tbd.pi
Posts: 34
Joined: Sat Aug 11, 2012 11:21 am
Location: NJ,USA
Contact: Website

Re: Compile raspberry serial number to sd card

Fri Oct 24, 2014 3:53 pm

expandables wrote:I want to do that but don't know how to that's why i was asking for a tutorial.
Can you assume access to the internet?

Are you distributing the pi with the software pre-installed?

Will your users have login/password to the pi?

How many users/customers are you aiming to distribute this amongst?

The amount of time and effort you put into protecting things can often be determined by your goals. If I'm planning on distributing software to a local library, then I'm not going to go through a big licensing effort because I'm not going to earn that much from it. If I'm planning on installing devices in a national chain of restaurants, I might put some more effort into protecting my effort (if I can assume there's a clear risk of that software being "stolen")

Also, you need to consider the licensing of any other libraries you are using before you decide to go charging for the software.

User avatar
expandables
Posts: 654
Joined: Fri Jun 27, 2014 7:34 pm
Location: Neverland with Michael Jackson

Re: Compile raspberry serial number to sd card

Fri Oct 24, 2014 4:38 pm

tbd.pi wrote:
expandables wrote:I want to do that but don't know how to that's why i was asking for a tutorial.
Can you assume access to the internet?

Are you distributing the pi with the software pre-installed?

Will your users have login/password to the pi?

How many users/customers are you aiming to distribute this amongst?

The amount of time and effort you put into protecting things can often be determined by your goals. If I'm planning on distributing software to a local library, then I'm not going to go through a big licensing effort because I'm not going to earn that much from it. If I'm planning on installing devices in a national chain of restaurants, I might put some more effort into protecting my effort (if I can assume there's a clear risk of that software being "stolen")

Also, you need to consider the licensing of any other libraries you are using before you decide to go charging for the software.
I am looking at 100,000 people the most. I live on a small island and the country has little to no legal copyright law. If a person steals the software and i try put them in court it can take up to 50 years to finish any case. I am distributing the pi with the software pre-installed. The users do not have login/password to the pi.
By thinking like an engineer you can create a raspberry pi.
Michael Jackson enthusiast.
I got the PI model B, B+ and PI 2 model B.
When will I get the A? I don't know.

tbd.pi
Posts: 34
Joined: Sat Aug 11, 2012 11:21 am
Location: NJ,USA
Contact: Website

Re: Compile raspberry serial number to sd card

Fri Oct 24, 2014 5:00 pm

What is the application doing, and where are you planning on actually delivering it? If the pi is pre-installed, has a strong username/password set and you're not allowing the user access to that, then I'm not sure what you're worried about. You've already gone and deterred a good percentage of people wanting to copy the software. You've still not provided a lot of details as to what the application is that you're trying to protect, but as you're distributing it I'm assuming no internet access so you can't dial home.

This is only an idea, but here's how I would go about figuring it out.

I would research how to start a program every time the pi starts, if your application is graphical then you're going to want this to be the first thing that appears during the start up (kiosk mode is how I would term that). Each pi could be pre-loaded with a key and based upon the pi it's on. This can read from the pi on startup (as mentioned earlier). As they don't have access to the pi, they can't change a file to override that. When you give the code it validates and "enables" this device. If they have to call you for the code and it's not easily guessed, you've deterred a whole bunch of people. A device that's not activated will ask for the code the first time, and never again. If they copy the SD card, when the application starts up it can determine it's not the same pi (again because the file they would need to be changed is not accessible to them) and disable itself or ask for another key and if they phone you can charge them for it.

Either way, you have two concerns. People wanting to take the software and pass it off as their own (Strong username/password will deter all but the smartest most dedicated individuals). People wanting to distribute your software and not have to pay the licensing fees (basic licensing model should generally work)

At best, most security measures are deterrents. Look at the gaming industry, how much effort they put into DRM to realize that it just makes it harder on the majority of honest people. They lose more money trying to stop the few!

