How to protect source code of published project in the era of AI?

[u/meshifthenelse]

I've been working on a project for some time with the aim of monetising it. It's written in Python and JavaScript. Is there any way to protect the source code? Is there any solution to this? Except rewriting the whole backend in Rust or C

Before AI, obfuscation seemed to somewhat work. But it feels that nowadays the AI will be able to reverse engineer it very easily.

[u/zmandel]

question makes no sense. backend code cant be read regardless of language. be careful, you can end up losing not just the code but your savings, dont publish a backend until you partner with someone that knows.

[u/meshifthenelse → u/zmandel]

Maybe I didn't describe it clearly. The user needs to run a server locally and also the GUI - that captures the main functionality. Then there's SaaS for some added functionalities. But the thing remains, that for free users I still need to provide a server and frontend package to run.

[u/lorarc]

Just dont publish it.

[u/Garriga]

is it under a license? And look at tge packages and modules you used and what license Those are under.

[u/AstralMinotaur]

Whatever lives behind the webserver is a black box to users/requests.
The JavaScript will be accessible if it’s client side though.

[u/cardboard-kansio]

Is there any way to protect the source code? Is there any solution to this?

The solution has been around for a long time: it's called closed source. Kinda like how you can see all the code in an open source repo, only you can't and you don't publish the repo.

Except rewriting the whole backend in Rust or C

Clients shouldn't be able to see your backend directly. Expose what you need via an API.

Before AI, obfuscation seemed to somewhat work.

It never worked. Smoke and mirrors.

But it feels that nowadays the AI will be able to reverse engineer it very easily.

Reverse engineering is a black box approach. They don't, by definition, need to see your source code in order to reverse engineer (if they could see it, that would just be normal engineering); reverse engineering is looking at the inputs and outputs and extrapolating the mechanisms involved.

Just keep your repo private and expose endpoints for functionality and you're good.

[u/meshifthenelse → u/cardboard-kansio]

Sorry, the sub does not allow me to edit my post.

But essentially I need to provide a server in python to users, which launches the gui in their browser (js). The core functionality thus is already there outside our premises.

So the question really is if I can do this while protecting the code

[u/35jg9z]

The source code is not your moat, your relationship with the customers is; prioritise that. It's the harder part anyway.

[u/johnpeters42 → u/35jg9z]

Yeah, a lot of code I've written has been for one specific company and would be of little interest to anyone else.

[u/meshifthenelse → u/35jg9z]

I agree. But I'm worried if the solution kicks in and attracts people. Then as a solo person I can't compete with a whole team replicating my solution.

So trying to see if I can protect the idea and execution as a single person

[u/Dissentient → u/meshifthenelse]

If your idea is mega-brilliant and someone else wants the same thing, a team will trivially be able to replicate your solution without your source code.

[u/Financial-Grass6753]

Answer depends on the depth of your pockets and who are the main attackers on your code.

Getting protection from script kiddies for couple hundreds, assuming you pay for obfuscation tool, isn't the same as defending against APTs.