tags:

views:

872

answers:

6

I've developed a Perl script that has a confidential business logic.

I have to give this script to another Perl coder to test it in his environment. He will definitely try to extract the logic in my program. So I want to make my script impossible, or at least very very hard, to understand.

I've tried a few sites like liraz, but they did not work for me. The encoded Perl script does not work the same as the original one.

A: 

You could look at perlcc. It doesn't guarantee correctness, but it should do alright if you're not doing anything too funky in your scripts.

Anon.
-1 Perl bashing is an appropriate pastime for comments, but answers should be informative, and relatively unbiased. Also, `perlcc` is still experimental and may not work and should be used with extreme caution, and not for production code. And that won't really stop someone who's determined.
Chris Lutz
Edited out the snarkiness.
Anon.
Retracted the -1, but `perlcc` is still a poor solution (to an admittedly unsolvable problem, so no penalty for trying).
Chris Lutz
Didn't mean to sick a hurricane on you, man. Sorry.
Chris Lutz
Nah, don't worry about it. The original version deserved downvoting, and the rep doesn't matter.
Anon.
+4  A: 

Use Acme::Bleach to bleach the code clean. Then obfuscate the resulting bleached code. However, any encoded/obfuscated code can be decoded, as the Perl interpreter has to decode it anyway.

Alan Haggai Alavi
no, first obfuscate, then bleach
ysth
That's even better than Acme::EyeDrops
mobrule
+57  A: 

I suggest that you get this person and his management to sign a legally enforceable agreement that forbids all forms of reverse engineering, and any other means of gaining access to the stuff you want to protect.

Obfuscation cannot protect you against a determined attempt to reverse engineer. It is theoretically and practically impossible.

Stephen C
+1 for the right answer.
Chris Lutz
What he (and several other folks answering similar questions in the past) said. Get a good lawyer. If your client is of a mind to reverse engineer your code you have far worse problems than him reverse engineering your code.
Penfold
+5  A: 

First, let me say that you're barking up the wrong tree. What you want to do is the wrong approach for many reasons.

Second, check out Filter::Crypto (and PAR::Filter::Crypto). Read the whole manual before your start.

tsee
+8  A: 

See perlfaq3: How can I hide the source for my Perl program?

Michael Carman
+8  A: 

Don't try to obfuscate your Perl. You're wasting your time there. I show plenty of people how to break that sort of stuff in Mastering Perl just so they won't try to do it.

Have you considered implementing the sensitive stuff in C and shipping a pre-compiled binary with a Perl interface? It's relatively easy to do and has the same effect without relying on a clever trick. The determined, skilled person can still reverse engineer it, but that's true for any solution. You do have to compile the library for each platform, but if this stuff is important enough to protect, it important enough to charge enough to people to use it.

Alternatively, put the sensitive stuff behind a web service so they never get the code.

The business answer is to not give the program to people you don't trust, or to make the penalties stiff enough to discourage it.

brian d foy