# Best practice to prevent to stolen ignition resources **URL:** \ **Category:** Ignition\ **Created:** [March 11, 2021, 2:25am UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344 "2021-03-11T02:25:11Z")\ **Posts on this page:** 20\ **Page:** 4
**Author:** ![victordcq](https://avatars.discourse-cdn.com/v4/letter/v/f6c823/32.png) [@victordcq](https://forum.inductiveautomation.com/u/victordcq)\ **Post date:** [November 3, 2021, 8:52am UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/61 "2021-11-03T08:52:38Z")
I mean most of websites javascript’s only “security agaisnt theft” is bassicaly changing all variable and function names to incomprehensible letters and removing all formatting (space and tabs) xd As there isnt much else you can do since the browser on the client need to be able to run it ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/e/c/ecb98c10e146ae1249d97d4d99e650e0e2547fc9.png) ---
**Author:** ![nminchin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nminchin/32/6911_2.png) [@nminchin](https://forum.inductiveautomation.com/u/nminchin)\ **Post date:** [November 3, 2021, 8:55am UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/62 "2021-11-03T08:55:42Z")
This obscurity model is no match for someone like @pturmel though ---
**Author:** ![victordcq](https://avatars.discourse-cdn.com/v4/letter/v/f6c823/32.png) [@victordcq](https://forum.inductiveautomation.com/u/victordcq)\ **Post date:** [November 3, 2021, 9:01am UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/63 "2021-11-03T09:01:09Z")
I mean getting the formatting back should be doable with a script… But the names? Debugging a code with bad naming is so hard, good luck reverse enginering one xd The problem is also it uses the same name multiple times if its out of its “scope” ---
**Author:** ![pascal.fragnoud](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pascal.fragnoud/32/24728_2.png) [@pascal.fragnoud](https://forum.inductiveautomation.com/u/pascal.fragnoud)\ **Post date:** [November 3, 2021, 10:16am UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/64 "2021-11-03T10:16:08Z")
The only way for Microsoft to make something that doesn’t suck would be for them to start making vacuum cleaners… ---
**Author:** ![SKA](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ska/32/29528_2.png) [@SKA](https://forum.inductiveautomation.com/u/SKA)\ **Post date:** [November 3, 2021, 11:58am UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/65 "2021-11-03T11:58:05Z")
Compressing JS also give a slightly less download for each user, but we’re probably talking a few hundred of bytes on a normal JS file and a few kB for large scripts. ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [November 3, 2021, 2:40pm UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/66 "2021-11-03T14:40:07Z")
> [@nminchin](#): > > This obscurity model is no match for someone like @pturmel though > **[JSFuck - Write any JavaScript with 6 Characters: \[\]()!+](https://jsfuck.com/)** > > JSFuck is an esoteric and educational programming style based on the atomic parts of JavaScript. It uses only six different characters to execute code. ---
**Author:** ![nminchin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nminchin/32/6911_2.png) [@nminchin](https://forum.inductiveautomation.com/u/nminchin)\ **Post date:** [November 3, 2021, 7:29pm UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/67 "2021-11-03T19:29:04Z")
Nice! I’m going to start writing all my code like that from now on 🙂 My co-workers will love it ---
**Author:** ![SKA](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ska/32/29528_2.png) [@SKA](https://forum.inductiveautomation.com/u/SKA)\ **Post date:** [November 4, 2021, 7:54am UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/68 "2021-11-04T07:54:23Z")
Check and see if Ignition has support for Brainf\*\*k coding 😃 ---
**Author:** ![pascal.fragnoud](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pascal.fragnoud/32/24728_2.png) [@pascal.fragnoud](https://forum.inductiveautomation.com/u/pascal.fragnoud)\ **Post date:** [November 4, 2021, 9:03am UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/69 "2021-11-04T09:03:47Z")
Rockstar would be much more fun in coding reviews. ---
**Author:** ![zacharyw.larson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/zacharyw.larson/32/23749_2.png) [@zacharyw.larson](https://forum.inductiveautomation.com/u/zacharyw.larson)\ **Post date:** [June 28, 2023, 1:04pm UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/70 "2023-06-28T13:04:38Z")
@nader.chinichian What did you end up doing? Did you find a way to do encryption? Or how did you secure your developments? ---
**Author:** ![nminchin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nminchin/32/6911_2.png) [@nminchin](https://forum.inductiveautomation.com/u/nminchin)\ **Post date:** [June 28, 2023, 1:10pm UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/71 "2023-06-28T13:10:58Z")
Holy cow, someone had _far_ too much time on their hands with that language 😂 ---
