How Public-Key Signing Enables Offline Software Licensing in .NET Apps

·8 views

A technical guide outlines how .NET developers can implement software licensing using asymmetric cryptography, where a private key on the server signs license payloads and a public key embedded in the app verifies them offline. The approach uses a small JSON license payload containing fields such as licensee, product tier, seat count, and expiry, all protected by an RSA signature. Developers can use the Keyright.NET SDK to initialize a single client at startup, which validates the license without making a network call, making it suitable for air-gapped or enterprise environments. The guide notes that while offline validation is fast and functional, it can be patched out by a determined attacker, and online activation should be layered on top when seat enforcement or key revocation is required.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Aqiron Security Split Its VS Code Extension from Its TypeScript Core

Developer building Aqiron Security, an open-source application security tool, chose to separate the security runtime from the VS Code extension as the project grew in complexity. Rather than bundling all logic inside the extension host, the architecture now runs the TypeScript core as a distinct Node.js process that the extension communicates with via stdin/stdout. This process boundary keeps VS Code-specific dependencies out of the security core, allowing the logic to operate on abstract concepts like workspaces rather than VS Code APIs directly. The separation also improves lifecycle management, making it easier to handle long-running scan operations, restarts, and failure isolation. A lightweight request-response protocol with typed message interfaces governs communication between the two layers, with the core package currently bundled privately into the extension rather than published as a standalone npm package.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Java's 'finally' Block Runs Before Exit, But Not Before Return Value Is Saved

A common Java misconception is that reassigning a variable inside a 'finally' block will change the value returned by a method, but the actual returned value is 1, not 99. This is because the JVM evaluates and stores the return expression in a hidden temporary variable before executing the 'finally' block. The stored value is what gets returned, so any reassignment of a primitive inside 'finally' has no effect on the result. However, mutating an object inside 'finally' does affect the outcome, since only the reference is captured, not a copy of the object. A 'return' statement placed inside a 'finally' block overrides everything, including pending exceptions, which is widely considered a bug-prone pattern.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Audit Finds Curve DEX Smart Contracts Could Cut Gas Costs by Up to 45%

A gas optimization audit of Curve DEX, a decentralized exchange with over $1.3 billion in total value locked, was conducted on September 23, 2026, by a senior DeFi security researcher. The review covered core smart contracts across Ethereum mainnet and Layer 2 networks including Optimism, Arbitrum, and zkSync. Auditors identified 25 findings across seven categories, with the most impactful issues stemming from redundant storage reads, inefficient loops, and suboptimal external call patterns. Applying all high- and medium-priority recommendations could reduce gas costs by 30–45% on the most expensive swap paths, saving users an estimated $0.12–$0.25 per $1,000 swap on Ethereum and $0.03–$0.07 on Layer 2s. The protocol received a gas-inefficiency risk score of 4 out of 10, indicating it is secure and functional but has meaningful room for cost improvement relative to competitors.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Memory Systems Lack Forgetting Controls, Creating Persistent Context Pollution

As AI platforms race to expand memory and context retention, a growing usability problem is emerging: there is no effective way to make AI systems forget irrelevant information. When unrelated conversations enter a user's session, they can permanently skew AI responses, mixing personal project context with unrelated queries. Human cognition relies on selective forgetting to prioritize important information, but current AI tools treat all stored data with equal weight. Developers and power users are resorting to workarounds like maintaining separate accounts to isolate meaningful conversations from throwaway queries. Proposed solutions include conversation tagging, relevance decay, selective memory management, and project-level context scoping, though no major platform has yet implemented these effectively.

0 comments Read more at DEV Community