FlexLM is still going "strong" and used to encumber many scientific pieces of software widely used. It's exactly as you describe and incredibly user hostile -- albeit somehow the "best" DRM scheme out of many bad options in a space that often includes hardware dongles like iLok. It's incredibly frustrating to e.g. pay >$1m for a piece of kit and get a DRM encumbered UI for it, deliberately designed to make life awkward.
Of course, the obvious issue with the public key approach listed as being "best" in the article is that all it takes for an attacker to overcome the scheme is to replace your private keys with theirs -- or to patch a JMP for every do_license_check() call in the binary. It's fundamentally an approach that is always hackable.
Re:Local License Key Verification
by justinjlynn on Tuesday April 25, 2023 @08:09AM
(#35699344)
Indeed. If you're selling a 1MM piece of scientific equipment, then that's the dongle.
>all it takes for an attacker to overcome the scheme is to replace your private keys with theirs -- or to patch a JMP for every do_license_check() call in the binary. It's fundamentally an approach that is always hackable.
That might be true in theory, but is non-trivial in practice. The code responsible for license verification is often obfuscated and tied to critical functionality, so you can't do a simple find and replace.
Re:Local License Key Verification
by angry_moose on Tuesday April 25, 2023 @09:10AM
(#35699947)
Also its still massive in anything that's licensed by the CPU core - FEA/CFD type stuff (1 license = 1 core; 16 licenses = 16 cores).
I never enjoy seeing FlexLM, but I absolutely dread seeing the homebrew license servers from companies that choose not to use it.
Re:Local License Key Verification
by feygeubdjvf on Tuesday April 25, 2023 @07:49AM
(#35699173)
i made a killing when i was 17 selling w32 POS software i developed in my bedroom with vb6(?) because i hit the time 1) everyone wanted the window look and 2) all the big players (with ascii art ux) were succumbing to flexLM pushing dongle licenses and they never worked.
Back in the 90s our product--and many of our competitors in EDA--integrated with FlexLM (then Globetrotter, then Macrovision, then I lost track). It was clever and flexible, especially when talking about seats and site licenses and combining different vendors onto one license server, all before Internet was serious.
In reality, it was painful for users and they lost so much time fighting it: someone forgot to "check in" a license before using it, or the site license server was down, or you had the wrong feature line, or dozens of other failure modes.