Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stupid security question on Rails

news.ycombinator.com

Post reply on HN
Print view View original

11–12 of 12 posts

Re: Stupid security question on Rails

#11

Post by tptacek »

srp wrote: post #9
tptacek wrote: post #2

Can you be more specific about the word "secure"? If you mean, "can I ship customers a Rails app that they themselves run, either on their own servers or an appliance, while keeping them from seeing the source code?", then the answer is "no". You should be aware that the same answer applies to Python, Perl, Tcl, Java, and C#. Bytecode is trivially decompiled back to readable source code.

For python use .pyc or .pyo - ofcourse they can be decompiled but then so can be a .class

Yes, and both a .class and a .pyc file are completely equivalent to source code. Why bother?

Re: Stupid security question on Rails

#12

Post by astrodust »

In terms of deploying an app for a customer without giving the customer source-code level access, then what you need to do is structure in terms of Software as a Service, where the customer is only able to access the application and not the server itself.

As others have pointed out, it might seem like an idea to "obfuscate" the source code, but really this does nothing to protect your application. For one, any obfuscation trick, no matter how obscure, is usually easily undone. Secondly, since Rails depends heavily on the use of eval(), there will be large chunks of raw code in your application even if, theoretically, it could be compiled.

Keep in mind you still have a lot of latitude in how you deploy Software as a Service. You can give your client DB dumps, you can run off your client's DB platform, if they want their data "in house" and not at some untrusted facility.

Post reply on HN