Where do we draw the line with DRM-based plugins?

[Bryce]

Hey guys,

Old school MCM user here... in a new era we live in, plagued by DRMs, I wanted to kick off a conversation regarding ownership and DRMs.

Not trying to call out any one developer. I just want to start a real discussion.

Lately it feels like almost every plugin on BBB ships with DRM. I get why devs do it, piracy is real, but I think we’re starting to cross a line where DRM stops protecting code and starts breaking servers.

What happened

We bought a ~$20 plugin. The listing said DRM: Yes. Fair enough.

Less than a week later, during an automated reboot, our server failed to come back properly because the plugin couldn’t validate its license. Cloudflare was having issues, the license check returned a 525 error, and the plugin completely disabled itself.

This wasn’t some optional feature. It was core server functionality. High player count, real impact.

When we asked for a refund, the response was basically:
"The plugin functions, and DRM was disclosed."

But that’s kind of the problem.

What did we actually pay for?

Did we buy:

• A plugin
• Or a loader that only works when someone else’s infrastructure is online

Because those are very different things.

If a third-party outage can fully disable something I’ve already installed and paid for, then DRM isn’t just copy protection anymore. It becomes a hard runtime dependency. And I don’t think “DRM: Yes” really explains that risk.

DRM isn’t bad. Brittle DRM is.

There are plenty of ways to protect plugins without hard-failing servers:

• Offline license caching
• Grace periods
• Periodic revalidation
• Warn-only modes
• Public key validation

Stuff that still protects developers, but doesn’t take down production servers because Cloudflare sneezed.

Genuinely curious what people think

• Should BBB enforce that plugins are clearer about how their DRM works?
• Should always-online license checks be explicitly disclosed?
• At what point does DRM turn a plugin into a rental?
• If a plugin is unusable due to an external outage, should refunds be on the table?
• Where do we draw the line between protecting devs and punishing buyers?

I’m not anti-DRM and I’m not anti-developer. I just think we need better transparency and safer failure modes, especially for plugins servers rely on to stay online.

Curious to hear thoughts from others hehe

 

[gr8job]

I’m fully with you on this, and I think you framed it in a really fair, level-headed way.

I’m not anti-DRM either. I understand why developers protect their work, and piracy absolutely hurts smaller plugin devs. That part isn’t controversial. The issue is how DRM is implemented and, more importantly, how it fails.

What you described isn’t just “DRM exists” - it’s DRM as a single point of failure. When a paid plugin can hard-disable core functionality because a third-party service (Cloudflare, auth server, license API, etc.) has a hiccup, that’s no longer just copy protection. That’s an always-online dependency being silently introduced into a production server.

And I agree:
“DRM: Yes” doesn’t adequately communicate that risk.

There’s a huge difference between:

• This plugin checks licenses occasionally
  and
• This plugin will refuse to load if it can’t phone home right now

Most buyers reasonably assume they’re purchasing software that runs on their server, not leasing functionality that depends on someone else’s uptime.

The alternatives you listed are exactly the right direction. Offline caching, grace periods, warn-only modes, these are solved problems in software licensing. They protect developers without punishing legitimate customers or turning routine outages into downtime events.

I also think the “no refund because DRM was disclosed” argument misses the point. Disclosure isn’t meaningful if the failure mode isn’t disclosed. If an external outage can brick a plugin that was working yesterday, that should absolutely factor into refund discussions.

To me, the real questions are:

• Should always-online checks be explicitly labeled as such?
• Should plugins that can hard-fail servers be held to a higher standard?
• And yes, at what point does this stop being ownership and start being a rental?

None of this is an attack on developers. It’s about trust. Server owners aren’t trying to steal software, they’re trying to keep their communities online.

Transparent DRM + safe failure modes feels like a reasonable baseline. Anything less just shifts all the risk onto the buyer, and that’s where things start to feel unfair.

Interested to see where the rest of the community lands on this.