Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:74413 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 95057 invoked from network); 21 May 2014 14:27:55 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 21 May 2014 14:27:55 -0000 Authentication-Results: pb1.pair.com smtp.mail=nicolai.scheer@gmail.com; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=nicolai.scheer@gmail.com; sender-id=pass Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.174 as permitted sender) X-PHP-List-Original-Sender: nicolai.scheer@gmail.com X-Host-Fingerprint: 209.85.160.174 mail-yk0-f174.google.com Received: from [209.85.160.174] ([209.85.160.174:53086] helo=mail-yk0-f174.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 3F/E9-24198-9E7BC735 for ; Wed, 21 May 2014 10:27:53 -0400 Received: by mail-yk0-f174.google.com with SMTP id 9so1621681ykp.19 for ; Wed, 21 May 2014 07:27:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=WR7CjHxWZAMP+QqDPFYsRVUkkOKSOMclm12dV4zun7k=; b=gTCNIxbAQHJlI1qzgZ2teyizVZGctWJotmVXGtzgc3UyHQPvO7JjwRNug/aldnIsaR V+e/2sHq5i8rtBWJRVXlBH/7lAogSnooKCUIwQQ8CXWtIP6gdP4BrSvpxlQYcVu6JgPC uDw8TuboalNKjkklsWXTlwKSbsOf3Swq6SaE1WwWuV99jd46bRO03iv4SAY6cpMcZwe8 YRVwKZfP40uApAP5JYBurjG0PZFW+weVwxwZ4tJjkmTEcEaUCaKOJ0myrsRtXYVCWvOq 7z4eg9nIeQSNkMLtFhHq9uqPJQI3pzW6ME2BGmISnCAJS3ImQZtjtWUFFtC60KyN3col UMvw== MIME-Version: 1.0 X-Received: by 10.236.74.33 with SMTP id w21mr21953584yhd.87.1400682470925; Wed, 21 May 2014 07:27:50 -0700 (PDT) Received: by 10.170.88.215 with HTTP; Wed, 21 May 2014 07:27:50 -0700 (PDT) In-Reply-To: References: <6048BA05-CC13-46DD-8439-9CB4EE29078B@ajf.me> <9EBA95A7-B9F7-41F0-AE2B-283260753E5A@googlemail.com> Date: Wed, 21 May 2014 16:27:50 +0200 Message-ID: To: Andrea Faulds Cc: Kevin Ingwersen , PHP Internals Content-Type: multipart/alternative; boundary=20cf30050c721f6be804f9e9cded Subject: Re: [PHP-DEV] encode php scripts with opcache compatibility From: nicolai.scheer@gmail.com (Nicolai Scheer) --20cf30050c721f6be804f9e9cded Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi, yes, we are shipping code to customers and they should not read the source. The level of protection gained from obfuscated code is not enough, but just delivering the opcodes would be ok. I know that the opcode array might be dumped, this is just to raise the bar. If I just obfuscate the code there's still the possibilty left to edit the code directly. Greetings Nico On 21 May 2014 15:52, Andrea Faulds wrote: > > On 21 May 2014, at 14:47, Kevin Ingwersen > wrote: > > > There are decent obfuscators? =E2=80=A6 have not seen any. > > And then, obfuscated code can be reversed still, whilst =E2=80=9Esort o= f=E2=80=9C > compiled code is far harder to reverse engeneer. > > For languages which don=E2=80=99t compile down to machine code, like PHP,= C#, > Java, JavaScript, Python, Perl or Ruby, obfuscation and (if it doesn=E2= =80=99t use > byte code) minification is really the best you can get. Such languages > necessarily cannot be compiled down to the metal, so if you really don=E2= =80=99t > want anyone to read your code, I=E2=80=99m not sure there=E2=80=99s anyth= ing you can do. > Then again, even x86 machine code can be decompiled. > -- > Andrea Faulds > http://ajf.me/ > > > > > --20cf30050c721f6be804f9e9cded--