# ANN: ZenObfuscate - for when you really really have to ship **URL:** \ **Category:** Ruby\ **Created:** [June 13, 2006, 4:58am UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200 "2006-06-13T04:58:51Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 13, 2006, 4:58am UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/1 "2006-06-13T04:58:51Z")
“Being perfectly honest, your obfuscator has made me feel like writing RubyCocoa apps is a commercially viable business, whereas before I had my doubts.” - Aidan R. - ZenObfuscate - What is it? - For when you really really have to ship a binary. - Lets you: Write in ruby, and ship a binary. - ZenObfuscate is a translator for a fairly large subset of ruby that converts your pure ruby code into a dynamically loadable binary, protecting your intellectual property(\*). - How does it work? zenobfuscate has a commandline interface that takes the specified ruby files and outputs a dynamically loadable binary (.bundle on osx, .so on unix/linux and .dll or windows). - TODO: diagram - e.g., ./bin/zenobfuscate -o mylibrary lib/blah.rb; ruby -rmylibrary -e ‘use\_my\_library’ - Built on a solid foundation: RubyInline and ParseTree. Long standing open source packages for ruby. - When is it available? Available nowish on an individual basis - How much does it cost and what is its licensing? ZenObfuscate costs $2500 for a site license or is individually negotiable. ZenObfuscate is a commercial product produced wholly by Eric H. and Ryan D. and is not for redistribution. All rights are reserved, etc., etc. Binaries produced from ZenObfuscate have no restrictions of any kind (except determined by their authors). - Requirements ruby 1.8.x, ruby2c, parse\_tree, rubyinline (all available as gems) available on darwin ppc, darwin intel, freebsd x86, freebsd amd/64bit, and linux x86 (with coaxing). - Known Limitations There are issues with what the obfuscator can translate to C and as a result you may need to modify your code in order to translate it. Usually this is a pretty straightforward and simple task. We do a good job of translating static ruby to its equivalent C, but not all ruby has an equivalent in C. - Only translates methods in classes and modules, not freestanding code. - Explicit returns are required in all methods. - Temporary: Conditional logic (including ?🙂 may not be on the right hand side of an assignment. - Temporaryish: Exception handling and generic block closures currently don’t translate. - Some expressions in ruby we don’t currently do, but could upon request, where some other ruby expressions will never translate. ---
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 13, 2006, 1:28pm UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/2 "2006-06-13T13:28:34Z")
Will this work with a Rails app? ----- Original Message ----- From: “Ryan D.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) To: “ruby-talk ML” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid); [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) Sent: Tuesday, June 13, 2006 3:56 AM Subject: ANN: ZenObfuscate - for when you really really have to ship a binary ---
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 13, 2006, 3:21pm UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/3 "2006-06-13T15:21:52Z")
On 6/13/06, Kris L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Will this work with a Rails app? > … > ----- Original Message ----- > From: “Ryan D.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > > > ``` > > - Known Limitations > > > > ``` … > > ``` > > - Explicit returns are required in all methods. > > - Temporary: Conditional logic (including ?:) may not be on the > > right hand side of an assignment. > > - Temporaryish: Exception handling and generic block closures > > currently don't translate. > > > > ``` Based on those limitations, I would think not. – Regards, John W. > **[John Wilger](http://johnwilger.com)** > > The personal website of John Wilger; Dad, Cyclist, Software Developer ---
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 13, 2006, 4:33pm UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/4 "2006-06-13T16:33:18Z")
On 6/13/06, Kris L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > "Being perfectly honest, your obfuscator has made me feel like > > - How does it work? > > Available nowish on an individual basis > > - How much does it cost and what is its licensing? > > ZenObfuscate costs $2500 for a site license or is That price looks a little extreme for what I have in mind… are there any alternative obfuscators? Alternatively could a percentage-of-returns license fee be negotiated (Eric)? Are programs written in Ruby distributable under any license you like? A friend of mine has proposed selling a program I wrote in Ruby but the thought of doing so made me feel like I was leveraging vast (GPL) resources avaliable to me for free - and profiting off of them by adding comparatively very little. I have in the past simply sold my development time, which seemed a fairer trade since copying my programs is a trivial task. Does anyone here actually sell Ruby programs themselves as products? Les ---
