Protecting your Shockwave from Pirates

August 6, 1998
by Alex Zavatone

Sometimes, the topic of "how can I stop somone from stealing my shockwave" comes up. This is not a rampant problem but I have heard reports of certain "are you sure you're over 18" web sites pirating shockwave games from legitimate game sites. In any case, what can you do to prevent shockwave pirates? Well, there are two levels of security that can be placed in your shockwave. The first relies on where the shockwave is being served from, ie your domain. You can add a handler or object to your shockwave startup routines that will check to see if the domain is an approved domain or url. If it is not, then post an alert and either stop or quit the browser. For your convienence, a simple handler and an object to do this are included at the end of the article.

The second method to protect your shockwave is a bit more complex and probably overkill for most projects but it does get by the one problem not solved by the previous method -- someone else's web page could still link to your shockwave on your site. This method requires the passing of an unlock key through any of the embed variables to the shockwave movie itself. The unlock variable would be intercepted and decoded in the shockwave based on a simple algorithm. The caveat here is that the HTML page on the server would have to be regenerated every day through a server side script. This is much more complicated but to date, we haven't been able to find any holes in this plan. And if you need it, it should do the trick for you.


On ValidateHostDomain domains, action, message
  set successFlag = 0
  repeat with myDomain in domains
    if the moviepath contains myDomain then
      set successFlag = 1
      return
    end if
  end repeat
  -- if we get here, there are no valid domains
  -- but we'll check anyway
  if not successFlag then
    alert message
    do action
  end if
end

Examples:


-- ValidateHostDomain ["director-online.com", ¬
  "indymusic.com"], "quit",
"don't pirate my shockwave"
-- set myDomains = ["director-online.com",¬
   "indymusic.com"]
-- set myAction = "quit"
-- set myMessage = "don't pirate my shockwave"
-- ValidateHostDomain myDomains, myAction, myMessage


parent script name: ValidateHostDomain
on new me, domains, action, message
  set successFlag = 0
  repeat with myDomain in domains
    if the moviepath contains myDomain then
      set successFlag = 1
      return
    end if
  end repeat
  -- if we get here, there are no valid domains
  -- but we'll check anyway
  if not successFlag then
    alert message
    do action
  end if
end

Examples:


-- ValidateHostDomain ["director-online.com", ¬
  "indymusic.com"], "quit",
"don't pirate my shockwave"
-- set myDomains = ["director-online.com",¬
  "indymusic.com"]
-- set myAction = "quit"
-- set myMessage = "don't pirate my shockwave"
-- new (script "ValidateHostDomain", myDomains,¬
   myAction, myMessage)

A Director user since 1987, Alex (Zav) Zavatone has worked on the engineering teams for both Director and Shockwave, 4, 5, 6 and 7. Recent investigations find him developing foundation classes for Director with asynchronous process management and other life threatening activities. In its early days, he had something to do with this Internet thing known as "DOUG". A noted ne'erdowell, slacker and laggard, Mr. Zavatone is nonetheless is trusted by children, small animals and the elderly. In his spare time, Mr. Zavatone rehabilitates lame desert trout.