Published Friday, June 13, 2008 5:27 AM by martin

The Campaign Against .NET Obfuscation

I've started a one-man campaign. In fact I started it years ago when .NET obfuscation first appeared. I don't like any of the .NET obfuscation technologies. I don't think obfuscation is worth bothering with, and it makes the developer's life just a little bit harder. So don't do it.

Think about it...

1. Obfuscation is not encryption. That's really important.

2. People being able to see your code is not a bad thing most of the time.

3. If you have a case where it's really necessary to hide your code then, by definition, obfuscation isn't good enough. You need to encrypt that really sensitive piece of code, perhaps using something like Microsoft's SLPS.  Even then, only encrypt the sensitive stuff, not the whole app.

4. .NET didn't change anything. Native code is not encrypted either. If someone can benefit from reverse-engineering your code, they are just as likely to do that to a native-code app as for a .NET app.

5. Obfuscation might deter the very casual observer, but how many casual observers fire up ildasm or Reflector? Honestly? And how much harm do you think casual observers will do to your business?

6. The ability to run ildasm and Reflector over my code is very useful to me, and makes me more productive.

7. Obfuscation might give your company a feeling of protection that it really doesn't offer.

8. No matter what the obfuscation-tool vendors do, the debug process is always slightly more complicated for an obfuscated app. If there was some value in obfuscating, this might be ok. But there just isn't.