) or the BSDs. It's a lot more involved than busybox, but you can still find some parts that are fairly easy to understand if you're familiar with the context.
Studying the Linux kernel, maybe in conjunction with one of the several books on the kernel or device drivers would provide a wealth of material. Much of this is available free.
any or all of the books by W. Richard Stevens that walk though the implementation (TCP/IP Illustrated) or use (UNIX Network Programming) of the networking stack or his Advanced Programming in the UNIX Environment book.
If you have a leaning toward Windows there are several good books, even if they're quite old, including:
Programming Server-Side Applications for Microsoft Windows 2000 by Richter and Clark
Programming Applications for Microsoft Windows by Richter
I would suggest the following sources might be interesting r.e. Operating Systems from a learning perspective. Be aware there have been many advancements actually present in modern kernels:
The original linux code.
xv6. This is a simple unix OS that goes along with MIT's excellent OpenCourseWare course on Operating Systems.
Other ideas:
The current grub stage 1 bootloader isn't that complicated - it's pretty hard to be complicated with 512 bytes to play with.
The Linux kernel module guide gives you an introduction to building kernel modules. You could experiment with building custom, yet pointless, drivers that add say character devices to /dev/ or proc devices to /proc and work towards implementing something interesting. People have implemented web servers in kernel space...
If you want to experiment with Windows kernels, have a go with Native NT applications. I'd start with printing a pointless boot message, then move up to drivers.
Beyond that, it's hard to suggest where you might want to go. Systems level is a wide space.
In the context of low level programming, C and C++ are portable assembler. In many of the above spaces the standard library is either partially or totally missing and extra functionality may be implemented by existing parts of the system-level code you're modifying, so you have to be aware of the API functions available to you in any given space and what you need to implement yourself, as well as what your memory and processing requirements must be. For example, a bootloader written to the MBR has to use bios interrupts and starts in real (16-bit) mode. Those are the constraints of the hardware design. Likewise, functions like fopen() aren't available in kernel space since they wrap system calls - you'd need to use kernel specific constructs to achieve this if it really made sense to write a file from kernel space.
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about programming within the scope defined in the help center.
Closed 7 years ago.
Improve this question
I've seen some software (a Joomla component, to be exact) for sale on a web site. The web site says it is licensed under the GNU GPL2. However it also says you need to pay for every site you use the software on (with bulk discounts).
I know it's perfectly acceptable to sell software under the GPL, however the license implies that the source code must be distributed at no cost.
So is this a legitimate use of the GPL, or is it violating the license? Is it legal to download the software for free (say, from Bittorrent) and use it as I wish?
Here is a FAQ from the GNU site. I think it answers your question:
Does the GPL allow me to sell copies
of the program for money?
Yes, the GPL allows everyone to do this. The right to sell copies is part
of the definition of free software.
Except in one special situation, there
is no limit on what price you can
charge. (The one exception is the
required written offer to provide
source code that must accompany
binary-only release.)
http://www.gnu.org/licenses/gpl-faq.html#DoesTheGPLAllowMoney
Further more:
If I distribute GPL'd software for a fee, am I required to also make it
available to the public without a
charge?
No. However, if someone pays your fee
and gets a copy, the GPL gives them
the freedom to release it to the
public, with or without a fee. For
example, someone could pay your fee,
and then put her copy on a web site
for the general public.
For GPL software, the source code must be distributed with the binary version or upon request to anyone who legally obtains the binary version.
Ergo, if you didn't buy the product from them, they are under no obligation to give you the source code.
The obvious flip side to this is that anyone who DOES legitimately get the source code is free to redistribute it as they please.
From my understanding distributing it on bittorrent would be redistribution which is permitted under the GPL without limitation (however Trademarks etc could still be violated!) This is how projects like CentOS work - they remove the trademarks, rebuild and then redistribute - and this is perfectly legal.
The company themselves are under no obligation to release source code unless they distribute the software to you.
So your options are:
Get it from someone else (who redistributes it under the GPL)
Purchase the product from the company - they'll give you the source code
I would personally suggest the latter option because it supports companies that support the GPL!
One question is whether the author wrote all the software or used any pre-existing GPLed software. If the person on the web site owns the copyright completely, then the web site may impose any conditions, including those incompatible with the GPL. Of course, releasing it under the GPL gives you some rights by itself. In particular, you can't redistribute without the source code, but you can make copies and use them.
