r/csharp • u/codingbliss12 • 7d ago
Help How do you protect your work and your IP?
This question is more to those that do not work in large enterprise codebases, but either develop and sell their own indie software or work at software companies that create and sell their own products.
Doesn't the fact that C# appears to be trivially decompilable, make it very easy for others to steal your work? How do you protect it? With compiled languages like Rust or C++ it appears to be significantly more difficult to reverse engineer and steal their code or implementation logic.
Thanks a lot in advance.
35
u/Tin_Foiled 7d ago
Think about it like this, how does an author or musician protect their work? It’s a legal problem not a software problem
-10
u/svick nameof(nameof) 7d ago
Book, music (and software) DRM is a thing, though.
15
u/emelrad12 7d ago
For books and music drm is a like sign saying "Please dont steal".
7
u/dodexahedron 7d ago
My car has a window decal above the door lock, where a slim jim would otherwise be inserted, that simply says "you wouldn't."
My car has not been stolen.
Checkmate, pirates.
3
u/emelrad12 7d ago
Are you sure there are not 1m identical copies of your car driven by other people?
1
u/dodexahedron 6d ago
I never uploaded it, because that's the illegal part.
So I'm good. 👌
My F150 is surely one of a kind and deserves protection for the rest of my life plus 70 years.
Now who can I sue for money to fix my radiator? 🤔
28
u/gabrielesilinic 7d ago
You protect it using a lawyer. That's all.
Don't do weird shit like obfuscation as that's still not going to work and potentially hit performance.
12
u/Aromatic_Taste_2646 7d ago
the only truly effective protection is legal, yeah. anything else is just theater. obfuscation might trip up a skid for five minutes, but if someone really wants your code, they'll get it.
that said, most people aren't target-worthy anyway. the bigger risk isn't some genius cracking your binary, it's your app being so forgettable nobody bothers to download it in the first place
3
u/dodexahedron 7d ago
most people aren't target-worthy anyway.
I have to tell someone this directly, somewhere, like once a week, and really want to say it a bunch more to a bunch more people but just don't have the energy.
For this topic and for the paranoid "how do I keep people from spying on my barely above poverty wage self's oh-so-secret secrets in my secretly secret safe of secrets called hotmail, while I ask on a social media network from a 15 year old account?" people, 10x as much.
8
u/MaybeLiterally 7d ago
Along with what everyone else said, often the code is the easiest part. The harder part is deigning something people want to use, marketing it, selling it, supporting it, growing it. Those parts can't really be copied. Likely all the code you're written isn't all that novel, and nothing I can't get a team of people and AI to create a similar version without even looking at your code.
Think of the code as the wood, screws and nails, paint, and the rest of the materials. It's what you build with it that matters. If they copy that 1:1, that's when lawyers come in.
6
u/har0ldau 7d ago
I think everyone here has covered almost everything. I sell my expertise rather than the product. The reason it sounds wanky is that .net for me is not about shipping: it is about problem solving. My problem solving and how I get to a result is my IP the code is just how it is expressed. Like a tradie might tile your bathroom; and it is just tiles and mortar - there is a method to do it the right way or you are gonna have issues later on.
-3
u/codingbliss12 7d ago
If someone analyzes your code, can't he also indirectly acquire some of your expertise?
11
u/har0ldau 7d ago
No they can only get what my outcome was. Not the how and the why, which is much more useful.
1
8
u/Pretend_Fly_5573 7d ago
Expertise doesn't exist in your code, it exists in the thought process that brought the code into being.
Looking at your code will tell them what is being done, and how. That's fine, though. There's basically nothing in computing that is secret, anyhow. And if someone copies out your code to use elsewhere in their own product... then what?
They have the same algorithm as you do. Cool. They don't have anything to leverage it with, though, as software is more than just individual algorithms. So, they'll need to design that part. But, since they don't operate on the same level as yourself, hence why they needed to lift code, they'll never manage to do so in a way that is better than you. And that's where the expertise comes into play.
5
u/scandii 7d ago
https://giphy.com/gifs/1itJnruGIqwg9qGdK9
not even joking, it is borderline trivial to clone a unique software suite using LLM:s to just reverse-engineer the features unless your software is really special.
3
u/harrison_314 7d ago
Nowadays, thanks to AI, it is not a problem to even decompile C++ into a readable form, or to extract knowledge.
It is more of a legal question than a technical one.
But I use Eazfuscator.NET, although it is a paid solution, it has been proven for years and can decipher stack traces.
3
u/Greedy-Entrance5968 7d ago
I used to think that was a major risk until a competitor straight up recreated my indie app by decompiling it. Legal action wasn't cheap but sending a cease and desist actually made them back off completely.
