.NET Obfuscation

Anders Molin

Paul Watson wrote: 1. Nutters, opressed-from-on-high developers and pomegranates use it 2. No May I ask why you feel this way about it? Paul Watson wrote: 4. But if you want to, then go right ahead. Of course, I do what I want to ;) But I don't know if its worth the efford... - Anders Money talks, but all mine ever says is "Goodbye!" ShotKeeper, my Photo Album / Organizer Application[^]

My Photos[^]

Paul Watson

>I'm looking into Obfuscation of .NET assemblies and is wondering how many people that actually uses it... Nutters and pomegranates because I don't see the point. It is just more paranoia. Like privacy. You won't stop the people you are trying to stop with obfuscating. All you are doing is hindering them a bit and maybe at best stopping script kiddies. >If you make programs using .NET, do you Obfuscate your files before giving them to customers? No, I don't because I don't see the benefit. My applications can be reversed engineered whether I obfuscate or not. Yes, it will be harder to understand when obfuscated. But the question is; Who are you protecting yourself against? A serious threat or script kiddies fooling around with your code? If you really care about the later then by all means use obfuscation because it will confuse them enough to hinder them, probably even stop them. But IMO the threat is not a threat. If the former then the keyword is serious and serious threats will find a way no matter what you do. It is the same with implementing registration codes or online-authentication systems for your apps to stop people pirating it. Someone somewhere will come up with a binary hack to your application and then you are screwed. You end up spending more time for no real benefit. Also what happens if you in desperation (maybe your source code and all back-ups got nuked) need to reverse engineer your app? Oh crap, it is obfuscated-garbage. It will take you a good deal longer to get back your code. regards, Paul Watson Bluegrass South Africa Christopher Duncan quoted: "...that would require my explaining Einstein's Fear of Relatives" Crikey! ain't life grand? Einstein says...

Anders Molin

Paul Watson wrote: If the former then the keyword is serious and serious threats will find a way no matter what you do. It is the same with implementing registration codes or online-authentication systems for your apps to stop people pirating it. Someone somewhere will come up with a binary hack to your application and then you are screwed. Hehe, most people will do everything to try to make it almost impossible to crack their application. I don't do much, as the crackers will do it anyway, and the really good protection schemes are too anoying for the regular user... Paul Watson wrote: Also what happens if you in desperation (maybe your source code and all back-ups got nuked) need to reverse engineer your app? Oh crap, it is obfuscated-garbage. It will take you a good deal longer to get back your code. I have no problem with all my C++ code in this regard, and to be honest I think it's a bad "excuse" for your case. I don't disagree with you when it comes to obfuscation but this one was not so good Paul ;) BTW, I have my source on my workstation, and in sourcesafe on my server with mirrored drives, and on tape-backup, and on the occasionally DVD I burn and store outside my house... - Anders Money talks, but all mine ever says is "Goodbye!" ShotKeeper, my Photo Album / Organizer Application[^]

My Photos[^]

Paul Watson

I didn't say it was the best example ever, it is just one of many. It isn't a "bad" excuse, it is plausible and happens. Not everyone is as perfect as yourself in backups, mirrors and offsite storage :) For when pigs fly I would rather not have to trawl through my own obfuscated code. regards, Paul Watson Bluegrass South Africa Christopher Duncan quoted: "...that would require my explaining Einstein's Fear of Relatives" Crikey! ain't life grand? Einstein says...

Anders Molin

Hmmm, we also come from different backgrounds. You come from ASP where everyone cound see anything, I come from (and still use) C++ where I compile native code which was not that easy to read, so I guess we look a bit differently at it ;) - Anders Money talks, but all mine ever says is "Goodbye!" ShotKeeper, my Photo Album / Organizer Application[^]

My Photos[^]

Paul Watson

I thought we were talking about .NET applications (whether windows forms or webforms), not C++ and ASP apps. I don't know anything about C++ apps and obfuscation so sorry, cheers. regards, Paul Watson Bluegrass South Africa Christopher Duncan quoted: "...that would require my explaining Einstein's Fear of Relatives" Crikey! ain't life grand? Einstein says...

Anders Molin

Errr, we do talk about .NET applications, I just mentioned our different background, like in what we did before this whole .NET thingy... - Anders Money talks, but all mine ever says is "Goodbye!" ShotKeeper, my Photo Album / Organizer Application[^]

My Photos[^]

slvrscremr

I left VB 6 a while ago ... :-D but I'd consider returning to the old ways for the right price. Woo Hoo! :-D My first CP post :):-D:cool: Darien "I don't know, I haven't tried today." - Trumpet icon Maynard Ferguson, when asked how high he could play.

Marcie Jones

Welcome, Darien. Marcie CP Blog[^]

ProffK

I'm going to be looking into it. I have authored two C# apps recently, and probably will author a few more in the near future, that require the storage of SQL Server passwords. Of course I'll encrypt the passwords etc., but then I still have to code the key etc. There are some situations where I can have a user enter a password everytime the application starts, but others, like installation of MSDE, which requires a strong SA password. I can't leave it open on the command line, and I can't put it in a settings.ini file either. My most secure would be obfuscated code to set it, even if it's not that secure. My blog.

ProffK

I have once or twice written some good tight code, and spent many hours debugging and refinining it, but even then laughed when clients expressed so much concern over 'their secrets'. How much source code needs to be secret? It's normally the business ideas that are the real IP, and they are publicised instead of obfuscated. Granted there are cases that warrant value in secrecy, such as developing a better than others scheduling and packing algorithm, but I venture that these cases are in the minority. My blog.

Anders Molin

slvrscremr wrote: but I'd consider returning to the old ways for the right price. Hehehe :laugh: Well, I hope you keep posting, it sounds you have humor :) - Anders Money talks, but all mine ever says is "Goodbye!" ShotKeeper, my Photo Album / Organizer Application[^]

My Photos[^]

Terry ONolley

Ah, thanks - now I get it!

Glano perictu com sahni delorin!