I have a huge problem with password protected VIs. It gives people false assurance that nobody will be able to see the intellectual property contained in a VI’s block diagram (the source code).
The basis of my argument is that, behind the scenes, LabVIEW accesses a VI’s block diagram to recompile it for other platforms (operating systems and processors) and newer LabVIEW versions. This means that:
- Some people within NI can access your block diagrams.
- Someone outside NI, if they were sufficiently clever (and there are many clever people in this world), might be able to fool LabVIEW into unlocking your VI’s block diagram.
Password protecting VIs is a scheme that relies on “security through obscurity”, which is, IMO, a very bad idea. (But, don’t just take my word for it — google “security through obscurity” and read some of the articles.)
So, why do I bring this up? LabVIEW is becoming more and more of a general purpose programming language and many people are building commercial products using LabVIEW, including reuse libraries and components. Customers of LabVIEW reuse libraries and components expect to be able to use them in future versions of LabVIEW as well as use them on any platform or execution target supported by LabVIEW (such as LabVIEW RT and FPGA targets). The only practical way for vendors to achieve this is to ship the reuse libraries with password protected block diagrams.
What would happen if, some day, a hack were to be discovered that could unlock the block diagram of any VI? What would be the implications for NI? What would be the implications for LabVIEW users? What would be the implications for LabVIEW tools vendors? I’ll bet you that many people would be VERY pissed off and there might even be legal actions taken.
The longer we rely on the fallacy of password protected VIs, the more catastrophic the consequences to all of us, once the scheme is cracked.
So, what now?
- First, do not rely on password protection for any VI with intellectual property that must not be made public.
- Second, demand (from NI) a better scheme for cross-platform execution of VIs.
So, what can NI do to devise a better scheme to lessen the need for distributing password protected VIs?
- Give VIs the ability to store the executable code for multiple platforms and execution targets
- Use platform-independent byte code that runs on a LabVIEW virtual machine
- Support old versions of VI executable code (for example, a VI saved in LabVIEW 6.1 on Windows without a block diagram should be callable by LabVIEW 8.5 on Windows). This can almost be done right now by building your reuse library into a DLL and providing VIs (with source code) that wrap the DLL. However, this technique still requires one version of the DLL for each platform (Mac, Linux, and Windows) and would not work well for targeting LabVIEW RT or FPGA.
Is the world coming to an end? No, not really. But, things are getting worse as time goes by. The longer people rely on password protected VIs and the more popular LabVIEW becomes, the larger the consequences when the scheme is eventually cracked.