Commercial Plugin development question

[Synrec]

So I'm making a plugin for sale and I wanted to know if I should obfuscate it?

Granted the reason I want to obfuscate it is because I don't want people to just take my stuff and either repost it as their own or do minor edits and then claim it as their own. This is my first project and I'm not exactly well known so it won't take much for some other plugin developer with a larger fan base to overwhelm me in virtual claim. Even after fighting through all that, the damage will be significant enough.

The reason I dont is because of the nature of the code itself. It rewrites a significant portion of rpg maker's core functions making it incompatible with any script which relies on those core functions. This rewrite is done as a need rather than a want and whilst it is possible to alias the functions, it makes no sense as those functions need to be rewritten so as they can function optimally for the design of the plugin.

Would you say that since I have a plugin that affects a large base of rpg maker's core files that i should leave it unobfuscated? Or rather, because of the complexity that i should obfuscate it?

 

[Shaz]

It's really up to you.

If you have overwritten a lot of the core functions and you obfuscate, you're basically making your plugin incompatible with a lot of others.

If you've overwritten a lot of the core functions and you don't obfuscate, you're basically making your plugin incompatible with a lot of others.

The difference is that someone who is willing would be able to make a patch for it without having to go back to you. But if you've overwritten a lot of the core functions, there wouldn't be many plugin writers who would want to make a patch.

 

[Synrec]

It's really up to you.

If you have overwritten a lot of the core functions and you obfuscate, you're basically making your plugin incompatible with a lot of others.

If you've overwritten a lot of the core functions and you don't obfuscate, you're basically making your plugin incompatible with a lot of others.

The difference is that someone who is willing would be able to make a patch for it without having to go back to you. But if you've overwritten a lot of the core functions, there wouldn't be many plugin writers who would want to make a patch.

Kinda a double edge then.

And well, Im not really looking for others to write a compatibility patch for me, more that Im trying to leave as much functions as I can without returns in the event that I dont obfuscate it.

I say overwrite because it really doesnt use those functions at all and those that it does are rewritten to use the custom functions.

 

[OcRam]

I was also thinking about obfuscation, but then I decided not to obfuscate for 3 major reasons:

1. Compatibility
2. Transparency
3. Editabilty

That would have been too high price to pay for "protecting" my source code.

But naturally everyone makes their own decission on this matter.

 

[Synrec]

I was also thinking about obfuscation, but then I decided not to obfuscate for 3 major reasons:

1. Compatibility
2. Transparency
3. Editabilty

That would have been too high price to pay for "protecting" my source code.

But naturally everyone makes their own decission on this matter.

Compatibility is really not my concern as much as editability is. I was going to append all variables to plugin manager so you can edit it from there but it doesn't work out if someone has an idea, is a coder and wants to put their own mix of things.

Hmm ah hell thanks.
You too @Shaz

 

[Shaz]

And well, Im not really looking for others to write a compatibility patch for me

That's just it though - if you are overwriting the core functions rather than aliasing them, and someone wants to use your plugin as well as others that aliased those same functions, they will have to have a patch written. Whether you write it or someone else does - they're not writing it for you, they're writing it for the person using the plugins. If you just aliased the functions, a patch might not be needed.

 

[Synrec]

That's just it though - if you are overwriting the core functions rather than aliasing them, and someone wants to use your plugin as well as others that aliased those same functions, they will have to have a patch written. Whether you write it or someone else does - they're not writing it for you, they're writing it for the person using the plugins. If you just aliased the functions, a patch might not be needed.

What if the plugin itself overwrites an entire feature of RPG Maker such that the core functions do not work at all, i.e: they are dead functions?
Dont get me wrong, I have tried aliasing, it just really doesn't make sense to do given that none of the functions get called. Tho it's not to say that no part of the script is aliased, it's mainly these dead functions for lets say a battle system.
For example, Battle Manager function mainly regulates the turn function of rpg maker (among a pletora of other functions...) but I took that and disabled it because it does nothing when using my plugin.
I can understand that some other plugin may use the battle manager but if no turn based function is being called, is there a reason to alias it? It seems like lines wasted towards null functions.
All aspects of the battle system have had there functions relocated and edited for efficiency towards this battle system edit.
By obfuscation, I wont be able to allow anyone but myself to make edits and addons and this lack of diversity of the plugin is what may drive some away but, same speed, without obfuscation, I leave myself wide open to plugin thieves or people who have larger fan bases and simply strong arming my project from me by providing an alternative.
For long term, which would you say has the bigger risk?

