Protecting a perl script

How to ensure others can use it, but not copy it?

[treeline]

I want to be sure visitors can enter their data in a form, submit it, and have a perl script I'm writing give them back some very useful information, constantly updating on the widget industry.

However, it's been a lot of work to find all the data sources, and anyone with a copy of it could immediately do the same thing without the effort. SO, what's the best way to keep the source code secret, while letting anyone run it?

Files and directory seem to need a chmod of 755 to run. Is this already OK? Do I need to learn to use .htaccess? (linux server, apache)

I'm pretty new to using perl, so any help is much appreciated. Thanks.

[Abdelrhman Fahmy]

Just first be sure that the script will run from the cgi-bin directory or if you'll run it from your project directory then /project directory must be executable and readable by the group.
And that's is the usual security offered by the server
By doing that any user trying to get call the script will get the just the HTML not the code

Its other ways to protect the scripts (like encryption) but it's more pro and related to the targeted scripts

[treeline]

Thank you for your help, I appreciate it.

[JasonD]

Are you looking at selling the script for others to host on their servers or just allow access to the script hosted on your server?

If the latter then as long as you have good server security then the script should never be able to be viewedby the end user whereas if you are looking at selling the script there are variopus methods of obfuscating the code.

I must stress to you though that due to the nature of Perl itself that this is obfuscation and not encryption which means that it can be relatively trivial to reverse engineer.

As a general statement though if someone has the knowledge to reverse a well obfuscfated script you have to ask why would they bother as their Perl is at a high level and so it would probably have been simpler for them to write the code themselves.

In this instance though I believe that the value isn't in the code but the data repositories that you gather the information from. There are techniques that can reduce the chances of the source becoming apparent but none that I know of that will guarantee it.

If you want some help on this area feel free to sticky me.

Jason