from localhost (localhost [127.0.0.1])
	by phobos.labs.netnoteinc.com (Postfix) with ESMTP id 877C7440C8
	for <jm@localhost>; Mon, 22 Jul 2002 22:04:08 -0400 (EDT)
from cpu59.osdn.com (slashdot.org [64.28.67.73] (may be forged))
    by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id g6N21L419287 for
    <jm-use-perl@jmason.org>; Tue, 23 Jul 2002 03:01:22 +0100
from [10.2.181.14] (helo=perl.org) by cpu59.osdn.com with smtp
    (Exim 3.35 #1 (Debian)) id 17Wosd-0006Ek-00 for <jm-use-perl@jmason.org>;
    Mon, 22 Jul 2002 21:54:27 -0400
From pudge@perl.org  Tue Jul 23 03:04:08 2002

This week on perl5-porters (15-21 July 2002)
posted by rafael on Monday July 22, @03:21 (summaries)
posted by ziggy on Monday July 22, @13:06 (events)

Yannick Gingras wrote:
> > What do you mean by "CD-Key or the like" (I presume that "of" was a
> > typo)? And what do you mean by "unbreakable"?
>
> "of" was a typo
>
> Unbreakable would mean here that no one, even previously authorised entity,
> could use the system without paying the periodic subscription fee.
>
> > You need to be far more explicit about the problem which you wish to
> > solve, and about the constraints involved.
>
> It could be an online system that work 95% offline but poll frequently an
> offsite server.  No mass production CDs, maybe mass personalised d/l like Sun
> JDK.
>
> Nothing is fixed yet, we are looking at the way a software can be protected
> from unauthorized utilisation.
>
> Is the use of "trusted hardware" really worth it ?
Answering that requires fairly complete knowledge of the business
model. But, in all probability: no, it isn't usually worth it. So, it
comes down to how difficult you want to make the cracker's job.
If the product requires occasional authentication, simple copying
won't work; the product has to be cracked. In which case, the issue is
whether you're actually going to enter into battle with the crackers,
or just make sure that it isn't trivial.
A lot of it comes down to your customer base. Teenage kids tend to be
more concerned about cost and less concerned about viruses/trojans,
and so more willing to use warez. Fortune-500 corporations are likely
to view matters differently.
> Does it really make it more secure ?
Yes; software techniques will only get you so far. Actually, the same
is ultimately true for hardware, but cracking hardware is likely to
require resources other than just labour.
Almost (?) anything can be reverse engineered. But it may be possible
to ensure that doing so is uneconomical.
> Look at the DVDs.
IIRC, CSS was cracked by reverse-engineering a software player; and
one where the developers forgot to encrypt the decryption key at that.
--
Glynn Clements <glynn.clements@virgin.net>