From: Michael Gebhart <mail@...>
Date: 2005-02-05T19:55:14+09:00
Subject: Re: Ruby for closed source projects

Hi,

first thanks for your answer. 

> Not that I want to sound academical or religious or anything, but if 
> your encryption algorithms need to operate in the dark to be secure they 
> probably aren't working very well. Also note that copying source code is 
> not legal so you might not even need to obfuscate it to get protection 
> against naive copy attempts.

Yes, sure you are right. But one example: I wanna have a registration code
in my application. The user gets a code to activate some more features. In
the code, there only is a flag reg=true/false. When the code is entered,
the application checks it and sets the variable to true, or false. The
user can now take a look at my code and simply change this part. After the
check he sets: reg=true.

So my mechanism to check the code is not useful. Also if I try to do the
check of the code on a external server and give back a true or false, the
user can change this part in the code directly. 

Ok, now you can say: registration codes are ugly and everything has to be
opened :) Sure, but if it is a commercial project, there is no other way. 

I only could appeal to the users forthrightness.


And yes: With Java I had the same problem. And with C# I will have it too.
But: I thought Microsoft would develop their applications in C# too. But
then the users also can see the code. Maybe Microsoft will keep on using
C++ for the huge projects? And only use C# for not important parts? 

Greetings

Mike

Greetings 

Mike

> That aside it's quite hard to hide code well -- just have a look at Java 
> where there's disassemblers that can produce pretty readable code from 
> byte code and there's lots of people reconstructing algorithms directly 
> from machine code -- if the machine can read it, it is quite likely that 
> an human will also be able to do so -- it's just a matter of how hard it 
> will be for him to do so. You're really only safe if you have the code 
> logic residing on an external server which will just take input and give 
> back output without disclosing how it processed the information.
> 
> There's tools available that will make reconstructing of the source code 
> non-trivial for inexperienced users -- RubyScript2Exe[1] and Exerb[2] 
> come to mind. But note that these just encode the unfiltered source code 
> directly and if somebody knows how that is done he can reconstruct the 
> original source code.
> 
> Other approaches include taking the code itself and making it harder to 
> read for humans (via variable/method/class name substitution or removing 
> meaningless whitespace) and dumping Ruby's syntax tree directly. The 
> latter is quite similar to how Java does this and can for example be 
> accomplished via NodeWrap[3]. I think I also heard about somebody 
> modifying Ruby itself (you are allowed to do so even without releasing 
> the source code of your modified Ruby) so that it would use a different 
> mechanism for loading code.
> 
> I hope you can understand the trouble associated with all this and will 
> still find a solution that works for you.
> 
> [1] 
> http://www.google.com/url?sa=U&start=1&q=http://www.erikveen.dds.nl/rubyscript2exe/&e=9818
> [2] http://exerb.sourceforge.jp/index.en.html
> [3] http://rubyforge.org/projects/nodewrap/