Re: Securing the deployment folders or at least the EOModel

If they have root or physical access, there is nothing that you can do 
to stop a determined reverse engineering attempt.  The best that you 
can hope for is to slow them down and make it so tedious that they give 
up.  One easy thing to do (or easy if you have not been using 
deprecated API), is to package it all in one jar as in JBoss 
deployments.  Then they at least have to unjar it to see the model.  A 
further step would be to dispense with the file based model altogether 
and create it in code.  You could even move these classes to their own 
framework and obsfucate them.  And / or use encryption.  All of these 
options represent a significant amount of effort and will only slow 
down a determined attack.

Or you could just put it in the contract and sue them silly if you 
think they have violated it.  That's the American way!


Chuck

On Nov 26, 2004, at 5:52 AM, Robert Huber@7r wrote:

> Hello Sam
>
> The situation is as follows:
>
> The deployment (folders) are on a PowerMac G5 at the customers site. 
> The G5 is support by the customer and therefor has root access to the 
> machine. As a company which delivers the application, I would like to 
> give nobody access to the (two) deployment folders so the customer can 
> not look at, read copy, (for example) the EOModel (and the other files 
> in the folders of course). But the root user can always get access so 
> I was thinking of (at least) securing the EOModel. Is there a way to 
> do that?
>
> Best regards, Robert
>
> On 25.11.2004, at 21:00, [email protected] wrote:
>
>> Send WebObjects-admin mailing list submissions to
>> 	[email protected]
>>
>> To subscribe or unsubscribe via the World Wide Web, visit
>> 	http://www.omnigroup.com/mailman/listinfo/webobjects-admin
>> or, via email, send a message with subject or body 'help' to
>> 	[email protected]
>>
>> You can reach the person managing the list at
>> 	[email protected]
>>
>> When replying, please edit your Subject line so it is more specific
>> than "Re: Contents of WebObjects-admin digest..."
>>
>>
>> Today's Topics:
>>
>>    1. Re: Securing the deployment folders (no access for
>>       foreigners) (Sam Hart)
>>
>>
>> ----------------------------------------------------------------------
>>
>> Message: 1
>> Date: Thu, 25 Nov 2004 08:42:19 +0000
>> From: Sam Hart <[email protected]>
>> Subject: Re: Securing the deployment folders (no access for
>> 	foreigners)
>> To: [email protected]
>> Message-ID:
>> 	<[email protected]>
>> Content-Type: text/plain; charset=US-ASCII; format=flowed
>>
>>
>> Robert wrote:
>>
>>> On a deployment installation, I would like to secure the EOModeler
>>> file, because it contains a lot of knowledge I don't like to make
>>> available to others. The deployment installation is on the customers
>>> Mac, so the root user (at least) has access to the deployment 
>>> folders.
>>> Any idea how to protect this folders?
>>
>> if this is a Mac we are talking about then we are really talking
>> permissions[1].
>> You want to read `man chmod` and `man chown`, set the owner and group
>> to that of
>> the user that will launch your WO applications. If you are using
>> monitor to launch
>> then set it to the same user ( looking at a Mac installation, the
>> default is root,
>> this could probably be changed depending on the capabilities of your
>> application. )
>>
>> You will want to revoke access to this file to anyone ( or group ) but
>> root.
>>
>>
>> S a m
>>
>> [1] We could protect it in code that would survive decompilation, but
>> this is overkill
>>
>> -------------------------------------------------------
>>
>> Drawing on my fine command of language, I said nothing.
>>
>>
>>
>> ------------------------------
>>
>> _______________________________________________
>> WebObjects-admin mailing list
>> [email protected]
>> http://www.omnigroup.com/mailman/listinfo/webobjects-admin
>>
>>
>> End of WebObjects-admin Digest, Vol 11, Issue 13
>> ************************************************
>>
>>
>
> _/ _/ _/ _/ _/                             r. huber
>                _/
>             _/      _/      _/           7r gmbh
>          _/      _/  _/               lindenplatz 12b
>       _/      _//                   ch-8203 schaffhausen
>    _/      _/
> _/      _/                    tel. +41 52 624 81 15   www.seven-r.ch
> _______________________________________________
> WebObjects-admin mailing list
> [email protected]
> http://www.omnigroup.com/mailman/listinfo/webobjects-admin
>
>
-- 
Practical WebObjects - a book for intermediate WebObjects developers 
who want to increase their overall knowledge of WebObjects, or those 
who are trying to solve specific application development problems.
http://www.global-village.net/products/practical_webobjects