Delivering Software, Electronically? 220
zpengo asks: "I'm trying to find the best way to implement a large-scale Electronic Software Delivery (ESD) service for my software company. I've been able to find very little information online (after weeks of research) so I must take it to America's best and brightest. Have you ever worked with ESD on a higher than plain-vanilla FTP level, and if so, what did you learn from it? When do you consider the product 'delivered'? Was it worth it? (I'm planning to put together a public domain whitepaper on the subject with the information I gather, to help fill in the gaps I found while researching online)."
Product delivery (Score:5, Funny)
When it's available on Kazaa?
Web-logons (Score:2, Insightful)
Take a look at it: http://www.bu.edu/software/ [bu.edu]
Delivering software electronicaly (Score:1, Interesting)
Anyone remember this?
ximian's red carpet (Score:4, Informative)
Ehem... (Score:5, Funny)
Um, this is Slashdot, dude...
Re:Ehem... (Score:3, Funny)
Re:Ehem... (Score:1)
Re:Ehem... (Score:2)
Re:Ehem... (Score:3, Funny)
1: Write free software.
2: ?
3: Profit!
Re:Ehem... (Score:2, Funny)
" I've been able to find very little information online (after weeks of research) so I must take it to America's best and brightest. But before that, let me ask on Slashdot..."
ESD (Score:1, Informative)
You know, Joe Schmuck loads his own software, and blammo my ESD job breaks. IF you have rigid controls on your environemnt, ESD works great.
Best and brightest? (Score:1, Funny)
Good idea, but what are you doing on Slashdot?
American? (Score:1)
We're not all American here.
Re:American? (Score:2, Funny)
Java? You could try Java Web Start (Score:4, Informative)
If you have a pure java swing application, this is probably the way to go. If not, read more about it and decide whether it's appropriate.
The technology was a little rough at first, but I assume it's matured somewhat, considering that it's now part of the standard java environment.
Java Web Start [sun.com]
Re:Java? You could try Java Web Start (Score:2)
Actually, if you're doing an internal or extra-net application (that is, you're distributing in a corporate environment, not an ISV) then you actually want to use DeployDirector [sitraka.com] by Sitraka.
The apps deployed with it do not have to run in a sandbox, which is a benefit if your users consider you a trusted souce (i.e., internal IT group). It's not free, but it's really good.
It's got some great administration/management capability as well -- far superior to WebStart, which has NO such capabilities.
Incidentally, Java Web Start is still really rough. (I've played around with a few Java deployment technologies, and JWS is the crappiest -- but then again, it's just the reference implemenation.)
.....tell...us...more... (Score:5, Insightful)
What software, which audience, which principles? It makes a difference whether you are building ESD like tucows or for a special product for a special market - for example. It might be possible for you to get some real information out from here, but you will have to tell more. Don't be scared, if someone wants to look up your company, he is already well capable of doing it :)
Re:.....tell...us...more... (Score:5, Funny)
Like somebody smart enough to click on his name in the story
Yeh, on slashdot? (Score:2)
Re:.....tell...us...more... (Score:4, Funny)
Not everyone who reads slashdot is a computer brainiac ya know. Why can't you just say what the damn AOL keyword is, so we can all find it?
-
Re:.....tell...us...more... (Score:1, Informative)
http://www.tivoli.com/products/index/config-mgr
Full disclosure: I work for Big Blue, and despite my bias I can tell you some HUGE companies and government agencies are happily using this product. (plus lots of small ones too)
"to America's best and brightest" (Score:1, Funny)
Software Delivery (Score:1, Informative)
If the above doesnt fit you then your answer is below.
There are a number of companys out there that specialize in software lic's.
Most can be included into a couple diffrent lang's with very little effort at all.
One very good example of this would be..
http://www.elicense.com/
This and more information can be found on google without a problem. ( But of course this persons "research" didnt include simple searches on the most popular search engine.. But he did research, He really did research hard, I got that link in 1 minute, He spent weeks? researching and sounds like he found nothing? )
Re:Software Delivery (Score:1)
This requires a method to keep only purchasing users from using his software..
Hence the need for something like elicense which in general would cover all his needs.. All he would have to do is put the file up on cnet downloads or something..
But again he researched this all for weeks..
