Re: [jruby-user] Re: Source Code Encryption

--001a113ce6a40e1ebf0515e8574b
Content-Type: text/plain; charset=UTF-8

I followed the thread and realized the you want to "encrypt" some passwords
or something when you asked about yaml file.

if you use something like configurator gem to replace yaml with ruby code
then the jrubyc will still keep yaml values as literals inside the class
files. even you decide to use some encryption for the yaml file you will
face the same problem that the encryption key which is just a literal or
byte array inside a class file. all you gain is that nobody tumbles over
the "password" accidentally but anyone who wants to unwrap if can do so and
it might take only a few minutes to do so.

if your intention is to obfuscate your ruby codebase then jrubyc could be
OK but even this can be reversed. but is probably not feasible for bigger
codebase as it is manual procedure.

I personally find it important to think on how to undo the protection you
put in place - just to get a feeling how good your protection is.

- christian

--001a113ce6a40e1ebf0515e8574b
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra">I followed the thread and reali=
zed the you want to &quot;encrypt&quot; some passwords or something when yo=
u asked about yaml file.</div><div class=3D"gmail_extra"><br></div><div cla=
ss=3D"gmail_extra">if you use something like configurator gem to replace ya=
ml with ruby code then the jrubyc will still keep yaml values as literals i=
nside the class files. even you decide to use some encryption for the yaml =
file you will face the same problem that the encryption key which is just a=
 literal or byte array inside a class file. all you gain is that nobody tum=
bles over the &quot;password&quot; accidentally but anyone who wants to unw=
rap if can do so and it might take only a few minutes to do so.</div><div c=
lass=3D"gmail_extra"><br></div><div class=3D"gmail_extra">if your intention=
 is to obfuscate your ruby codebase then jrubyc could be OK but even this c=
an be reversed. but is probably not feasible for bigger codebase as it is m=
anual procedure.</div><div class=3D"gmail_extra"><br></div><div class=3D"gm=
ail_extra">I personally find it important to think on how to undo the prote=
ction you put in place - just to get a feeling how good your protection is.=
</div><div class=3D"gmail_extra"><br></div><div class=3D"gmail_extra">- chr=
istian</div></div>

--001a113ce6a40e1ebf0515e8574b--