I don’t know how to alert JetBrains about this problem. I won’t discuss it publicly, and I already opened an issue for that (CPRTINF-5521, private to JB and me), but it’s super easy to use paid plugins and IDEs without paid licenses.
I opened CPRTINF-5521 two months ago, and still zero feedback. This led me to add additional protections to my plugins, but I wonder why JetBrains seems to remain silent on this issue. I understand that this is certainly a critical issue, but you could at least give your opinion when plugin developers alert you to it.
(feel free to delete this thread, I just want to alert you about this issue, and get a minimal feedback)
Just for info, my latest plugin releases are protected against the given crack, and it had to happen: yesterday (2 weeks after I’ve published my plugin releases), a user email me because he can’t use my plugin. I look at his idea.log: he was clearly using a crack
Which means at least some people still crack the IDE, and plugins…
Seems pretty easy … i just wasted 3 months to now be preparing a release to find out its too easy … and i tried it on a couple of paid plugins … must be deliberate … this is so bad … i mean there are ways to protect that is way better than this … everything is in the shipped plugin.xml
the license facade is easy to crack. That means you can’t just rely on the state of the license facade.
the IDE itself is easy to crack. This is frustrating because there are known ways to detect and block several cracks, but the IDE still allows them, which also allows these cracks to work on our plugins.
3rd-party plugin developers can’t discuss thus subject with the security team. No help, no advice, no response.
Personally, I managed to detect most cracks by myself, and with the help of friendly plugin developers.
So, I would recommend you to:
add license calls in your code. This is the first thing to do.
try to detect some cracks (the most commons and less advanced cracks are mostly java agents or dedicated plugins)
obfuscate your plugin. Don’t use ProGuard, as this is not an obfuscator but only a trimmer. Prefer a real obfuscator like Zelix KlassMaster (I’m working on a guest blog post about Zelix). It’s worth its price (USD 290 for a single developer). Minimal documentation about Zelix integration.
keep in mind that this must be invisible to legitimate users.
I’m curious to know if anyone taking active anti-piracy measures (beyond obfuscation and license calls) has a sense for how wide-spread/impactful piracy is on their bottom line/paid subscriber base.
Is the cat/mouse game of detecting and blocking the various cracks actually worth the effort from a financial perspective?
I’ve started to see things differently since I realized that ~90 % of my users are using a pirated version.
I’m not saying that anti-piracy measures will win over paying users, absolutely not.If it has any effect, it will take time to measure. But, if I could convince even just 4 or 5 % of these guys, my business would finally become profitable. Developing anti-cracks doesn’t take much effort, and my income is far from sufficient at the moment. While that, I’m also working on other projects to pay the bills.
I just think that when software is too easy to pirate, some people don’t even consider paying. I’m trying to target those few people.
