Protecting PHP Source When Distributingn

Anon

I am developing a PHP application for commercial distribution and I am wrestling with solutions for protecting my source code from copyright infringement when I license the software.

Does anyone know of any smart ways to protect your code in this type of situation? I have seen that zend.com is selling PHP encoder. Is it worth the hefty price tag? A cheaper solution must be out there!

I look forward to any suggestions.

Many Thanks!!

giovo

No comment.

[deleted]

"Is it worth the hefty price tag?"

Depends on how mucn money you're planning to make.

If encoding costs more than what you'll make from selling the product, then obviously it's pointless.

Another question to ask is: is my code worth encoding in the first place?

Is your script that much in demand? Are there people waiting for you to release the source so they can sell it for themselves?

Are there no alternatives for your product at all?

And do you really want your customers to have to go through you for every little change they want to make to the product?

Anon

Ultimately, yes, the customer would need to go through me requesting changes. The software would be updated on a regular basis (how regular is to be determined).

More than anything, I am just curious what people in the same situation have done to solve the same problem. I am sure the zend encoder would be worth the investment, but right now it is out of reach for me.

The other alternative that I am considering is just hosting the software on my server where I have control over the code and the environment that it runs on.

I have heard that building a basic structure that calls out to remotely hosted include files is a way to distribute code, but still maintain control over the meet of the application.

Again, this is something I am new to and would love any observations people have from past experiences.

Thanks

Anon

Do you have thoughts/ideas on this topic?

Anon

"I have heard that building a basic structure that calls out to remotely hosted include files is a way to distribute code"

derr in effect still giving the client access your source...

Anon

General foolishness. High tech encrypting. You must be f---ing kidding. Who the f--- is this?!!

Allleee... Great,... just great.

As long as someone might think about protecting its own security on server in case of something - might be accetable.... I said might.

But selling the encrypted source...
The folks is gonna kill ya... You have to say that, befor selling? & than is the admin ready to install optimiser for ya / your client? Don't think so...

No matter what zend might say,... it's gonna be slover unless you use zend accelerator on it? Optimiser sucks, & it's okay for low hits,... do a heavy traffic &... CIAO.

I do not approve this mentality. guys go to doctors & find a good schrink befor you'll gonna f--- up our open source env, like sun is beggining to do with SO 6.0 (fortunatelly will be on paying only and not encryped. I HOPE.).

What's your company name? Just give me a link so I'll know where not to buy things.

-Gord

Anon

True, they would have access to some of the source, but if the majority of the code were tied up in a remote location that is not accessable, then it would bemore difficult than it is worht to attempt to assemple the missing pieces.

Anon

I have heard that zend encoder does slow things down considerably, and you are right, it may not be a practical solution if the application is being distributed to a large number of people.

I have combed other discussion threads here, and found many people asking similar questions (sans-flames I might add).

Does anyone know anything about code obfuscation? Perhpas making the source painful to interpret is a simpel solution.

Again, thanks for any flame free help.

[deleted]

"but if the majority of the code were tied up in a remote location that is not accessable,"

But the source is accessible, how else can the client's script read the source to execute it?

Anyway, no sane person would ever allow any script to execute sourcecode taken from another server, because that's a hacker's paradise.

You'll have to encode the whole thing and be stuck with the cost and the maintenance, or slap a good licence on it and save yourself a whole lot of trouble.

[deleted]

Methinks you need a stress-pill.

or at least a brain.

get a life puhleaze...

[deleted]

there's no way to make your code un-readable.

Everything you do to make the code 'hard to read' is just as easily reversed. Only the variable names would be meaningless, but you don't have to be a rocket-scientist to work out what they do.

Why don't you instead develop in C++? that will give binaries that are very complex to reverse-engineer, and they're faster too.

A forum, a FAQ, email notification, what else do you need?

Time to YAPF!: http://www.hvt-automation.nl/yapf/

van__

I'm in the same boat you are as far as trying to determine the best way to release this portalware I have.

I was thinking about encoder...
but if zend eats it's it's own dog food,
then I'd say the performance of the zend.com site is a classic example of what to expect with the use of encoder/optimizer.

Frankly, zend.com is my least favorite site to visit because the page has this unexplicable hang even after it's rendered on the page, sometimes up to 20 seconds.

I've been thinking about playing around with resources though and seeing if I could write a C program to decrypt mcrypt encrypted files and pass back a resource and then have PHP use the resource returned to do an include().

That would allow the files in question to be encoded without paying thousands of dollars for an app that will make your entire site run like a tortoise.

Essentially, it would be a software dongler
that would require a keyfile for access
and wouldn't really slow the PHP application down all that much if you were thoughtfull in your approach... and it would allow for non-incrypted files to be used as well.

Since my app is a portal framework, the people who use it would need use their own non-encrypted code to control it and they wouldn't need to get into my code since it's all abstracted.

But, I have been toying with the idea of just putting it under the GPL and posting the entire damn library on sourceforge or some other open source site for public participation. It definitely would be a useful piece of software for others to have access to since it allows you to host multiple sites of a single source distro and performs many mundane things like DB access, user login and Directory IO automagically.

And with a public project, you can often times wind up with a better codebase if you get some decent programmers to participate.

But on the other hand...
I really don't feel like managing a project like that since I have so many other apps to write.

So I'm still so very confused on this subject.