Limit how often machines can be added / removed within a given time period

[taxilian]

I'm guessing the only way to do this will be using a webhook on machine creation and doing it in my own microservice somewhere, but let me pose the suggestion just in case someone else has a better idea =]

Here is the situation: I have an app (hamstudy.org's desktop app, if you care) which I plan to charge $5 for. I want people to be able to share with their family members, etc, but I want the licensing to be as inoffensive as possible. If someone really wants to pirate it then it isn't worth fighting them. At the same time, I want to make it inconvenient to do so.

The point of the app is to not require an active internet connection to work; my plan is that if you are connected then it will validate your license key, but it will activate the machine and save the machine file locally so if there is no internet connection it will continue working.

I also want to make it possible to remove a machine from their account and activate a new one, preferably without requiring interaction from me -- and this is where it gets tricky. If they go to activate the machine and they have already met their limit I'd like to let them deactivate another machine. That means that they could pretty easily just take a computer offline and activate another over and over until they have a full classroom of systems that are offline and have the app set up.

My thought is that an easy counter to that would be to have some kind of limit to how often you can remove systems or possibly have it limit to only n new systems in a given i day period, etc. Basically something that'll decline to add a new system if you keep removing them and then adding another one too quickly.

Thoughts?

[taxilian]

Heh. and now that I've thought on it, I realize that the easiest way to do this (not securely, but quickly) is to just have the client look at the created/updated dates on the machine and enforce it there. Sure they could work around it since I'm just working in javascript, but I've already said it's not worth it in my case to try to fight someone determined to work around the system, I'm just keeping honest people honest.

Still curious what other people think, so I'll leave this here

[ezekg]

Another way to accomplish this would be to set an upper bound on activations for each activation token, via the maxActivations property. That way, excessive activation-deactivation-activation dances will eventually run down the quota, requiring a new activation token to be issued. Once an activation token reaches its limit, a new one will need to be requested (e.g. via a support channel), where you keep tabs on number of tokens per-license.

[taxilian]

Ahh, good thought. If nothing else that provides a sort of a "failsafe". I had forgotten about that capability with the activation tokens!