From: Hal Fulton <hal9000@...>
Date: 2006-05-23T16:56:17+09:00
Subject: Re: Writing a interpreter extension

Kris Leech wrote:
>>Google for the phrase "security through obscurity" (STO).
> 
> 
> I know what this is. But I'm getting no helpful suggestions on this. 
> There seems to be a load of resistance to doing anything secure or 
> commerical in ruby. And yes its a general problem with all interpreted 
> languages except Coldfusion which I think allows you to encrypt source. 
> PHP goes part way with obsfucation.
> 
> The general feeling I get is it can't be done... Does anyone have any 
> suggestions how to secure ruby (or other) code.
> 

Oh, anything can be done... but is it worth it, and have you really
accomplished anything?

That's the source of the resistance you perceive. Most of us don't
want or need what you describe.

I venture to say there are numerous people here who might put in
some hours and achieve what you want. But the people who really
understand cryptography (and I am not one) will not spend their
time on an STO scheme.

As for coding... Most people are motivated only two ways to write code:
   1. They're paid
   2. The project seems cool to them

You're not paying (are you?) and people aren't convinced this is cool.

Actually I remember *someone* making an obfuscator of some kind 3-4
years ago... I played with it awhile and couldn't break it. Others
could, though. Or I could given a few hours.

The best suggestion yet was to keep the code off the client machine
and make a web service. That is relatively secure.


Hal