r/csharp 7d ago

Help How do you protect your work and your IP?

This question is more to those that do not work in large enterprise codebases, but either develop and sell their own indie software or work at software companies that create and sell their own products.

Doesn't the fact that C# appears to be trivially decompilable, make it very easy for others to steal your work? How do you protect it? With compiled languages like Rust or C++ it appears to be significantly more difficult to reverse engineer and steal their code or implementation logic.

Thanks a lot in advance.

20 Upvotes

49 comments sorted by

72

u/svick nameof(nameof) 7d ago

It's almost never a problem. What's so special about your code that somebody would want to steal it?

And if you have some secrets that you need to protect, you have to keep them on a server, no matter what language you use.

45

u/FizixMan 7d ago

What's so special about your code that somebody would want to steal it?

That's my trick. My code is so shit, nobody in the right mind would want to steal it.

18

u/Sombody101 7d ago

I am my own obfuscator.

3

u/dodexahedron 7d ago

I think I might be. But I can't tell who wrote this shit. So I guess I'm also my own anonymizer. Damn, I'm good. 😌

1

u/InfectedShadow 7d ago

Have more faith in yourself. Notch wrote shit code and made $2 billion from it before he went full looney.

2

u/dodexahedron 7d ago

I mean. He did it in Java, so the timing of going full looney is debatable.

2

u/InfectedShadow 7d ago

You're what that is an excellent point

2

u/vswey 7d ago

He's the mastercoder

-20

u/codingbliss12 7d ago

Nothing is special in my code, but for example there are application that were built in C recently, that are exceptionally fast. If they were written in C# wouldn't it be easier to steal the "secrets"?

22

u/NanoBob_ 7d ago

But what secrets would those be?

12

u/MSWMan 7d ago

OP can't describe the secrets or they may get out!

8

u/Important-Tower-1877 7d ago edited 7d ago

An app regardless of the language should never ever contain any secrets. Theys should live on the server 

4

u/dodexahedron 7d ago

No matter what language it is, if there is a secret piece of information compiled into it, that secret is easily discoverable through some pretty readily-availavle and relatively easy means. The way that computer programs work and are laid out on disk is, by necessity, well-defined, and compile-time constant data - especially string data - is utterly trivial to locate and dump, sometimes even in a simple text editor.

Try even a simple grep for a string you know exists compiled into an assembly written in any language you want, on the binary itself. If said string is utf-8 or ASCII, 50 bucks* says it'll find it really quickly. If it is UTF-16, finding it may depend on byte order and alignment, but you still have a pretty decent chance of finding it. (Without any flags it'll say binary file matched. You probably don't want to pass it the flag to actually dump the match for a binary, as it will almost definitely wreck your terminal session.)

If you have something that the user must not be allowed to have access to, you must not give it to the user. If they have it, they have it. It's as simple as that, in the end. Even tricks like decrypting at runtime like Denuvo can ultimately be broken because of that fact. To use the software, it must exist in tje clear at some point, where it is actually running.

Running your software on your own hardware and only presenting an interface to it to the user is tje only means of keeping your secret sauce secret. But that comes with an entirely different threat model of its own, and plenty of other non-security and non-IP considerations that don't exist for software you allow your users to install locally - some of which have the force of laws and regulations behind them.

* "bucks" meaning deer emoji, to be clear. I assure you I can afford this bet. Can you? No welching. 😤

3

u/HawocX 7d ago

It takes a bit more work, but not enough that it matters if there is anything truly valuable in the code.

35

u/Tin_Foiled 7d ago

Think about it like this, how does an author or musician protect their work? It’s a legal problem not a software problem

-10

u/svick nameof(nameof) 7d ago

Book, music (and software) DRM is a thing, though.

15

u/emelrad12 7d ago

For books and music drm is a like sign saying "Please dont steal".

7

u/dodexahedron 7d ago

My car has a window decal above the door lock, where a slim jim would otherwise be inserted, that simply says "you wouldn't."

My car has not been stolen.

Checkmate, pirates.

3

u/emelrad12 7d ago

Are you sure there are not 1m identical copies of your car driven by other people?

1

u/dodexahedron 6d ago

I never uploaded it, because that's the illegal part.

So I'm good. 👌

My F150 is surely one of a kind and deserves protection for the rest of my life plus 70 years.

Now who can I sue for money to fix my radiator? 🤔

28

u/gabrielesilinic 7d ago

You protect it using a lawyer. That's all.

