From: Kris Date: 2006-05-23T19:40:18+09:00 Subject: Re: Writing a interpreter extension Tim Becker wrote: >> I know what this is. But I'm getting no helpful suggestions on this. > > You're getting plenty of helpful suggestions: it makes no sense to go > to great lengths to encrypt code and expect it to be secure. But it is more secure than open source. > > If you want to keep casual eyes away from your code, the very first > answer to your question: > >>On 5/19/06, Eric Hodel wrote: >> Override require. > > was spot on. Implementing any sort of obfuscation in your own > `require` will keep 99% of the audience out of your code. Agreed. It is something I am looking at. > > If, on the other hand, you want to securely keep the other 1% who are > determined in one way or the other to get at your code out, you can't > do it in software. > > Keeping your sensitive *data* encrypted on the other hand can be done > in software and with proper encryption, there is no need to obscure > the encryption routine, only the keys you're using (granted, you need > to find a secure way of destributing encryption passwords to users). > You could use the `openssl` ruby library to do the encryption, for > example. Openssl, by the way, is open source, yet quiete a few banks > trust it to protect their homebanking sites. How do those banks prevent the keys being found by their own staff or server admins? > >> The general feeling I get is it can't be done... Does anyone have any >> suggestions how to secure ruby (or other) code. > > Nobody is denying that it can be done to some extent. You can keep out > casual attackers by implementing some trivial protection (rot13, > obfuscation, loading your code from a zip file ...) or even keep out > professionals with some resources to invest by executing in tamper > proof hardware. But you seem to want something `in between`, and are > convinced the only way to do it is to compile your encryption key in > C. > -tim -- Posted via http://www.ruby-forum.com/.