Hacker News Reader

> I mean, the same argument has been applied to other cryptographic tools. Why encrypt your messages, unless you're sending something sketchy? Why obfuscate programs, unless you're hiding something?

There is a huge difference: Encryption is used to hide something from a third party, while obfuscation is used to hide something from the intended recipient.

Or, if you'd like to argue that the intended recipient is the computer, not the user: To turn that computer into a deputy of the sender, while still formally belonging to the recipient.

> while obfuscation is used to hide something from the intended recipient.

No. Most obfuscation is done to increase the time needed to reverse the source of publicly available programs. Not the user (99% of the recipients) but the adversary is the intended target. The users are just cought in the crossfire.

Unless you consider every user of apps as someone who has both the skill and the need to reverse engineer your app.

> No. Most obfuscation is done to increase the time needed to reverse the source of publicly available programs.

So to stop the intended recipient from deciphering the program.

"Adversaries" are the strawman used to hurt legitimate customers who are left with black boxes for device drivers and no functioning hardware since the manufacturers make it impossible to open source firmware updates.

In case of DRM sure, but there are cases like online games where "adversaries" are players (intended users of the app) trying to use cheat programs on game binary to get an advantage over other players.

I share the sentiment that in most cases it just serves DRM vendors and is disservice to users but that's not all the cases.

> I mean, the same argument has been applied to other cryptographic tools. Why encrypt your messages, unless you're sending something sketchy? Why obfuscate programs, unless you're hiding something?

It's easy to argue that everyone has legitimate interest in hiding some things in data, but what would be a legitimate case for hiding things in code?

"This is a trade secret. We have not patented it, because it's so clever and valuable that it needs to be protected longer than a patent lasts"

Except we know(and have example from cryptocurrency) that the problems with ownership in real life have little to do with cryptography.

The reason coca cola doesn't use Pepsi's recipe isnt because mixing the ingredients under heat creates an irreversible mixture that you can seperate to find the recipe. They don't use pepsis recipe because its illegal.

That's true for a recipe that was developed in a past millennium. Trade secrets are still very much relevant for companies that work with more modern technologies than soda from before the Great War, and a useful protection against competition. Even if you do believe that companies within the US or EU wouldn't touch other's IP with a 10 foot pole due to strong laws, you'd have to be very naive to think this is valid in all parts of the globe.

Edit: it's also trivially not true for trade secrets in the legal sense -- if you upload your trade secret willingly to AWS, it's no longer a trade secret, unless you have extra contracts in place. With obfuscation, you could skip a lot of red tape to keep it secret.

You can't copyright a recipe, the thing reason it doesn't make sense for Pepsi to make an exact duplicate of coke is that Coke is better at selling Coke that Pepsi is, and it's better for them to be a niche alternative some people prefer than to be an undifferentiated competititor. Reverse engineering trade secrets is perfectly legal if you haven't agreed otherwise.

Since when is coca cola niche?

That remains a fundamentally anti-social motivation...

Making it harder for bad actors to create malware would seem like one legitimate case.

> I mean, the same argument has been applied to other cryptographic tools.

Intent matters.

> Why encrypt your messages, unless you're sending something sketchy?

Because I am sending something private, I can't believe people bring this dumbass argument still, and even here.

> Why obfuscate programs, unless you're hiding something?

Why indeed. This one is the red flag, not message in your e-mail client being encrypted. Again. Intent, and context, matters.

You say the intent is different but don’t show why. What about obfuscation implies malicious intent? How come it doesn’t apply to encryption?

It can’t be about applications, because I can come up with a thousand applications for obfuscation with benign intent. Such as delegating private computation to AWS without Amazon learning my personal information.

> and why iO is called a crown jewel.

Ah, thanks. That's far from clear in the article.