From: Tim Becker <a2800276@...>
Date: 2006-05-23T17:26:25+09:00
Subject: Re: Writing a interpreter extension

> I know what this is. But I'm getting no helpful suggestions on this.

You're getting plenty of helpful suggestions: it makes no sense to go
to great lengths to encrypt code and expect it to be secure.

If you want to keep casual eyes away from your code, the very first
answer to your question:

>On 5/19/06, Eric Hodel <drbrain@segment7.net> wrote:
> Override require.

was spot on. Implementing any sort of obfuscation in your own
`require` will keep 99% of the audience out of your code.

If, on the other hand, you want to securely keep the other 1% who are
determined in one way or the other to get at your code out, you can't
do it in software.

Keeping your sensitive *data* encrypted on the other hand can be done
in software and with proper encryption, there is no need to obscure
the encryption routine, only the keys you're using (granted, you need
to find a secure way of destributing encryption passwords to users).
You could use the `openssl` ruby library to do the encryption, for
example. Openssl, by the way, is open source, yet quiete a few banks
trust it to protect their homebanking sites.

> The general feeling I get is it can't be done... Does anyone have any
> suggestions how to secure ruby (or other) code.

Nobody is denying that it can be done to some extent. You can keep out
casual attackers by implementing some trivial protection (rot13,
obfuscation, loading your code from a zip file ...) or even keep out
professionals with some resources to invest by executing in tamper
proof hardware. But you seem to want something `in between`, and are
convinced the only way to do it is to compile your encryption key in
C.
   -tim