Comment removed (Score:3, Interesting)
ESD (Score:5, Funny)
Re:ESD (Score:1)
Valve is doing it (Score:3, Informative)
Re:Valve is doing it (Score:2)
Re:Valve is doing it (Score:1)
How do I know for certain? I just headed over to the website and installed the thing. I'm sitting behind a hardware firewall/router.
I'm particularly impressed with Steam's efficientness. I participated in the early beta, but things have come a long way since then. From the time I visited the web page for the first time, to the time I was sitting in the game watching the in-game intro (The whole transit system bit), complete with MP3 music, less than five minutes had passed. This truely is a revolutionary way to deliver software. What's more, their beta servers were unable to provide my with more than ~700-1000kbit of bandwidth over my 3.5mbit connection. When they go live with much greater ammounts of bandwidth, those five minutes of prep time could be reduced to two or three minutes!
Steam is truely an incredible experience.
Regards, Guspaz.
Re:Valve is doing it (Score:3, Informative)
If it only it worked through NAT firewalls. Grrrr
The server is blocking ICMP requests, which means it will not see the ICMP Fragmentation Needed packets your NAT'd boxes will send. You need to reduce the MTU to around 1412 on the machines behind the firewall, or force the MTU in the firewall itself.
If using Linux 2.4/iptables, see the netfilter kernel config help option for "TCPMSS Target Support"...
Note that, technically, this is a problem on the server side (blocking ICMP for "security" reasons) but it can be solved on your end.
(I fought with this for months before I found the problem)
Re:Valve is doing it (Score:2)
Re:Valve is doing it (Score:2)
Assuming the other poster had the correct soluton, and assuming I usderstood it accurately, he said you can solve the problem without touching the firewall. You need to change the MTU on your computer to "around 1412". Try doing a google on "set MTU" and add in your operating system to narrow down the search.
-
rsync and rdist (Score:4, Informative)
From the rdist website: "RDist is an open source program to maintain identical copies of files over multiple hosts. It preserves the owner, group, mode, and mtime of files if possible and can update programs that are executing."
From the rsync website: "rsync is an open source utility that provides fast incremental file transfer. rsync is freely available under the GNU General Public License"
Web Based Software Delivery (Score:5, Informative)
For examply, only users identified as Development can submit software. At that point Software Configuration Management is notified to reproduce the software (can SCM build the same binaries as the developers?) SCM retrieves the software from the web site. Once SCM approves the software, Test is notified.
Test retrieves the software and puts it through its paces. If it passes Test grants its approval through the web site. Otherwise the software fails and Test provides a URL explaining the problems. And on...
At any point program management can see the state of the software in its track to customer delivery. PM has override ability to approve software for customer delivery even if it has, for example, failed testing.
The web site makes it easy to access. Access control and approval manage the software delivery process. Notification keeps everyone on the ball. And logging provides CYA - and has covered my butt on numerous occasions.
My boss particularly loves to be sitting in a Change Control Meeting and hear the development manager say, "The software's been delivered to SCM. We're waiting on them." And he can say with confidence, "Not yet it hasn't."
Re:Web Based Software Delivery (Score:2)
what are you deliver matters - java app - dll - ? (Score:3, Interesting)
I built a app that for win32 sat in the systray and then looked at a internal FTP and checked the manifest against its own on the machine if anything was new download and ask the user for interaction
on the java side their was webstart which is really nice and is default on MacOS X.x
this automatcally does what my app did and is a hell of a lot nice and secure
apps like windows update are pretty silly as you have to ask the user to look every day and how many lusers do that ? let alone people who know better
its what crontabs where ment for (-;
of course you can build it into the app
and if you just want to deliver software to customers use sftp
its nice and you can even get it on a java applet so that you can point people to a web page and get them to enter username and password and then its server side chrooting them to the right dir
have fun
regards
John Jones
You are using it right now (Score:3, Insightful)
Yeah, right (Score:3)
If there's a problem, it's probably related to getting paid for it. Or, worst case, figuring out some way to "deliver" some kind of hostile code (adware, spyware, etc.) to the user's desktop.
I do! (Score:5, Insightful)
We do about 5,000 transactions per month.
Our method is this (note, this is after 5 iterations of delivery systems- all of which had issues):
- When a customer pays, we create a unique copy of the purchased product and place it in a queue directy for download. This unique file is prefixed with the customers transaction ID, so
"filename.zip" becomes "a1dys3ad4a-filename.zip"
We then provide a direct link to the file. We also send this direct link in an email to the person.
