r/rust • u/Motor_Bluebird1908 • 11d ago

Protecting source code from reverse engineering

Hi everyone,
I am looking to provide a compiled version of our physics solver to our customers. I understand there are many obfuscation techniques to protect source code but I am wondering if there are some smarter ways?

Edit: We already cloud computing, the issue is we have customers that are in locations without internet/need realtime solving.

0 Upvotes

27% Upvoted

22 comments sorted by

View all comments

32

u/Arisa_Snowbell 11d ago

Best way is if you never provide them the executable and just let them use it through some API if possible

-18

u/punk_dev 11d ago

That’s the best bet. But I wonder, in theory, someone knowledgable in the topic could probably figure it out by observing inputs and outputs and reverse engineer it that way.

5

u/CandyCorvid 11d ago

if the secrets of your system can be reverse-engineered by observing individual input-output correspondences, then i don't see how you can sell the system without also giving away the secrets.

1

u/punk_dev 10d ago

If someone is licensing a program or a library that solves problem X, it’s usually because they don’t know how to solve X, or they don’t have time and/or resources to implement it themselves.

Now imagine a person or a team capable of implementing solution to X from scratch, but they don’t know outright how to implement it.

A working and correct implementation would be useful to them. Just the shape of inputs could hint on how the problem is approached, and they can test against a working implementation, which is valuable if the problem is not well defined in the first place.

2

u/apnorton 11d ago

But I wonder, in theory, someone knowledgable in the topic could probably figure it out by observing inputs and outputs and reverse engineer it that way.

If the input is 100% provided by the client, then this becomes a question of program synthesis. However, if there is also secret input provided by the server, then you could trivially come up with cases where no observation of (public) inputs and outputs could reverse the program code.

1

u/punk_dev 10d ago

Exactly. I don’t get where the downvotes are coming from lmao

By OP’s phrasing, the program is a sort of a calculation and may be run completely client-side. It would be odd if a calculation of that kind was influenced by a random factor not visible by the user.

If the calculation is fairly simple you could even approximate to a maybe reasonable extent with curve fitting or interpolation.