I'm releasing some software in python which is impossible to fully encrypt. I was thinking of changing the variable names slightly for every copy that I release. Is this a good way to figure out who is leaking my software? Chances are no 2 people who bought this software will compare because the price is in the thousands. Furthermore, there are limited copies so they won't even realize they are being tracked.
What is the downfall to this method and are there any better ways to do this?
You can add an external lib to the product, made in C/C++. Python can import those just fine. Add a couple vital functions on that library, and change the library a little for each client.
An interesting way of doing this is to use internationalization to encrypt most of the strings, and use the external library to decrypt them. Use a custom key to each client, and encrypt the strings file before shipping.
It might be easier to assign an identifier to your product, and tie those identifier details with customers that buy the product. Another issue though is that even if someone did leak your product, it can often be very difficult to do anything about it, let alone enforcing it. So if you want to protect your product it would be wise to look into using license keys, its not a perfect method but can give an extra layer of protection.
I do not see a straightforward solution here, as ThoriumBR mentioned,
you can add an external lib to the product, made in C/C++. Python can import those just fine. Add a couple vital functions on that library, and change the library a little for each client.
The idea to use these external libraries for encryption I do like. A system similar to that used by intelligence agencies involves having all classified files encrypted at rest, and when requested by an employee, the file is decrypted and issued to them. This method will ensure logs can be kept for each request, and who requested a decrypted version. Although, for that environment, air-gapped networks are used, and employees are not allowed to remove material from the workplace.
I do have concerns over this, as while programming, programmers are using the source code, which might as well be equivalent to plaintext. So signing the code would not make a difference, as it would only serve to slow down the leaker if they did not want to be found afterward. So, taking measures to ensure full working code cannot be dumped on the Internet, like using external libraries which the programmers never have direct access to might actually be more ideal.
Is this a good way to figure out who is leaking my software?
It's viable - but you also need to build another application to track the changes applied to the code and link these to customers.
But the elephant in the room is what you intend to do when you find an unlicensed copy of the software somewhere. You merely have a very strong indicator of which legitimate customer the software came from. What do you do next? Evidence of possession alone (assuming that you can prove posession) does not demonstrate malfeasance on the part of the legitimate licencee nor the possessor. Possession of IP belonging to someone else is an issue of copyright (or patent) and in most jurisdictions copyright and tort are primarily civil matters. The police will not be interested in investigating this.
there are limited copies so they won't even realize they are being tracked
....and what happens to your reputation when the world finds out that you've been deliberately building capabilities into your software which you don't tell your clients about?
BTW in Europe I suspect that customizations deliberately intended to identify a specific individual would be considered PII under the GDPR; by not telling people about this you may the bad guy (and a lot of GDPR comes under criminal law).