After 48 hours the file is deleted. after which time, the customer must request more downloads from the merchant.
We tried many other methods but there always arose a browser/platform issue. The ONLY reliable method has been to provide a direct link to the file for download.
It can create server load and file storage issues if you have a large scale site.
Hope that helps, feel free to contact me off list.
Re:I do! (Score:5, Funny)
Re:I do! (Score:3, Informative)
I'm generating PDFs to send dynamically. I've done the same thing with inline jpgs for ages now, without having to save them to disk in any way, shape, or form.
Browsers don't like HTTP redirects. It doesn't always work. IE5.5 is seriously broken unless you have a certain set of patches installed. Opera 6.0 Linux freaks out. Mozilla mostly handles stuff right.
Eventually I had to do something like you did, generate the file and put it on a directly accessible filesystem, which is very inefficient compared to just streaming the data out, and potentially a lot less secure.
Why can't browsers get their act together with dymanic content generated for external plugins? It doesn't seem like it would be that hard to fix... Mozilla already has it mostly right.
Re:I do! (Score:1)
Hint: Three Letters, and it hurts really bad (Score:1)
Re:I do! (Score:1)
Re:I do! (Score:1)
Links that try to use tricks to redirect, etc. fail becuase of browser/os compatibility issues.
Re:I do! (Score:4, Interesting)
Either use a symbolic link (most Unix filesystems), or even a bit of mod_rewrite (Apache). The user will never see the true filename, and if you're smart the actual file is not within a web- or ftp-accessible location anyway.
Eg:
on the filesystem.
Or use a script that authenticates (using the unique ID) and sends the file data; this can be done with PHP, Perl, ASP, or just about any language that can read the QUERY_STRING environment and open/read files. You can store the user's ID and expiration time in a database, flat file, whatever. No browser issues as long as you send the appropriate headers.
I could think of many other ways do accomplish this; copying the file for each user is just nuts... you might as well email it to them.
Re:I do! (Score:4, Informative)
Tell me this: what is different between your script writing headers, and the Apache server writing headers, to describe the content about to be sent?
Honestly, use 'wget' or 'lynx -dump' and really examine the headers that are sent when you download a file. Apache is sending those headers. This is what tells the browser what is being sent, and it's the *only* thing telling the browser what is being sent.
Simply mimic those headers (substituting the proper filename and size etc), and the browser will happily prompt the user to download.
We built an inventory system for a manufacturer, and having pre-built Excel reports was one of their requirements. We simply send an HTML table, but sending the headers to appear as a
It just takes some trial and error, but the biggest clue is to look at the headers that are sent when you actually download a file directly. The browser doesn't know (or care) whether it's a binary webserver program, or a bash shell script, sending the headers.
And if that's too much work, again, create a symlink:
ln -s filename.zip [unique-id]-filename.zip
And give a hyperlink to the symlink. That's about as simple as it gets. In Windows you could probably create a "shortcut", but I really don't know/care about that. If you're running Unix, you have a ton of options here.
Re:I do! (Score:4, Informative)
I do recall there being one issue, with Mozilla/Netscape specifically, where the filename it prompts you to save is the filename of the *script*. But we got around this using mod_rewrite. So a link like this:
[unique-id]-filename.zip
becomes:
script.php?id=[unique-id]
And, since the browser is seeing "...zip" as the filename, it prompts with the correct default "Save As" filename. That's what we actually did for the Excel file, we just linked to (eg) Report.xls, which was actually a script.
Personally, I say go with the symlink idea. It's probably the easiest for you to change from your current setup; simply change your 'cp' command to 'ln -s'... the deletion of the link, downloading of the link, etc will work just the same as if it were truly a redundant copy of the file.
Of course Apache must be set to follow symlinks; don't forget to check that first.
Re:I do! (Score:2)
As for PDFs, you can't simply stream them as-is. You have to "optimize" them first. Have a look at pdfopt.ps (part of Ghostscript).
Re:I do! (Score:2)
Re:I do! (Score:2)
Re:I do! - hooray for *nix users (Score:2, Informative)
We will use the free junction command line component, or linkd.exe, or one of the others and run it from our ASP page using ASPExec from ServerObjects.com. Will do the same as the unix version of a virtual link.
So, even if this thread did not help the oroginal poster, it helped us out and that is a good thing.
