Is there a way to secure a Rails-deployed app without exposing the source code?
Stupid security question on Rails
1–10 of 12 posts
Re: Stupid security question on Rails
#2Can you be more specific about the word "secure"?
If you mean, "can I ship customers a Rails app that they themselves run, either on their own servers or an appliance, while keeping them from seeing the source code?", then the answer is "no".
You should be aware that the same answer applies to Python, Perl, Tcl, Java, and C#. Bytecode is trivially decompiled back to readable source code.
Re: Stupid security question on Rails
#3Well, put it like this. If they're looking at your source code it means they're already in your production server, and they can do pretty much whatever the hell they want anyway :)
Re: Stupid security question on Rails
#4Five runs developed a system for packaging and deploy ruby/rails apps without exposing the source. Bruce Williams presented on it at RubyConf2007:
http://rubyconf2007.confreaks.com/d2t2p2_desktop_apps.html
I don't know what the state of the project is, but it looks like what you wanted.
Re: Stupid security question on Rails
#5Five runs developed a system for packaging and deploy ruby/rails apps without exposing the source. Bruce Williams presented on it at RubyConf2007: http://rubyconf2007.confreaks.com/d2t2p2_desktop_apps.html I don't know what the state of the project is, but it looks like what you wanted.
FiveRuns deploys berkdb's with AES-encrypted compressed Ruby source. I have no idea what the point of the encryption is here, because it's a speed bump to someone who wants the source code; the "player" needs the key to run the code, the key sits in memory, as does the decoded source code.
This system looks even easier to deal with than a typical J2EE app; at least with J2EE, I have to fix up all the JAD artifacts.
Beware of systems that offer packaged solutions to hard problems, like the software protection problem.
Re: Stupid security question on Rails
#6Can you be more specific about the word "secure"? If you mean, "can I ship customers a Rails app that they themselves run, either on their own servers or an appliance, while keeping them from seeing the source code?", then the answer is "no". You should be aware that the same answer applies to Python, Perl, Tcl, Java, and C#. Bytecode is trivially decompiled back to readable source code.
I think there are pretty good obfuscation tools to provide some degree of protection to C# or Java apps (although I don't remember if they are free). But if you have some proprietary code that you don't want anyone to see the best solution is to run it on your own server and just expose an interface to code that runs on customer machines.
Re: Stupid security question on Rails
#7No. If someone has only 15 seconds to get the source code, you might be able to try the encryption mentioned below. Otherwise, it's not possible; if the computer can run the code, the attacker can read the source code.
It's better to just host the application yourself.
Re: Stupid security question on Rails
#8Can you be more specific about the word "secure"? If you mean, "can I ship customers a Rails app that they themselves run, either on their own servers or an appliance, while keeping them from seeing the source code?", then the answer is "no". You should be aware that the same answer applies to Python, Perl, Tcl, Java, and C#. Bytecode is trivially decompiled back to readable source code.
Although I don't think anyone has done it yet, it may perhaps be possible to package a JRuby on Rails app compiled to java bytecode. Not sure about the technical difficulties or when/if that might happen.
Re: Stupid security question on Rails
#9Can you be more specific about the word "secure"? If you mean, "can I ship customers a Rails app that they themselves run, either on their own servers or an appliance, while keeping them from seeing the source code?", then the answer is "no". You should be aware that the same answer applies to Python, Perl, Tcl, Java, and C#. Bytecode is trivially decompiled back to readable source code.
For python use .pyc or .pyo - ofcourse they can be decompiled but then so can be a .class
Re: Stupid security question on Rails
#10Can you be more specific about the word "secure"? If you mean, "can I ship customers a Rails app that they themselves run, either on their own servers or an appliance, while keeping them from seeing the source code?", then the answer is "no". You should be aware that the same answer applies to Python, Perl, Tcl, Java, and C#. Bytecode is trivially decompiled back to readable source code.
I think there are pretty good obfuscation tools to provide some degree of protection to C# or Java apps (although I don't remember if they are free). But if you have some proprietary code that you don't want anyone to see the best solution is to run it on your own server and just expose an interface to code that runs on customer machines.
Bytecode obfuscation is a speed bump. We do more raw X86 than .NET, and compared to X86 --- which every security consultancy worth its bill rate can handle now --- obfuscated .NET bytecode is a dream. And that's as mature as we get now.