Topic: Tools for deployment. Reccomendations

[Jeff H]

GEN11518: Introducing Secure Development Methods and Concepts for AutoCAD Plug-ins

[CADbloke]

...The way they handle licenses is - you provide a pile of license numbers (GUIDS ?). They dole out one when the customer purchases...

Consider what happens if when one of those serial numbers hits the Internet. If one serial number unlocks any number of seats then why bother having different serial numbers, apart from being able to track who leaked it? I'm going with an activation server based thing, for various reasons, monthly subscriptions and floating licenses being one of them. See http://wyday.com/limelm/features/why/ for the difference between just serials & activations.

While you're reading, this article: http://www.codeproject.com/Articles/7312/Piracy-and-Unconventional-Wisdom is thoroughly worth your time.

Displaying the registered name and email address in the app is one way to deter key sharing - their name and email address would appear on all pirated installations. Make sure they know that.

The have a secure api that let's you check if the customer is current with payments. This is a RESTful web service which can be programmed in PHP. (that's what I did)

All the payment providers do that, Paypal has their IPN, Fastspring, Stripe, Braintree etc do the same. Features like storefronts (Fastspring, Gumroad etc), subscriptions etc separate them and their pricing.

I found that it took as much or more time to work out the commercial side of my program as it did to write the whole thing.

I'm rapidly coming to the same conclusion. Actually, in the last year I have spent most of my time on marketing and product validation, a good thing, don't build something nobody wants,and setting up commercial systems (not so good because it is non-core but a necessary evil).

As an aside, here are a couple of podcasts I listen to regularly..

• http://www.chasingproduct.com/episodes
• http://www.startupsfortherestofus.com/greatest-hits

If you like that sort of thing I have attached my current podcast subscription list. </aside>

Ultimately it's all a matter of time vs cost, how much do you want to DIY. FastSpring + LimeLM is practically zero DIY but you pay for it. Roll your own + Paypal IPN is the other end of the spectrum. Paying the fees not be a bad thing if your time is better spent on creating and supporting the product you're good at, generating sales and consultancy income. I still freelance so the bottom line for me is that hourly rate.

[CADbloke]

Just discovered http://netlicensing.io/ - it's free unless you want to go all enterprisey on it.

Free makes me nervous but they seem legit, they've been around for over 3 years[/url, and they [url=https://www.labs64.com/]do client work. They only recently went to a freemium model: http://netlicensing.io/blog/2015/09/01/netlicensing-is-going-free/. Check out the rest of their blog too, it is good reading. NetLicensing's client code is on Github. I am checking this out as an alternative to LimeLM.

There's also a LimeLM clone I discovered at http://www.cryptlex.com/ but I personally have zero confidence in it - it just looks like a shiny but shallow rip-off. Judging by their support forum traffic they have very little traction so you'd be an alpha tester there, methinks.

LimeLM has a new version coming out very soon which sounds interesting. There has been a fair bit of talk about it on their discussion forum. In the founders own words in an email today ... "We’re getting there. They’re almost out, and we’re really proud of the work we’ve done." I still have a strong preference for LimeLM and their no BS philosophy.

As an aside, LimeLM's build & update tool looks interesting too.

... (update an hour later)... NetLicensing is somewhat confusing to configure, particularly compared to the more thought-out and documented process for LimeLM. Their C# Github repo has some odd coding standards (probably Java) and needs tweakage to compile in Visual Studio - I think it was written in MonoDevelop (have a look at the .sln file). Their plugin shop only does Paypal and only does Euros.  You'd have to run an intermediate web server for license validation because their API key  is not granular, a key in a client app seems to have full access to everything. Well, that's what the demo does.

Verdict: not as straightforward and mature as others. Worth looking into but I am reluctant.

[CADbloke]

Today's (actually a while ago but I forgot) discovery: https://wixsharp.codeplex.com - Wix done via C#. I'll get to that in a minute, after this boring story.

I just spent a weekend looking into Win installer GUIs. Yeah, I bet you're jealous.

Advanced Installer is the nicest one I've found so far that does MSI with MSM merge modules plus patch-updates but that version is US$1,499. & $499/yr maintenance OUCH. That sucks because the $399 & $139/yr would be fine if it made patches, it does auto updates but doesn't build them. What a rort. There's a free version that doesn't do most of what you actually need (it has a long feature list but meh). What sucked more is that it built a broken MSI as soon as I added any RealDwg MSM to it. I never got it to build an MSI that worked with a RealDwg MSM. Yes, I'm thinking the same thing but it I can't fix that either. Worse, it also completely obfuscates anything Wix-related - you never see any *.wxs files and you can't debug the process. You could decompile the MSI with dark.exe but meh. That's a shame because Advanced Installer is actually usable by mortals and I seriously considered buying it just put me out of my misery. But no, the misery continues...

Installshield was more confusing than Wix, a bigger installation than Windows and more expensive than the looming US election (good luck with that). Just so you don't think anyone had less fun than you last weekend, I tried Advanced Installer, Add in Express, Install Aware, MSI Factory, Install Shield (in case I win a lottery) and I forget whatever else. I didn't bother with anything that costs more than a car that's faster (or newer) than mine. These and most of the other (expensive) tools don't expose Wix XML and it makes them really hard to debug which is especially troublesome for Wix. The downside of hiding all the Wix is that it hides all the Wix so you never know what is _really_ going on.

I revisited Wix angle brackets, "Wax" (Visual Studio Add-on which I already use) and also Wix# at http://www.codeproject.com/Articles/31407/Wix-WixSharp-managed-interface-for-WiX which is basically a C# transpiler into Wix but it does actually build and uses Wix XML so you can see what you broke, or at least learn how it actually works.

You can Automate some of the XML building with the Visual Studio add-ons from the Wix Tools set and "Wax" ... and learn more Wix ... it still seems to be the most painless (in the long term) way to do MSI installers, for differing counter-intuitive values of "painless" IsWix would be good if it still worked properly, which small parts of it it don't (the file drop target zone). There's a post about it at http://blog.iswix.com/2011/03/installation-collaboration-workflows.html

None of the Wix builders I like (or can afford) do patching in any sensible manner. So, here we are. Patching for MSIs that don't upset the Add/Remove programs can really only be done with MSP installers.

So today I be mostly mucking about with Wix#

For updates I'm pretty-much sold on https://wyday.com/wybuild/help/automatic-updates/. I'm using their LimeLM and it's solid, working really well. Recommended. It's also large (2.5MB if you include the floating license DLL) so perhaps a bit impractical for small AutoCAD plugins. I'm revisiting Infralution for that one. Still undecided though.

[Atook]

Thanks for the updates CADbloke.

As jealous as I am of you getting to looking into installer GUIs all weekend, I guess I'll just settle for your review 

And I won't have the luxury of looking into autoupdates for a week straight either, but I'll look into LimeLM and keep an ear on this thread for any other input you have.