Give yourselves all +1 karma
Good job!
Re:I do too! (Score:2)
I am curious how this is done (for prevention knowledge only). This includes snooping HTTP traffic for passwords, etc.
For example, how can somebody snoop into HTTP traffic going between client A and server B? Do they have to tap into A or B's ISP from the inside of the ISP?
I am a software guy who is a bit cloudy about network stuff.
I worked for a company that did that (Score:3, Informative)
Re:I worked for a company that did that (Score:1)
How do you stop port snoffers from determining the direct path to the file and posting it on a NG ?
The trick is not to divulge the path to the real files.
Re:I worked for a company that did that (Score:1)
1 - send company list of paid buyers by back channel like a direct T1 to server's Database
2 - Wait till someone uses the key
3 - Close tunnel after your done
once it's downloaded this part is done, if someone goes and puts it on Kazaa, that's another matter. Portsnifflers just don't seem like a good way to pirate software. Just wait a while, it may or may not show up on kazaa.
Honestly, it's a matter of what security you put into the install codes not what you do to protect the distribution. If you got good install protections then they just downloaded 200 megs of inert junk, that's a lot of time on a 56k modem....
Sig- Maybe we should rate article here on signal to noise ratio.
Consider this...(corporate plug) (Score:3, Informative)
software = Decrypt(software, key), where key = Hash(k1 concatenate-with k2).
This is called time-lock crypto as written by Rivest Shamir Wagner in [3].
CertainKey [certainkey.com] offers this service with all the software/crypto you need at a modest price see [1].
note: I'm a founder of CertainKey...so use discretion.
References:
[1] [certainkey.com]
[2] [com.com]
[3] [mit.edu]
America's Best and Brightest? (Score:3, Funny)
Who accepts liability ... (Score:2, Insightful)
On the other hand, if you are offering automagic updates (a la MS) then I hope the software contract indicates what happens if things goes wrong. The actual mechanism (whether JavaBeans,
LL
Steam (Score:1)
Please restrain the knee-jerk reaction (Score:5, Informative)
It's also similar to the way F-Prot Antivirus [complex.is] is delivered.
Basically each customer gets a login for the web site and can download from there. It avoids serial generators and cracks because you can't just download the shareware and then apply a crack. The only people who even get the opportunity to download the software are those who have paid so it's less likely (but still inevitable) that they will give it away, share it on kazaa, etc.
Re:Please restrain the knee-jerk reaction (Score:3, Informative)
So anyone who shares it will be likely flagged by Gibson.
Kagi.com (Score:5, Informative)
-John
Re:human required? Don't want (Score:2)
Unix or Windows? (Score:1)
If its Windows, its going to be a bit more difficult. Maybe Windows Update?
electrostatic discharge (Score:1)
Re:electrostatic discharge (Score:1)
Existing standards and design patterns (Score:3, Funny)
How could you not find alot of info? (Score:1, Informative)
There's some good payware service providers like Digital River, Metatec, Intraware, etc. And some decent freeware/open source ones that you could build off of, like weps.org. And there's always freshmeat, twocows.
It really depends what you're trying to achieve - what you're trying to deliver, to whom and for what reasons. You may need accountability, tracking, different views for different user sets, etc. Usually, you're best off just rolling your own if you have the time & resources to implement it.
Oh, and for resuming transactions, you can use HTTP 1.1 "Range" header protocol to do that if the files are large, and you lost connectivity.
Too Vague.... No Doughnut :( (Score:5, Insightful)
Do you want to deliver upgrades or patches?
Do you want to tie your system into a point of sale mechanism?
Are you worried about security? (you should be)
What security mechanisms are you able to implement?
How many people will download your software each day? Each hour? How many do you expect to do so next year?
What platforms will your target audience be running?
I could go on and on....but my point is that you cannot go to anyone, even "America's Best and Brightest" (whereever they are) and ask for a one-size-fits-all solution to a software delivery system - even if you do have a fancy buzzword like ESD to make it sound sort of sexy.
You first step here (AS ALWAYS) is to define your specifications. You can *start* with the questions above but if you haven't thought of 4 times that many yourself in your specs then you don't really know what you want... and hence can be offered no real solution.
Confirmation (Score:5, Interesting)
I am currently adding ESD capability to my eCommerce software, so that I can deliver electronic goods to customers.
