I have an idea for an open source app -- the app would be free, but I would charge a small fee for data that a customer would order. For instance, let's say I'm writing a map application. I'd give the app away, make it open-source, but I would like to sell various maps to individual users.
Is there a way to protect the data in such a way that makes it very difficult for someone to simply take the map they bought and distribute it to others? Is this feasible for an open source app?
Have the application create a private and public key pair on the first launch. When the user wants to purchase a map, they must provide you with their public key. Encrypt the map files using this key. Users that do not know the private key cannot use the map.
However, if a user looses their private key, they will have to recreate the pair and you will have to provide them with new maps that correspond to the new key.
This doesn't stop a user from giving away the maps along with the private key or even decrypting the maps and distributing the plain-text maps. You can try hiding the key from the user in some way, but this won't actually help much, especially since the application is open-source.
Revocation lists, key expiration or any other client-side validation is futile, since users could just compile the application such that your validation methods just return true. So avoid implementing anything other than decryption on the client-side.
No, I do not see how it is feasible. Any user can just remove the copy protection check from the sources and recompile the application.
Encrypting the data won't help either; the app needs to decrypt it, you could just extract the decryption routine from the app and decrypt the data (then use a version of the app without encryption).
Usually the proper way to make money with open source is to use a service model.
The idea is you want your software out in as many hands as possible, and then to add services that make the application valuable. This could be providing for-pay custom integrations or a data feed that is higher quality than maybe a freely provided data feed.
Due to the ability to freely modify it and distribute it, the software propagates faster (providing it is useful, of course). The more people that have the software, the larger the pool of people willing to pay for a service.
License management is sort of painful anyhow, and most software protection goes down in flames anyway.
Copy protection is basically a losing game, those who would pay for the information will do so regardless of the copy protection scheme. Those who will not pay won't do so.
The only successful copy protection implementation that I have seen is Steam, but the only reason that it's successful is because it gives the users a value-added service. Steam games are still pirated, but the people who are on the fence about paying might do so through Steam because of the extra value that they receive.
Perhaps you could serve the map information to users through a web service, this could automatically update the maps for the users, maybe even save their configuration data(if any) online. The pirates will still just steal the maps, but maybe you can get more users to purchase.
Perhaps watermarking the content would help? While it does not prevent copying, you can track down the origin of leaks and maybe even hold them accountable for damages caused by unauthorized copying.
The solution is quite simple. Set up a open source plugin API in your code.
Then write a closed source plugin that can load your map. This plugin will perform the license check (with asymetric crypto) and feed the Open Source part of the code with on-the-fly decoded data. People could work out a way to save the map, but if the effort requires more time than the map price, it's very unlikely they'll do this. (Understand than if your map cost 5$, then I don't think anyone would ever try to write a "dumper").
Any data that has to be decrypted to be used is not any more secure than just supplying the non-encrypted equivalent data, all the data has to be in memory decrypted and patchers, loaders and hooks can be written easily for non-open source apps to dump that data out un-encrypted, so an open source program would be that much easier to subvert. If someone with the resources of Apple or Microsoft can't create a secure DRM scheme that can't be circumvented by college students, then I doubt a single developer can do better. Making it difficult implies that you are going to burden the paying customer in some way while not really burdening the people that are willing to pirate in the first place.
Make your content compelling and reasonably priced and people will buy it, those that don't would never have bought it anyway.