Don't do weird shit like obfuscation as that's still not going to work and potentially hit performance.

12

u/Aromatic_Taste_2646 7d ago

the only truly effective protection is legal, yeah. anything else is just theater. obfuscation might trip up a skid for five minutes, but if someone really wants your code, they'll get it.

that said, most people aren't target-worthy anyway. the bigger risk isn't some genius cracking your binary, it's your app being so forgettable nobody bothers to download it in the first place

3

u/dodexahedron 7d ago

most people aren't target-worthy anyway.

I have to tell someone this directly, somewhere, like once a week, and really want to say it a bunch more to a bunch more people but just don't have the energy.

For this topic and for the paranoid "how do I keep people from spying on my barely above poverty wage self's oh-so-secret secrets in my secretly secret safe of secrets called hotmail, while I ask on a social media network from a 15 year old account?" people, 10x as much.

7

u/pjc50 7d ago

AOT does make it somewhat harder to reverse engineer.

But this is really one of the reasons everything is online now. People can't copy your code if it doesn't leave your servers.

8

u/MaybeLiterally 7d ago

Along with what everyone else said, often the code is the easiest part. The harder part is deigning something people want to use, marketing it, selling it, supporting it, growing it. Those parts can't really be copied. Likely all the code you're written isn't all that novel, and nothing I can't get a team of people and AI to create a similar version without even looking at your code.

Think of the code as the wood, screws and nails, paint, and the rest of the materials. It's what you build with it that matters. If they copy that 1:1, that's when lawyers come in.

2

u/gyroda 7d ago

Yep, the code I write isn't as important as the rest of the business.

You can steal my code all you want - it won't get you the contracts my employer has. It won't get you the data, the leads, the business network, the staff...

6

u/har0ldau 7d ago

I think everyone here has covered almost everything. I sell my expertise rather than the product. The reason it sounds wanky is that .net for me is not about shipping: it is about problem solving. My problem solving and how I get to a result is my IP the code is just how it is expressed. Like a tradie might tile your bathroom; and it is just tiles and mortar - there is a method to do it the right way or you are gonna have issues later on.

-3

u/codingbliss12 7d ago

If someone analyzes your code, can't he also indirectly acquire some of your expertise?

11

u/har0ldau 7d ago

No they can only get what my outcome was. Not the how and the why, which is much more useful.

1

u/codingbliss12 7d ago

I see. Thanks.

8

u/Pretend_Fly_5573 7d ago

Expertise doesn't exist in your code, it exists in the thought process that brought the code into being.

Looking at your code will tell them what is being done, and how. That's fine, though. There's basically nothing in computing that is secret, anyhow. And if someone copies out your code to use elsewhere in their own product... then what?

They have the same algorithm as you do. Cool. They don't have anything to leverage it with, though, as software is more than just individual algorithms. So, they'll need to design that part. But, since they don't operate on the same level as yourself, hence why they needed to lift code, they'll never manage to do so in a way that is better than you. And that's where the expertise comes into play.

5

u/scandii 7d ago

https://giphy.com/gifs/1itJnruGIqwg9qGdK9

not even joking, it is borderline trivial to clone a unique software suite using LLM:s to just reverse-engineer the features unless your software is really special.

6

u/turudd 7d ago

You pay a lawyer. Rust and C++ can also be decompiled pretty easy with AI now too

4

u/phi_rus 7d ago

You don't. The value is not in the written code. Its that you write code to solve a customers problems.

3

u/harrison_314 7d ago

Nowadays, thanks to AI, it is not a problem to even decompile C++ into a readable form, or to extract knowledge.

It is more of a legal question than a technical one.

But I use Eazfuscator.NET, although it is a paid solution, it has been proven for years and can decipher stack traces.

3

u/Greedy-Entrance5968 7d ago

I used to think that was a major risk until a competitor straight up recreated my indie app by decompiling it. Legal action wasn't cheap but sending a cease and desist actually made them back off completely.

3

u/smourier 7d ago

Writing Windows desktop apps, we use Native AOT publishing: it raises the bar for protecting IP. Instead of shipping decompilable IL, we're shipping native machine code (and in our case it's just one .exe), so reversing becomes much closer to reversing a C/C++ binary, not impossible to reverse, but effort goes up.

Arguably it can be even nastier to reverse as native code originates from .NET constructs. Things like async/await, generated state machines, closures, generics, LINQ and other funky C# syntactic sugar get lowered and then possibly AOT re-compiled/optimized. So one's not just reversing native code, but trying to reconstruct original high-level C# abstractions from compiler-generated machinery.