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 13, 2006, 4:07pm UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/5 "2006-06-13T16:07:34Z")
> On 6/13/06, Kris L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > Will this work with a Rails app? > > … > > ----- Original Message ----- > > From: “Ryan D.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > > > > > ``` > > > - Known Limitations > > > > > > ``` > > … > > > > ``` > > > - Explicit returns are required in all methods. > > > - Temporary: Conditional logic (including ?:) may not be on > > > > > > ``` the > > > ``` > > > right hand side of an assignment. > > > - Temporaryish: Exception handling and generic block closures > > > currently don't translate. > > > > > > ``` > > Based on those limitations, I would think not. I wonder if Rails apps will ever be compiled? ---
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 13, 2006, 6:15pm UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/6 "2006-06-13T18:15:40Z")
On Jun 13, 2006, at 6:20 AM, John W. wrote: > > > ``` > > > right hand side of an assignment. > > > - Temporaryish: Exception handling and generic block > > > > > > ``` > > > > closures > > > > > ``` > > > currently don't translate. > > > > > > ``` > > Based on those limitations, I would think not. Actually we have every reason to believe that we can obfuscate rails apps. Obviously you wouldn’t obfuscate the whole ruby stack, but models and controllers should de doable. ---
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 13, 2006, 6:21pm UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/7 "2006-06-13T18:21:55Z")
On Jun 13, 2006, at 7:29 AM, Leslie V. wrote: > That price looks a little extreme for what I have in mind… are there > any alternative obfuscators? Alternatively could a > percentage-of-returns license fee be negotiated (Eric)? see: > ``` > - How much does it cost and what is its licensing? > ZenObfuscate costs $2500 for a site license or is > individually negotiable. ZenObfuscate is a commercial > > ``` > > product > Are programs written in Ruby distributable under any license you like? Yes. > A friend of mine has proposed selling a program I wrote in Ruby but > the thought of doing so made me feel like I was leveraging vast (GPL) > resources avaliable to me for free - and profiting off of them by > adding comparatively very little. I have in the past simply sold my > development time, which seemed a fairer trade since copying my > programs is a trivial task. Well, it is your moral system at work here. Think about those who use GCC to compile commercial apps. I should point out that ruby isn’t under GPL. It is under the ruby license which allows you to make modifications or apply the GPL. See COPYING. > Does anyone here actually sell Ruby programs themselves as products? As the quote at the top of my announcement suggests, yes (eventually). ---
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 13, 2006, 6:15pm UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/8 "2006-06-13T18:15:30Z")
On Jun 13, 2006, at 4:27 AM, Kris L. wrote: > Will this work with a Rails app? We haven’t tested obfuscating a rails app yet, but we have every reason to believe that we can make it work. Obviously you wouldn’t obfuscate the whole rails stack, just your controllers/models. My only real concern is how rails does class loading magic (I’d really want to run my tests against the obfuscated code). When we get time, we’ll do a proof of concept against a rails app to see what issues arise. ---
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 14, 2006, 12:26pm UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/9 "2006-06-14T12:26:04Z")
----- Original Message ----- From: “Ryan D.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) To: “ruby-talk ML” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) Sent: Tuesday, June 13, 2006 5:13 PM Subject: Re: ZenObfuscate - for when you really really have to ship a binary On Jun 13, 2006, at 4:27 AM, Kris L. wrote: > Will this work with a Rails app? We haven’t tested obfuscating a rails app yet, but we have every reason to believe that we can make it work. Obviously you wouldn’t obfuscate the whole rails stack, just your controllers/models. My only real concern is how rails does class loading magic (I’d really want to run my tests against the obfuscated code). When we get time, we’ll do a proof of concept against a rails app to see what issues arise. I would be _very_ intrested in this. ---
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 14, 2006, 8:27pm UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/10 "2006-06-14T20:27:39Z")