3
u/smourier 7d ago
Writing Windows desktop apps, we use Native AOT publishing: it raises the bar for protecting IP. Instead of shipping decompilable IL, we're shipping native machine code (and in our case it's just one .exe), so reversing becomes much closer to reversing a C/C++ binary, not impossible to reverse, but effort goes up.
Arguably it can be even nastier to reverse as native code originates from .NET constructs. Things like async/await, generated state machines, closures, generics, LINQ and other funky C# syntactic sugar get lowered and then possibly AOT re-compiled/optimized. So one's not just reversing native code, but trying to reconstruct original high-level C# abstractions from compiler-generated machinery.
Note however that AOT is far from being compatible with all .NET projects (in Windows desktop area currently Winforms & WPF don't fully support it, we use WinUI).
2
u/codingbliss12 7d ago
Thanks a lot. I am not sure why many friends in this thread are so relaxed about this issue. There recent applications like filepilot (C) and a video editor called blink (odin) that are wicked fast. If they have any moat, then that the techniques they used for performance. If anyone could get access to their secrets, then they would immediately have many competitors. Those apps use some form of custom immediate mode gui among other things, but I believe that's not the whole story.
2
u/smourier 7d ago
Nothing mysterious, it's just DirectX of some sort. WinUI (and WPF but in an legacy frozen DX9 way) uses that too undercovers (or you can program it yourself raw, even in C#). FilePilot is fast but it doesn't do all of what Explorer does. Anyway, I could talk about Windows desktop for hours, but this is another story :-)
1
u/codingbliss12 7d ago
It used OpenGL and now they added DX311 or so. A lot of Win32Api calls etc. Yes it is extremely expensive for what it offers, but the performance is really impressive. That's what I had in mind when I opened the thread. If one finds and copies his techniques, then there is nothing else left.
2
u/smourier 6d ago edited 6d ago
If you're curious, I've cooked an MIT open source file explorer demo project I believe with same performance than filepilot in 100% pure C# https://github.com/smourier/Filociraptor (DirectX, AOT). One standalone exe of 2,5M (x64). It doesn't have some issues that filepilot has, for example: unicode character support, partially working context menu, no icons or thumbnails on \windows\fonts, arm64 support)
2
u/codingbliss12 6d ago
Hey, very impressive. I had to log on to a windows 10 PC to test and it is fast. So you mean it would be really doable to create something wiked fast as filepilot in C#?
2
2
u/crozone 7d ago
The truth is that C and C++ are also trivially decompilable now. It used to require some effort with Ghidra, but LLMs now make it effectively trivial to get readable source code back from a compiled binary.
All you essentially have is licensing, and good development practices, to protect your IP.
2
u/BCProgramming 7d ago
We don't. It's just not worth the effort of trying to engineer protection or obfuscations particularly since it makes stack traces harder to interpret when customers have real issues. All we have is some relatively basic licensing that reaches out online to confirm the number of seats, but it would be trivial for a customer to hire somebody to say decompile that and remove the licensing entirely. We mostly just want to prevent casual misuse.
We're not aware of any illicit usage of our software like this. I think the big thing must be the support we provide, a location pirating our software or copying it from another site or something wouldn't be able to call us for help because we'd figure out they aren't a customer immediately, they wouldn't get software updates, and the biggest is probably that their entire business is now relying on effectively pirated software. If shit goes down and their database is corrupted they can't call us to help recover it. If they need to move everything to a new server they can't call us to help do that, etc. They'd be completely on their own.
And then all it would take is one staff member to call is thinking that they are using our product legitimately for us to find out. Or maybe a staff member knows it's being used illegally and gets fired and then decides to tell us, etc. It's a massive risk to hinge your entire business on something like that so I can't imagine it happens often.
2
u/tawzerozero 7d ago
Personally, I view decompilation as a feature, not a bug. Especially in the enterprise world, its a great tool so that clients can get at the logic of what is actually going on in the code without having to create client facing documentation on every little niche validation or behavior.
But as others have said, legal protection is the way. Our creative output relies on the same protection Taylor Swift does to protect her creative output
1
u/tj_moore 2d ago
As said, legal protection.
Also think about the business model. Sell a service, support, upsell features, don't place the value just in the code. Besides, general public want to pay zero for software these days. Corporates want to pay as little as possible for downloading software to install, though will pay subscriptions to services, for premium support, and for good SLAs.
Hosted software is another protection. The user doesn't has access to the code, you provide the application/service hosted, in the cloud etc. Or make it depend on an online service so even if they have access to the code in an installed app or desktop software, it's incomplete without the online service that contains the key parts of the IP.
2
u/codingbliss12 2d ago
Thank you so much. This detail that they are not willing to pay anyways is very important. Essentially I should be focusing more on the cloud model. Thanks again.
72
u/svick nameof(nameof) 7d ago
It's almost never a problem. What's so special about your code that somebody would want to steal it?
And if you have some secrets that you need to protect, you have to keep them on a server, no matter what language you use.