0

I have a project which involves using C++ files along with an API on a local PC to communicate with a remote server app, and for sake of maintaining a semblance of non-disclosure with any hired developer(s), I'd like to 'mask' the context of the logic by renaming all variables to something less-obvious.

However, the local C++ app must of course use the functions/commands supplied by the API vendor to interact with the remote server, so I'd like to also create an 'intermediate API' to mask both the send commands, and return parameter names, with intent to completely remove access to the actual names used by the API.

Finally, once the code is delivered to me, I could reference another file in TXT, CSV, or other format and do a bulk 'find-&-replace' rename of the variables, and discard the intermediate API.

So, questions are:

  1. How complex/feasible would this be?
  2. How much time might such a thing take for an array of 20 command/return pairs (so 40 names in total)? Just a ballpark estimate (e.g. 15 hours).
  3. If such a practice is already well-established and built out as a readily-available package/library, what name(s) do such items go by and where to download them?

I have read through this thread ( Why do programming languages allow shadowing/hiding of variables and functions? ), and understand that debugging would be made more cumbersome...I can act as secondary programmer for that aspect of the build.

Community
  • 1
CB001
  • 19
  • 1
  • 4
  • For what purpose? – Robert Harvey May 08 '16 at 00:25
  • When you say "an API", are you talking about a C++ API, which deals in classes and functions, or a *web* API, which would probably deal in HTTP requests and such? If you're trying to obfuscate the latter, I fail to see what C++ or C++ files has to do with it. – Nicol Bolas May 08 '16 at 00:56
  • Hello Robert - the intent of doing this is to partially protect my intellectual property. – CB001 May 08 '16 at 01:52
  • Hello Nicol - it is a C++ API dealing in classes and functions; the program to be built ("app") would communicate with a C++ based program ("API") provided by the vendor, which then in turn communicates with the remote server. The prospective intermediary program would be situated between the app and API. – CB001 May 08 '16 at 01:54
  • 2
    The established practice for protecting intellectual property is by means of contracts (and non-disclosure agreements) that spell out exactly what a hired programmer can do with the code he makes/receives and which can be enforced in a court of law. – Bart van Ingen Schenau May 08 '16 at 05:42

2 Answers2

1

If I understand your question correctly, you would like to obfuscate the protocol, but not necessarily masquerading the nature (purpose) of the software to be built by the hired C++ developer.

You can consider using protobuf and focus your mass-renaming efforts on just the message and field names. The hired C++ developer will use one set of names and the communication side (written by you) will use the actual set of names. Also, you can consider adding a number of unused fields or parameters as decoy, merely for confusion.

Note that if the hired developer can run Wireshark on the same computer, it is trivial to discover the communication with the remote server.

Finally, I would reiterate that masquerading the nature of the software is not going to work for a hired programmer. You as the stakeholder of the project will have a hard time communicating with the hired programmer on what the software is supposed to do. A lot of software requirements happen with the customer giving an outline about the purpose of the software, and the programmer has to research about the customer's situation, discover use-cases, review and confirm the use-cases with the customers, and go through various prototyping stages to verify that this is what the customer wants. Masquerading the purpose of the software will make all of that communication impossible. It is unlikely that you can find an adequate analogy that will describe the software's purpose unless your creativity is on par with a world-class sci-fi writer.

(This is an informal, personal view. I have no experience or qualifications in software project management. I reserve the right to delete this answer at any time, because this answer does not meet my own personal standards of rigor.)

rwong
  • 16,695
  • 3
  • 33
  • 81
0

You cannot practically hide anything from a determined programmer, but you can create an abstraction layer to hide the details of your implementation from a casual user, for various purposes. For additional details, search for Proxy and Adapter pattern articles.

Depending on the requirements of the original API it might not be possible to completely hide the implementation details, and it should also not be the main reason for doing anything, IMO.

For instance you can accomplish this abstraction by using an interface or pure virtual class in c++, where the actual implementation is only obtained through a factory method returning an implementation of said interface.

It's not completely clear what you want to achieve so this is the best answer I can give from the perspective of normal development practices.

axl
  • 1,237
  • 9
  • 11