How can I hide my Ruby code?

Props to Andy's solution - thats pretty awesome... hopefully not everyone needs that!

We’re developing the site but the day to day running is down the client (but

they have lots of power from various sources, redundancy and sysadmins to

type the password back in).

Is the client trying to keep the code hidden from his own sysadmins or

are you trying to hide it from the client?

The first option :slight_smile:

Cheers,

Andy

Or if there is any way so that I can encrypt my code

without interrupting the execution of the application.

If your client is determined to access your code even an encryption of

the Ruby source code will not be sufficient. In order for MRI to

interpret Ruby it must be decrypted. If the client has full access to

the system then this means that they also have access to the encryption

keys.

This is the same issue that makes decrypting DVDs possible. The keys

must be available to the system performing the decryption. Now maybe

doing this will discourage a client from making the attempt, but if they

are determined then there’s nothing stopping them from hiring someone to

“crack” your encryption. But, as I said it’s not really cracking it

since the encryption keys exist in a location where the client has

access.

Indeed, finding them in memory. I believe though that the requirement is to stop casual looking/tampering by the company’s sysadmins rather than to stop a dedicated expert cracker.

Cheers,

Andy

Thanks Skip and I agree with your hope.

There are so many weird things I’ve done on this project, it’s been a great/interesting experience…

Cheers,

Andy

Bad news on that front, all the sys admins I know use Ruby. They start with Puppet and then start writing their own applications.

Sys admins, by virtue of their job, are highly skilled individuals. Least all the ones I know.

YMMV

In a way, you can praise yourself lucky, in my years of work (and that’s quite a lot of years actually) I’ve come across all kinds of sysadmins: very knowledgable people, capable people, people that think they are capable, people that are complete and utter fools, citing things they picked up from some magazine, completely misunderstood, but still think they got their position with good reason, people that know they are incapable of their job and try to make me do their work for them.

Guess it all depends on what company you work with and especially in midsize and small companies there’s a huge difference in knowledge and experience when it comes to IT staff.

Getting a bit OT here, but reading this brings back so many memories… :slight_smile:

Best regards

Peter De Berdt

You can also do fun things with ruby2ruby, eg

require 'rubygems' require 'ruby2ruby' class Secret   def secret_method     %w(I am secret).each {|p| puts p}   end end

puts Ruby2Ruby.translate(Secret)

outputs: class Secret < Object   def secret_method     ["I", "am", "secret"].each { |p| puts(p) }   end end

In theory an interested person could attach themselves to one of your ruby processes with gdb and if they knew enough about the ruby c api they could load up stuff like ruby2ruby and inspect your classes.

Fred