views:

233

answers:

6

I have a unique idea for a browser based application that I'm considering developing and selling. The only problem is that it would all be HTML/Javascript based code. It is not a web-based service that I would host and others would use. It is something that clients would purchase and use either on their own local server or even on their own local desktop, since the HTML/Javascript would not necessarily require a web server.

My question is, how do I go about selling something that open? Anyone who demo'ed it would basically have the full source.

And also, how do I protect it? If a company bought a seat of it, how could I prevent them from using it on 100 different computers? Is there any type of protection scheme I could use?

EDIT: My apologies. I changed the title to be more specific because I'm not talking about FOSS software but rather software who's code is easily accessible to the user.

UPDATE: I think the simple answer is that I can't fully protect it, but at least I could obfuscate the heck out of the source to make it difficult (but unfortunately not impossible) to reverse engineer.

+1  A: 

There's no server back-end code? I doubt you could protect 100%. The best I could think of is to obfuscate the production version of your HTML and Javascript code. But someone could probably crack that if they we're motivated.

Bill Paetzke
A: 

I cannot answer the original question. But my suggestion is to rewrite the application in way that is not visible such as not using HTML or javascript. Or is obfuscated.

Preet Sangha
+5  A: 
  • Give away the product and sell support.
  • Give away the product and sell advertising space.
  • Give away the product and sell custom plugins.
  • Give away the product and sell a hosted version.
  • Give away the product and sell the content.
Daniel Vassallo
He could sell the product, too. People buy Wordpress themes and that's just HTML, CSS, and a few images. However, I have no idea what his target market is, nor the demand for his product. So, I don't know if he would sell any copies.
Bill Paetzke
+1 for good ideas that mostly can't be cheated
alex
@Bill: Yes of course. My list is not to be considered exhaustive... Users will pay a fair price to have a legal license. Giving it away and selling something else is just another option.
Daniel Vassallo
+2  A: 
ChristopheD
A: 

Who do you want to sell to and what is the approximate price range? $50 or $5,000? If it's a large application or something that would require customization at the user site, you could sell a support contract. People buy Red Hat Enterprise Linux for the support even though you can get it for free.

Dan
+2  A: 

If you're worried about protecting your source code in a Ajax/HTML app you should be using a tool like use YUI JavaScript and Css compressor. As a bonus you'll actually get increased performance since it reduces the payload significantly.

Effectively if you look at any of Google's flagship products they are almost impossible to reverse engineer, that's because they compress their JavaScript to the minimum amount possible.

Here is a simple example of a static Ajax website that's compressed in a single file. If you check the source code you can see that I've compressed the JavaScript (and 3rd party libs like jquery, etc), CSS and HTML all into a single JavaScript page. Now I've done this for maximum perf but it has the side effect of making it very difficult to copy and make changes without the original source code.

mythz
Not downvoting but I disagree with the usefullness of 'obfuscation' as a `protection` technique (It will take a little more time to `reverse-engineer` if someone wants to, yes ; that's about it.). This also does not imply any `copy-protection` of the more traditional sort.
ChristopheD
I agree, though the time it takes can effectively render the practice futile. When Google first released Google Maps I tried to reverse engineer it to see how it works, I built a pretty complicated mapping program matching symbols/patterns to full descriptive names, unfortunately the time it took me to get something remotely legible Google had released 5 new versions. I didn't bother after that.
mythz
I disagree with it even more for this question, because it's not even mainly reverse-engineering that's being asked about - a compressor isn't going to stop someone at all from just copying the file. A copied, compressed Javascript works the same as a copied, non-compressed one.
Nate
From what I could tell by his question he was only concerned with other people having access to the full source.
mythz