How to protect your PHP code from third-party use?

Question

PHP

This question is relevant not only for PHP, but also for other interpreted languages ​​or scripts that are hosted in an open form.

I draw your attention to the fact that the question refers not only to protecting the code from hackers who hacked the hosting and gained access to the source code, but also from the hoster itself and / or former project colleagues who have already dropped out of it.

In addition, any service that respects its customers a little has a system of backups, SVN, etc. systems that save sources not only in a single copy in the web server folder. And accordingly, "press F6" is not an option here.

There are a lot of articles on this topic, but in this issue the emphasis is on non-compiled software products.

In addition, it should be taken into account that the banal insertion of your copyrights into the source code in each page in remarks (for example) can be easily removed if desired, the programming style is also edited. In general, some more reliable solution is needed.

Perhaps someone will suggest a more reliable method or service that performs a function similar to patent protection, but related to protecting sources from being used without the consent of the author. A kind of public register of copyrights of developers indicating the rights of use.

Answer 1

Hiding code from colleagues is a useless and pointless exercise. This means that you do not trust them, or they do not trust you. Large companies have adopted the principle of internal openness. In Yandex, any developer can read and use the code of internal servers; in microsoftware, windows can be checked out (except for commercially significant sections of code like bitlocker and ranking algorithms in advertising and search).
Protecting the right to code is very simple - make it open. Then everyone will know for sure that this is your project, and not someone else's.

Answer 2

Regarding SVN and former work colleagues. Do you store encrypted code in SVN too? And programmers should immediately be forced to write obfuscated code?

Answer 3

The code encrypted through IonCube or Zend Encoder is decrypted by installing a special php extension. Alternatively, you can obfuscate the code, and then encrypt it through IonCube. Then, after the initial decryption, there will still be unreadable abracadabra.

Answer 4

Write your own coder or make a piece of your application as SaaS. Whatever the encoder is, this is foolproof, if someone needs to look at the code, then nothing will help.
Make a wiki and phpdoc section on the code, and if there are frictions, you can always refer to the fact that you posted your code earlier and sue. Well, think well - who needs it besides you and what is so interesting about it that others do not know. Usually they close the license verification code, everything else is open for editing. Look this way.

Answer 5

Nothing will save you from colleagues who have at least read access to the central repository (unless, as indicated above, you do not upload already encrypted code there). From a hoster that has physical access to disks, too. From the idle curiosity of the hoster's employees, the use of encrypted file systems can help, from the targeted one, no longer.
In general, IMHO, technical means of code protection (especially for interpreted PLs) can only be used to complicate illegal use, they will not save you from a targeted attack. The main protection should be legal - to begin with, the State registration of a computer program or database

Answer 6

I may be too categorical, but in your situation ... no way. The code is stored unencrypted, not only you have access to it, which means that no precautions will give a 100% guarantee.
In general, NDA usually helps from colleagues, in which, for example, we included a ban on the personal use of any joint developments. I am not a lawyer, and therefore I don’t know how serious (well, at least theoretically) the consequences of violating this agreement can be, but for some reason I never wanted to check.

Answer 7

1. Work with people you trust . This applies to colleagues as well as to the provider.
2. Reconsider the approach to work . If it is difficult to do this now - do not worry, it will come with experience. Perhaps it makes sense to just go deeper into the work - then there will be fewer rhetorical questions (the answers to which do not make sense), and there will be more practically effective solutions - actions that will bring you real benefits, and will not just take time.

Answer 8

https://xpir.ru/discussions/Deponirovanie-Obektov-...