The approach I am looking at is one where after payment has been accepted, the user gets a secure account where they can download the files they have a valid licence for, and the file is passed through a script which checks that the user has authenticated properly. This means they cannot simply post a URL to allow everyone access to the file.
In order to authenticate, and so that they can download this file again at a later date (maybe their hard disk blew up or whatever), they must enter a random 4 digits of the credit card used to purchase the file. This means they would not simply post a username/password and allow everyone access to their account.
When they receive the file it will be archived. When they unarchive the file, the custom unarchiver will request authorisation from my server, informing me they have the file, and what the md5 hash is. This confirms to me they have a valid file and helps against credit card refunds.
Inside the archive, I will look for ways to have unique ID's hidden inside various files, so I can then track the file's owner should it appear on any file sharing sites/networks. This doesnt have to be done in realtime, you can prepare 1000 files in advance and assign them to customers. I will look to write into the EULA a clause that states it is their sole responsibility to keep the file and contents secure, and that any lost sales will be charged to them if it could be proven they were neglegent in securing their computer/network.
I think that the above will be a good set of measures to take. Of course, it all depends on how important/valuable your software is.
Remember, if someone is really persistant, they will find away to share your files without detection. So things like great customer service, and value add will be your biggest help in keeping your customers loyal to you.
Re:Confirmation (Score:3, Insightful)
Dude, you crack me up - (Score:2)
Will you be here all week?
perl ESD? (Score:1)
my copmany is developing a colaboration app in perl for internal use. i was recently approached by management asking if there is a possibility for resale of the application weve been developing for quite some time now.
of course theres a big problem with very nature of perl... its an interpreted language. how would someone go around to resell something like a perl script and then prevent people from freely distributing it? only other modules its using is CGI::Application and all the data are stored in mysql database.
does anyone have experience w/ reselling compiled perl binaries?
oz
Re:perl ESD? (Score:2)
Take a look at SVGames (Score:3, Insightful)
Take a look at SVGames.com. This is an outfit that sells, among other things, PDFs of old TSR AD&D books (the PDF were obtaining by scanning the books). The PDFs are a few bucks each and are sold only through download.
The neat thing is that they offer a temporary download URL that allows you to redo a download wihin a few days if the first one failed. You don't even need to bookmark the temp URL, you just reenter your name and CC number for authentication and can redo the download (without being charged twice, obviously). This is a very cool feature. I suggest your site adopt a similar functionality.
What about the rest of the world? (Score:1, Interesting)
First idea, stop thinking that the best and the brightest are all American.
Second, do a spider diagram of all the possobilities.
Third, remove the ideas from the diagram that are not feasible.
Presto, a solution.
But who is going to write your Draconian EULA? (Score:5, Funny)
After the Electronic Software Delivery (ESD) is complete, the user has to get through the EULA so he can install it.
Just who are you going to get to write that EULA?
Might I humbly suggest,
http://www.evil-lawyers-who-write-eulas.com
These guys specialize in incomprehensible leagaleze and by the time they are done, your EULA will stand a proud 250 lines long and allow you to have your way with both the user of your software and his/her computer.
Good Luck!@
Java Web Start for Java programs... (Score:2)
How about sneakernet (Score:3, Funny)
However I recommend third party fedex or ups wans. They add great routing and delivery support and would mix your data with their own delivery network. They integrate well with the messenger protocal since they both use the mail room gateway as a standard to retrieve and sometimes even store data. The mailroom is the default gateway between the messenger and fedex and ups protocals.
The downside of course can be transfer time and very high latency. For example using a third party network like fedex can take a day or two to ship the data to Hong Kong and can be pricy depending on how quick you want the data to move.
The good side of sneakernet is that when the network is down I can still get data from one side of the office to the next. When the network is congested I can still move around huge amounts of data depending on the store medium used. With me implementing the messenger layer of the sneakernet protocal suite, you do not have to worry about hiring any expensive consultans or installation fee's. All you need is the store medium like a tape or cd-rw drive on both nodes.
Ps. I am looking for work and wouldn't mind doing this at this point.
why not partner with digital river? (Score:1, Interesting)
Shareware model? (Score:3, Insightful)
For example...
In the Palm OS world, most software is released in a Shareware fashion. Every Palm OS device has a HotSync ID that is used to identify it on a PC, and to keep that device's data separate from other Palms on the same PC. Two people could very well have the same ID, but not on the same PC, and the vast majority of users just use their own name as their ID, so the odds of two people with identical IDs meeting is neglibible.