 

[TheoAllen]

It looks like you have made your mind to just overwrite the function. Shaz already gives an explanation for the general case of what is going to happen if you do that. You have your own specific cases. Further discussion needs more context, which is bringing your code for the context here that I don't think that would happen.

By obfuscation, I wont be able to allow anyone but myself to make edits and addons and this lack of diversity of the plugin is what may drive some away but, same speed, without obfuscation, I leave myself wide open to plugin thieves or people who have larger fan bases and simply strong arming my project from me by providing an alternative.

For long term, which would you say has the bigger risk?

For obfuscation, you're going to be actively supporting it. It depends on how much you care about protecting your code. If you care so much and in fact, you put em behind the paywall, then obfuscation could be the better thing to do.

I would ask, which is the bigger mental risk for you in the long term?
Supporting your customer because you obfuscated your code or the anxiety (for a lack of a better word) knowing that somewhere in the world would take your code?

 

[Synrec]

It looks like you have made your mind to just overwrite the function. Shaz already gives an explanation for the general case of what is going to happen if you do that. You have your own specific cases. Further discussion needs more context, which is bringing your code for the context here that I don't think that would happen.


For obfuscation, you're going to be actively supporting it. It depends on how much you care about protecting your code. If you care so much and in fact, you put em behind the paywall, then obfuscation could be the better thing to do.

I would ask, which is the bigger mental risk for you in the long term?
Supporting your customer because you obfuscated your code or the anxiety (for a lack of a better word) knowing that somewhere in the world would take your code?

I think the better question is how secure is obfuscation?

 

[Aaron]

I think the better question is how secure is obfuscation?

Look at VisuStella.

 

[Ahuramazda]

As a person who heavily edits any plugin I use (normally) to fit the exact needs of my game if the original work doesn't, I would skip an obfuscated plugin without hesitation, even if it was doing a major thing for my game I would like to have.
If I cannot toy and tinker with it to learn how to do things or make the minor changes someone else thinks may be useless to them (thus a waste of time to make a small patch/update for) then I will wait or eventually try making it myself.

I'm not saying that protecting your work is a bad thing, but don't let the minority of the RM users that are would-be thieves stop you from making an open sourced plugin that can be user-friendly. If you are making it a paid for plugin that would probably stop most of the bad eggs from stealing the work in the first place.

Don't bother worrying about the less than 1% that can give releasing open sourced material a pain and think of all the possible decent users that might be more interested if they can see exactly what you have changed and how.

Thats how I view it: open source is transparent and more trustworthy so we know everything under-the-hood... obfuscated: not user friendly and questionable as to what it may do and a hassle to ever edit.

As for how secure... depends on how you go about making it... but considering people have already (apparently) broken the VisuStella obfuscation and it was pretty decent, then you might be making more work than expected for yourself.

 

[Synrec]

As a person who heavily edits any plugin I use (normally) to fit the exact needs of my game if the original work doesn't, I would skip an obfuscated plugin without hesitation, even if it was doing a major thing for my game I would like to have.
If I cannot toy and tinker with it to learn how to do things or make the minor changes someone else thinks may be useless to them (thus a waste of time to make a small patch/update for) then I will wait or eventually try making it myself.

I'm not saying that protecting your work is a bad thing, but don't let the minority of the RM users that are would-be thieves stop you from making an open sourced plugin that can be user-friendly. If you are making it a paid for plugin that would probably stop most of the bad eggs from stealing the work in the first place.

Don't bother worrying about the less than 1% that can give releasing open sourced material a pain and think of all the possible decent users that might be more interested if they can see exactly what you have changed and how.

Thats how I view it: open source is transparent and more trustworthy so we know everything under-the-hood... obfuscated: not user friendly and questionable as to what it may do and a hassle to ever edit.

As for how secure... depends on how you go about making it... but considering people have already (apparently) broken the VisuStella obfuscation and it was pretty decent, then you might be making more work than expected for yourself.

By easily broken you mean that it is simply a matter of time before someone simply unobscures it.
In that case, that really doesn't seem viable over just increasing code complexity manually?

 

[Trihan]

One thing to keep in mind is that although there is an anti-theft angle to it, one of the primary reasons for VS plugins being obfuscated is that it's a team effort and they needed to protect all team members (a few of whom have had things stolen before).