W. H. Heydt
Posts: 10884
Joined: Fri Mar 09, 2012 7:36 pm
Location: Vallejo, CA (US)

Re: Compile raspberry serial number to sd card

Fri Oct 24, 2014 5:22 pm

expandables wrote: I am looking at 100,000 people the most. I live on a small island and the country has little to no legal copyright law. If a person steals the software and i try put them in court it can take up to 50 years to finish any case. I am distributing the pi with the software pre-installed. The users do not have login/password to the pi.
Hmmm..... Well, as long as you are aware that, unless you are writing *everything* on the Pi, right down to the tool chains, you will be required under GPL to either provide the source code covered by that license or make it readily available to anyone who wants it. Lest you think this is idle speculation when it comes to a "black box" system, Cisco was sued--and lost--because they refused to release the source code for the Linux-based Linksys routers.

You may not have functioning copyright law in your country, but that wouldn't stop someone who owns the copyright on GPL'd code from suing you in *their* country.

User avatar
expandables
Posts: 654
Joined: Fri Jun 27, 2014 7:34 pm
Location: Neverland with Michael Jackson

Re: Compile raspberry serial number to sd card

Fri Oct 24, 2014 5:32 pm

So how would i be able to do the serial to pi. So when they buy they can call me for a code or i email it to them.

" Each pi could be pre-loaded with a key and based upon the pi it's on. This can read from the pi on startup (as mentioned earlier). As they don't have access to the pi, they can't change a file to override that. When you give the code it validates and "enables" this device. If they have to call you for the code and it's not easily guessed, you've deterred a whole bunch of people. A device that's not activated will ask for the code the first time, and never again. If they copy the SD card, when the application starts up it can determine it's not the same pi (again because the file they would need to be changed is not accessible to them) and disable itself or ask for another key and if they phone you can charge them for it. "
By thinking like an engineer you can create a raspberry pi.
Michael Jackson enthusiast.
I got the PI model B, B+ and PI 2 model B.
When will I get the A? I don't know.

User avatar
RaTTuS
Posts: 10458
Joined: Tue Nov 29, 2011 11:12 am
Location: North West UK

Re: Compile raspberry serial number to sd card

Tue Oct 28, 2014 8:57 am

if your going to all this trouble them a CM device will be better for you with an attached bit of hardware , however , the CM's are removable and look at able on an other machine, but some software could be made none workable without the use of the CM board
a pure software solution will not work for anyone determined
How To ask Questions :- http://www.catb.org/esr/faqs/smart-questions.html
WARNING - some parts of this post may be erroneous YMMV

1QC43qbL5FySu2Pi51vGqKqxy3UiJgukSX
Covfefe

BillStephenson
Posts: 254
Joined: Thu May 17, 2012 1:25 am
Location: SW Missouri Ozarks
Contact: Website

Re: Compile raspberry serial number to sd card

Tue Oct 28, 2014 5:24 pm

You can always require the RPi to get some data from a web server. I wrote a simple script that resides on a Rpi. It grabs the Rpi's serial number and sends it to my web server which checks to see if it's on a list of RPis I've authorized.

This app can, of course, be modified to send any serial number the owner of the RPi wants it to, so it's not secure. On my servers end however, I can monitor the usage of the serial number and the IP addresses associated with it, and could deny them access to certain data as a result. So, there is that option to consider.

In my case, I fully understand the limits here, and it was not my intention to prevent them from copying the disk I provide, but to offer them one time incentives on other products or services I provide if they purchased their hardware from me. If someone really wanted to take advantage of those incentives by using a copied serial number I'd still have a new customer, so it really wouldn't grump me out.

I think the best advice you've gotten here though is to look at the Compute Module. It's my understand that you can install your disk image software by "Flashing" it to some internal memory. This may offer some protections that I'm not aware of.

User avatar
expandables
Posts: 654
Joined: Fri Jun 27, 2014 7:34 pm
Location: Neverland with Michael Jackson

Re: Compile raspberry serial number to sd card

Tue Oct 28, 2014 8:03 pm

BillStephenson wrote:You can always require the RPi to get some data from a web server. I wrote a simple script that resides on a Rpi. It grabs the Rpi's serial number and sends it to my web server which checks to see if it's on a list of RPis I've authorized.

