Im going to suggest a solution, but first I want to say that I wasnt expecting RICH to be entered in the runoff rounds, and this wasnt a request by myself or anyone at R.I. Software Developers LLC or its spinoffs. To be honest we (at the company) were still debating whether or not to pull RICH after recieving the letter from Mr Giordano regarding including him when the runoffs were held as we did not want to cause a controversy with the other contestants who had been cut. I had already been in contact with other contestants regarding this when the runoff transcripts were posted, communicating that I would pull RICH if he made it. The fact that we didnt make the cut solved the dilemma. I will say that I am glad that the transcripts that were posted reflect a slightly better public record than the first round transcripts.
Heres my proposed solution. Certainly I understand Wendells desire to protect his source code, although I have to say that I believe that this probably impossible once his work is made public. Its simply one of the problems with client side scripting. Even Javascript obfuscation techniques are not 100% effective. I also understand Steves desire to communicate with a winning entry, which was I believe a condition of the contest rules. “Bots must be available for people to talk with” In a limited sense however I believe I can offer a solution that will satisfy all parties concerned.
1. Steve provides an IP address to Wendell
2. Wendell locks down the directory where his contest entry resides so that only this IP address is allowed. If that is impossible, the same thing can be accomplished in code.
3. Wendell gives me a USER-AGENT string that is wholly unique
4. I can knock out a browser in a matter of minutes that will EXECUTE javascript, but has no Java console or other device that would allow source code to be viewed. I can hard code the USER-AGENT string into this browser.
5. Wendell can add code to his page that will reject any USER-AGENT but the one which Wendell has provided.
6. Wendell sets this directory to NO-CACHE7. Wendell sets this directory so that it will only allow access over SSL
No one will be able to access the bot except from this IP, and the person who accesses it will have no access to bot except by using the provided browser. the javascript. The unique USER-AGENT is obfuscated by the SSL. In this way Steve can satisfy his curiosity and that of everyone else, Wendell can protect his source code, and the matter can be put to rest. In addition Wendell is free to make this available as a download so that people can safely view his work. If anyone sees any security holes in this please feel free to point them out, quite frankly I hadnt considered this particular problem before.
Hope this helps
VLG