Re: securely distirbute applications
Thomas Weidenfeller wrote:
saotome wrote:
I'm planning on distributing some java apps. I'm a bit preocupied that
some of the users may try to decompile the jars and learn about the
source.
Are you ashamed of your code?
Not very relevant comment, is it?
Let's face it. Almost 100% of the code of
an typical commercial application is trivial
Yes, but this poster code might not be, that might be why he asks the
question. You are generalising your respons without knowing the details
of the application.
in the sense that there are
no breakthrough algorithms or top-secret information in the code.
Typically is the amount of code and the perseverance shown to put it
together which makes it valuable, not any algorithm. However, it is the
algorithms from which one can learn most. And reverse-engineering and
understanding an algorithm consists of much more than just decompiling
the code.
There might be pieces of information in the code that the OP wants to
protect, such as structure of communication/systems etc in the backend,
passwords/certificates in the code and so on, or just some small smart
way of doing a single thing which one can make some money on.
Easy decompilation makes the hacking simpler, but difficult
disassembling doesn't prevent the hacking.
No, but it can stop the general script kiddie and similar crackers.
The point of such things are not necessarily to make 100% unbreakable
solutions, as one would except from a technical perspective. But rather
to create barriers to shut out 99% of the people trying, its basically a
psychological game on human nature.
It would be nice if the community could started talking about security
and similar things pragmatically instead of ideally. Yes, most solutions
are ugly if they are not 100% perfect, but that's a technical problem.
Sure, for some problems only a 100% solution is good enough, such as
encryption etc. But in real life, a lot of security is about perceived
security, even in high security situations (such as protection of head
of states or military installations). The reason encryption, for
example, needs 100% security is that you can set the computer to brute
force the attack. While breaking into a system or reverse-engineering
some code requires human reasoning, planning and action, which can be
foiled by reasonable barriers.
tom