Hardware locking on Java 1.5 is made possible by the addition of a new (and pluggable) MAC address provider implementation. The default uses Java’s built in provisions for acquiring MAC addresses for interfaces in Java 1.6, and drops back to a secondary method for determining addresses when using Java 1.5

For those that want a even more control over determining system MACs, you can simply implement your own provider through the MacAddressProvider interface.

The default provider also screens out several ranges of addresses used by virtual machines in an effort to ignore various types of virtual interfaces.

As usual, please let me know if you’ve got any questions or comments.

Happy Licensing!

Jason Nichols
jason@padlocksoftware.net

Both bugs are related to date modification detection:

1) The first bug manifests itself as a prolonged validation lasting for as long as 20 seconds. The thread calling the Validator’s validate() method will block.

2) The second bug is an NPE thrown during validation. This happens most often for apps running under a service where the user’s home directory may not exist or may not be readable by the user.

As mentioned above, this will affect various end users, and you are encouraged to upgrade. If you have any questions, please feel free to email me.

Happy Licensing!
Jason Nichols
jason@padlocksoftware.net

The short story: Padlock’s License Vault is a new technology for the storage and archival of both Padlock keys and licenses. It’s based on the venerable Apache CouchDB. For those unfamiliar with CouchDB, it’s an Erlang based document server that utilizes JSON over HTTP for all communications.

This is a very exciting project, as it will allow for a slew of applications that will help integrate Padlock throughout your business infrastructure. It’s an LGPL licensed Maven project stored at GitHub.

The long story can be found on the new License Vault page.

Documentation is sparse (ok, non-existent) at this point – but will be added over the next week.

I hope you will become active in its development, many of you have proven yourselves early adopters and I would expect no less in this case =)

Happy licensing,
Jason Nichols
jason@padlocksoftware.net

Fixes:
- Fix in Padlock Core for two bugs 1) Padlock API did not offer a method to set the location of the Padlock.lic file and 2) KeyManager import was not throwing an exception when attempting to import an older Padlock (1.x series) key

- Fix in Padlock Manager to use the selected Padlock License file from chosen location when signing licenses.

These bugs do not affect Padlock end users, as they only arise during the license signing process.

Specifically: Padlock 1.x customers who were attempting to use their older, RSA based licenses for Padlock 2.0 were getting validation errors. This update corrects this and allows them to use their licenses as expected. Note that this only affected license signing and not validation on the end user side of things.

• A new DSA based license format. This means Padlock now works out of
  the box on nearly any JVM you can find today.
• Hardware locked licenses. Since Padlock is now Java 1.6 based, we
  can easily grab system MAC addresses for locking licenses to a
  machine.
• Validator Plugins. If you’ve got specialized requirements for
  validating licenses, you can now add your custom plugin to Padlock’s
  validation procedure.
• Improved resistance to code decompilation. The Validator now throws
  exceptions when issues arise, making it tougher for crackers to follow
  the code flow.
• A great new user interface called Padlock Manager. I took the older
  PadlockUI and focused on the tasks that matter most to you guys when
  working with licenses. The result is a management app that’s even
  more powerful than the last. Padlock Manager now includes license
  templates. No longer do you have to manually enter license properties
  each time you generate a new license.

This release creates the foundation for a slew of new Padlock products
that are in the works. Stay tuned for more great products, and thanks
for using Padlock!

- Jason Nichols
jason@padlocksoftware.net

I also want to alert potential customers that version 2.0 will come with a price increase (the details of which are yet to be determined).  If your thinking of purchasing Padlock, I highly suggest getting it before the 2.0 release, because you’ll get the lower price and a free upgrade to 2.0 when it’s released.

This is mentioned elsewhere, but Padlock automatically comes with 1 year of free updates and support, so you can purchase now and upgrade for free.

• Revamped Validator reporting.  Developers now have fine grained access to the results of each test a license is run against.  This includes both the built in and developer added plugins.
• Quieter default logging.  Most of the current INFOs have been moved to FINEs, which is below the default logging threshold.
• Padlock Manager.  The entire UI has been re-worked to focus on core activities in day to day license management.  We’ve even added OS X and Windows specific executables!

Padlock Manager is still beta quality, with some missing features (license templates, sorting, and some input validation).  These will be added prior to the next public build.  Bulk creation of licenses (from CSV) is planned for Padlock 2.1.  The OS X application bundle is new, with much thanks to the developers who sent in suggestions on making it more Mac friendly.  The final release will have even better integration.

I look forward to your feedback – reach me anytime at jason@padlocksoftware.net

For whatever reason, my son’s bedroom did not have this style of lock. It had an actual key lock, for which I did not have the keys. From the outside the setup looked impossible to defeat (short of destroying the doorknob). The hinges were on the other side of the door, and I don’t possess the skills required to align tumblers for the key lock.

The setup looked secure and tough to beat. My son had a karate class in an hour, so I was prepared to resort to a sledgehammer if needed, but then another option appeared – using a flathead screwdriver I could simply pry the door molding a half inch to the side and slide a credit card to release the latch. It took all of 20 seconds and was not destructive to the door or the lock.

There are obvious parallels between the setup on the door and the security of software. Often software claims (and looks) to be secure, even under the most cursory scrutiny it turns out to be a facade.

During pre-sales emails with potential customers, I often encourage them to test out Padlock’s security for themselves. If security minded software can’t stand up to even the occasional and friendly attack, how will it last in the real world?