On 6/13/06, Ryan D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > On Jun 13, 2006, at 6:20 AM, John W. wrote: > > > Based on those limitations, I would think not. > > Actually we have every reason to believe that we can obfuscate rails > apps. Obviously you wouldn’t obfuscate the whole ruby stack, but > models and controllers should de doable. OK. For some reason I was thinking of whether you could obfuscate the framework itself. That would be incredibly pointless, though, wouldn’t it? 🙂 – Regards, John W. > **[John Wilger](http://johnwilger.com)** > > The personal website of John Wilger; Dad, Cyclist, Software Developer ---
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 14, 2006, 10:20pm UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/11 "2006-06-14T22:20:27Z")
On Jun 14, 2006, at 3:23 AM, Kris L. wrote: > I would be _very_ intrested in this. You know how to reach us. P.S. Be a good list citizen. PLEASE learn how to properly reply to email. ---
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 14, 2006, 10:20pm UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/12 "2006-06-14T22:20:39Z")
On Jun 12, 2006, at 7:56 PM, Ryan D. wrote: > ``` > - How much does it cost and what is its licensing? > ZenObfuscate costs $2500 for a site license or is > individually negotiable. ZenObfuscate is a commercial > > ``` > > product > produced wholly by Eric H. and Ryan D. and is not for > redistribution. All rights are reserved, etc., etc. Binaries > produced from ZenObfuscate have no restrictions of any kind > (except determined by their authors). I should have been more clear with my English. We’re open to negotiations _for alternative licensing schemes_. ---
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 14, 2006, 10:51pm UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/13 "2006-06-14T22:51:09Z")
On 6/14/06, Ryan D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > On Jun 14, 2006, at 3:23 AM, Kris L. wrote: > > > I would be _very_ intrested in this. > > You know how to reach us. > > P.S. Be a good list citizen. PLEASE learn how to properly reply to > email. Are you talking about the indenting? In Kris’ defense I think that’s a Microsoft mail client being used, which makes proper netiquette an incredible chore. How I suffer under the opression of Outlook! Les ---
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 15, 2006, 10:06am UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/14 "2006-06-15T10:06:02Z")
On 6/15/06, Ryan D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > 2 million hits… I’m sure the problem is solvable. > I have previously installed a few of these fixes and they didn’t help > much. They plugin I tried worked for new messages only, not replies. Kris, if you have the freedom, I recommend either GMail or > **[Thunderbird — Free Your Inbox.](https://www.thunderbird.net/en-US/)** > > Thunderbird is a free email application that’s easy to set up and customize - and it’s loaded with great features! Les ---
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 15, 2006, 5:23pm UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/15 "2006-06-15T17:23:36Z")
At Thu, 15 Jun 2006 05:50:03 +0900, Leslie V. wrote: > > email. > > Are you talking about the indenting? > In Kris’ defense I think that’s a Microsoft mail client being used, > which makes proper netiquette an incredible chore. How I suffer under > the opression of Outlook! YACTTMD(\*) I think Ryan talks about the attribution novel. ----- Original Message ----- From: “Ryan D.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) To: “ruby-talk ML” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) Sent: Tuesday, June 13, 2006 5:13 PM Subject: Re: ZenObfuscate - for when you really really have to ship a binary The first, third and fifth line are superfluous and ought to be removed. The result of this were From: “Ryan D.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) Sent: Tuesday, June 13, 2006 5:13 PM which IMHO is acceptable as an approximation to the Nettiquette while at the same time only requiring very little editing. I am unsure if From: “Ryan D.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid), Sent: Tuesday, June 13, 2006 5:13 PM actually had any advantage over this. If one actually requires a one-liner that should rather read From: “Ryan D.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) because it makes little sense to provide a time without mentioning the time zone when writing messages to c.l.r. IMHO the problem is the misconception that Outlook, Outlook Express and Lotus Notes are Mail User Agents. This is wrong. They are multi-purpose tools that _include_ a MUA. As well as it is stupid to expect that all the different functions of a Swiss Army Knife serve their purpose as well as dedicated tools, it is equally stupid to expect such multi-purpose tools to be as good as a dedicated Mail User Agent. To give an example the Screwdriver works fine if you have free access to the screw. But as soon as this is not the case you run into trouble and have to find a real screwdriver. Often as SAK is sufficient for IKEA products but I found out that sometimes it isn’t 😑 (\*) Yet another contribution to this meta-discussion. Josef ‘Jupp’ Schugt ---
