newbie: does PHP code obfuscation make sense?

[r_ahimsa_m]

Hello,
I am learning PHP5. I would like to ask experienced programmers if you use
PHP5 code obfuscation? I am writing website in Linux and I consider using
some code obfuscator because I don't trust hosting firms, I wouldn't like
to have my code stolen because it contains some good idea.
Thanks in advance for your answers.
/RAM/

[=?ISO-8859-13?Q?Kristaps_K=FBlis?=]

On Jun 7, 11:32 pm, [e-mail] wrote:

Hello,
I am learning PHP5. I would like to ask experienced programmers if you use
PHP5 code obfuscation? I am writing website in Linux and I consider using
some code obfuscator because I don't trust hosting firms, I wouldn't like
to have my code stolen because it contains some good idea.
Thanks in advance for your answers.
/RAM/

When I need to protect my intelectual property on PHP source code, I
use Zend Guard.
But if you are not selling your product, I don't see the point. If you
don't trust your hosting company, just choose better one.
If someone would gain unauthorized access to your application, he
could just copy it.

[Lars Eighner]

In our last episode, <g2**********@news2.task.gda.pl>, the lovely and
talented r_********@poczta.onet.pl broadcast on comp.lang.php:

Hello,
I am learning PHP5. I would like to ask experienced programmers if you use
PHP5 code obfuscation? I am writing website in Linux and I consider using
some code obfuscator because I don't trust hosting firms, I wouldn't like
to have my code stolen because it contains some good idea.
Thanks in advance for your answers.

I get the analogous question all the time from would-be writers. It's
vanity.

Have you got thousands of lines of wiki-blog-shopping cart? I'm bettng you
don't. I'm betting you have a gadget. An experience programmer will look
at your page --- which I am assuming you mean to make public --- see what
you page does, and if by chance he wants to do the same thing, he'll code it
himself. Even if you have the sleaziest hosting company in the world, they
won't even look at your pages unless they get a complaint, and if they do
get a complaint, they won't be looking for code snippets (unless of course
you are using them to hotlink or do something to hang up the server --- even
then they won't analyze it --- they'll just tell you stop and they'll change
the permissions so it won't execute until you replace it).

--
Lars Eighner <http://larseighner.com/us****@larseighner.com
Countdown: 226 days to go.

[=?UTF-8?B?SXbDoW4gU8OhbmNoZXogT3J0ZWdh?=]

r_********@poczta.onet.pl wrote:

I am learning PHP5. I would like to ask experienced programmers if you use
PHP5 code obfuscation? I am writing website in Linux and I consider using
some code obfuscator because I don't trust hosting firms, I wouldn't like
to have my code stolen because it contains some good idea.

First of all, it's good to have certain degree of paranoia. You'd make a
good sysadmin.

Second, "stoling code" is not a technological problem, but a social one.
Don't try to apply technological measures to non-technological problems.
Obfuscation won't help you here. DRM won't help the music industry against
piracy.

Third, lawyers. If you have a real fear of the "code theft" happening, get
yourself one. They tend to be a good non-technological solution to
non-technological problems.

Fourth, get a good pipe and build your own servers. No risk in this
scenario.

Fifth, develop trust with your host. Get in touch with local hosting
companies.

And last but not least, remember what all the expers in crypto always say:
you cannot be smarter than yourself to tell out if your ideas are good or
bad. Eventually you'll have to tell the world out. Read some on Bruce
Schneier, really.
Cheers,
--
----------------------------------
Iván Sánchez Ortega -ivansanchez-algarroba-escomposlinux-punto-org-

Un ordenador no es un televisor ni un microondas, es una herramienta
compleja.

[Jerry Stuckle]

Lars Eighner wrote:

In our last episode, <g2**********@news2.task.gda.pl>, the lovely and
talented r_********@poczta.onet.pl broadcast on comp.lang.php:

>Hello,
I am learning PHP5. I would like to ask experienced programmers if you use
PHP5 code obfuscation? I am writing website in Linux and I consider using
some code obfuscator because I don't trust hosting firms, I wouldn't like
to have my code stolen because it contains some good idea.
Thanks in advance for your answers.

I get the analogous question all the time from would-be writers. It's
vanity.

Have you got thousands of lines of wiki-blog-shopping cart? I'm bettng you
don't. I'm betting you have a gadget. An experience programmer will look
at your page --- which I am assuming you mean to make public --- see what
you page does, and if by chance he wants to do the same thing, he'll code it
himself. Even if you have the sleaziest hosting company in the world, they
won't even look at your pages unless they get a complaint, and if they do
get a complaint, they won't be looking for code snippets (unless of course
you are using them to hotlink or do something to hang up the server --- even
then they won't analyze it --- they'll just tell you stop and they'll change
the permissions so it won't execute until you replace it).

Except PHP script files are not executed. They are only read. So you
should NOT have the execute bit set...

Unless, that is, they have a shebang at the start - which a web page
would not have.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

[Gordon]

On Jun 7, 9:32 pm, [e-mail] wrote:

Hello,
I am learning PHP5. I would like to ask experienced programmers if you use
PHP5 code obfuscation? I am writing website in Linux and I consider using
some code obfuscator because I don't trust hosting firms, I wouldn't like
to have my code stolen because it contains some good idea.
Thanks in advance for your answers.
/RAM/

If it's the idea you're trying to protect then obfuscation will do
nothing for you as the idea will become clear to anybody who uses your
script. For example, you don't need to know how Amazon implemented
its one click system to be able to implement your own, because what
happens when you click the "Buy with oneClick" button is immediately
obvious. A competent programmer could produce his own oneClick system
without ever seeing how Amazon's implementation works.

If it's the idea you seek to protect then your only recourse is the
legal system and patents. And as I think software patents are
inherently evil I couldn't recommend that you do that.