Tip of the Iceberg

Category domino
Another security-related post. First, a big kudos to IBM: as always, Notes/Domino security reigns supreme. While Java can be decompiled rather easily, LotusScript can not. If, instead of typing your script directly within Designer, you store it in a text file (generally with a .lss extension) and then place a %INCLUDE directive where the script would ordinarily live, when you save the design element, Designer compiles the code as if the contents of the file specified in the %INCLUDE were there instead of the directive. Once you've done that, there's no way (that I know of, anyway) to retrieve that portion of the source from the design element itself... you must have the separate source file. In fact, if you attempt to recompile the element without access to that file, it breaks; either it simply won't compile, or the recompiled element no longer contains any of the code defined in that file. In other words, if you're selling a template and have no intention of open sourcing it, this is a pretty solid way to hide your script code.

Secondly, an apology to any actual chiropractors for the slander that is about to follow. As far as I know, I don't personally know any chiropractors, and have never gone to one, so the reputation may be ill-deserved, but everyone I know who's described the experience has done so almost identically: they seem to be great at addressing short term needs, but once you go, you have to keep going. Each time, you feel great immediately afterwards; they've provided much-needed relief. But before long, the same symptoms come back, often worse than before. Again, I don't have any direct personal experience in this area, so that could be a completely unfair generalization.

Finally, if you're an organization selling a product to many customers, by all means, feel free to keep your source inaccessible to those customers if there are legitimate reasons for doing so. In addition to simply safeguarding your intellectual property to ensure that you'll be around long-term to support and enhance the product, there's definitely something to be said for knowing, when a customer reports a problem, that the code they're running is still the code that you wrote. I shudder to guess how many times someone has called IBM to tell them that their mail template is broken, not realizing (or unwilling to admit) that something they mucked with is causing the aberration. So I'm fine with hidden source in that scenario. But... if you're just some guy who was brought in by a specific client to develop a Domino app specifically for that client - even if certain portions of functionality it will contain are fairly universal in nature - don't tie everything in that app to a script library that consists only of a single %INCLUDE and then walk out the door with that file without giving it to the client. That's not cool. That's chiropractic consulting: the client is forced to come back to you to make any changes, 'cause if they try to do it themselves (or bring in a competitor), they'll have to waste time and money rewriting everything except the interface... even recompiling the library without that file breaks their entire app. If you're ninja enough, they'll keep coming back anyway because they're satisfied with the result every time they do - not because that's their only option.

This scenario is purely hypothetical, of course. All the same, if you do know of a way to extract $ScriptLib_O to get at the original source, please contact me directly (i.e. email, phone, IM), but not via a comment. For the reasons listed above, I'm glad you can't just Google something like this.