Hacker News Reader

Comment by kuschku | Hacker News Reader

> Is photoshop harmful to the web?

Photoshop isn't on the web, but I oppose closed source in principle.

> Should they give away their source code?

Ideally, yes. If you do it is still your decision, but you still should be aware that if you introduce truly new concepts, someone will clean-room reverse them, and publish them.

> So, art programs kind of need source protection.

The Krita project begs to differ.

> I won't be making a web-version until this is the case. If you can crack NW.js source protection, let me know

Then you shouldn't make any build where the business code runs on the client. Even native binaries can be reversed, their functionality analyzed, and copied. Which is how LibreOffice/OpenOffice originally discovered how to parse the Microsoft Office formats.

View on HN

It's possible, but not very ideal to have all the operations done on the server, and just serve interface stuff, maybe even as a streaming video, to the client.

When people paint, they want it responsive, no stream lag, no server hiccups. I must allow people to install the software on their computer. I would still like to protect the work I've done, because I'm just one guy making software, and I don't have marketing money. What would stop big companies from taking my source and spending more on advertising? I need source protection.

> What would stop big companies from taking my source and spending more on advertising? I need source protection.

If your threat model is a company with billions in of dollars in revenue, then source protection is useless.

NW.js protection can be cracked, too, requiring maybe one or two man-months more. For a student reversing it, this is annoying, but not a problem.

For GoogleAppleAdobeZon? They dont even notice the cost difference. You can be Snapchat, have unique features, and have it all obfuscated — and Facebook can still copy it all in weeks.

The question isn't "will Adobe be able to copy my app" — the answer to that is always yes.

Sure it's possible, but I'm trying to make it as hard as possible. Currently I think NW.js source protection is the hardest.

I think there are times when open source isn't the best. I never would have spent so much time making art software if I didn't think I could make it reasonably hard to crack. Eh, maybe I would have anyway, but I might have just made another mindless web app that wasn't difficult to code.

I think there are definitely cases where closed source works, especially when certain algorithms are easy to read but hard to contrive.

Well, NW.js is the strongest on the web.

For native binaries, such as games, currently the strongest solution is Denuvo, from a team that formerly implemented copy protection for Sony. Decades of engineering went into it, at the risk of significantly slowing down the game, using several layers of obfuscation (including VMProtect), all wrapped around the existing, older obfuscation schemes, for a native binary.

The first version of it took a few hobbyists 6 months to break, by now games protected with it get usually broken within of one week or less by hobbyists.

That’s hobbyists.

If, as you truly say, your threat model is Adobe, or a similar corporation, your obfuscation is basically useless. If determined individuals can break some of the most advanced obfuscation schemes in days, how long do you think will it take Adobe to break yours, if they actually see you as competitor?

> I think there are definitely cases where closed source works, especially when certain algorithms are easy to read but hard to contrive.

They work short-term, but as soon as someone extracts the algorithm once, everyone has it. Especially considering that in most places algorithms are neither protected by copyright nor patents (including the EU).

Denuvo... I can't remember the game (it was shite) but it got cracked 6 hours before release. You have to laugh especially because it actually did create low FPS so all the actual customers were pissed off.

Same story since the Amiga Days

Do you believe that Adobe would lift algorithms from your non-open source JS if not for NS.js? Or are you worried about some other tiny company?

As someone who worked for a while on painting tech at a BigCo, the truth is that the chance that a BigCo would steal an algorithm from your one-man-paint-app's minimally obfuscated JS is extremely close to zero (excluding if it was MIT/BSD OSS license, and even then I would be pretty surprised if it happened). Anything half as novel as you are describing would be better leveraged by talking about some of it as siggraph and then acqui-hire selling your company for millions to a Adobe/Microsoft/Apple type.

It makes perfect sense to not open source it, but if you are trying to build this as a business any amount of time you second you spend trying harden your source from some hypothetical reverse engineering boogeyman (that is likely to never even be trivially attempted) is time that would be much better spent on marketing or improving your product.

>What would stop big companies from taking my source and spending more on advertising?

Almost every country on this planet has copyright laws.

If you're worried about them ignoring the law and taking your source code why are you not worried about them ignoring the law and physically stealing your computers?

Reply on news.ycombinator.com