Re: Protecting Source code of a perl script

From: Eric J. Roode (REMOVEsdnCAPS_at_comcast.net)
Date: 11/21/03 

Date: Thu, 20 Nov 2003 17:02:26 -0600

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

ctcgag@hotmail.com wrote in news:20031120130645.330$nD@newsreader.com:

> "Eric J. Roode" <REMOVEsdnCAPS@comcast.net> wrote:
[...]
>> What makes you think that hiding the source code will make your
>> application more secure?
>
> Reality.

Hah. It will make your application more secure if and only if there are
no crackers who will try to reverse-engineer your algorithms, *and* there
are no bugs or holes that can be found by white-hats.

>> Typically, a dedicated cracker will figure out
>> what the program is doing and find a way around it anyhow,
>
> True, and a dedicated lock-picker can pick my lock. But I'd prefer
> not to make the parts transparent, as that would lower the bar for how
> dedicated he would have to be.

That analogy is not quite on. The parts need not be transparent, but the
design of the lock should be published. Would you trust a lock from a
manufacturer who refused to tell you how it worked, but simply said,
"Trust me. It's super-duper secure. Nobody can pick this lock!" ?

With the conventional tumbler-lock, you know how it works; you know its
limitations. It's not very secure, but it's a known quantity.

With a secret design, a dedicated picker *will* take it apart to find out
how it works, and will find its weaknesses, if it has any. The
manufacturer may or may not already know of these weaknesses.

>> while your
>> program may not be reviewed for bugs or security holes by your peers.
>
> It seems like a rather unlikely event that some kind-hearted person is
> going to stumble upon your code uninvited, find the holes, and point
> them out to you. Premeditated code review is a great thing, but in
> the absense of it, it's hard to see how making the code available to
> untrustworthy parties is a good thing.

It may seem unlikely, but nearly every month some white-hat finds and
reports (or patches) a security hole in sendmail, bind, or any of a
hundred other unix networking and administration tools. Often, these are
professionals who have encountered a problem at work, but often they are
also hobbyists who are endeavoring to understand the program.

There is no possibility of such peer-review with, say, Microsoft
networking and administration tools. Many bugs are reported, and many
patches come out. These must perforce come by way of internal code
review at Microsoft, or painstaking reverse-engineering by people in the
field.

I suspect there are far more latent security holes in MS-Windows OS
software than in unix OS software, simply because in the unix world, it
is all laid bare for everyone to see.

Take for example the PGP program with which I signed this message.
Nobody will argue that it's not secure -- and its source code is open for
anyone to see.

- --
Eric
$_ = reverse sort $ /. r , qw p ekca lre uJ reh
ts p , map $ _. $ " , qw e p h tona e and print

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>

iQA/AwUBP71IKmPeouIeTNHoEQI2ZQCfYoasY6lyFt+yaDv0rI0XM39sY94AniS2
4sSC5Mpay1HC55U8KfUYsiwu
=f7SR
-----END PGP SIGNATURE-----