Protecting the code

lobobr

Greetings everyone

This is a pretty old problem, but maybe I've found a solution and I wanna see if I'm right on this and if anyone have other suggestions on how this could be done.

I guess everybody knows how terrible it is to "give away" applications developed in an interpreted language, such as Perl and PHP.

I'm bringing this subject because I'm about to develop a very important web application that will be available for buying once it's done.

Well, for severla reasons I can't host the entire applications on my webspace, so I've thought "Man, I'm screwed. Once the entire app will be available at the client webspace what assures me that it won't be stealed?"

So it hitted me:

What if I host just part of the code on my web space and make it available for the app via include() or require() ?

Do you people agree that this solves the problem?

Does anyone have other solutions for this?

Best regards.

kparker

Zend makes a php compiler. Of course, it costs $$$$.

lobobr

Kirk Parker wrote:

Zend makes a php compiler. Of course, it costs $$$$.

So, this is a problem...

Besides, I don't like to "trust" a compiler for an interpreted language... I think there's always something that won't work correctly, not to mention possible problems with compatibility, performance, etc...

What do you think about the use of require()/include()? Is this a reasonable solution?

Regards.

Anon

No, it won't work - think about it, you'd have to supply your script with access to the source code. You wouldn't want to include() already-parsed code now would you. So, if your script has access to your source code on another machine then anybody else will.

As for the Zend Encoder - it's not a compiler, it's an encoder ... and IMO anything that's encoded can be decoded (of course I don't know the ins and outs of it because I don't have the $$$'s - probably how they like it because they realise it's weak).

Andy.

dannys

Zend do the insides of PHP4 now anyway (AFAIK) so I don't think compatibilty would be a problem and speed is Zend's main selling point.

But back to your soloution - It won't work, if the script could include yuor files then it could also fopen() them and save them locally.

What I do is make it as difficult to read as possible by removing all comments and line breaks, then using find/replace tool in any old text editor I replace the name of every variable with some a little more cyptic (i'm gonna write a little automated tool for this when I get time)

Ok so that won't put of any determined to read the code, but it tends to put off the 'casual curious' 🙂

jamie_webstart

Any includes from the other doamin would be parsed by your complier as it is passed out, so you'd only be including output. If your app is dependent on one big secret algorithm you might just make it work, but it's not really practical. Then there's the slight delay of a HTTP call to get the file too.

There are a couple of apps out there that will garble your code, (like change all the variable names to un-rememberable names that look like md5 hashes), they might help to make the code a little less friendly to the back engineer. I can't remember the names offhand.

If you're selling your app, could you not make the price include the cost of running it all on your webspace?

Hope that helps

lobobr

Good point...

Or maybe I'll include the Zend's cost on the price...

I have to think about this.

Thanks, people.

Anon

Where do you stand legally. Even if you were to use your proposed resolution, you cold be walking into a legal minefield. It's the age old problem of who owns which bit of the solution; and ultimately, what happens if the network link to your machine fails? Unless your "legal bods" have gone through the contract with the finest of tooth-combs you could be sued for not guaranteeing availability. If you are struggling to find the fund to cover the cost of the end interpreter I would suggest that you do not have the funds to guarantee network availability and bandwidth.

You need to think about this more and more (BTW, I'm not advocating Zend, just using it as an example)

dannys

Why is PHP still interpreted anyway? I thought it could've progressed to a fully compiled language by now, at least as an option.

dannys

Never mind, I just thought of a few reasons why not.

Too much sun, I think 🙂