[chris98]

So I came across some software yesterday that uses the IonCube extension to encode the source code. I get why this is done, obviously for code protection reasons, but what I can't understand is what you have to gain?

Anything that is encoded can be decoded, which I've already seen in the case of this software because there are published versions of this source code online still despite the effort they've gone to conceal it. There's even an IonCube decode website here that allows you to decode IonCube encoded files..... it kind of reminds me of a point that CTphpnwb once made.... that security through obscurity is always a bad idea.

So all it really seems to do is deter absolute rookies from looking at the source code. That and complicate things giving PHP the extra work of needing to decode the encoded code into bytecode. It also stops people from being able to develop their own plugins etc for the software because from the company point of view they have no idea how it works.

I'm not sure whether I've just missed the point here but I can't help but feel that surely if it was that effective at what it did, loads of commercial companies and software developers would use it.... except they don't. So why?

[modi123_1]

Typically you gain a bit of protection from script kiddies, and maybe even throw up to a few moderates off the trail.

They look to have a few other perks, but sometimes 'mostly good enough' is what you - or the higher ups - are shooting for. Hopefully it isn't the only line of defense, but sometimes better than none.

[ArtificialSoldier]

Quote

It also stops people from being able to develop their own plugins etc for the software because from the company point of view they have no idea how it works.

That's not true, there are all kinds of plugins or mods for proprietary software. Like games, for example. You don't need the original source code if the published documentation is accurate and extensive.

[chris98]

ArtificialSoldier, on 05 February 2022 - 06:54 PM, said:

Quote

It also stops people from being able to develop their own plugins etc for the software because from the company point of view they have no idea how it works.

That's not true, there are all kinds of plugins or mods for proprietary software. Like games, for example. You don't need the original source code if the published documentation is accurate and extensive.

That's true I stand corrected. I actually just checked on the WHMCS website as well, as they use IonCube, and they have a marketplace with plugins for it as well. I guess it just makes it a lot more complex if docs aren't clear or you run into a problem and can't see the original source to know where you're going wrong (e.g. incorrect parameters, types, etc).

[ArtificialSoldier]

Right. In general, proprietary software requires more developer support to be as effective, because you can't figure everything out yourself.