What most developers do is release a single binary version of the program that includes all of the functionality, but sometimes blocks it with popups, disabled functions, timeouts, or whatever. If the user decides to register, they go to a web site (usually PalmGear.com) and enter their HotSync ID along with their credit card data and the web site generates a unique registration key for them based on their HotSync ID and some program-specific key, known only to the developer. The user enters that code into the Palm program and they're all set and registered. The program can then just generate what the reg code should be against the HotSync ID and the secret key (which it has compiled into it), and determine if the entered code is valid or not. The reg code is stored in the device's Preferences database (sorta kinda the Palm version of the Registry, though better implemented), so the user can easily beam the program to others and SHAZAAM!, the other user now has the unregistered, shareware version of the program! Yay, viral marketing!
Yes, it is possible for the user to fudge the HotSync ID with 3rd party programs, but that's not very common. And frankly, if someone is going to do that to "get around" your registration system, they would never have paid for the program in the first place, so you've lost nothing.
Of course, that is all predicated on the platform supporting that sort of unique ID. I don't know if that sort of user-defined, constant, pseudo-unique ID exists on any other platform. I wish it did, it would make it a lot easier to develop shareware-type apps. E-mail address is possible, but is subject to change more often.
[insert obligatory commentary about why you should be releasing GPLed software instead of commercial software here.]
Companies specialize in doing just that... (Score:1)
Eletronically (Score:2)
I wrote something to do this a while ago... (Score:3, Informative)
It's windows, and freeware now. You might learn about some of the issues from the documentation.
rsync over SSL (Score:2, Insightful)
Anyone (Score:3, Interesting)
Warez groups used it a LOT to remove copy protection from games/apps/etc, so the first think they did whith it after they downloaded it was to alter the SoftIce binaries to get rid of the expiration date...using SoftIce itself to find the places where the checks were being made.
I developed such a system (Score:2, Informative)
The basic features of the system were as follows:
1) Packaging of software into the smallest deployable units. Define a standard for how files and meta-information are grouped together into a package (e.g. tarfiles, RPM's) so that the packages can be created and installed in a common manner.
2) tracking of dependencies and compatibilities between packages
3) Specification of the set of top-level packages that are required by an individual workstation
4) dependency evaluation to calculate the final set of packages to be installed, or determine if no viable package set existed because of dependency conflicts
5) a sizeable set of tools to allow us to manage this information, build packages, and track what got downloaded, why it got downloaded, and who changed what when
The combination of these features is very much like what RedHat's "update agent" (and other Linux update utilities) provides. If you have the luxury of only having to support Linux, your best bet is probably to try to adapt one of these to your needs.
Personal experience (Score:2)
The app itself was started by a launcher which would watchdog the app and could report/then fall back the patches/new code if it didn't work. We could (by option) track users/problems/usage statistics and control upgrades for each user. Finally, we have a diagnostic applet (+HTML page) in the same jar which the user could then start from a browser to deal with failed system/comm/proxy issues.
It worked extremely well during the pilot -- interestingly the most important feature turned out to be the diagnostic applet which saved us huge amounts of time during the trial rollouts, test cycles and releases. Our biggest expenses came from initial support and upgrades.
Hope this helps.
How about this: (Score:2)
How about the following:
$ wget http://MIRROR.sourceforge.net/sourceforge/PROJECT
> && su -c 'rpm -Uhv SOFTWARE-VERSION.ARCH.rpm'
Or alternatively:
$ wget http://MIRROR.sourceforge.net/sourceforge/PROJECT
> && tar xjf SOFTWARE-VERSION.tar.bz2 \
> && cd SOFTWARE-VERSION \
> &&
> && make \
> && make check \
> && su -c 'make install'
Re:How about this: (Score:2)
$ apt-get upgrade PACKAGE
Or:
$ rpmfind --upgrade PACKAGE
(These are jokes. They are neither insightful nor informative.)
If you build it... they will break it. (Score:2, Interesting)
Developing a secure distribution channel has always fallen down, for me at least, at the point the user gets the raw bytes. Crypto schemes, authorisation keys and checks, and even personalised code is useless once one person manages the crack.
