Sneaky Sneaky

[KyleB]

We have a -government- customer that wants to buy our code so they can run the program themselves. We are using some code that we consider proprietary in nature (I.E. we developed internally how to obtain results that they seek) We want to hide that or lock their ability to understand what we do, as to retain other programs with said company - but out of good grace sell a program that is obsoleting so they may run it at their pleasure.

What sort of sneaky sneaky tricks do you guys have to bury code deep?
I was thinking of a pulling the code from a text file (have never done this). But I'm also not sure how robust that can be.

[InspectorJester]

Well, at the end of the day, if they are good at what they do, there probably isn't a way for you to completely hide the code.

If you pulled the data from a .txt file, their IT department (if they're worth their weight in salt) would be able to access it pretty easily.
If you put it into a .exe file, they might not be able to access it, but I've got no idea how you would do that.

Otherwise, you could obfuscate the code and make all of the names and such really hard to understand, which would only slow them down, if they decided to break it apart piece by piece...

Why not upcharge the crap out of it with a bunch of copyright and such notices, saying that "we don't care what you do with this code, but don't reverse engineer it or we'll sue"?
AFAIK that's why a lot of companies request this sort of thing, to cover their butts

[Kp61dude!]

Where there's a will there's a way!

[Kp61dude!]

We have a -government- customer that wants to buy our code so they can run the program themselves. We are using some code that we consider proprietary in nature (I.E. we developed internally how to obtain results that they seek) We want to hide that or lock their ability to understand what we do, as to retain other programs with said company - but out of good grace sell a program that is obsoleting so they may run it at their pleasure.

What sort of sneaky sneaky tricks do you guys have to bury code deep?
I was thinking of a pulling the code from a text file (have never done this). But I'm also not sure how robust that can be.

They're probably just trying to buy the time savings by buying the work instead of developing it themselves. If you allow time to go you'd probably be out of a potential buy. Certainly something to think about but your creation is YOUR creation do as you wish with it.

[AndersI]

I don't think there's any way you can hide your code/algorithm - if PC-DMIS can run it, a human being can decode it. Period. All you can do is obscure, and that will not make any friends of that customer…

Set the price tag to what you believe it (idea + programming + testing + verifying + profit?) is worth, and see if they'll pay.

[KyleB]

Yeah, there's no doubt there. They will be made aware of the code being hidden if we do 'hide' it for that reason. On that note it has been a sensitive subject as we originally proposed a price for what you speak and we were scoffed at. I think the better route for next time would have just been that that program is not for sale, but we were afraid of that consequence... go figure.

[AndersI]

Well, you always have to balance with "How much is that customer worth to us (in the long run)?". It may be you *need* that customer, in that case their price tag is the right one...

[anthony.alfaro]

because posting about this on the internet is great idea!

[KyleB]

Its a rabbit hole.

[louisd]

In my experience, if a customer wants the method of measurement to accept your product... I'd do whatever it takes to keep that customer, especially if it promotes consistent product acceptance and drawing interpretation.

Aerospace is pushing Net-Inspect down everyone's throats for AS9102 FAIR's. This isn't a far stretch, to start demanding the measurement routine to be added to those net-inspect fairs submittals!

You can call subs, use external alignments, use groups... implement difficult to attain or utilize probes or sensors (unique star probes or use custom-order probes)... But no matter how you skin the cat, DMIS is open-source code, that anyone with equivalent knowledge as you will be able to reverse engineer.

[bfire85]

What do you consider "proprietary in nature"? I've had customers ask for the program in the past, but there are lines of code that useless to them (CMM logs for calculating run time, File Writes for importing to our check sheet system, DataPage code, etc), so I axe those out and leave the main code intact. IMHO, if you're trying to hide something from the customer because you're taking a shortcut to "make parts in spec", you are setting yourself up for failure and potentially a lawsuit if the component fails and causes an injury or fatality.

[Kp61dude!]

Ewwww that's no good!

[KyleB]

bfire85, Absolutely not. I'm part of an accredited body and that would be a huge risk with minimal reward and completely conflict with the nature of our business. The answer is actually very simple. Radii with very minimal arc length inspect more repeatable as a profile. The data is 100% raw and real, we are calculating the radii as a deviation of profile from the fix radii center to make it repeatable (Small deviations on small arc length = huge calculation ranges for circles ). There is no shortcut, and IMHO it's actually a better way of defining the feature. They just don't know how to do it and don't do research. That's why I don't care that it's posted on the internet.. Just thought it was a fair ask.

[bfire85]

I get it. I do small radii in the same fashion. I was gearing towards "cheating the standard" to get a part to show in spec.

[NinjaBadger]

KyleB.

This method you speak of isn't really proprietary in nature it's a fairly widely accepted method in the CMM world.

The problem is described here

https://www.npl.co.uk/special-pages/guides/gpg41_cmm

Your solution (or in effect the same thing) is described here...

https://support.hexagonmi.com/s/article/How-to-measure-a-small-arc-less-than-90-degrees-1528360401117

I believe the issue you have is that although yours is a more reliable method you've not actually have this okayed with your customer.

[KyleB]

No doubt, but to them it's proprietary. Our QM has the acceptance of methods that are reliable/repeatable as the standard. I.E. it's written into our standard that the customer accepts the methods we utilize under the assumption due diligence was utilized to ensure it's accuracy. This allows 'proprietary' information to be kept confidential. Whether proprietary in nature or not, I don't have to share my methods unless otherwise agreed upon - therefore everything is 'proprietary'.

No doubt, otherwise. It's no real big secret.

[vpt.se]

Is it possible to have the "secret code" perform outside of PC-DMIS, ie. create an executable in Visual Basic that performs whatever stuff you want to hide and call that from within PC-DMIS??

[AndersI]

If you do it in VB.Net it's a piece of cake to transform the .exe back to source code and work out the algorithm.

In general: If the computer can execute it, a human can see what instructions are executed and, with enough time spent, the algorithms used can be re-constructed. If it's worth the time is a completely different question...

[vpt.se]

Does VB.net have obfuscators? I know there are obfuscators for Java and .NET C, but if they exist for the VB flavour is unknown to me. I was thinking maybe apply obfuscation when compiling and perhaps pack/crypt it using an EXE packer/crypter...

[InspectorJester]

If you can't auto-obfuscate the code, you could at least scramble a bunch of variable names and use some wonky construction & formatting to accomplish the same goal.
There's no way to make it impenetrable, but you can certainly make it not worth the time