I use the mega-isp solution mentioned above - the Arduino avrisp sketch is here
http://code.google.com/p/mega-isp/downloads/list
I do not use the shield they have - I made up a simple cable using two 6 pin dual-in-line header sockets to fit the programming ISP connector on your Arduino. (I did not have two dil sockets so I used standard single in line and superglued two 3 pin sockets together.
You then need a piece of ribbon cable or some wire.
![Arduino 6 pin ISP](https://john.crouchley.com/images/ISP%206%20way%20pinout.png)
Connect each pin on one socket the the corresponding one on the other, with the exception of pin 5 = Reset.
Connect one end of the cable to pin 5 - this is the end that will connect to the target AVR that you wish to program. Connect the other end of the pin 5 wire to a floating pin connector.
To use connect the cable to the arduino by placing over the ISP programming connector and connecting the floating lead to digital 10, connect the other end to the target ISP connector. You need to ensure that the pin 1's match up.
![cable detail](https://john.crouchley.com/images/isp%20socket%20closeup.jpg)
Program with avrdude using
avrdude -P com7 -p t2313 -c avrisp -b 19200 -U flash:w:fred.hex
where
com7 - the com port that the Arduino based programmer is on
t2313 - the type of AVR you wish to program (m328 for ATMega328).
fred.hex - the name of the hex file you wish to progam into the target.
I have used this to program Tiny2313 with no problems.
Note: The cable will carry 5v to power the target - if the target is already powered then do not connect pin 2 of the cable.
The simplest method is to make your code pull some pin up before it executes the code you want to time, and pull it low after it has finished doing whatever. Then make the code loop (or use digital oscilloscope with memory in single-shot mode) and just scope then pin. The length of the pulse tells you how long it took to execute the piece of code plus one clock cycle from changing the pin state (I think it takes one cycle, not 100% sure).
Best Answer
First:
There are fuses on the chip that can be set to prevent external tools from reading the code off the chip. Look for the protection fuses in your datasheet and/or programmer documentation.
It's not perfect, but it protects you from simple attacks.
Second:
You cannot download firmware securely. The AVR cannot self-program protected areas:
http://www.atmel.com/dyn/resources/prod_documents/doc1644.pdf
The best you might be able to do is to use an encrypted token language (such as basic, or forth) and have the interpreter protected on the chip with a bootloader that can program the encrypted tokens into an open area. When running, the chip would decrypt and execute the instructions on the fly.