Re: Obfuscated stored procedures (was Re: Oracle and Postgresql)

On Sep 24, 2008, at 8:05 AM, David Fetter wrote:
> C is not magic obfuscation gear. Anybody with a debugger can expose
> what it's doing.

Yes, but you don't get original code, comments, etc. and it takes a
lot of effort to refine it back down into something maintainable.
People looking to protect IP are often not looking to prevent the same
functionality from being executed elsewhere, but to prevent somebody
from taking the results of their hard work with minimal effort (think
of Microsoft and the FreeBSD TCP/IP stack). If it costs the
competition a lot of time to decompile code and then rebuild
maintainable code out of it that probably doesn't take all the same
things into consideration and will lead to difficulties keeping up
with new features, that's adequate protection.

Of course, there are idiots out there who think that not making pl/
pgsql code visible should protect even against root-level access and
that compilation equals irreversible encryption, but not everyone
using these techniques is one of those idiots, and a few do have
pretty good reasons. Consider for example chipmakers, who compete
against each other selling to a very small number of clients. A board
maker will buy whatever does the job well at lowest cost, and the cost
associated with creating these is purely development time. If you put
months into making a really fast/efficient chip to do a specific task,
protecting this is very important, or you go out of business. This is
much the opposite of a business that provides a service.

Cheers,
--
Casey Allen Shobe
Database Architect, The Berkeley Electronic Press