Re: About functions

Developer wrote:

APC check for existence of file (bad thing for this solution),

apc.stat=0 will not check for file existence if it's in the cache, this is one of the purposes of the binary loading functions below. You can in theory compile files on one server, dump them, transfer them as binary to another set of machines that don't have the original source code and then load them back up. if apc.stat=0 then APC should never go to disk to find the file, and you know have a server that doesn't hit disk, and has no source code. Note though that the following functions are architecture specific, so you can't port files between 32-bit and 64-bit systems for example.

PHP_FUNCTION(apc_bin_dump); PHP_FUNCTION(apc_bin_load); PHP_FUNCTION(apc_bin_dumpfile); PHP_FUNCTION(apc_bin_loadfile); And this routines are good for performance issues, and 'light-lax' security (opcode is difficult to read). Opcode never changes do not need to recompile (on same machine) or check it for change. All files of application can be loaded in memory with routine.

Seeing as this wasn't the intended purpose of these functions (obfuscation/security) I don't think they really are a security enhancing feature. You could however use these in some form perhaps to wrap them up in a encryption wrapper etc or as you said just to make it more difficult. However this has it's own flaws at the point of translation etc. I think Zend and some other companies try to offer products that obfuscate opcodes etc, these tools are probably more suited to this purpose as I can't say that the above functionality ensures any level of securiyt ;-) -shire