One of my software development clients is licensing a Windows application to another software company, for bundling with that company's own product, and I was tasked with integrating this unmanaged C++ application (compiled with Visual Studio .NET 2003) with the other company's C# 2.0 application and ASP.NET 2.0 Web site for licensing. It seemed simple enough.

At first, my opposite number at the licensee and I agreed on a licensing scheme in which their software would write an encrypted license code and expiration date in the registry for our software to read. Then we realized that a simple clock setback attack could effectively extend someone's subscription indefinitely. So, we decided to create a Web API for license verification.

There were two obvious choices: a RESTful API, and a Web Service API. We both had experience with both kinds of Web APIs, and neither of us had a strong preference. For me, it seemed like implementing the RESTful client would have been a matter of adapting a function that was already in the program. Implementing the Web service client seemed like a matter of importing some WSDL and letting Visual Studio generate a proxy, then instantiating and calling the proxy.

We decided on the Web service, because it looked a little easier to implement at the server. It took them under an hour to put up a stub service; it took me under an hour to import the WSDL, generate the proxy, and write the call. It took me about a day to write the rest of the code needed to process all the necessary parameters and handle all the possible error conditions.

When it came time to test the code, I found that the Web service call never returned. My counterpart supplied a C# client that demonstrated that the service was working and could be called from my machine, so I massaged my code and tried again. This time the Web service call returned, but with an error. Further debugging showed that the C++ proxy code couldn't parse the reply from the Web service.

As we fade out to a commercial, my counterpart is trying to make the C++ equivalent of his C# test client work on his machine. The last I heard, he was having the same trouble that I had.

I wrote Web service code, it seemed like the thing to do,
Yes I wrote Web service code, it seemed like the thing to do,
But the client hates the server, and it makes its Daddy blue.

Posted by Martin Heller on July 11, 2007 07:59 AM