You bring up some very good discussion points. I don't know of any formal studies regarding obfuscation, but absent hard scientific data, sometimes one has to make decisions based on common sense.

For example, you are correct that business logic is relatively easy to decipher just by studying how software works, but it still takes a lot of effort to write the detailed code. An application we developed recently took 14 months of coding by ten highly skilled developers. So naturally one would expect that it would take a competitor somewhere around 140 man-months to copy our software, maybe a little less with our application as a guide. But without obfuscation, a competitor armed with a good decompiler could reproduce our entire application in about 10 minutes. Without obfuscation, you might as well publish your original C# source code on the Web.

Regarding piracy, our experience is that piracy does indeed affect sales. Given a choice between paying and getting something for free, especially when it comes to something intangible such as software or music or web content, most people will choose free. If you read the blogs of very successful shareware authors such as Nick Bradbury (HomeSite, TopStyle, FeedDemon) and Chris Thornton (Clipmate), they are able to detect exactly when their software is cracked and posted on the Web because of a sudden dramatic drop in sales. While there may be a small percentage of customers who obtain software via piracy but then develop a conscience and later pay, marketing through piracy is not a winning strategy. A better strategy is to provide a basic free version of your software and have an advanced pay version.

Bottom line, if you feel comfortable posting your source code on the web, then obfuscation will not benefit you. But if your source code and intellectual property is something you wish to protect, then obfuscation is a must for .NET applications and libraries.

Thank you for commenting!

Even if piracy is decreased, is revenue increased? Piracy doesn't necessarily equal lost sales. It may even have the opposite effect of free advertising.

As for protecting your business logic from competitors reverse engineering it… What kind of applications are we talking about here? The business logic of a typical applications is more or less trivial to figure out by just using the application.

I'm not so sure this obfuscation thing is useful at all. I'll believe it when I see some real data.

Thanks.