Re: Securing the deployment folders or at least the EOModel

On Nov 26, 2004, at 12:25 PM, Chuck Hill wrote:
> If they have root or physical access, there is nothing that you can do 
> to stop a determined reverse engineering attempt.  The best that you 
> can hope for is to slow them down and make it so tedious that they 
> give up.  One easy thing to do (or easy if you have not been using 
> deprecated API), is to package it all in one jar as in JBoss 
> deployments.  Then they at least have to unjar it to see the model.  A 
> further step would be to dispense with the file based model altogether 
> and create it in code.  You could even move these classes to their own 
> framework and obsfucate them.  And / or use encryption.  All of these 
> options represent a significant amount of effort and will only slow 
> down a determined attack.
I agree with Chuck.  If the client is going to host the application 
then, at best, your only going to be able to slow down their alleged 
efforts to access the internal workings.  On this front, encoding the 
eomodel folder and then decoding and loading it a run-time might 
provide you with a level of security which is satisfactory.  However 
this will not withstand a developer who is capable of decompiling your 
java code for very long.

On another front, have you considered hosting the application somewhere 
other then the client site?
Perhaps you're willing to host the site yourself or you know of a 3rd 
party which will host it.
That might be an option.

Good luck!
Mark.
__
Mark Ritchie, [email protected] 416-843-5479
Software Developer, Apple Certified Developer Trainer
WebObjects, Cocoa, Mac OS X and Mac OS X Server
Diamond Lake Consulting Inc., Toronto, Ontario, Canada