Rails - Jun 2009 - Your expert views on rails code security needed !

Hello All,

I wanted to know your views on how rails application code can be secured
while deployment.
I know there are some commercial encryption tools which can do it for you.

Anyone have any idea on this ??


Thanks,
Sandip R~
-- 
Ruby on Rails Developer
http://sandip.sosblog.com
http://funonrails.wordpress.com
www.joshsoftware.com

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk+unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk?hl=en
-~----------~----~----~----~------~----~------~--~---

Sandip Ransing wrote:
> Hello All,
> 
> I wanted to know your views on how rails application code can be secured
> while deployment.
Just make sure no one can gain unauthorized access to the server.  (That 
includes setting things up with proper permissions, decent 
passwords...you get the idea.)
> I know there are some commercial encryption tools which can do it for 
> you.
There''s no need.  This is not client-side code.  Your Rails application
lives on the server, so no end-user will ever see the source code.
> 
> Anyone have any idea on this ??
Yes: understand a little better how things work and what lives where. 
Then it will be easier to create an appropriate security model.
> 
> 
> Thanks,
> Sandip R~
> --
> Ruby on Rails Developer
> http://sandip.sosblog.com
> http://funonrails.wordpress.com
> www.joshsoftware.com
Best,
--
Marnen Laibow-Koser
http://www.marnen.org
marnen-sbuyVjPbboAdnm+yROfE0A@public.gmane.org
-- 
Posted via http://www.ruby-forum.com/.

Marven, Thanks for your reply !

I think, you missunderstood what i am saying.

Let me explain little deep.
Suppose, I have rails application as a product,
I wanted to deploy it for many clients.
They have their own servers.

What make me sure that code is not exposed.

What are your views ???


Thanks,

Sandip R~

-- 
Ruby on Rails Developer
http://sandip.sosblog.com
http://funonrails.wordpress.com
www.joshsoftware.com

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk+unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk?hl=en
-~----------~----~----~----~------~----~------~--~---

Sandip Ransing wrote:
> Marven, 
If you''re going to use my name, please spel it correctly. :)
> Thanks for your reply !
> 
> I think, you missunderstood what i am saying.
> 
> Let me explain little deep.
> Suppose, I have rails application as a product,
> I wanted to deploy it for many clients.
> They have their own servers.
> 
> What make me sure that code is not exposed.
You mean you want to hide the code from your clients?  Do you really 
think they''re going to be able to do anything with it anyway?  This 
seems slightly pointless to me.

However, if you really need to, probably the best way would be to use 
JRuby and compile the whole thing as a Java application.

But as I said, I''d advise you to drop the whole idea of hiding the
code.

> 
> What are your views ???
> 
> 
> Thanks,
> 
> Sandip R~

Best,
--
Marnen Laibow-Koser
http://www.marnen.org
marnen-sbuyVjPbboAdnm+yROfE0A@public.gmane.org
-- 
Posted via http://www.ruby-forum.com/.

What you''re attempting here is equivalent to a DRM system; or in
simpler terms, giving someone a lock and the key and expecting that
the lock will provide protection.

The code''s got to be run somehow, and if the clients control the
server, they can get at it. Encrypted source files can be captured
from memory, Java bytecodes can be decompiled, etc.

You don''t need a technical solution, you need a good contract lawyer.

--Matt Jones

On Jun 23, 5:02 am, Sandip Ransing
<san2...-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
wrote:
> Suppose, I have rails application as a product,
> I wanted to deploy it for many clients.
> They have their own servers.
>
> What make me sure that code is not exposed.
>

Sandip,

I never used it myself but http://www.rubyencoder.com/ seems to be what 
you''re looking for. It''s not free but is not that expensive
and they
have a free trial.

Would you mind giving some feedback on the forum if you try it?

Paolo

Sandip Ransing wrote:
> Marven, Thanks for your reply !
> 
> I think, you missunderstood what i am saying.
> 
> Let me explain little deep.
> Suppose, I have rails application as a product,
> I wanted to deploy it for many clients.
> They have their own servers.
> 
> What make me sure that code is not exposed.
> 
> What are your views ???
> 
> 
> Thanks,
> 
> Sandip R~
> 
> --
> Ruby on Rails Developer
> http://sandip.sosblog.com
> http://funonrails.wordpress.com
> www.joshsoftware.com
-- 
Posted via http://www.ruby-forum.com/.

On Tue, Jun 23, 2009 at 2:02 AM, Sandip
Ransing<san2821-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
wrote:
> Marven, Thanks for your reply !
> I think, you missunderstood what i am saying.
> Let me explain little deep.
> Suppose, I have rails application as a product,
> I wanted to deploy it for many clients.
> They have their own servers.
> What make me sure that code is not exposed.
> What are your views ???

This question comes up regularly.  Like once a month.  Seriously,
check the list archives.

People have gone to great lengths to protect their ruby code only to
have someone figure out how to break the encryption/obsfucation with
about 3 lines of code.  I''m not kidding:

http://seanmountcastle.com/2007/12/15/protecting-your-ruby-source-code-for-end-user-applications/

Read the post and his rather cool trick and then how someone "broke"
the encryption in about 3 lines of ruby.

Point is, you can keep the honest people honest (at which point, why
bother?), but the dishonest are going to get your code if you use an
interpreted language like Ruby.  If you want to make it hard, use C++.

-- 
Aaron Turner
http://synfin.net/
http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix &
Windows
Those who would give up essential Liberty, to purchase a little temporary
Safety, deserve neither Liberty nor Safety.
    -- Benjamin Franklin