# Your expert views on rails code security needed! **URL:** \ **Category:** Rails\ **Created:** [June 16, 2009, 1:00pm UTC](https://www.ruby-forum.com/t/your-expert-views-on-rails-code-security-needed/170347 "2009-06-16T13:00:02Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![san2821](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/4da419/32.png) [@san2821](https://www.ruby-forum.com/u/san2821)\ **Post date:** [June 16, 2009, 1:00pm UTC](https://www.ruby-forum.com/t/your-expert-views-on-rails-code-security-needed/170347/1 "2009-06-16T13:00:02Z")
Hello All, I wanted to know your views on how rails application code can be secured while deployment. I know there are some commercial encryption tools which can do it for you. Anyone have any idea on this ?? ## Thanks, Sandip R~ Ruby on Rails Developer > **[Blogs - Neuigkeiten - Artikel - Webseiten - Medien](https://www.sosblog.com/)** > > Auf SOSblog geht es um aktuelle Blogs, Neuigkeiten, Artikel, Webseiten und Medien. Wir bringen interessante neue Webseiten aus den Tiefen des Webs. > **[Judul Situs](https://funonrails.wordpress.com)** > > “Cinta tidak mengenal batas. Cinta mampu melewati rintangan, melompati pagar, menembus dinding untuk mencapai tujuannya dengan penuh harapan.” — Maya Angelou > **[Josh Software | Custom Software Development Services & Solutions](https://joshsoftware.com/)** > > JoshSoftware offers custom software development Services & Solution that provides enterprise, software development services for web & mobile. ---
**Author:** ![san2821](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/4da419/32.png) [@san2821](https://www.ruby-forum.com/u/san2821)\ **Post date:** [June 16, 2009, 5:37pm UTC](https://www.ruby-forum.com/t/your-expert-views-on-rails-code-security-needed/170347/2 "2009-06-16T17:37:25Z")
Sandip R. wrote: > Hello All, > > I wanted to know your views on how rails application code can be secured > while deployment. Just make sure no one can gain unauthorized access to the server. (That includes setting things up with proper permissions, decent passwords…you get the idea.) > I know there are some commercial encryption tools which can do it for > you. There’s no need. This is not client-side code. Your Rails application lives on the server, so no end-user will ever see the source code. > Anyone have any idea on this ?? Yes: understand a little better how things work and what lives where. Then it will be easier to create an appropriate security model. > ## Thanks, Sandip R~ > > Ruby on Rails Developer > [http://sandip.sosblog.com](http://sandip.sosblog.com) > [http://funonrails.wordpress.com](http://funonrails.wordpress.com) > [www.joshsoftware.com](http://www.joshsoftware.com) ## Best, Marnen Laibow-Koser [http://www.marnen.org](http://www.marnen.org) removed\_email\_address@domain.invalid ---
**Author:** ![san2821](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/4da419/32.png) [@san2821](https://www.ruby-forum.com/u/san2821)\ **Post date:** [June 23, 2009, 11:03am UTC](https://www.ruby-forum.com/t/your-expert-views-on-rails-code-security-needed/170347/3 "2009-06-23T11:03:19Z")
Marven, Thanks for your reply ! I think, you missunderstood what i am saying. Let me explain little deep. Suppose, I have rails application as a product, I wanted to deploy it for many clients. They have their own servers. What make me sure that code is not exposed. What are your views ??? Thanks, Sandip R~ – Ruby on Rails Developer > **[Blogs - Neuigkeiten - Artikel - Webseiten - Medien](https://www.sosblog.com/)** > > Auf SOSblog geht es um aktuelle Blogs, Neuigkeiten, Artikel, Webseiten und Medien. Wir bringen interessante neue Webseiten aus den Tiefen des Webs. > **[Judul Situs](https://funonrails.wordpress.com/)** > > “Cinta tidak mengenal batas. Cinta mampu melewati rintangan, melompati pagar, menembus dinding untuk mencapai tujuannya dengan penuh harapan.” — Maya Angelou > **[Josh Software | Custom Software Development Services & Solutions](https://joshsoftware.com/)** > > JoshSoftware offers custom software development Services & Solution that provides enterprise, software development services for web & mobile. ---
