Piracy and copy protection

The case against cracks is security, not ethics#

Everyone discusses cracked plugins as if it were an ethical debate. That is a distraction. Cracking a modern plugin is not a one-byte patch any more. You reverse engineer the copy protection, write new code and patch it into the binary. So you are already trusting an anonymous person to put his code on your computer. Anyone with the skills to crack big commercial plugins has the skills to write ransomware.. The only two things standing between those skills and you getting scammed are ethics and probability, and the world has no shortage of skilled people or of bad people.

Even when the original cracker is trustworthy, releases often get repackaged and uploaded to other mirrors, and that can be a major route for malware.

A plugin is not contained in the DAW#

"It's just an audio plugin. It's contained in my DAW. What's the worst that can happen?" Wrong. A plugin inherits the DAW's permissions, so anything your DAW can do on your computer, the plugin can do too: read files, send them to a server, delete them, spy on your clipboard. I made a demonstration plugin in a few minutes that emailed my clipboard and a list of my files to a live account.

An installer wizard that asks for your administrator password is worse, because now it has the whole machine. It can turn your computer into a crypto-mining rig on your electricity bill, log your keystrokes, stream your webcam and microphone so someone can blackmail you, or silently encrypt every file you own and demand a ransom.

Legal accountability#

So why trust any plugin? Because a legitimate developer has a real name, a VAT number, a registered business address and a paper trail of customers paying into a bank account. If a developer like that put a drop of rat poison in a paid plugin, he would go straight to prison. A cracker has already shown he is happy to act illegally and anonymously, so there is little to stop him going one step further.

That applies to every binary, not just cracks, and more so now that anyone can generate plugin code with AI. Before you install anything, it's worth knowing who answers for it.

Plugins should be files you drag and drop#

A plugin does not need administrator rights to exist. Mine are single files you drag into the plugin folder: no installer wizard, no downloader app, no manager app. Bloatware is just annoyance with additional security risk.

Copy protection should be minimal, offline and silent#

Copy protection cannot stop a determined cracker. It is like fitting a bank-vault door to your house: the burglar just makes a hole in the wall next to it. Heavy copy-protection schemes can bloat the software, give paying customers a slower and worse experience than the people running the crack, and lock developers out of platforms such as Linux.

I still use it reluctantly, because the data says people won't pay without it, and donationware only works if you have millions of users. But my position is that it should at least be lightweight.

My plugins authorise offline and generate zero network traffic. A plugin that sends megabytes of data to a server without telling you, with the opt-out buried in a licence agreement, has not, in my view, got your informed consent.

Piracy is a part of the ecosystem#

If developers can't pay their rent, there is no software and nothing to crack. If the lions eat all the other animals, the lions starve. The fair balance is a mix of free, open-source software and reasonably priced paid software, which is why some of my plugins, such as Versatile Compressor, are free with the code on GitHub. Free software is a gift, though, not a right; see pricing.

I do not endorse cracking. But if a crack is going to exist, it should be open source, so you can read the code, check it is clean, compile it yourself and learn some cryptography in the process. When one of my own plugins was cracked, the crack was open source, and I praised that. I still strongly advise against running any executable from a source that isn't 100% trusted. And if you use a cracked version and get value from it, please consider buying the plugin, or buying something else to support the developer.