Unlike other products, though, your end-user is free to muck about with it.

About the biggest difference between Perl and "other products" in this regard, is Perl does less to maintain the illusion of protection. The bottom line is, anything you give someone to run on their computer can be mucked about with. Granted, most folks won't have the tuits to break out a decompiler, or debugger, or whatever... but the opportunity is there for the taking.

I would go so far as to say about the only fool-proof way to keep your program secret is to not let people run it on their computer. Web applications are an excellent way to accomplish this. As things go, without knowing much about it specifically, I would presume PerlApp (along with other "Perl compilers") is probably one of the least effective ways to keep your program secret, short of giving out plain-text source.

I think most experienced Perl programmers realize this, and stop trying to fight it. If you make a great product, and provide good service to go along with it, that effort stands on its own.

PS: I second duff's recommendation. There is no such thing as PERL; only Perl and perl. People sometimes call it the "Practical Extracting and Reporting Language," but as far as we know this is a retronym, and was coined after the name was already chosen.

I think that the nifty thing in this example is that they *can't* know anything about it.

On the contrary, if you're loading their Perl code into your process, they can find out just about anything.

For example, they could supply you with a module with a BEGIN block that walked through all of the package namespaces, dumping out subroutine names and variable values. They could also wrap relevant subs in a logging wrapper to observe the flow of function/method calls and the arguments they receive, dumping the results to a text file for later review.

In an extreme case, they might even be able to deparse your program back to source code using something like the B:: modules.

However, I agree that in the vast majority of cases, most people won't do any of the above, and your commercial application will be sufficiently safe. (To the best of my knowledge, nobody else ever used the plugin mechanism in IntraNetics other than in the specific ways we documented.)

Yes it's cool, but no more so than using 3rd party libraries in C++, C, or any other typically compiled language.

And please, please, PLEASE, stop saying "PERL" It grates on my eyes. It's Perl if you're talking about the language and perl if you're talking about the program.