**Author:** ![san2821](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/4da419/32.png) [@san2821](https://www.ruby-forum.com/u/san2821)\ **Post date:** [June 23, 2009, 7:25pm UTC](https://www.ruby-forum.com/t/your-expert-views-on-rails-code-security-needed/170347/4 "2009-06-23T19:25:34Z")
What you’re attempting here is equivalent to a DRM system; or in simpler terms, giving someone a lock and the key and expecting that the lock will provide protection. The code’s got to be run somehow, and if the clients control the server, they can get at it. Encrypted source files can be captured from memory, Java bytecodes can be decompiled, etc. You don’t need a technical solution, you need a good contract lawyer. –Matt J. ---
**Author:** ![san2821](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/4da419/32.png) [@san2821](https://www.ruby-forum.com/u/san2821)\ **Post date:** [June 23, 2009, 5:50pm UTC](https://www.ruby-forum.com/t/your-expert-views-on-rails-code-security-needed/170347/5 "2009-06-23T17:50:14Z")
Sandip R. wrote: > Marven, If you’re going to use my name, please spel it correctly. 🙂 > Thanks for your reply ! > > I think, you missunderstood what i am saying. > > Let me explain little deep. > Suppose, I have rails application as a product, > I wanted to deploy it for many clients. > They have their own servers. > > What make me sure that code is not exposed. You mean you want to hide the code from your clients? Do you really think they’re going to be able to do anything with it anyway? This seems slightly pointless to me. However, if you really need to, probably the best way would be to use JRuby and compile the whole thing as a Java application. But as I said, I’d advise you to drop the whole idea of hiding the code. > What are your views ??? > > Thanks, > > Sandip R~ ## Best, Marnen Laibow-Koser [http://www.marnen.org](http://www.marnen.org) removed\_email\_address@domain.invalid ---
**Author:** ![san2821](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/4da419/32.png) [@san2821](https://www.ruby-forum.com/u/san2821)\ **Post date:** [June 24, 2009, 7:20am UTC](https://www.ruby-forum.com/t/your-expert-views-on-rails-code-security-needed/170347/6 "2009-06-24T07:20:44Z")
On Tue, Jun 23, 2009 at 2:02 AM, Sandip R.[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Marven, Thanks for your reply ! > I think, you missunderstood what i am saying. > Let me explain little deep. > Suppose, I have rails application as a product, > I wanted to deploy it for many clients. > They have their own servers. > What make me sure that code is not exposed. > What are your views ??? This question comes up regularly. Like once a month. Seriously, check the list archives. People have gone to great lengths to protect their ruby code only to have someone figure out how to break the encryption/obsfucation with about 3 lines of code. I’m not kidding: [http://seanmountcastle.com/2007/12/15/protecting-your-ruby-source-code-for-end-user-applications/](http://seanmountcastle.com/2007/12/15/protecting-your-ruby-source-code-for-end-user-applications/) Read the post and his rather cool trick and then how someone “broke” the encryption in about 3 lines of ruby. Point is, you can keep the honest people honest (at which point, why bother?), but the dishonest are going to get your code if you use an interpreted language like Ruby. If you want to make it hard, use C++. – Aaron T. [http://synfin.net/](http://synfin.net/) [http://tcpreplay.synfin.net/](http://tcpreplay.synfin.net/) - Pcap editing and replay tools for Unix & Windows Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. – Benjamin Franklin ---
**Author:** ![san2821](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/4da419/32.png) [@san2821](https://www.ruby-forum.com/u/san2821)\ **Post date:** [June 23, 2009, 8:01pm UTC](https://www.ruby-forum.com/t/your-expert-views-on-rails-code-security-needed/170347/7 "2009-06-23T20:01:08Z")
Sandip, I never used it myself but [http://www.rubyencoder.com/](http://www.rubyencoder.com/) seems to be what you’re looking for. It’s not free but is not that expensive and they have a free trial. Would you mind giving some feedback on the forum if you try it? Paolo Sandip R. wrote: > Marven, Thanks for your reply ! > > I think, you missunderstood what i am saying. > > Let me explain little deep. > Suppose, I have rails application as a product, > I wanted to deploy it for many clients. > They have their own servers. > > What make me sure that code is not exposed. > > What are your views ??? > > Thanks, > > Sandip R~ > > – > Ruby on Rails Developer > [http://sandip.sosblog.com](http://sandip.sosblog.com) > [http://funonrails.wordpress.com](http://funonrails.wordpress.com) > [www.joshsoftware.com](http://www.joshsoftware.com)