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 16, 2006, 12:04pm UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/16 "2006-06-16T12:04:10Z")
Leslie V. wrote: > On 6/15/06, Ryan D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > 2 million hits… I’m sure the problem is solvable. > > I have previously installed a few of these fixes and they didn’t help > > much. They plugin I tried worked for new messages only, not replies. > > Kris, if you have the freedom, I recommend either GMail or > [Thunderbird — Free Your Inbox. — Thunderbird](http://www.mozilla.com/thunderbird/) > > Les I was replying using the ruby-forum, it did not add the “\>”'s even though I used reply with quote. My bad either way. Email-wise I’m on ThunderB… I think the web based interface to the list is mis-leading, ruby-forum. Until recently I didn’t know it was a list. Anyways will be in touch. ---
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 16, 2006, 12:06pm UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/17 "2006-06-16T12:06:07Z")
John W. wrote: > On 6/13/06, Ryan D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > On Jun 13, 2006, at 6:20 AM, John W. wrote: > > > > > Based on those limitations, I would think not. > > > > Actually we have every reason to believe that we can obfuscate rails > > apps. Obviously you wouldn’t obfuscate the whole ruby stack, but > > models and controllers should de doable. > > OK. For some reason I was thinking of whether you could obfuscate the > framework itself. That would be incredibly pointless, though, wouldn’t > it? 🙂 > > – > Regards, > John W. > [http://johnwilger.com](http://johnwilger.com) It would be an advantage to compile the whole Rails framework and the standard libary to prevent code injection. If of course possible? ---
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 15, 2006, 2:53am UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/18 "2006-06-15T02:53:12Z")
On Jun 14, 2006, at 1:50 PM, Leslie V. wrote: > Are you talking about the indenting? > In Kris’ defense I think that’s a Microsoft mail client being used, > which makes proper netiquette an incredible chore. How I suffer under > the opression of Outlook! [http://www.google.com/search?q=outlook+reply+quote+fix](http://www.google.com/search?q=outlook+reply+quote+fix) 2 million hits… I’m sure the problem is solvable. ---
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 16, 2006, 1:50pm UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/19 "2006-06-16T13:50:41Z")
On 6/16/06, Kris L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > It would be an advantage to compile the whole Rails framework and the > standard libary to prevent code injection. If of course possible? That’s not the point of ZenObfuscate. It doesn’t turn Ruby into a “static” language. If you want to prevent code injection, you need to defend against it in your application. -austin ---
**Author:** ![aguynamedryan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/43a26b/32.png) [@aguynamedryan](https://www.ruby-forum.com/u/aguynamedryan)\ **Post date:** [June 16, 2006, 3:25pm UTC](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200/20 "2006-06-16T15:25:55Z")
On 6/16/06, Austin Z. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > That’s not the point of ZenObfuscate. It doesn’t turn Ruby into a > “static” language. If you want to prevent code injection, you need to > defend against it in your application. I believe that the injection he is talking about after the application is deployed with rails still in plain text view, having someone open the rails files and add code that could over write methods, etc. Of course this implies a pretty sophisticated understanding of Ruby and the application. And also leads to a pretty difficult chain – now you have to handle all the standard libraries that are used as well, otherwise the same user could inject their code there as well. Don’t forget about the RUBYOPT environment variable or even modifying the ruby interpreter. I am not against any of these things and may likely purchase ZenObfuscate for our company at some point, but to base any business model around the purity of code (in any language, but especially dynamic languages) run on a clients machine is a mistake. You can take some baby steps to hide stuff, but the cost/benefit ratio slips rapidly when you try to defend against a reasonably sophisticated attacker. pth [Next page](https://www.ruby-forum.com/t/ann-zenobfuscate-for-when-you-really-really-have-to-ship/63200.md?page=2)