How to hide the python code from users?

Question

I am developing a paid application in python. I do not want the users to see the source code or decompile it. How can I accomplish this task to hiding the source code from the user but running the code perfectly with the same performance.

Answer 1

To a determined user, you can't.

From a practical standpoint, you can do some tricks, such as wrapping it into a binary executable or using obfuscation.

See here for full details: https://stackoverflow.com/questions/261638/how-do-i-protect-python-code

Answer 2

There's no use in doing that.

If your application is not incredibly small and simple, then even if the client (or other programmers they hired) were to work on that code, they'd still need a lot of your help with it.

If it is incredibly small and simple, don't even bother with it. The client could just get someone to rewrite it from scratch anyway.

Answer 3

I was in a similar situation to this not too long ago. But i managed to find a way to hide my source code, at least, enough to deter most from trying to hack it.

Contrary to common belief, obfuscation and/or encryption of interpreted language scripts is possible. The question is, do you have the time (and motivation) to devote to it? You'll need to make sure whichever "obfuscation/encryption" method you use is very difficult to crack, and that it does not slow down the execution time of the script in any noticeable way.

If you wish to encrypt a python script, without having to do any work on your end, you can do so using this site.

I tested the following script using the aforementioned site and it produced a very intimidating output, which worked (at least for my purposes):

#!/usr/bin/env python2
# vim: ft=python

import sys, json, urllib2

URL = 'http://127.0.0.1:8080/optimization/resources/_harness/status?_fields=health.summary'

try:
    response = urllib2.urlopen(URL).read()
except:
    print('HEALTHCHECKS CRITICAL - Error fetching health check at %s' % URL)
    sys.exit(2)

parsed = json.loads(response)
resource = parsed["resource"] if "resource" in parsed else parsed
status = resource["health"]["summary"]["status"]
incidents = resource["health"]["summary"].get("incidents", [])
warning = len([incident for incident in incidents if incident["status"] == "WARNING"])
critical = len([incident for incident in incidents if incident["status"] == "CRITICAL"])

if warning or critical:
    print('HEALTHCHECKS %s - %d WARNING - %d CRITICAL' % (status, warning, critical))
else:
    print('HEALTHCHECKS OK - no incidents')

print(json.dumps(resource, indent=2))

sys.exit({"OK":0, "WARNING":1, "CRITICAL":2}.get(status, 3))

Can the obfuscated code produced be broken into? Maybe, maybe not. But it is sure to deter most people from even attempting it.

If you do have some time on your hands and wish to encrypt your script on your own using your own improvised method, you'll want to use the openssl command. Why? Because it appears to be the one encryption tool that is available across most Unix systems. I've verified it exists on Linux (ubuntu, centos, redhat, mac), and AIX. SunOS i believe uses the "crypt" command instead.

The simplest way to use Openssl to encrypt a script is:

1. cat <thescript> | openssl aes-128-cbc -a -salt -k "specify-a-password" > thescript.enc

OR

2. openssl aes-128-cbc -a -salt -in <path-to-your-script> -k "yourpassword"

To decrypt a script using Openssl (notice the '-d'):

1. cat thescript.enc | openssl aes-128-cbc -a -d -salt -k "specify-a-password" > thescript.dec

OR

2. openssl aes-128-cbc -a -d -salt -in <path-to-your-script> -k "yourpassword" > thescript.dec

The trick here would be to automate the supply of password so your users need not specify a password each time they wanted to run the script.