RE: Obfuscation

["David Morris" <David.Morris@xxxxxxxxxxxxx>]

Joe,

I hadn't thought of decompiling byte code as criminal
behavior -- I had better be careful :). One reason I ask
is that it really is frustrating that IBM does not provide the
source for the security related procedure. That means
I had to duplicate a lot of the work that those procedures
provides to get control of what is happening. Based on
what you say, the hacker is not kept out anyway.

David Morris

>>> joepluta@PlutaBrothers.com 04/11/02 10:34PM >>>
> From: David Morris
>
> I wonder how effective this is and also whether IBM employs
> obfuscation in the toolkit classes that have no source. I
> guess that they might include some inline encrypted byte
> code to discourage casual observation, but even then it
> would seem possible to write code that would dump
> the bytecode when the class is loaded.

How effective it is really depends on your coding style.  Since I use
lots
of setters and getters and methods that simply change a value and call
another method, it makes it really, really difficult to read my code
once
it's been obfuscated.  Not impossible, mind you, but very difficult.

If, on the other hand, you tend to write long, involved procedural code
in
your methods, then obfuscation is probably less effective, because
it's
easier to see what an entire piece does.

In either case, though, obfuscation is just like serial number
validation
and license keys.  None of them will stop a determined hacker, but they
will
make it obvious in court that the hacker committed criminal behavior to
get
past the security.

No security method is unbreakable - the issue is whether it is
prosecutable.

Joe