Something unusual happened to our website traffic this morning.
A few minutes before 7:00, hundreds of visitors from around the world suddenly arrived at the Stillwell Audio plugin catalog. After a little digging, I found the reason: a warez release of the current Windows catalog had appeared, described as “patched” and accompanied by what was advertised as a keygen.
Well. Apparently I’m back.
It has been a busy year here: the Version 4 catalog rebuild, new products, Linux support, CLAP support, and a great deal of less-visible work to carry these plugins forward. I suppose being noticed again by the warez community is one thoroughly unofficial measure of renewed relevance. Not one I requested, but there it is.
A technical point is worth making: nobody broke Ed25519 overnight.
Current Stillwell Audio license files are digitally signed, with separate signing material for each product. Producing a valid license for an untouched official build would require the corresponding private signing key. Calling an unknown executable a “keygen” does not make that cryptographic problem disappear.
The usual alternative is considerably less impressive: modify the plugin so it no longer verifies licenses correctly, then generate some license-shaped data that only the modified binary accepts. That is not a keygen for the official product. It is a patch paired with another executable whose behavior you are being asked to take on faith.
There are additional layers of trust around the official files.
Our Windows installers are EV-signed. If somebody modifies or repackages one, that valid signature does not survive. If Windows shows an unknown publisher, an unexpected SmartScreen warning, or instructions telling you to disable security software, stop. You are no longer running the installer we shipped.
The same basic issue exists on macOS: altering a plugin breaks its code signature and puts it outside the signed and notarized delivery chain that Gatekeeper evaluates.
AAX is a separate case. AAX plugins are signed through PACE, and Pro Tools verifies that signature. Modify the binary and the PACE signature is no longer valid, so Pro Tools should refuse to load it. Merely putting an .aaxplugin file in an archive is not evidence that the patched version works in Pro Tools.
I have not downloaded or analyzed this release, and I’m not going to run an unknown executable merely to satisfy my curiosity. Neither should you.
Keygens and cracks are unusually convenient places to hide malware. The person running one is already expecting antivirus warnings, strange behavior, and instructions to weaken security protections. That makes the format a nearly perfect Trojan horse. A modified plugin also runs inside your DAW under your user account; you are trusting the person who altered it with whatever that account can reach.
There is no practical reason to take that risk just to evaluate our plugins. Every Stillwell Audio evaluation version is fully functional and unobtrusive. There are no activation servers, no background authorization service, and no crippled audio path. Download it directly from us, use it properly, and remove it normally if it is not for you. It does not take computer-forensics skills to uninstall.
Is piracy frustrating? Of course. Stillwell Audio is a small independent company, and purchases pay for the engineering, maintenance, support, and free updates behind the software. But I’m not naïve enough to think a lecture will change anyone’s mind.
So I’ll leave it here: I’m glad people have noticed that Stillwell Audio is active again. I would prefer that nobody hand control of their studio computer to a mystery executable in the process.
Apparently I’m back. Now, back to work.