Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: markspace <markspace@nospam.nospam>
Newsgroups: comp.lang.java.help
Subject: Re: Finally java class file encryption possible.
Date: Wed, 30 Oct 2013 12:06:22 -0700
Organization: A noiseless patient Spider
Lines: 25
Message-ID: <l4rlbj$bco$1@dont-email.me>
References: <16e63103-68ab-4b05-8645-ff79080a94f9@googlegroups.com> <j3e2ka-878.ln1@s.simpson148.btinternet.com> <85e67187-df89-47ff-9f44-d486b846b421@googlegroups.com> <u1p5ka-tt6.ln1@s.simpson148.btinternet.com> <9611b714-c4c1-42e3-80dc-edd2f1939b36@googlegroups.com> <bmf7ka-is7.ln1@s.simpson148.btinternet.com> <db658622-4627-4f2e-9c17-2d76cb6400ca@googlegroups.com> <16pm8rba3p5hh$.wng8plh755vm$.dlg@40tude.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Date: Wed, 30 Oct 2013 19:06:27 +0000 (UTC)
Injection-Info: mx05.eternal-september.org; posting-host="9185b88a2b5381a82810209530bb8295"; logging-data="11672"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX19hDal8b8L2upsSycMhfigRGAlpnDM+0yQ="
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.0.1
In-Reply-To: <16pm8rba3p5hh$.wng8plh755vm$.dlg@40tude.net>
Cancel-Lock: sha1:gzBHRsC7BOgbPQy/qdBt9ggbkAY=
Xref: csiph.com comp.lang.java.help:2845

On 10/30/2013 11:17 AM, Joerg Meier wrote:
> On Wed, 30 Oct 2013 10:40:28 -0700 (PDT), Java Encryptor wrote:
>
>> So basically there is no way we can prevent our class from de-compiling.
>
> No, of course not - in the end, the computer still has to be able to decode
> them to run them, and anything the computer does, a potential thief can do.
> It's best to just obfuscate your code and then be done with it and accept
> that some people will be looking at your code.

Obfuscation can make stack traces and log output hard to read (they'll 
print the obfuscated class and method names).

Better I think to:

1. Provide enough value that it's more work to steal code than it is to 
subscribe to your service/product.

2. Keep some of the code on a server where folks can't get at it, and 
make API calls over the network to return results.

3. Use the courts for egregious cases of theft.