.NET executables are compiled to MSIL (Microsoft Intermediate Language). Unlike native code binaries, MSIL contains metadata that makes it easy to decompile. Utilities exist that can convert compiled code back into C#. This is a problem for any developer who wants to keep source code confidential.

There are two standard answers to this. One is to run your code through an obfuscator, which deliberately mangles names and takes other steps to make the code hard to read while preserving its functionality. The second commonly-made point is that any code can be decompiled with sufficient effort.

Despite the above, Microsoft could do more to improve code security. Some developers may not realise that by default they are all-but publishing their code when they deploy their application. It would also be good to integrate name mangling more deeply. Currently Visual Studio comes with a third-party, cut-down obfuscator which has to be run after compilation. Why shouldn't this be a check-box project option? You do need fine-grained control over the procedure, otherwise obfuscators can defeat the advantage of component-sharing in .NET.

Of course if you are an open-source advocate none of the above is any trouble to you :-)

I think this issue is a bit of a red herring if you are doing commercial development, and not selling your software on. Big organisations with in-house development teams don't give a monkey's who decompiles their code as access is restricted to people who work for the company.



--------------------------------------------------------------------------------------------
deadlyvices@hotmail.com
Currently writing the GuideDog editor using MSHTML in my copious free time...

Not only it exist obfuscator but...
When you buy / use / get your hand on a new API it's difficulty enough to learn with the documentation.

I don't think being decompilabe is a real issue...