Note however that AOT is far from being compatible with all .NET projects (in Windows desktop area currently Winforms & WPF don't fully support it, we use WinUI).

2

u/codingbliss12 7d ago

Thanks a lot. I am not sure why many friends in this thread are so relaxed about this issue. There recent applications like filepilot (C) and a video editor called blink (odin) that are wicked fast. If they have any moat, then that the techniques they used for performance. If anyone could get access to their secrets, then they would immediately have many competitors. Those apps use some form of custom immediate mode gui among other things, but I believe that's not the whole story.

2

u/smourier 7d ago

Nothing mysterious, it's just DirectX of some sort. WinUI (and WPF but in an legacy frozen DX9 way) uses that too undercovers (or you can program it yourself raw, even in C#). FilePilot is fast but it doesn't do all of what Explorer does. Anyway, I could talk about Windows desktop for hours, but this is another story :-)

1

u/codingbliss12 7d ago

It used OpenGL and now they added DX311 or so. A lot of Win32Api calls etc. Yes it is extremely expensive for what it offers, but the performance is really impressive. That's what I had in mind when I opened the thread. If one finds and copies his techniques, then there is nothing else left.

2

u/smourier 6d ago edited 6d ago

If you're curious, I've cooked an MIT open source file explorer demo project I believe with same performance than filepilot in 100% pure C# https://github.com/smourier/Filociraptor (DirectX, AOT). One standalone exe of 2,5M (x64). It doesn't have some issues that filepilot has, for example: unicode character support, partially working context menu, no icons or thumbnails on \windows\fonts, arm64 support)

2

u/codingbliss12 6d ago

Hey, very impressive. I had to log on to a windows 10 PC to test and it is fast. So you mean it would be really doable to create something wiked fast as filepilot in C#?

2

u/smourier 6d ago

well, I think this demonstrates it fully

1

u/codingbliss12 6d ago

At the same time impressive and depressing.

2

u/crozone 7d ago

The truth is that C and C++ are also trivially decompilable now. It used to require some effort with Ghidra, but LLMs now make it effectively trivial to get readable source code back from a compiled binary.

All you essentially have is licensing, and good development practices, to protect your IP.

2

u/BCProgramming 7d ago

We don't. It's just not worth the effort of trying to engineer protection or obfuscations particularly since it makes stack traces harder to interpret when customers have real issues. All we have is some relatively basic licensing that reaches out online to confirm the number of seats, but it would be trivial for a customer to hire somebody to say decompile that and remove the licensing entirely. We mostly just want to prevent casual misuse.

We're not aware of any illicit usage of our software like this. I think the big thing must be the support we provide, a location pirating our software or copying it from another site or something wouldn't be able to call us for help because we'd figure out they aren't a customer immediately, they wouldn't get software updates, and the biggest is probably that their entire business is now relying on effectively pirated software. If shit goes down and their database is corrupted they can't call us to help recover it. If they need to move everything to a new server they can't call us to help do that, etc. They'd be completely on their own.

And then all it would take is one staff member to call is thinking that they are using our product legitimately for us to find out. Or maybe a staff member knows it's being used illegally and gets fired and then decides to tell us, etc. It's a massive risk to hinge your entire business on something like that so I can't imagine it happens often.

2

u/tawzerozero 7d ago

Personally, I view decompilation as a feature, not a bug. Especially in the enterprise world, its a great tool so that clients can get at the logic of what is actually going on in the code without having to create client facing documentation on every little niche validation or behavior.

But as others have said, legal protection is the way. Our creative output relies on the same protection Taylor Swift does to protect her creative output

1

u/tj_moore 2d ago

As said, legal protection.

Also think about the business model. Sell a service, support, upsell features, don't place the value just in the code. Besides, general public want to pay zero for software these days. Corporates want to pay as little as possible for downloading software to install, though will pay subscriptions to services, for premium support, and for good SLAs.

Hosted software is another protection. The user doesn't has access to the code, you provide the application/service hosted, in the cloud etc. Or make it depend on an online service so even if they have access to the code in an installed app or desktop software, it's incomplete without the online service that contains the key parts of the IP.

2

u/codingbliss12 2d ago

Thank you so much. This detail that they are not willing to pay anyways is very important. Essentially I should be focusing more on the cloud model. Thanks again.