 

[Ahuramazda]

There is no true method of ever hiding access to your code, think of how people break into some of the most secure websites and other things. if some REALLY wants something and they know what they are doing, the will find a way.

So unless you are willing to shell out more money than its worth to pay some professional to help attempt to obfuscate the work on a higher level/method, which with average RM users would stop them from trying.

I'm not 100% sure but I think Moghunter has the right idea from some of the code he has written, its open sourced, but at the same time he codes in such a manner that if any of his code is ever stolen you can tell that was a MOG plugin at some point. He just code in his own way that makes it harder for someone to rip off without making it obvious (in this case in your wording: manual complexity.)

In the end it is completely up to you as what you think is worth the effort to try hiding it or simply blocking it with a paywall and if you ever get reports of your work being posted elsewhere praying that the place its being hosted at will listen to you and take it down.

To give you an idea of how I edit things though... I added professions into Yanfly's Item Synthesis from MV. Not as an additional plugin, but actually edited the YEP plugin directly adding them in and changing the windows, effects, crafting proc chances... everything. If he had been obfuscating his work back then, I would have never gotten my crafting and profession system the way I wanted it would bothering someone a LOT. While a ton of this code is my personal effort I would never claim it as my own, but simply an edit to an already great plugin and all credit still goes to Yanfly in my game. I only credit myself as "minor edits" and not in the plugin files... only in credits.


This is the Synthesis plugin where I actually ported it to MZ where I also have it force linked to DreamX's Random Prefix/Suffix plugin (which I also ported) along with making new windows and still have my professions I coded into the MV version.

While I may be a single user who is for open sourced work, I am also an honest user who believes in not stealing another persons work/efforts. Not everyone will be like me and that is the way it is everywhere. Do what you need to do, but obfuscation keeps people like me away

Also, sorry for the wall o' text crit hit I just performed.

 

[Synrec]

There is no true method of ever hiding access to your code, think of how people break into some of the most secure websites and other things. if some REALLY wants something and they know what they are doing, the will find a way.

So unless you are willing to shell out more money than its worth to pay some professional to help attempt to obfuscate the work on a higher level/method, which with average RM users would stop them from trying.

I'm not 100% sure but I think Moghunter has the right idea from some of the code he has written, its open sourced, but at the same time he codes in such a manner that if any of his code is ever stolen you can tell that was a MOG plugin at some point. He just code in his own way that makes it harder for someone to rip off without making it obvious (in this case in your wording: manual complexity.)

In the end it is completely up to you as what you think is worth the effort to try hiding it or simply blocking it with a paywall and if you ever get reports of your work being posted elsewhere praying that the place its being hosted at will listen to you and take it down.

To give you an idea of how I edit things though... I added professions into Yanfly's Item Synthesis from MV. Not as an additional plugin, but actually edited the YEP plugin directly adding them in and changing the windows, effects, crafting proc chances... everything. If he had been obfuscating his work back then, I would have never gotten my crafting and profession system the way I wanted it would bothering someone a LOT. While a ton of this code is my personal effort I would never claim it as my own, but simply an edit to an already great plugin and all credit still goes to Yanfly in my game. I only credit myself as "minor edits" and not in the plugin files... only in credits.

View attachment 159842
This is the Synthesis plugin where I actually ported it to MZ where I also have it force linked to DreamX's Random Prefix/Suffix plugin (which I also ported) along with making new windows and still have my professions I coded into the MV version.

While I may be a single user who is for open sourced work, I am also an honest user who believes in not stealing another persons work/efforts. Not everyone will be like me and that is the way it is everywhere. Do what you need to do, but obfuscation keeps people like me away

Also, sorry for the wall o' text crit hit I just performed.

Thanks for the input

 

[TheoAllen]

I think the better question is how secure is obfuscation?

And if you even questioning this, this is more reason to use obfuscation as not obfuscating code is not even an option. And the answer to my question is you have a high risk of your mental health if you don't obfuscation. I, unfortunately, can not answer your question precisely how secure it is. But it is more secure for sure.

 

[Synrec]

And if you even questioning this, this is more reason to use obfuscation as not obfuscating code is not even an option. And the answer to my question is you have a high risk of your mental health if you don't obfuscation. I, unfortunately, can not answer your question precisely how secure it is. But it is more secure for sure.

Thanks for the input but I ask my questions in such a manner to draw out information rather than as a case of insecurity.