Should I be worried about obfuscating my .NET code

Question

I'm sure many readers on SO have used Lutz Roeder's .NET reflector to decompile their .NET code. I was amazed just how accurately our source code could be recontructed from our compiled assemblies.

I'd be interested in hearing how many of you use obfuscation, and for what sort of products?

I'm sure that this is a much more important issue for, say, a .NET application that you offer for download over the internet as opposed to something that is built bespoke for a particular client.

Answer 1

Remember, obfuscation is not encryption. IMHO, if somebody perceives value in reverse-engineering your code, they will do it. That's true for managed code or native code, obfuscated or not. Sure, obfuscation deters the casual observer, but is your business actually threatened by such people? Every .NET obfuscation method I've seen makes your life as a developer harder.

There are services that offer true encryption, such as SLPS from Microsoft. See http://www.microsoft.com/slps/default.aspx

Answer 2

No new obfuscation, but lots of compiler tricks since 1.1

For instance every time you use an anonymous type you get IL that compiles back with a pretty obscure name. Every time you use yield you get a whole new class that implements both IEnumerable and IEnumerator (clever optimisation, unreadable code). Every time you use an anonymous delegate you get a new method with a name that's invalid in every .Net language that I know of, but that's fine in the IL.

Answer 3

Agree, most people who know how to code even a little bit do not need to steal your code!

Answer 4

We currently obfuscate all our output, even though we are a small outfit who sells specialist software to a small number of clients.

We made this decision for one simple reason - we discovered a disgruntled ex-employee was actively approaching our clients requesting binaries - there was some some concern he was intending to reverse engineer newer features in order to offer competing functionality.

Of course he is still able to do this if he uses the software, but there is no reason to make it easy for him.

Answer 5

Obsfucation is limited in it's effectiveness, it might keep the casual guy away. The most effective obsfucation is making only the smallest amount of code available to the user. If you can, make your app run depend heavily on a fat server.

Answer 6

I wouldn't worry about it too much. I'd rather focus on putting out an awesome product, getting a good user base, and treating your customers right than worry about the minimal percentage of users concerned with stealing your code or looking at the source.