The above practice is generally considered unfriendly by Free and Open Source Software advocates. Since it's not really honest to advertise GPLv2 and not deliver everything necessary, I'd advise being careful about the product. People who deliberately misrepresent things in advertising are likely to be selling shoddy software.
If the software contains pre-existing GPLed components, and the author didn't come to other terms with the copyright holders, then the GPL applies in full. The distributor has to provide source code (either with the executable or on request at nominal cost) and may not impose restrictions not allowed by the GPL.
There's also the possibility that the author released under GPLv2 without actually understanding the license. This happens from time to time, and frequently the FSF will quietly work with companies on getting into compliance.
In either case, it's perfectly fine to sell the software. If somebody else has the software including the source, they can redistribute freely, and it's perfectly legal for you to get it from them.
This is obviously a very simple business trick that relies on the naivity of the purchaser. It is obvious that, if the component is GPL, you can get it from any other user (bittorrent, file sharing), redistribute it and even resell it (but keep it GPL).
It is also very obvious that, if there's no other source to find/get it from, if you purchase, there is absolutely no need to pay multiple times for it. You just need to buy it once, and re-use it on all of the websites that you wish.
Even if it has some source of protection, the source code is open, so you can easily remove that protection.
Just out of curiousity, can you please give the name/website of the Joomla! component?
Once upon a time, a team of guys sat down and wrote an application in C, running on VMS on a VAX. It was a rather important undertaking and runs a reasonably important back-end operation at LargeCo. This whole shebang works so well that twenty-five years later it's still chugging along and doing it's thing.
Time passes and people retire and it so happens that the Last Man Standing has turned over the keys to a new generation who - we might imagine - are less than thrilled to find themselves caretakers of a system old enough to be their younger brother. Yet, as underwhelmed as they are by the idea of dealing with Ultra Legacy Systems, they can't justify the cost of replacing the venerable application.
LMS discovered that I habla unix and put this question to me. And since I habla unix but don't speak the C I shall summarize and put it to you. Long Story Short:
LMS wants to port LegacyApp, written in C. from VMS to unix. Resources? Any books he can read? People he can talk to?
The first question I'd need to ask is why, and I'd be leading the conversation in the direction of "Do you really need to port it off of VMS". There are a number of things worth mentioning about VMS:
-> VMS is still actively developed and maintained by HP. They just release V8.4 for Field Test last week (see http://h71000.www7.hp.com/openvmsft/).
-> VMS is available on new hardware; specifically HP's Integrity servers based on the Itanium processor.
-> VMS is also available on virtual platforms via the Charon Emulation products.
-> Popular estimates are that there are about 300,000 VMS systems still in active use today. LMS may be the last man at LargeCo, but he's far from the last man standing worldwide.
-> Lots of information out there, see openvms.org for example, to see lots of current information on VMS, all from current users.
OK - you still want to port off of VMS. How do you do it? Well, it depends on lots of stuff.
-> As others have said, how standard is the code? Chances are, not very. The more VMS-isms, the more difficult the job. 'nuff said.
-> What is the database? If it's Oracle, probably not too tough to move to Oracle on some other platform. If it's some sort of custom DB based on RMS index files, then you've got more work to do, you'll need to re-create that pseudo DB, or, understand it enough to replace it with some relational DB.
-> Besides C, what else is used to create the application? What's on the front end? DECforms? FMS? Is there a transaction engine, e.g. ACMS? RTR? These things will have a huge impact on the feasibility and effort required to port to UNIX.
-> What other products are involved? Are there any 3rd party libraries being used? Are there 3rd party products in use that are critical to the application or functionality?
-> Is this system clustered? If so why? You'll need to meet those same goals with the UNIX box.
-> There are companies out there that will help you do it, and claim to have tools to make it easier, but my experience is that these companies tend to be selling you more services than products (i.e. you need to hire them to use the tools. It'll be expensive).
The book UNIX for OpenVMS Users will give the VMS novice some help in understanding VMS, but, as the title says, the book is really intended for the opposite purpose.
Everything written on VMS uses lots of VMS specific stuff it was just so convenient.
There are a few companies that sell compatibility libs to make the port easier - they wont be cheap though, VMS tended to be used where reliability mattered more than cost.
The other option is to run openVMS on some modern hardware, possibly in a VM.