This app can, of course, be modified to send any serial number the owner of the RPi wants it to, so it's not secure. On my servers end however, I can monitor the usage of the serial number and the IP addresses associated with it, and could deny them access to certain data as a result. So, there is that option to consider.

In my case, I fully understand the limits here, and it was not my intention to prevent them from copying the disk I provide, but to offer them one time incentives on other products or services I provide if they purchased their hardware from me. If someone really wanted to take advantage of those incentives by using a copied serial number I'd still have a new customer, so it really wouldn't grump me out.

I think the best advice you've gotten here though is to look at the Compute Module. It's my understand that you can install your disk image software by "Flashing" it to some internal memory. This may offer some protections that I'm not aware of.
Hi Sir. Is it possible you can send me a script like that please.
By thinking like an engineer you can create a raspberry pi.
Michael Jackson enthusiast.
I got the PI model B, B+ and PI 2 model B.
When will I get the A? I don't know.

W. H. Heydt
Posts: 10884
Joined: Fri Mar 09, 2012 7:36 pm
Location: Vallejo, CA (US)

Re: Compile raspberry serial number to sd card

Tue Oct 28, 2014 8:36 pm

expandables wrote:
BillStephenson wrote:You can always require the RPi to get some data from a web server. I wrote a simple script that resides on a Rpi. It grabs the Rpi's serial number and sends it to my web server which checks to see if it's on a list of RPis I've authorized.
Hi Sir. Is it possible you can send me a script like that please.
Heh... You are concerned with protecting the code you write so no one can steal it from you and you're asking someone else to provide you with code he writes? Unclear on the concept....

BillStephenson
Posts: 254
Joined: Thu May 17, 2012 1:25 am
Location: SW Missouri Ozarks
Contact: Website

Re: Compile raspberry serial number to sd card

Tue Oct 28, 2014 9:38 pm

Here's the code I use to grab the serial number. There are a lot of ways to do this....

Code: Select all

#!/usr/bin/perl

# grab the pi device info
open(FILE, "< /proc/cpuinfo") or die "can't open file: $!";

# put the lines into an array
my @lines = <FILE>;

# the line with the serial number is 12
my $number = 12;
my $LINE = $lines[$number];

# Split the line into the name and number
($name, $serialnumber) = split(/:/, $LINE);

# filter out white space around the number   
$serialnumber =~ s/^\s+//; # leading space
$serialnumber =~ s/\s+$//; # trailing space

print "$serialnumber";

BillStephenson
Posts: 254
Joined: Thu May 17, 2012 1:25 am
Location: SW Missouri Ozarks
Contact: Website

Re: Compile raspberry serial number to sd card

Tue Oct 28, 2014 10:08 pm

W. H. Heydt wrote:Heh... You are concerned with protecting the code you write so no one can steal it from you and you're asking someone else to provide you with code he writes? Unclear on the concept....
I gently explained this in a PM. I understand the desire to protect ones work from theft, but I also know the fear of that far outweighs the reality of it, and I've read the licenses for all the code mine runs on top of.

I think at some point you just have to up and embrace the concept and run with it, fearlessly. It also helps to realize what you're making isn't really all that special or amazing. That doesn't mean it doesn't have value, but that you didn't do it alone. Not by a long shot.

Everything I've ever made is a hack that's cobbled together with the generosity of others.

User avatar
Richard-TX
Posts: 1549
Joined: Tue May 28, 2013 3:24 pm
Location: North Texas

Re: Compile raspberry serial number to sd card

Wed Oct 29, 2014 12:47 am

Why not have your software phone home whenever it starts? That way you know for sure who is running it and what their auth key is.
Richard
Doing Unix since 1985.
The 9-25-2013 image of Wheezy can be found at:
http://downloads.raspberrypi.org/raspbian/images/raspbian-2013-09-27/2013-09-25-wheezy-raspbian.zip

Return to “Beginners”