packages - How safe is Encode?

How safe is an encoded package (using locked, etc)?

If I don't specify a personal key, I understand that the encoding key must be somewhere in the Mathematica program itself, and so it is not a perfect system, but:

• can we trust it for commercial deployment?



• has someone of you ever heard of it being found?


• do you know if there are backdoor to reverse the code, like shadowing the encode/decode system...? (don't want to know them, just checking how safe it is...)

If I specify a key, I understand that it becomes a stronger system, but:

• how can the client use the app without me giving back the key (without him seeing the code -> I'm supplying the app, but with closed source)?


• is there a workaround for this personal key system?


• how do you typically do it, or see it done?

I heard of MX files being used, but at first glance, they look very version/system specific, and so kind of difficult to manage when the client updates his Mathematica, or player. Nevertheless:

• are they safer than encode?


• can they be mixed up with encode to become safer?

On other programming languages I use USB dongles:

• do you know how it could be done with Mathematica (my program is 100% coded on Mathematica language)?


• would I need to go through the new librarylink?

I know that these are lots of questions, but I cannot find a lot of info on this theme.

Answer

The documentation of Encode states:

No function is provided in Mathematica to convert encoded files back to their original form.

implying that an average user should not be able to view your proprietary code.

If you look at the example on the Encode doc page you see that Get is used to read back the Encoded Collatz package and Collatz works as intended. If you now type:

Definition[Collatz]

you get

Collatz[1]:={1}

Collatz[Collatz`Private`n_Integer]:=
    Prepend[Collatz[3 
        Collatz`Private`n+1],Collatz`Private`n]/;OddQ[Collatz`Private`n]&&
           Collatz`Private`n>0

Collatz[Collatz`Private`n_Integer]:=
    Prepend[Collatz[Collatz`Private`n/2],Collatz`Private`n]
      /;EvenQ[Collatz`Private`n]&&Collatz`Private`n>0

So, some or all of your code becomes visible.

Of course, you can use TagSet to prevent this:

Collatz /: Definition[Collatz] := ""

but I'd think there will be ways to get around that and other measures.

So, it doesn't seem that Encode is sufficient to keep your code proprietary. It might be a good way to prevent third parties from viewing your code during transport, though. In a quick search I couldn't find the type of encryption, so there's not much to say about its actual safety.

If you want to deploy your code in encoded form, your clients might have to use Mathematica Player Pro (or MMA itself) as I don't think the CDF-player reads encoded documents (it doesn't import and export documents at all, see the CDFplayer FAQ). There may be Digital Rights Management in future versions according to the same FAQ:

Can I put copy protection on my CDFs?

At the moment, we do not have Digital Rights Management (DRM) for CDF, but we are working on making it available. Contact us for more details when DRM support becomes available.

---

Update:

There was a discussion about DRM in the LinkedIn group Mathematica. Perhaps you could contact the guy who seemed to have a solution?