I am sure Brian has made his decision by now, but for my sins of working for many years in DEC OpenVMS language support (yes, some people had this dubious honour) the real question I would have asked a customer such as Brian is: is it a real-time application or not? If it is the former, then it would be heavily dependent on many VMS system services which would rule out a 'port' and indicate a re-write. If it were the latter then the frequency of VMS system services should (possibly) be limited and make a port viable.
The acid test for me, would be to SEARCH *.c "SYS$", "LIB$" i.e. to search all of the C source files for "SYS$" and "LIB$" tags which prefix VMS system services. If the count for these are in the 10s then a port is probably likely, between 10 and 100 makes it possibly likely, but over a 100 makes a successful port highly unlikely.
Hope this helps
You have several choices.
Get the OpenVMS source, and continue to maintain Open VMS as if it were a Linux distribution. Some folks don't mind keeping up with Linux distributions and OpenVMS distributions. It can be done.
Try to recompile the VMS C into Linux. This can be trivial if the C used only standard libraries. This can be very, very difficult if the C used a lot of VMS libraries.
Once you have facts at your fingertips, you can reevaluate this course of action. Since you didn't list a bunch of VMS library methods this program uses, it's impossible to tell how entangled it is with the OS.
This may be trivial or impossible. It's difficult to tell without analysis of the source.
Write bridge libraries from VMS to Linux. If your program only does a few VMS things, this isn't very difficult. If your program does extensive VMS things, this is craziness.
The bridge -- in the long run -- is a terrible idea. Managers love it, however.
An alternative is to replace the VMS library calls with proper, portable Linux calls rather than write bridges. This is better in the long run, because it excises the non-portable features of the program.
Rewrite it from scratch in Python. That is usually simpler than trying to port the C code. It will be shorter, cleaner, simpler, and portable.
If you're willing to keep running VMS in a VM, you can look into CHARON-VAX ( http://www.charon-vax.com/ ). As previously mentioned, the ease of porting really depends a lot on how much of the VMS extensions were used; searching the source code for $ characters embedded in strings (usually with a 3-character leading substring, such as lib$gettime or dsc$descriptor or sys$foobar etc) will give you at least a basic idea of what VMS system functions are called and how likely they are to be portable, if the name is reasonably obvious.
If it ain't broke, don't fix it! Why port it or migrate the app if you don't have to? Why not run it on a current install of OpenVMS running on an HP Itanium server; that is assuming you wish to upgrade the hardware, which may not even be necessary if your VAX hardware is still running strong.
To learn C, you might as well drag it from the horse's mouth: "The C Programming Language" by its inventors, Kernighan and Ritchie.
I can recommend "The UNIX programming environment" by (again) Brian Kernighan; a more authoritative source you'll hardly find, and it teaches you both Unix/C idioms and a bit of C programming at the same time.
For more depth and detail on C, I heartily enjoyed a book by Peter van der Linden: "Expert C Programming - Deep C Secrets".
You'll also want to wrestle LMS for a library documentation of VMS-specific C functions with (of course) special emphasis on those actually used in the app. That's where your porting effort will be.
The job could be easy or difficult, depending on how much machine-specific cleverness and bit-twiddling is done, and how many VMS-specific system calls are used. It would be very good if word size was equal (in other words, if your VMS box has a word size of 32 bits, don't run the code on a 64 bit version of Unix!)
Brian, I'm not sure if LMS specified/cared to port C-code or the WHOLE process. As too often people think of languages out of scope of systems.
If there're was a process built on VMS, most likely it used at least scheduling/batch facilities, which are often scripted in DCL (rather simple and clear language, unlike shell or perl scripting).
So the cost of porting the whole process may be higher than originally perceived by your LMS. Add here the reliability aspect, given your crunches with C, which is nothing impossible, of course, with enthusiasm and determination.
If you want simply give the C-code a try, as previously posted, search it for the "$" hits. Or just cc it with all headers present, the basics of compile-link command should be enough.
Alternatively, this looks like a consultant's call, as indeed such jobs were abundant at the "exodus" time. All said VMS remains quite a robust platform (24x7 is a norm!), unless the harware dies, then there're still tons of "exodus" spares. GOOD LUCK!
About a year and a half later, maybe you've already figured out what to do. My organization has recently decided to stick with OpenVMS instead of switching to Linux even though the old guard recently left. We just couldn't argue with what we felt was a very stable and reliable system. We are currently switching from Alpha servers to Integrity servers for end of life reasons. HP has been very helpful with our transition.