**Author:** ![nader.chinichian](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nader.chinichian/32/9261_2.png) [@nader.chinichian](https://forum.inductiveautomation.com/u/nader.chinichian)\ **Post date:** [June 28, 2023, 2:18pm UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/72 "2023-06-28T14:18:56Z")
Unfortunately, nothing you can do except some Intellectual property rights documents at your source or views. It is something we talk about with IA and if they see there are quite a few people asking for it, they will do that. As you see in this thread no one supports this concept!!! ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [June 28, 2023, 2:34pm UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/73 "2023-06-28T14:34:41Z")
> [@nader.chinichian](#): > > no one supports this For resources going to a browser, it is entirely pointless. If the browser can run or render it, the obscuration can be undone (mostly). Lot's of tools in security research space for this, specifically to figure out what malware is doing. For resources your client will run, same issue, just not in a browser. Even 3rd-party java modules--the highest level of IP protection available in the Ignition world--can be decompiled by any modern development environment. I can understand IA's unwillingness to offer **illusory** protections. If only to avoid being targeted by angry developers when one of their "protected" resources is deobscured/decompiled. ---
**Author:** ![nader.chinichian](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nader.chinichian/32/9261_2.png) [@nader.chinichian](https://forum.inductiveautomation.com/u/nader.chinichian)\ **Post date:** [June 28, 2023, 4:45pm UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/74 "2023-06-28T16:45:20Z")
> [@pturmel](#): > > browser What we need to encrypt mostly in script, binding, and component properties. I know every CSS, js, HTML can seem in Browser but it is not possible for other dev to get your resource as your resources are Python code that is running on the server side. By the way, the cracking process is costly and it is not wise for other people to invest in that for such low-cost resources. They simply buy it. What I saying here is done by other platforms already. Another topic is source control of the Ignition resources in such Github, which encrypting may break it. But the important note here is we want to sell resources as the black box so there is no need to use it. In develop phase of the resource in my office I simply turn encryption off and use resource control tools. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [June 28, 2023, 5:13pm UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/75 "2023-06-28T17:13:01Z")
What platform(s) are you referring to and what exactly are they claiming? ---
**Author:** ![nader.chinichian](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nader.chinichian/32/9261_2.png) [@nader.chinichian](https://forum.inductiveautomation.com/u/nader.chinichian)\ **Post date:** [June 28, 2023, 6:50pm UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/76 "2023-06-28T18:50:58Z")
Wonderware Edge( indusoft), Yokogawa Fasttools, ABB 800xa,... They offer to encrypted the resource by right click on it and select encrypt and ask a password. Now your resource is run in client side. And when you want to edit it or see the code double click to open it ask you password to decrypt it. Even Microsoft Excel has this option for macros ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 28, 2023, 6:57pm UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/77 "2023-06-28T18:57:48Z")
This is just obfuscation. If the resource is encrypted, then the runtime (Ignition Gateway, or whatever other software package we're talking about) must be able to decrypt it in order to understand/interpret it. If the runtime can decrypt it, the password is stored in the runtime somewhere. Which means anybody with the means to poke around can find that password and decrypt it themselves. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [June 28, 2023, 7:02pm UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/78 "2023-06-28T19:02:27Z")
Oh I thought you were talking about things that ran in a browser. But regardless exactly what @Kevin.Herron just said. The only real security (in my naïve opinion) is network security and making sure only computers and users you explicitly want to have access to these projects has access (and everything that goes along with that). If your project is out on the internet for anyone, malicious parties with nothing better todo will poke around if they think there's potential for some ransomware. ---
**Author:** ![nminchin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nminchin/32/6911_2.png) [@nminchin](https://forum.inductiveautomation.com/u/nminchin)\ **Post date:** [June 28, 2023, 9:39pm UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/79 "2023-06-28T21:39:16Z")
The best security for now is to create really bad projects 😂 ---
**Author:** ![nader.chinichian](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nader.chinichian/32/9261_2.png) [@nader.chinichian](https://forum.inductiveautomation.com/u/nader.chinichian)\ **Post date:** [June 29, 2023, 4:59am UTC](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344/80 "2023-06-29T04:59:45Z")
I'm sure there a method to protect even runtime. In any case it is not even easy task to hack for most people and other guys that can do that request money so at the end the end user is Williston buy it instead do the cracking. [Previous page](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344.md?page=3) [Next page](https://forum.inductiveautomation.com/t/best-practice-to-prevent-to-stolen-ignition-resources/44344.md?page=5)