dflemstr wrote:
SSL: you need to be able to make trusted payments. PayPal won't accept you if you aren't a certified website, and an user won't trust a site that operates over http because someone can be a middle man and intercept your bank info etc (you know this already, don't you).
Granted. I don't think it's as big of a problem as you're making it out to be, though. And there are lots of alternatives to paypal that just take a credit card.
Quote:
Copy protections: OK, this is actually up to the app maker. There must be some basic copy protection systems in place, however, for example something that prevents the same download URL from being used multiple times on multiple computers, something which *can* be a pain to manage.
Again, why? World of Goo is doing quite well with no DRM. The download link I was sent is still active. I can download any client I choose. I downloaded the Linux client first, then later the Windows client. I could download them again and again if I choose. This is straight http, no secure connection or anything. Lots of cheap programs use this or similar model, with absolutely no DRM.
Quote:
Closed-source client application: If you want to be able to make the payments for applications in a local GUI app, it has to be trusted so that it doesn't get modded to report "Well, yeah, the guy has payed for the product!" for every application in the store or similar. There are other ways of doing this, such as creating a close PGP relationship between server and store, but it can become very complicated.
I'm not certain what you're getting at. Are you saying the gui buys from one site, and then somehow tells the repository it can be downloaded? It's entirely possible to get Paypal to send a message of some kind, even over a secure link, when a purchase is made. If it's going through paypal, the gui makes the purchase through paypal, paypal sends the signal to a known server, the GUI doesn't need to know anything about what happens next, just that a previously unavailable app has now become available. Alternatively, you can link the store and repository as one, as you say. That's the model Apple uses. In that case, you really do need SSL, but I don't really see that being the problem you make it. Perhaps I'm wrong.