For that matter, there may be Linux vendors out there who can help with the transition. Ask your new hardware vendor if they have any recommendations.
Depending on what languages you already know, C is not that hard to learn. I taught myself C in the course of learning C++ after finally prying myself loose from Pascal.
(VAX Pascal, plus Rdb/VMS, plus DCL formed a combination that was hard to beat.)
If the software is typical C, you'll spend more time learning the library functions than learning the language.
It's pretty lightweight stuff, but I went through the online tutorials for C++ that Microsoft makes available in conjunction with the express edition of Visual Studio for C++.
Here's the beginner's tutorial:
http://msdn.microsoft.com/en-us/beginner/cc305129.aspx
It's probably worth making the effort to ask why LMS wants to port the application to Unix. The answer may seem obvious, but properly exploring the reasons has its benefits. I would assume:
OpenVMS is an "ultra legacy platform", and for that reason alone is something that is not worth running an application on anymore;
It's tough to find anyone who is willing to maintain an application that runs on OpenVMS these days;
The hardware on-which OpenVMS runs is threatening to become moribund.
We have a similar challenge, but in our case the application in question not only runs on OpenVMS but is also written in COBOL. I would have to say that your situation is rosy in comparison given that your application is written in a cross-platform language.
In any case, I think if you're about to make a big decision like moving from OpenVMS to Unix it would be prudent to do a little due diligence. In your case, try to assess just how portable the code is--only then will you know what the scale of the effort is (worst case could quite easily be a multiple of best case). In C, code portability is mostly a function of the dependencies--are they "standard" or are they VMS-specific?
Our enquiries revealed that HP would be supporting OpenVMS on Itanium until at least 2022. There isn't necessarily a need to rush to another platform--perhaps you could keep things on OpenVMS whilst embarking on an effort to prepare the application for porting (make it less dependent on OpenVMS specifics).
VMS has a surprisingly healthy community and if it's the lack of Unix that's the issue, then maybe GNV could help bridge the gap?
Well u have a few options. if this code needs to be ported rather quickly, i would write a bridge library to emulate the vms libs. whener you get it back up and running on a *nix, then go through replacing the vms library calls with native/portable calls for *nix.
Also if there is a lot of optimizations in the code ie inline assembly and bit twiddling. then you will have to rewrite thi code, which will take an understanding of the VAX arch. also. be sure to check word size differences and endian differences
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about programming within the scope defined in the help center.
Closed 7 years ago.
Improve this question
This question is a follow up on one of my other questions, Can I legally Incorporating GPL & LGPL, open-sourced software in a proprietary, closed-source project?
Many of the conditions of the LGPL license are based on the notion of distribution. My company does business as a consultant. We are contracted to create software, which we deliver to our clients. Does this constitute distribution under the LGPL license?
We have also made available the software, to our clients, for download through a password-protected file server. Does this constitute distribution?
Yes it does. One of the reasons the GPL came into being in the first place was to prevent the situation where somebody had a binary, but no source to go with it.
IANAL, so I can't speak to whether the consultancy-client relationship would constitute a loophole which you could use to avoid passing on source code, but it is certainly against the license's intent to do what you're suggesting.
I think that what you do is "distribution". At any rate, the support of a lawyer is important in this case.
Your first question really depends on the contract you develop software under. Do you deliver a complete product or work on a hour-by-hour basis? Who retains copyright over the software?
I'd say that in general if you work as a contractor, its your client that has to deal with these issues.
Yes, download via password protection constitutes distribution in my opinion, and you would have to distribute source code in the same manner.
Yes, both those cases constitute distribution. If it's leaving the hands of the developer, it's being distributed. That is of course, assuming that your company is the license holder, not your client.
Any time you give someone else a copy of some software you have distributed that software. It does not have to be to the public at large to qualify as distribution.
First off, I am not a lawyer. You should probably consult one.
When your client receives your program or libraries, you are distributing to that client. This means that you must offer to supply your client with the source code, as per the GPL. HOWEVER, if the distribution goes no farther than that, you are NOT required to distribute your code to the public at large.
If, however, the client distributes the code, they become a distributor under the terms of the GPL, and are then required to offer the code to their customers/clients/whatever.
Note that the GPL does not require that source code is given to the client at the same time that they receive the binary. You must, however, give the client a written offer to give them the source code at their request, for no further cost to them.