My perspective nowdays is to try and delay breakages until after the main marketing period. With the upgrade cycle, you can generally keep at least the current version fairly secure.
Sorry to sound pessimistic - but I am a great believer in "If it can be built, it can be broken". It's just the time taken that varies.
Q.
P.S. An unmodified crypto routine is brute force ready... Much as I hate to say it, security by obscurity is your best first line of defence. Mod that crypto routine, just don't fsck it up...
ESD? Isn't that just digital delivery of data... (Score:3, Informative)
I believe it's already been done. Originally, the exchange of digital information was done by a wide variety of means, then commerce kinda standardized on this thing called EDI (Electronic Data Interchange). More recently, it's evolved into an XML-based thing, but it's still EDI.
It seems to have all the attributes you need:
*) electronic delivery across platform, language, even character sets (XML will handle/requires Unicode).
*) authentication of the recipient and sender, reasonable security
*) provisions to automatically and securely exchange payment data upon receipt
*) a standardized set of tags to use for referring to the business entities involved in the exchange
*) many products already exist to facilitate this
Googling on "XML EDI" will get you a bunch of responses. From a quick once once-over of the 1st page, I thought this one was a good starting point:
http://www.eccnet.com/xmledi/guidelines-s
The only downside (and you may or may not consider it a problem) is that this requires your consumers to use a program they probably don't already have to receive and decode the transmission. Ftp has the virtue of being essentially omnipresent, albeit in minutely-differing flavors, and requires a modicum of knowledge to use in cross-platform, cross character set interactions. Perhaps your target user base has that knowledge. You don't really say whether this is an intracorporate distribution mechanism, or a vehicle for direct sales to the unwashed masses. This is important.
I'm not really sure why nobody (at least nobody I know of) is using this to manage software distribution and payment exchange today, other than that the existing web-based tools are "good enuff".
I'm sure some standards group has defined the grammar for commercial sale of software and related items (media, documentation, support contracts). And I'm equally sure that someone has a nice generic java-based XML-EDI client/server implementation package. But it's certainly cheaper to whack out something using normal web tools and ftp.
In the end, cheaper usually wins out over everything else.
Biz methed patent? (Score:2)
I vaguely remember a story on this. I would recommend doing research before opening such a service.
Beyond Just Software? (Score:2)
I have been looking for a similar service, but not necessarily for software, although it could be used for that since it is rather generic.
What I envision is a way to get payment feedback back to the seller's website (or server). In other words, the person makes a payment, and the customer's information, especially email address, is sent back to the server. The server can then send the target file or message (music, software, passwords, etc.) to the customer, all without human intervention.
My need was to have a way for customers to purchase "units" of an online service, not download software, although I needed that service too for another project. I figure if I solve it for one that it will work for software downloads too.
Although the store server could perhaps read and parse email from the payment server (Paypal-like service), I suspect that HTTP transactions would be better. The commerce server makes a CGI call to the store site and send the customer information, including customer's email address, and a special password code that only the store site and the payment site both know. (This password would *not* be known to the customer.) The store site can then do whatever it needs to do with the information.
There is a slight risk that the password can be intercepted from the HTTP transaction though. Perhaps an increment counter can be used to reduce such risk. I suppose security certificates could be used, but this gets rather complicated.
In a nutshell, what I need is a secure way for my website to know that a customer has made a payment without me physically reviewing something. My website can do the rest from there.
The store site would need the following info from the payment server/service after the payment has been successfully accepted:
1. Customer's name
2. Customer's email address
3. Payment amount
4. Product(s) selected (optional)
5. Quantity of product(s) selected (optional)
I have been kicking around ways to get such info from Paypal, but its email is too easy to fake.
I agree that multiple different products in a single given payment could make such a service a bit complicated, but right now I don't really need it that fancy.
BTW, it ain't porn, but could in theory be used for that too. It would make a good test example for discussion.
apt-get install yourprogram (Score:2)
Dude, this is soooo EZ (Score:2)
No-Touch Deployment (Score:2)
smartcert (Score:2)
I have been working on a simple shop system to tie into Payment One and other credit card clearing systems, written in Perl. A lot of the design depends on your own business policy and how much risk you are willing to take (i.e. is it okay if people can post copies of your software on bbs systems?). If you only have a few items it is easy but with higher throughput you will want to manage clients and handle cooling off (giving money back) quickly. Check out Red Hat's system for some ideas.