RE: Obfuscation

["Joe Pluta" <joepluta@xxxxxxxxxxxxxxxxx>]

> From: David Morris
>
> I wonder how effective this is and also whether IBM employs
> obfuscation in the toolkit classes that have no source. I
> guess that they might include some inline encrypted byte
> code to discourage casual observation, but even then it
> would seem possible to write code that would dump
> the bytecode when the class is loaded.

How effective it is really depends on your coding style.  Since I use lots
of setters and getters and methods that simply change a value and call
another method, it makes it really, really difficult to read my code once
it's been obfuscated.  Not impossible, mind you, but very difficult.

If, on the other hand, you tend to write long, involved procedural code in
your methods, then obfuscation is probably less effective, because it's
easier to see what an entire piece does.

In either case, though, obfuscation is just like serial number validation
and license keys.  None of them will stop a determined hacker, but they will
make it obvious in court that the hacker committed criminal behavior to get
past the security.

No security method is unbreakable - the issue is whether it is prosecutable.

Joe